{"licence":["ControlMapping crosswalk — https://controlmapping.org/downloads/","Licence: ControlMapping's own work (topic definitions, mapping picks, editorial notes, SOC 2 criterion summaries) is CC BY 4.0 — credit \"ControlMapping (controlmapping.org)\".","Third-party material: NIST CSF 2.0, SP 800-53, SP 800-171 and SP 800-66 text and crosswalks are US Government works (public domain). CIS Controls safeguard titles © Center for Internet Security, CC BY-NC-ND 4.0. ISO/IEC 27001, PCI DSS and AICPA TSC: identifiers and short titles/summaries only; the standards' text is not reproduced. DORA (Regulation (EU) 2022/2554) © European Union, reused with acknowledgement. APRA CPS 234 text based on content from the Federal Register of Legislation (https://www.legislation.gov.au), CC BY 4.0. Essential Eight: ISM controls © Commonwealth of Australia (Australian Signals Directorate), CC BY 4.0. NIS2: requirement titles and the NIS2 to CSF 2.0 / ISO 27001 mapping from ENISA's NIS2 Technical Implementation Guidance (© ENISA, reproduced with acknowledgement). UK Cyber Essentials: control names only (Crown copyright). ControlMapping is not affiliated with or endorsed by any standards body or regulator.","Basis \"crosswalk\" = linked by a published crosswalk (source in the evidence column); \"editorial\" = ControlMapping's judgement (reason in the note column). Crosswalks show related outcomes, not proof of compliance. Not compliance advice."],"version":"2026-10-27","meta":{"built":"2026-10-27","sourcesFetched":"2026-10-16","crosswalks":{"nist80053":"NIST CSF 2.0 informative references","iso":"NIST CSF 2.0 informative references (ISO/IEC 27001:2022 to CSF 2.0) and NIST SP 800-53 Rev 5 to ISO/IEC 27001:2022 (OLIR 155)","pci":"NIST CSF 2.0 informative references (PCI DSS)","cis":"NIST CSF 2.0 informative references (CIS Controls v8.1)","cmmc":"NIST SP 800-171r2 Appendix D (→ SP 800-53), SP 800-171r3 → SP 800-53 references, CSF 2.0 informative references","soc2":null,"hipaa":"NIST HIPAA Security Rule to SP 800-53 Rev 5.1.1 crosswalk (OLIR 110)","gdpr":null,"e8":null,"dora":null,"cps234":null,"ce":null,"nis2":"ENISA NIS2 Technical Implementation Guidance mapping table v1.2 (CIR 2024/2690 → CSF 2.0 and ISO 27001)"}},"subcategories":{"GV.OC-01":"The organizational mission is understood and informs cybersecurity risk management","GV.OC-02":"Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered","GV.OC-03":"Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed","GV.OC-04":"Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated","GV.OC-05":"Outcomes, capabilities, and services that the organization depends on are understood and communicated","GV.RM-01":"Risk management objectives are established and agreed to by organizational stakeholders","GV.RM-02":"Risk appetite and risk tolerance statements are established, communicated, and maintained","GV.RM-03":"Cybersecurity risk management activities and outcomes are included in enterprise risk management processes","GV.RM-04":"Strategic direction that describes appropriate risk response options is established and communicated","GV.RM-05":"Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties","GV.RM-06":"A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated","GV.RM-07":"Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions","GV.RR-01":"Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving","GV.RR-02":"Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced","GV.RR-03":"Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies","GV.RR-04":"Cybersecurity is included in human resources practices","GV.PO-01":"Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced","GV.PO-02":"Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission","GV.OV-01":"Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction","GV.OV-02":"The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks","GV.OV-03":"Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed","GV.SC-01":"A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders","GV.SC-02":"Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally","GV.SC-03":"Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes","GV.SC-04":"Suppliers are known and prioritized by criticality","GV.SC-05":"Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties","GV.SC-06":"Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships","GV.SC-07":"The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship","GV.SC-08":"Relevant suppliers and other third parties are included in incident planning, response, and recovery activities","GV.SC-09":"Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle","GV.SC-10":"Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement","ID.AM-01":"Inventories of hardware managed by the organization are maintained","ID.AM-02":"Inventories of software, services, and systems managed by the organization are maintained","ID.AM-03":"Representations of the organization's authorized network communication and internal and external network data flows are maintained","ID.AM-04":"Inventories of services provided by suppliers are maintained","ID.AM-05":"Assets are prioritized based on classification, criticality, resources, and impact on the mission","ID.AM-07":"Inventories of data and corresponding metadata for designated data types are maintained","ID.AM-08":"Systems, hardware, software, services, and data are managed throughout their life cycles","ID.RA-01":"Vulnerabilities in assets are identified, validated, and recorded","ID.RA-02":"Cyber threat intelligence is received from information sharing forums and sources","ID.RA-03":"Internal and external threats to the organization are identified and recorded","ID.RA-04":"Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded","ID.RA-05":"Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization","ID.RA-06":"Risk responses are chosen, prioritized, planned, tracked, and communicated","ID.RA-07":"Changes and exceptions are managed, assessed for risk impact, recorded, and tracked","ID.RA-08":"Processes for receiving, analyzing, and responding to vulnerability disclosures are established","ID.RA-09":"The authenticity and integrity of hardware and software are assessed prior to acquisition and use","ID.RA-10":"Critical suppliers are assessed prior to acquisition","ID.IM-01":"Improvements are identified from evaluations","ID.IM-02":"Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties","ID.IM-03":"Improvements are identified from execution of operational processes, procedures, and activities","ID.IM-04":"Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved","PR.AA-01":"Identities and credentials for authorized users, services, and hardware are managed by the organization","PR.AA-02":"Identities are proofed and bound to credentials based on the context of interactions","PR.AA-03":"Users, services, and hardware are authenticated","PR.AA-04":"Identity assertions are protected, conveyed, and verified","PR.AA-05":"Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties","PR.AA-06":"Physical access to assets is managed, monitored, and enforced commensurate with risk","PR.AT-01":"Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind","PR.AT-02":"Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind","PR.DS-01":"The confidentiality, integrity, and availability of data-at-rest are protected","PR.DS-02":"The confidentiality, integrity, and availability of data-in-transit are protected","PR.DS-10":"The confidentiality, integrity, and availability of data-in-use are protected","PR.DS-11":"Backups of data are created, protected, maintained, and tested","PR.PS-01":"Configuration management practices are established and applied","PR.PS-02":"Software is maintained, replaced, and removed commensurate with risk","PR.PS-03":"Hardware is maintained, replaced, and removed commensurate with risk","PR.PS-04":"Log records are generated and made available for continuous monitoring","PR.PS-05":"Installation and execution of unauthorized software are prevented","PR.PS-06":"Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle","PR.IR-01":"Networks and environments are protected from unauthorized logical access and usage","PR.IR-02":"The organization's technology assets are protected from environmental threats","PR.IR-03":"Mechanisms are implemented to achieve resilience requirements in normal and adverse situations","PR.IR-04":"Adequate resource capacity to ensure availability is maintained","DE.CM-01":"Networks and network services are monitored to find potentially adverse events","DE.CM-02":"The physical environment is monitored to find potentially adverse events","DE.CM-03":"Personnel activity and technology usage are monitored to find potentially adverse events","DE.CM-06":"External service provider activities and services are monitored to find potentially adverse events","DE.CM-09":"Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events","DE.AE-02":"Potentially adverse events are analyzed to better understand associated activities","DE.AE-03":"Information is correlated from multiple sources","DE.AE-04":"The estimated impact and scope of adverse events are understood","DE.AE-06":"Information on adverse events is provided to authorized staff and tools","DE.AE-07":"Cyber threat intelligence and other contextual information are integrated into the analysis","DE.AE-08":"Incidents are declared when adverse events meet the defined incident criteria","RS.MA-01":"The incident response plan is executed in coordination with relevant third parties once an incident is declared","RS.MA-02":"Incident reports are triaged and validated","RS.MA-03":"Incidents are categorized and prioritized","RS.MA-04":"Incidents are escalated or elevated as needed","RS.MA-05":"The criteria for initiating incident recovery are applied","RS.AN-03":"Analysis is performed to establish what has taken place during an incident and the root cause of the incident","RS.AN-06":"Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved","RS.AN-07":"Incident data and metadata are collected, and their integrity and provenance are preserved","RS.AN-08":"An incident's magnitude is estimated and validated","RS.CO-02":"Internal and external stakeholders are notified of incidents","RS.CO-03":"Information is shared with designated internal and external stakeholders","RS.MI-01":"Incidents are contained","RS.MI-02":"Incidents are eradicated","RC.RP-01":"The recovery portion of the incident response plan is executed once initiated from the incident response process","RC.RP-02":"Recovery actions are selected, scoped, prioritized, and performed","RC.RP-03":"The integrity of backups and other restoration assets is verified before using them for restoration","RC.RP-04":"Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms","RC.RP-05":"The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed","RC.RP-06":"The end of incident recovery is declared based on criteria, and incident-related documentation is completed","RC.CO-03":"Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders","RC.CO-04":"Public updates on incident recovery are shared using approved methods and messaging"},"withdrawnCsf":{"RS.MI-03":"Incorporated into ID.RA-06","RS.CO-04":"Incorporated into RS.MA-01, RS.MA-04","RS.CO-05":"Incorporated into RS.CO-03","RS.IM-01":"Incorporated into ID.IM-03, ID.IM-04","RS.IM-02":"Incorporated into ID.IM-03","RC.CO-01":"Incorporated into RC.CO-04","RC.CO-02":"Incorporated into RC.CO-04","DE.DP-05":"Incorporated into ID.IM, ID.IM-03","RS.RP-01":"Incorporated into RS.MA-01","RS.AN-01":"Incorporated into RS.MA-02","RS.AN-02":"Incorporated into RS.MA-02, RS.MA-03, RS.MA-04","RS.AN-04":"Moved to RS.MA-03","RS.AN-05":"Moved to ID.RA-08","RS.CO-01":"Incorporated into PR.AT-01","DE.AE-05":"Moved to DE.AE-08","DE.CM-08":"Incorporated into ID.RA-01","DE.AE-01":"Incorporated into ID.AM-03","DE.DP-01":"Incorporated into GV.RR-02","DE.DP-02":"Incorporated into DE.AE","DE.DP-03":"Incorporated into ID.IM-02","DE.DP-04":"Incorporated into DE.AE-06","PR.PT-01":"Incorporated into PR.PS-04","PR.PT-02":"Incorporated into PR.DS-01, PR.PS-01","PR.PT-03":"Incorporated into PR.PS-01","PR.PT-04":"Incorporated into PR.AA-06, PR.IR-01","PR.PT-05":"Moved to PR.IR-03","DE.CM-04":"Incorporated into DE.CM-01, DE.CM-09","DE.CM-05":"Incorporated into DE.CM-01, DE.CM-09","DE.CM-07":"Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09","PR.MA-02":"Incorporated into ID.AM-08, PR.PS-02","PR.MA-01":"Incorporated into ID.AM-08, PR.PS-03","PR.IP-09":"Moved to ID.IM-04","PR.IP-10":"Incorporated into ID.IM-02, ID.IM-04","PR.IP-11":"Moved to GV.RR-04","PR.IP-12":"Incorporated into ID.RA-01, PR.PS-02","PR.IP-01":"Incorporated into PR.PS-01","PR.IP-02":"Incorporated into ID.AM-08, PR.PS-06","PR.IP-03":"Incorporated into PR.PS-01, ID.RA-07","PR.IP-04":"Moved to PR.DS-11","PR.IP-05":"Moved to PR.IR-02","PR.IP-06":"Incorporated into ID.AM-08","PR.IP-07":"Incorporated into ID.IM, ID.IM-03","PR.IP-08":"Moved to ID.IM-03","PR.DS-08":"Incorporated into ID.RA-09, DE.CM-09","PR.DS-06":"Incorporated into PR.DS-01, DE.CM-09","PR.DS-07":"Incorporated into PR.IR-01","PR.AT-05":"Incorporated into PR.AT-02","PR.DS-03":"Incorporated into ID.AM-08, PR.PS-03","PR.DS-04":"Moved to PR.IR-04","PR.DS-05":"Incorporated into PR.DS-01, PR.DS-02, PR.DS-10","PR.AC-02":"Moved to PR.AA-06","PR.AC-03":"Incorporated into PR.AA-03, PR.AA-05, PR.IR-01","PR.AC-04":"Moved to PR.AA-05","PR.AC-05":"Incorporated into PR.IR-01","PR.AC-06":"Moved to PR.AA-02","PR.AC-07":"Moved to PR.AA-03","PR.AT-03":"Incorporated into PR.AT-01, PR.AT-02","PR.AT-04":"Incorporated into PR.AT-02","PR.AC-01":"Incorporated into PR.AA-01, PR.AA-05","ID.SC-04":"Incorporated into GV.SC-07, ID.RA-10","ID.SC-05":"Incorporated into GV.SC-08, ID.IM-02","ID.SC-01":"Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10","ID.SC-02":"Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10","ID.SC-03":"Moved to GV.SC-05","ID.RM-01":"Incorporated into GV.RM-01, GV.RM-06, GV.RR-03","ID.RM-02":"Incorporated into GV.RM-02, GV.RM-04","ID.RM-03":"Moved into GV.RM-02","ID.GV-01":"Incorporated into GV.PO, GV.PO-01, GV.PO-02","ID.GV-02":"Incorporated into GV.OC-02, GV.RR, GV.RR-02","ID.GV-03":"Moved to GV.OC-03","ID.GV-04":"Moved to GV.RM-04","ID.BE-05":"Incorporated into GV.OC-04","ID.BE-03":"Incorporated into GV.OC-01","ID.BE-04":"Incorporated into GV.OC-04, GV.OC-05","ID.AM-06":"Incorporated into GV.RR-02, GV.SC-02","ID.BE-01":"Incorporated into GV.OC-05","ID.BE-02":"Incorporated into GV.OC-01","RC.IM-01":"Incorporated into ID.IM-03, ID.IM-04","RC.IM-02":"Incorporated into ID.IM-03"},"catalogues":{"nist":[["DE.AE-02","Potentially adverse events are analyzed to better understand associated activities",["DE.AE-02"]],["DE.AE-03","Information is correlated from multiple sources",["DE.AE-03"]],["DE.AE-04","The estimated impact and scope of adverse events are understood",["DE.AE-04"]],["DE.AE-06","Information on adverse events is provided to authorized staff and tools",["DE.AE-06"]],["DE.AE-07","Cyber threat intelligence and other contextual information are integrated into the analysis",["DE.AE-07"]],["DE.AE-08","Incidents are declared when adverse events meet the defined incident criteria",["DE.AE-08"]],["DE.CM-01","Networks and network services are monitored to find potentially adverse events",["DE.CM-01"]],["DE.CM-02","The physical environment is monitored to find potentially adverse events",["DE.CM-02"]],["DE.CM-03","Personnel activity and technology usage are monitored to find potentially adverse events",["DE.CM-03"]],["DE.CM-06","External service provider activities and services are monitored to find potentially adverse events",["DE.CM-06"]],["DE.CM-09","Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events",["DE.CM-09"]],["GV.OC-01","The organizational mission is understood and informs cybersecurity risk management",["GV.OC-01"]],["GV.OC-02","Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered",["GV.OC-02"]],["GV.OC-03","Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed",["GV.OC-03"]],["GV.OC-04","Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated",["GV.OC-04"]],["GV.OC-05","Outcomes, capabilities, and services that the organization depends on are understood and communicated",["GV.OC-05"]],["GV.OV-01","Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction",["GV.OV-01"]],["GV.OV-02","The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks",["GV.OV-02"]],["GV.OV-03","Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed",["GV.OV-03"]],["GV.PO-01","Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced",["GV.PO-01"]],["GV.PO-02","Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission",["GV.PO-02"]],["GV.RM-01","Risk management objectives are established and agreed to by organizational stakeholders",["GV.RM-01"]],["GV.RM-02","Risk appetite and risk tolerance statements are established, communicated, and maintained",["GV.RM-02"]],["GV.RM-03","Cybersecurity risk management activities and outcomes are included in enterprise risk management processes",["GV.RM-03"]],["GV.RM-04","Strategic direction that describes appropriate risk response options is established and communicated",["GV.RM-04"]],["GV.RM-05","Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties",["GV.RM-05"]],["GV.RM-06","A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated",["GV.RM-06"]],["GV.RM-07","Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions",["GV.RM-07"]],["GV.RR-01","Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving",["GV.RR-01"]],["GV.RR-02","Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced",["GV.RR-02"]],["GV.RR-03","Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies",["GV.RR-03"]],["GV.RR-04","Cybersecurity is included in human resources practices",["GV.RR-04"]],["GV.SC-01","A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders",["GV.SC-01"]],["GV.SC-02","Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally",["GV.SC-02"]],["GV.SC-03","Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes",["GV.SC-03"]],["GV.SC-04","Suppliers are known and prioritized by criticality",["GV.SC-04"]],["GV.SC-05","Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties",["GV.SC-05"]],["GV.SC-06","Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships",["GV.SC-06"]],["GV.SC-07","The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship",["GV.SC-07"]],["GV.SC-08","Relevant suppliers and other third parties are included in incident planning, response, and recovery activities",["GV.SC-08"]],["GV.SC-09","Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle",["GV.SC-09"]],["GV.SC-10","Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement",["GV.SC-10"]],["ID.AM-01","Inventories of hardware managed by the organization are maintained",["ID.AM-01"]],["ID.AM-02","Inventories of software, services, and systems managed by the organization are maintained",["ID.AM-02"]],["ID.AM-03","Representations of the organization's authorized network communication and internal and external network data flows are maintained",["ID.AM-03"]],["ID.AM-04","Inventories of services provided by suppliers are maintained",["ID.AM-04"]],["ID.AM-05","Assets are prioritized based on classification, criticality, resources, and impact on the mission",["ID.AM-05"]],["ID.AM-07","Inventories of data and corresponding metadata for designated data types are maintained",["ID.AM-07"]],["ID.AM-08","Systems, hardware, software, services, and data are managed throughout their life cycles",["ID.AM-08"]],["ID.IM-01","Improvements are identified from evaluations",["ID.IM-01"]],["ID.IM-02","Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties",["ID.IM-02"]],["ID.IM-03","Improvements are identified from execution of operational processes, procedures, and activities",["ID.IM-03"]],["ID.IM-04","Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved",["ID.IM-04"]],["ID.RA-01","Vulnerabilities in assets are identified, validated, and recorded",["ID.RA-01"]],["ID.RA-02","Cyber threat intelligence is received from information sharing forums and sources",["ID.RA-02"]],["ID.RA-03","Internal and external threats to the organization are identified and recorded",["ID.RA-03"]],["ID.RA-04","Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded",["ID.RA-04"]],["ID.RA-05","Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization",["ID.RA-05"]],["ID.RA-06","Risk responses are chosen, prioritized, planned, tracked, and communicated",["ID.RA-06"]],["ID.RA-07","Changes and exceptions are managed, assessed for risk impact, recorded, and tracked",["ID.RA-07"]],["ID.RA-08","Processes for receiving, analyzing, and responding to vulnerability disclosures are established",["ID.RA-08"]],["ID.RA-09","The authenticity and integrity of hardware and software are assessed prior to acquisition and use",["ID.RA-09"]],["ID.RA-10","Critical suppliers are assessed prior to acquisition",["ID.RA-10"]],["PR.AA-01","Identities and credentials for authorized users, services, and hardware are managed by the organization",["PR.AA-01"]],["PR.AA-02","Identities are proofed and bound to credentials based on the context of interactions",["PR.AA-02"]],["PR.AA-03","Users, services, and hardware are authenticated",["PR.AA-03"]],["PR.AA-04","Identity assertions are protected, conveyed, and verified",["PR.AA-04"]],["PR.AA-05","Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties",["PR.AA-05"]],["PR.AA-06","Physical access to assets is managed, monitored, and enforced commensurate with risk",["PR.AA-06"]],["PR.AT-01","Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind",["PR.AT-01"]],["PR.AT-02","Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind",["PR.AT-02"]],["PR.DS-01","The confidentiality, integrity, and availability of data-at-rest are protected",["PR.DS-01"]],["PR.DS-02","The confidentiality, integrity, and availability of data-in-transit are protected",["PR.DS-02"]],["PR.DS-10","The confidentiality, integrity, and availability of data-in-use are protected",["PR.DS-10"]],["PR.DS-11","Backups of data are created, protected, maintained, and tested",["PR.DS-11"]],["PR.IR-01","Networks and environments are protected from unauthorized logical access and usage",["PR.IR-01"]],["PR.IR-02","The organization's technology assets are protected from environmental threats",["PR.IR-02"]],["PR.IR-03","Mechanisms are implemented to achieve resilience requirements in normal and adverse situations",["PR.IR-03"]],["PR.IR-04","Adequate resource capacity to ensure availability is maintained",["PR.IR-04"]],["PR.PS-01","Configuration management practices are established and applied",["PR.PS-01"]],["PR.PS-02","Software is maintained, replaced, and removed commensurate with risk",["PR.PS-02"]],["PR.PS-03","Hardware is maintained, replaced, and removed commensurate with risk",["PR.PS-03"]],["PR.PS-04","Log records are generated and made available for continuous monitoring",["PR.PS-04"]],["PR.PS-05","Installation and execution of unauthorized software are prevented",["PR.PS-05"]],["PR.PS-06","Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle",["PR.PS-06"]],["RC.CO-03","Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders",["RC.CO-03"]],["RC.CO-04","Public updates on incident recovery are shared using approved methods and messaging",["RC.CO-04"]],["RC.RP-01","The recovery portion of the incident response plan is executed once initiated from the incident response process",["RC.RP-01"]],["RC.RP-02","Recovery actions are selected, scoped, prioritized, and performed",["RC.RP-02"]],["RC.RP-03","The integrity of backups and other restoration assets is verified before using them for restoration",["RC.RP-03"]],["RC.RP-04","Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms",["RC.RP-04"]],["RC.RP-05","The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed",["RC.RP-05"]],["RC.RP-06","The end of incident recovery is declared based on criteria, and incident-related documentation is completed",["RC.RP-06"]],["RS.AN-03","Analysis is performed to establish what has taken place during an incident and the root cause of the incident",["RS.AN-03"]],["RS.AN-06","Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved",["RS.AN-06"]],["RS.AN-07","Incident data and metadata are collected, and their integrity and provenance are preserved",["RS.AN-07"]],["RS.AN-08","An incident's magnitude is estimated and validated",["RS.AN-08"]],["RS.CO-02","Internal and external stakeholders are notified of incidents",["RS.CO-02"]],["RS.CO-03","Information is shared with designated internal and external stakeholders",["RS.CO-03"]],["RS.MA-01","The incident response plan is executed in coordination with relevant third parties once an incident is declared",["RS.MA-01"]],["RS.MA-02","Incident reports are triaged and validated",["RS.MA-02"]],["RS.MA-03","Incidents are categorized and prioritized",["RS.MA-03"]],["RS.MA-04","Incidents are escalated or elevated as needed",["RS.MA-04"]],["RS.MA-05","The criteria for initiating incident recovery are applied",["RS.MA-05"]],["RS.MI-01","Incidents are contained",["RS.MI-01"]],["RS.MI-02","Incidents are eradicated",["RS.MI-02"]]],"nist80053":[["AC-1","Policy and Procedures",["AC-1"]],["AC-2","Account Management",["AC-2"]],["AC-3","Access Enforcement",["AC-3"]],["AC-4","Information Flow Enforcement",["AC-4"]],["AC-5","Separation of Duties",["AC-5"]],["AC-6","Least Privilege",["AC-6"]],["AC-7","Unsuccessful Logon Attempts",["AC-7"]],["AC-8","System Use Notification",["AC-8"]],["AC-9","Previous Logon Notification",["AC-9"]],["AC-10","Concurrent Session Control",["AC-10"]],["AC-11","Device Lock",["AC-11"]],["AC-12","Session Termination",["AC-12"]],["AC-14","Permitted Actions Without Identification or Authentication",["AC-14"]],["AC-16","Security and Privacy Attributes",["AC-16"]],["AC-17","Remote Access",["AC-17"]],["AC-18","Wireless Access",["AC-18"]],["AC-19","Access Control for Mobile Devices",["AC-19"]],["AC-20","Use of External Systems",["AC-20"]],["AC-21","Information Sharing",[]],["AC-22","Publicly Accessible Content",["AC-22"]],["AC-23","Data Mining Protection",[]],["AC-24","Access Control Decisions",["AC-24"]],["AC-25","Reference Monitor",[]],["AT-1","Policy and Procedures",["AT-1"]],["AT-2","Literacy Training and Awareness",["AT-2"]],["AT-3","Role-based Training",["AT-3"]],["AT-4","Training Records",["AT-4"]],["AT-6","Training Feedback",[]],["AU-1","Policy and Procedures",["AU-1"]],["AU-2","Event Logging",["AU-2"]],["AU-3","Content of Audit Records",["AU-3"]],["AU-4","Audit Log Storage Capacity",["AU-4"]],["AU-5","Response to Audit Logging Process Failures",["AU-5"]],["AU-6","Audit Record Review, Analysis, and Reporting",["AU-6"]],["AU-7","Audit Record Reduction and Report Generation",["AU-7"]],["AU-8","Time Stamps",["AU-8"]],["AU-9","Protection of Audit Information",["AU-9"]],["AU-10","Non-repudiation",["AU-10"]],["AU-11","Audit Record Retention",["AU-11"]],["AU-12","Audit Record Generation",["AU-12"]],["AU-13","Monitoring for Information Disclosure",["AU-13"]],["AU-14","Session Audit",["AU-14"]],["AU-16","Cross-organizational Audit Logging",["AU-16"]],["CA-1","Policy and Procedures",["CA-1"]],["CA-2","Control Assessments",["CA-2"]],["CA-3","Information Exchange",["CA-3"]],["CA-5","Plan of Action and Milestones",["CA-5"]],["CA-6","Authorization",["CA-6"]],["CA-7","Continuous Monitoring",["CA-7"]],["CA-8","Penetration Testing",["CA-8"]],["CA-9","Internal System Connections",["CA-9"]],["CM-1","Policy and Procedures",["CM-1"]],["CM-2","Baseline Configuration",["CM-2"]],["CM-3","Configuration Change Control",["CM-3"]],["CM-4","Impact Analyses",["CM-4"]],["CM-5","Access Restrictions for Change",["CM-5"]],["CM-6","Configuration Settings",["CM-6"]],["CM-7","Least Functionality",["CM-7"]],["CM-8","System Component Inventory",["CM-8"]],["CM-9","Configuration Management Plan",["CM-9"]],["CM-10","Software Usage Restrictions",["CM-10"]],["CM-11","User-installed Software",["CM-11"]],["CM-12","Information Location",["CM-12"]],["CM-13","Data Action Mapping",["CM-13"]],["CM-14","Signed Components",[]],["CP-1","Policy and Procedures",["CP-1"]],["CP-2","Contingency Plan",["CP-2"]],["CP-3","Contingency Training",["CP-3"]],["CP-4","Contingency Plan Testing",["CP-4"]],["CP-6","Alternate Storage Site",["CP-6"]],["CP-7","Alternate Processing Site",["CP-7"]],["CP-8","Telecommunications Services",["CP-8"]],["CP-9","System Backup",["CP-9"]],["CP-10","System Recovery and Reconstitution",["CP-10"]],["CP-11","Alternate Communications Protocols",["CP-11"]],["CP-12","Safe Mode",[]],["CP-13","Alternative Security Mechanisms",["CP-13"]],["IA-1","Policy and Procedures",["IA-1"]],["IA-2","Identification and Authentication (Organizational Users)",["IA-2"]],["IA-3","Device Identification and Authentication",["IA-3"]],["IA-4","Identifier Management",["IA-4"]],["IA-5","Authenticator Management",["IA-5"]],["IA-6","Authentication Feedback",["IA-6"]],["IA-7","Cryptographic Module Authentication",["IA-7"]],["IA-8","Identification and Authentication (Non-organizational Users)",["IA-8"]],["IA-9","Service Identification and Authentication",["IA-9"]],["IA-10","Adaptive Authentication",["IA-10"]],["IA-11","Re-authentication",["IA-11"]],["IA-12","Identity Proofing",["IA-12"]],["IA-13","Identity Providers and Authorization Servers",["IA-13"]],["IR-1","Policy and Procedures",["IR-1"]],["IR-2","Incident Response Training",["IR-2"]],["IR-3","Incident Response Testing",["IR-3"]],["IR-4","Incident Handling",["IR-4"]],["IR-5","Incident Monitoring",["IR-5"]],["IR-6","Incident Reporting",["IR-6"]],["IR-7","Incident Response Assistance",["IR-7"]],["IR-8","Incident Response Plan",["IR-8"]],["IR-9","Information Spillage Response",["IR-9"]],["MA-1","Policy and Procedures",["MA-1"]],["MA-2","Controlled Maintenance",["MA-2"]],["MA-3","Maintenance Tools",["MA-3"]],["MA-4","Nonlocal Maintenance",["MA-4"]],["MA-5","Maintenance Personnel",["MA-5"]],["MA-6","Timely Maintenance",["MA-6"]],["MA-7","Field Maintenance",[]],["MP-1","Policy and Procedures",["MP-1"]],["MP-2","Media Access",["MP-2"]],["MP-3","Media Marking",["MP-3"]],["MP-4","Media Storage",["MP-4"]],["MP-5","Media Transport",["MP-5"]],["MP-6","Media Sanitization",["MP-6"]],["MP-7","Media Use",["MP-7"]],["MP-8","Media Downgrading",["MP-8"]],["PE-1","Policy and Procedures",["PE-1"]],["PE-2","Physical Access Authorizations",["PE-2"]],["PE-3","Physical Access Control",["PE-3"]],["PE-4","Access Control for Transmission",["PE-4"]],["PE-5","Access Control for Output Devices",["PE-5"]],["PE-6","Monitoring Physical Access",["PE-6"]],["PE-8","Visitor Access Records",["PE-8"]],["PE-9","Power Equipment and Cabling",["PE-9"]],["PE-10","Emergency Shutoff",["PE-10"]],["PE-11","Emergency Power",["PE-11"]],["PE-12","Emergency Lighting",["PE-12"]],["PE-13","Fire Protection",["PE-13"]],["PE-14","Environmental Controls",["PE-14"]],["PE-15","Water Damage Protection",["PE-15"]],["PE-16","Delivery and Removal",["PE-16"]],["PE-17","Alternate Work Site",["PE-17"]],["PE-18","Location of System Components",["PE-18"]],["PE-19","Information Leakage",["PE-19"]],["PE-20","Asset Monitoring and Tracking",["PE-20"]],["PE-21","Electromagnetic Pulse Protection",[]],["PE-22","Component Marking",["PE-22"]],["PE-23","Facility Location",["PE-23"]],["PL-1","Policy and Procedures",["PL-1"]],["PL-2","System Security and Privacy Plans",["PL-2"]],["PL-4","Rules of Behavior",["PL-4"]],["PL-7","Concept of Operations",["PL-7"]],["PL-8","Security and Privacy Architectures",["PL-8"]],["PL-9","Central Management",[]],["PL-10","Baseline Selection",[]],["PL-11","Baseline Tailoring",[]],["PM-1","Information Security Program Plan",["PM-1"]],["PM-2","Information Security Program Leadership Role",["PM-2"]],["PM-3","Information Security and Privacy Resources",["PM-3"]],["PM-4","Plan of Action and Milestones Process",["PM-4"]],["PM-5","System Inventory",["PM-5"]],["PM-6","Measures of Performance",["PM-6"]],["PM-7","Enterprise Architecture",["PM-7"]],["PM-8","Critical Infrastructure Plan",["PM-8"]],["PM-9","Risk Management Strategy",["PM-9"]],["PM-10","Authorization Process",["PM-10"]],["PM-11","Mission and Business Process Definition",["PM-11"]],["PM-12","Insider Threat Program",["PM-12"]],["PM-13","Security and Privacy Workforce",["PM-13"]],["PM-14","Testing, Training, and Monitoring",["PM-14"]],["PM-15","Security and Privacy Groups and Associations",["PM-15"]],["PM-16","Threat Awareness Program",["PM-16"]],["PM-17","Protecting Controlled Unclassified Information on External Systems",[]],["PM-18","Privacy Program Plan",["PM-18"]],["PM-19","Privacy Program Leadership Role",["PM-19"]],["PM-20","Dissemination of Privacy Program Information",[]],["PM-21","Accounting of Disclosures",[]],["PM-22","Personally Identifiable Information Quality Management",["PM-22"]],["PM-23","Data Governance Body",["PM-23"]],["PM-24","Data Integrity Board",["PM-24"]],["PM-25","Minimization of Personally Identifiable Information Used in Testing, Training, and Research",[]],["PM-26","Complaint Management",[]],["PM-27","Privacy Reporting",[]],["PM-28","Risk Framing",["PM-28"]],["PM-29","Risk Management Program Leadership Roles",["PM-29"]],["PM-30","Supply Chain Risk Management Strategy",["PM-30"]],["PM-31","Continuous Monitoring Strategy",["PM-31"]],["PM-32","Purposing",[]],["PS-1","Policy and Procedures",["PS-1"]],["PS-2","Position Risk Designation",["PS-2"]],["PS-3","Personnel Screening",["PS-3"]],["PS-4","Personnel Termination",["PS-4"]],["PS-5","Personnel Transfer",["PS-5"]],["PS-6","Access Agreements",["PS-6"]],["PS-7","External Personnel Security",["PS-7"]],["PS-8","Personnel Sanctions",["PS-8"]],["PS-9","Position Descriptions",["PS-9"]],["PT-1","Policy and Procedures",["PT-1"]],["PT-2","Authority to Process Personally Identifiable Information",[]],["PT-3","Personally Identifiable Information Processing Purposes",["PT-3"]],["PT-4","Consent",[]],["PT-5","Privacy Notice",[]],["PT-6","System of Records Notice",[]],["PT-7","Specific Categories of Personally Identifiable Information",["PT-7"]],["PT-8","Computer Matching Requirements",[]],["RA-1","Policy and Procedures",["RA-1"]],["RA-2","Security Categorization",["RA-2"]],["RA-3","Risk Assessment",["RA-3"]],["RA-5","Vulnerability Monitoring and Scanning",["RA-5"]],["RA-6","Technical Surveillance Countermeasures Survey",[]],["RA-7","Risk Response",["RA-7"]],["RA-8","Privacy Impact Assessments",["RA-8"]],["RA-9","Criticality Analysis",["RA-9"]],["RA-10","Threat Hunting",["RA-10"]],["SA-1","Policy and Procedures",["SA-1"]],["SA-2","Allocation of Resources",[]],["SA-3","System Development Life Cycle",["SA-3"]],["SA-4","Acquisition Process",["SA-4"]],["SA-5","System Documentation",["SA-5"]],["SA-8","Security and Privacy Engineering Principles",["SA-8"]],["SA-9","External System Services",["SA-9"]],["SA-10","Developer Configuration Management",["SA-10"]],["SA-11","Developer Testing and Evaluation",["SA-11"]],["SA-15","Development Process, Standards, and Tools",["SA-15"]],["SA-16","Developer-provided Training",[]],["SA-17","Developer Security and Privacy Architecture and Design",["SA-17"]],["SA-20","Customized Development of Critical Components",[]],["SA-21","Developer Screening",["SA-21"]],["SA-22","Unsupported System Components",["SA-22"]],["SA-23","Specialization",[]],["SA-24","Design For Cyber Resiliency",["SA-24"]],["SC-1","Policy and Procedures",["SC-1"]],["SC-2","Separation of System and User Functionality",["SC-2"]],["SC-3","Security Function Isolation",["SC-3"]],["SC-4","Information in Shared System Resources",["SC-4"]],["SC-5","Denial-of-service Protection",["SC-5"]],["SC-6","Resource Availability",["SC-6"]],["SC-7","Boundary Protection",["SC-7"]],["SC-8","Transmission Confidentiality and Integrity",["SC-8"]],["SC-10","Network Disconnect",["SC-10"]],["SC-11","Trusted Path",["SC-11"]],["SC-12","Cryptographic Key Establishment and Management",["SC-12"]],["SC-13","Cryptographic Protection",["SC-13"]],["SC-15","Collaborative Computing Devices and Applications",["SC-15"]],["SC-16","Transmission of Security and Privacy Attributes",["SC-16"]],["SC-17","Public Key Infrastructure Certificates",["SC-17"]],["SC-18","Mobile Code",["SC-18"]],["SC-20","Secure Name/Address Resolution Service (Authoritative Source)",["SC-20"]],["SC-21","Secure Name/Address Resolution Service (Recursive or Caching Resolver)",["SC-21"]],["SC-22","Architecture and Provisioning for Name/Address Resolution Service",["SC-22"]],["SC-23","Session Authenticity",["SC-23"]],["SC-24","Fail in Known State",["SC-24"]],["SC-25","Thin Nodes",[]],["SC-26","Decoys",[]],["SC-27","Platform-independent Applications",[]],["SC-28","Protection of Information at Rest",["SC-28"]],["SC-29","Heterogeneity",[]],["SC-30","Concealment and Misdirection",[]],["SC-31","Covert Channel Analysis",[]],["SC-32","System Partitioning",["SC-32"]],["SC-34","Non-modifiable Executable Programs",["SC-34"]],["SC-35","External Malicious Code Identification",["SC-35"]],["SC-36","Distributed Processing and Storage",["SC-36"]],["SC-37","Out-of-band Channels",[]],["SC-38","Operations Security",[]],["SC-39","Process Isolation",["SC-39"]],["SC-40","Wireless Link Protection",["SC-40"]],["SC-41","Port and I/O Device Access",[]],["SC-42","Sensor Capability and Data",[]],["SC-43","Usage Restrictions",["SC-43"]],["SC-44","Detonation Chambers",[]],["SC-45","System Time Synchronization",["SC-45"]],["SC-46","Cross Domain Policy Enforcement",[]],["SC-47","Alternate Communications Paths",[]],["SC-48","Sensor Relocation",[]],["SC-49","Hardware-enforced Separation and Policy Enforcement",["SC-49"]],["SC-50","Software-enforced Separation and Policy Enforcement",[]],["SC-51","Hardware-based Protection",["SC-51"]],["SI-1","Policy and Procedures",["SI-1"]],["SI-2","Flaw Remediation",["SI-2"]],["SI-3","Malicious Code Protection",["SI-3"]],["SI-4","System Monitoring",["SI-4"]],["SI-5","Security Alerts, Advisories, and Directives",["SI-5"]],["SI-6","Security and Privacy Function Verification",[]],["SI-7","Software, Firmware, and Information Integrity",["SI-7"]],["SI-8","Spam Protection",["SI-8"]],["SI-10","Information Input Validation",["SI-10"]],["SI-11","Error Handling",[]],["SI-12","Information Management and Retention",["SI-12"]],["SI-13","Predictable Failure Prevention",["SI-13"]],["SI-14","Non-persistence",[]],["SI-15","Information Output Filtering",[]],["SI-16","Memory Protection",["SI-16"]],["SI-17","Fail-safe Procedures",[]],["SI-18","Personally Identifiable Information Quality Operations",["SI-18"]],["SI-19","De-identification",["SI-19"]],["SI-20","Tainting",["SI-20"]],["SI-21","Information Refresh",["SI-21"]],["SI-22","Information Diversity",[]],["SI-23","Information Fragmentation",[]],["SR-1","Policy and Procedures",["SR-1"]],["SR-2","Supply Chain Risk Management Plan",["SR-2"]],["SR-3","Supply Chain Controls and Processes",["SR-3"]],["SR-4","Provenance",["SR-4"]],["SR-5","Acquisition Strategies, Tools, and Methods",["SR-5"]],["SR-6","Supplier Assessments and Reviews",["SR-6"]],["SR-7","Supply Chain Operations Security",["SR-7"]],["SR-8","Notification Agreements",["SR-8"]],["SR-9","Tamper Resistance and Detection",[]],["SR-10","Inspection of Systems or Components",["SR-10"]],["SR-11","Component Authenticity",["SR-11"]],["SR-12","Component Disposal",["SR-12"]]],"iso":[["A.5.1","Policies for information security",["A.5.1"]],["A.5.2","Information security roles and responsibilities",["A.5.2"]],["A.5.3","Segregation of duties",["A.5.3"]],["A.5.4","Management responsibilities",["A.5.4"]],["A.5.5","Contact with authorities",["A.5.5"]],["A.5.6","Contact with special interest groups",["A.5.6"]],["A.5.7","Threat intelligence",["A.5.7"]],["A.5.8","Information security in project management",["A.5.8"]],["A.5.9","Inventory of information and other associated assets",["A.5.9"]],["A.5.10","Acceptable use of information and other associated assets",["A.5.10"]],["A.5.11","Return of assets",["A.5.11"]],["A.5.12","Classification of information",["A.5.12"]],["A.5.13","Labelling of information",["A.5.13"]],["A.5.14","Information transfer",["A.5.14"]],["A.5.15","Access control",["A.5.15"]],["A.5.16","Identity management",["A.5.16"]],["A.5.17","Authentication information",["A.5.17"]],["A.5.18","Access rights",["A.5.18"]],["A.5.19","Information security in supplier relationships",["A.5.19"]],["A.5.20","Addressing information security within supplier agreements",["A.5.20"]],["A.5.21","Managing information security in the ICT supply chain",["A.5.21"]],["A.5.22","Monitoring, review and change management of supplier services",["A.5.22"]],["A.5.23","Information security for use of cloud services",["A.5.23"]],["A.5.24","Information security incident management planning and preparation",["A.5.24"]],["A.5.25","Assessment and decision on information security events",["A.5.25"]],["A.5.26","Response to information security incidents",["A.5.26"]],["A.5.27","Learning from information security incidents",["A.5.27"]],["A.5.28","Collection of evidence",["A.5.28"]],["A.5.29","Information security during disruption",["A.5.29"]],["A.5.30","ICT readiness for business continuity",["A.5.30"]],["A.5.31","Legal, statutory, regulatory and contractual requirements",["A.5.31"]],["A.5.32","Intellectual property rights",["A.5.32"]],["A.5.33","Protection of records",["A.5.33"]],["A.5.34","Privacy and protection of PII",["A.5.34"]],["A.5.35","Independent review of information security",["A.5.35"]],["A.5.36","Compliance with policies, rules and standards for information security",["A.5.36"]],["A.5.37","Documented operating procedures",["A.5.37"]],["A.6.1","Screening",["A.6.1"]],["A.6.2","Terms and conditions of employment",["A.6.2"]],["A.6.3","Information security awareness, education and training",["A.6.3"]],["A.6.4","Disciplinary process",["A.6.4"]],["A.6.5","Responsibilities after termination or change of employment",["A.6.5"]],["A.6.6","Confidentiality or non-disclosure agreements",["A.6.6"]],["A.6.7","Remote working",["A.6.7"]],["A.6.8","Information security event reporting",["A.6.8"]],["A.7.1","Physical security perimeters",["A.7.1"]],["A.7.2","Physical entry",["A.7.2"]],["A.7.3","Securing offices, rooms and facilities",["A.7.3"]],["A.7.4","Physical security monitoring",["A.7.4"]],["A.7.5","Protecting against physical and environmental threats",["A.7.5"]],["A.7.6","Working in secure areas",["A.7.6"]],["A.7.7","Clear desk and clear screen",["A.7.7"]],["A.7.8","Equipment siting and protection",["A.7.8"]],["A.7.9","Security of assets off-premises",["A.7.9"]],["A.7.10","Storage media",["A.7.10"]],["A.7.11","Supporting utilities",["A.7.11"]],["A.7.12","Cabling security",["A.7.12"]],["A.7.13","Equipment maintenance",["A.7.13"]],["A.7.14","Secure disposal or re-use of equipment",["A.7.14"]],["A.8.1","User endpoint devices",["A.8.1"]],["A.8.2","Privileged access rights",["A.8.2"]],["A.8.3","Information access restriction",["A.8.3"]],["A.8.4","Access to source code",["A.8.4"]],["A.8.5","Secure authentication",["A.8.5"]],["A.8.6","Capacity management",["A.8.6"]],["A.8.7","Protection against malware",["A.8.7"]],["A.8.8","Management of technical vulnerabilities",["A.8.8"]],["A.8.9","Configuration management",["A.8.9"]],["A.8.10","Information deletion",["A.8.10"]],["A.8.11","Data masking",["A.8.11"]],["A.8.12","Data leakage prevention",["A.8.12"]],["A.8.13","Information backup",["A.8.13"]],["A.8.14","Redundancy of information processing facilities",["A.8.14"]],["A.8.15","Logging",["A.8.15"]],["A.8.16","Monitoring activities",["A.8.16"]],["A.8.17","Clock synchronization",["A.8.17"]],["A.8.18","Use of privileged utility programs",["A.8.18"]],["A.8.19","Installation of software on operational systems",["A.8.19"]],["A.8.20","Networks security",["A.8.20"]],["A.8.21","Security of network services",["A.8.21"]],["A.8.22","Segregation of networks",["A.8.22"]],["A.8.23","Web filtering",["A.8.23"]],["A.8.24","Use of cryptography",["A.8.24"]],["A.8.25","Secure development life cycle",["A.8.25"]],["A.8.26","Application security requirements",["A.8.26"]],["A.8.27","Secure system architecture and engineering principles",["A.8.27"]],["A.8.28","Secure coding",["A.8.28"]],["A.8.29","Security testing in development and acceptance",["A.8.29"]],["A.8.30","Outsourced development",["A.8.30"]],["A.8.31","Separation of development, test and production environments",["A.8.31"]],["A.8.32","Change management",["A.8.32"]],["A.8.33","Test information",["A.8.33"]],["A.8.34","Protection of information systems during audit testing",["A.8.34"]],["Clause 4.1","Understanding the organization and its context",["Clause 4.1"]],["Clause 4.2","Understanding the needs and expectations of interested parties",["Clause 4.2"]],["Clause 4.3","Determining the scope of the ISMS",["Clause 4.3"]],["Clause 4.4","Information security management system",["Clause 4.4"]],["Clause 5.1","Leadership and commitment",["Clause 5.1"]],["Clause 5.2","Policy",["Clause 5.2"]],["Clause 5.3","Organizational roles, responsibilities and authorities",["Clause 5.3"]],["Clause 6.1.1","General",["Clause 6.1.1","Clause 6.1"]],["Clause 6.1.2","Information security risk assessment",["Clause 6.1.2","Clause 6.1"]],["Clause 6.1.3","Information security risk treatment",["Clause 6.1.3","Clause 6.1"]],["Clause 6.2","Information security objectives and planning to achieve them",["Clause 6.2"]],["Clause 6.3","Planning of changes",["Clause 6.3"]],["Clause 7.1","Resources",["Clause 7.1"]],["Clause 7.2","Competence",["Clause 7.2"]],["Clause 7.3","Awareness",["Clause 7.3"]],["Clause 7.4","Communication",["Clause 7.4"]],["Clause 7.5.1","General",["Clause 7.5.1"]],["Clause 7.5.2","Creating and updating",["Clause 7.5.2"]],["Clause 7.5.3","Control of documented information",["Clause 7.5.3"]],["Clause 8.1","Operational planning and control",["Clause 8.1"]],["Clause 8.2","Information security risk assessment",["Clause 8.2"]],["Clause 8.3","Information security risk treatment",["Clause 8.3"]],["Clause 9.1","Monitoring, measurement, analysis and evaluation",["Clause 9.1"]],["Clause 9.2.1","General",["Clause 9.2.1","Clause 9.2"]],["Clause 9.2.2","Internal audit programme",["Clause 9.2.2","Clause 9.2"]],["Clause 9.3.1","General",["Clause 9.3.1","Clause 9.3"]],["Clause 9.3.2","Management review inputs",["Clause 9.3.2","Clause 9.3"]],["Clause 9.3.3","Management review results",["Clause 9.3.3","Clause 9.3"]],["Clause 10.1","Continual improvement",["Clause 10.1"]],["Clause 10.2","Nonconformity and corrective action",["Clause 10.2"]]],"cis":[["CIS 1.1","Establish and Maintain Detailed Enterprise Asset Inventory",["CIS 1.1"]],["CIS 1.2","Address Unauthorized Assets",["CIS 1.2"]],["CIS 1.3","Utilize an Active Discovery Tool",["CIS 1.3"]],["CIS 1.4","Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory",["CIS 1.4"]],["CIS 1.5","Use a Passive Asset Discovery Tool",["CIS 1.5"]],["CIS 2.1","Establish and Maintain a Software Inventory",["CIS 2.1"]],["CIS 2.2","Ensure Authorized Software is Currently Supported",["CIS 2.2"]],["CIS 2.3","Address Unauthorized Software",["CIS 2.3"]],["CIS 2.4","Utilize Automated Software Inventory Tools",["CIS 2.4"]],["CIS 2.5","Allowlist Authorized Software",["CIS 2.5"]],["CIS 2.6","Allowlist Authorized Libraries",["CIS 2.6"]],["CIS 2.7","Allowlist Authorized Scripts",["CIS 2.7"]],["CIS 3.1","Establish and Maintain a Data Management Process",["CIS 3.1"]],["CIS 3.2","Establish and Maintain a Data Inventory",["CIS 3.2"]],["CIS 3.3","Configure Data Access Control Lists",["CIS 3.3"]],["CIS 3.4","Enforce Data Retention",["CIS 3.4"]],["CIS 3.5","Securely Dispose of Data",["CIS 3.5"]],["CIS 3.6","Encrypt Data on End-User Devices",["CIS 3.6"]],["CIS 3.7","Establish and Maintain a Data Classification Scheme",["CIS 3.7"]],["CIS 3.8","Document Data Flows",["CIS 3.8"]],["CIS 3.9","Encrypt Data on Removable Media",["CIS 3.9"]],["CIS 3.10","Encrypt Sensitive Data in Transit",["CIS 3.10"]],["CIS 3.11","Encrypt Sensitive Data at Rest",["CIS 3.11"]],["CIS 3.12","Segment Data Processing and Storage Based on Sensitivity",["CIS 3.12"]],["CIS 3.13","Deploy a Data Loss Prevention Solution",["CIS 3.13"]],["CIS 3.14","Log Sensitive Data Access",["CIS 3.14"]],["CIS 4.1","Establish and Maintain a Secure Configuration Process",["CIS 4.1"]],["CIS 4.2","Establish and Maintain a Secure Configuration Process for Network Infrastructure",["CIS 4.2"]],["CIS 4.3","Configure Automatic Session Locking on Enterprise Assets",["CIS 4.3"]],["CIS 4.4","Implement and Manage a Firewall on Servers",["CIS 4.4"]],["CIS 4.5","Implement and Manage a Firewall on End-User Devices",["CIS 4.5"]],["CIS 4.6","Securely Manage Enterprise Assets and Software",["CIS 4.6"]],["CIS 4.7","Manage Default Accounts on Enterprise Assets and Software",["CIS 4.7"]],["CIS 4.8","Uninstall or Disable Unnecessary Services on Enterprise Assets and Software",["CIS 4.8"]],["CIS 4.9","Configure Trusted DNS Servers on Enterprise Assets",["CIS 4.9"]],["CIS 4.10","Enforce Automatic Device Lockout on Portable End-User Devices",["CIS 4.10"]],["CIS 4.11","Enforce Remote Wipe Capability on Portable End-User Devices",["CIS 4.11"]],["CIS 4.12","Separate Enterprise Workspaces on Mobile End-User Devices",["CIS 4.12"]],["CIS 5.1","Establish and Maintain an Inventory of Accounts",["CIS 5.1"]],["CIS 5.2","Use Unique Passwords",["CIS 5.2"]],["CIS 5.3","Disable Dormant Accounts",["CIS 5.3"]],["CIS 5.4","Restrict Administrator Privileges to Dedicated Administrator Accounts",["CIS 5.4"]],["CIS 5.5","Establish and Maintain an Inventory of Service Accounts",["CIS 5.5"]],["CIS 5.6","Centralize Account Management",["CIS 5.6"]],["CIS 6.1","Establish an Access Granting Process",["CIS 6.1"]],["CIS 6.2","Establish an Access Revoking Process",["CIS 6.2"]],["CIS 6.3","Require MFA for Externally-Exposed Applications",["CIS 6.3"]],["CIS 6.4","Require MFA for Remote Network Access",["CIS 6.4"]],["CIS 6.5","Require MFA for Administrative Access",["CIS 6.5"]],["CIS 6.6","Establish and Maintain an Inventory of Authentication and Authorization Systems",["CIS 6.6"]],["CIS 6.7","Centralize Access Control",["CIS 6.7"]],["CIS 6.8","Define and Maintain Role-Based Access Control",["CIS 6.8"]],["CIS 7.1","Establish and Maintain a Vulnerability Management Process",["CIS 7.1"]],["CIS 7.2","Establish and Maintain a Remediation Process",["CIS 7.2"]],["CIS 7.3","Perform Automated Operating System Patch Management",["CIS 7.3"]],["CIS 7.4","Perform Automated Application Patch Management",["CIS 7.4"]],["CIS 7.5","Perform Automated Vulnerability Scans of Internal Enterprise Assets",["CIS 7.5"]],["CIS 7.6","Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets",["CIS 7.6"]],["CIS 7.7","Remediate Detected Vulnerabilities",["CIS 7.7"]],["CIS 8.1","Establish and Maintain an Audit Log Management Process",["CIS 8.1"]],["CIS 8.2","Collect Audit Logs",["CIS 8.2"]],["CIS 8.3","Ensure Adequate Audit Log Storage",["CIS 8.3"]],["CIS 8.4","Standardize Time Synchronization",["CIS 8.4"]],["CIS 8.5","Collect Detailed Audit Logs",["CIS 8.5"]],["CIS 8.6","Collect DNS Query Audit Logs",["CIS 8.6"]],["CIS 8.7","Collect URL Request Audit Logs",["CIS 8.7"]],["CIS 8.8","Collect Command-Line Audit Logs",["CIS 8.8"]],["CIS 8.9","Centralize Audit Logs",["CIS 8.9"]],["CIS 8.10","Retain Audit Logs",["CIS 8.10"]],["CIS 8.11","Conduct Audit Log Reviews",["CIS 8.11"]],["CIS 8.12","Collect Service Provider Logs",["CIS 8.12"]],["CIS 9.1","Ensure Use of Only Fully Supported Browsers and Email Clients",["CIS 9.1"]],["CIS 9.2","Use DNS Filtering Services",["CIS 9.2"]],["CIS 9.3","Maintain and Enforce Network-Based URL Filters",["CIS 9.3"]],["CIS 9.4","Restrict Unnecessary or Unauthorized Browser and Email Client Extensions",["CIS 9.4"]],["CIS 9.5","Implement DMARC",["CIS 9.5"]],["CIS 9.6","Block Unnecessary File Types",["CIS 9.6"]],["CIS 9.7","Deploy and Maintain Email Server Anti-Malware Protections",["CIS 9.7"]],["CIS 10.1","Deploy and Maintain Anti-Malware Software",["CIS 10.1"]],["CIS 10.2","Configure Automatic Anti-Malware Signature Updates",["CIS 10.2"]],["CIS 10.3","Disable Autorun and Autoplay for Removable Media",["CIS 10.3"]],["CIS 10.4","Configure Automatic Anti-Malware Scanning of Removable Media",["CIS 10.4"]],["CIS 10.5","Enable Anti-Exploitation Features",["CIS 10.5"]],["CIS 10.6","Centrally Manage Anti-Malware Software",["CIS 10.6"]],["CIS 10.7","Use Behavior-Based Anti-Malware Software",["CIS 10.7"]],["CIS 11.1","Establish and Maintain a Data Recovery Process",["CIS 11.1"]],["CIS 11.2","Perform Automated Backups",["CIS 11.2"]],["CIS 11.3","Protect Recovery Data",["CIS 11.3"]],["CIS 11.4","Establish and Maintain an Isolated Instance of Recovery Data",["CIS 11.4"]],["CIS 11.5","Test Data Recovery",["CIS 11.5"]],["CIS 12.1","Ensure Network Infrastructure is Up-to-Date",["CIS 12.1"]],["CIS 12.2","Establish and Maintain a Secure Network Architecture",["CIS 12.2"]],["CIS 12.3","Securely Manage Network Infrastructure",["CIS 12.3"]],["CIS 12.4","Establish and Maintain Architecture Diagram(s)",["CIS 12.4"]],["CIS 12.5","Centralize Network Authentication, Authorization, and Auditing (AAA)",["CIS 12.5"]],["CIS 12.6","Use of Secure Network Management and Communication Protocols",["CIS 12.6"]],["CIS 12.7","Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure",["CIS 12.7"]],["CIS 12.8","Establish and Maintain Dedicated Computing Resources for All Administrative Work",["CIS 12.8"]],["CIS 13.1","Centralize Security Event Alerting",["CIS 13.1"]],["CIS 13.2","Deploy a Host-Based Intrusion Detection Solution",["CIS 13.2"]],["CIS 13.3","Deploy a Network Intrusion Detection Solution",["CIS 13.3"]],["CIS 13.4","Perform Traffic Filtering Between Network Segments",["CIS 13.4"]],["CIS 13.5","Manage Access Control for Remote Assets",["CIS 13.5"]],["CIS 13.6","Collect Network Traffic Flow Logs",["CIS 13.6"]],["CIS 13.7","Deploy a Host-Based Intrusion Prevention Solution",["CIS 13.7"]],["CIS 13.8","Deploy a Network Intrusion Prevention Solution",["CIS 13.8"]],["CIS 13.9","Deploy Port-Level Access Control",["CIS 13.9"]],["CIS 13.10","Perform Application Layer Filtering",["CIS 13.10"]],["CIS 13.11","Tune Security Event Alerting Thresholds",["CIS 13.11"]],["CIS 14.1","Establish and Maintain a Security Awareness Program",["CIS 14.1"]],["CIS 14.2","Train Workforce Members to Recognize Social Engineering Attacks",["CIS 14.2"]],["CIS 14.3","Train Workforce Members on Authentication Best Practices",["CIS 14.3"]],["CIS 14.4","Train Workforce on Data Handling Best Practices",["CIS 14.4"]],["CIS 14.5","Train Workforce Members on Causes of Unintentional Data Exposure",["CIS 14.5"]],["CIS 14.6","Train Workforce Members on Recognizing and Reporting Security Incidents",["CIS 14.6"]],["CIS 14.7","Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates",["CIS 14.7"]],["CIS 14.8","Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks",["CIS 14.8"]],["CIS 14.9","Conduct Role-Specific Security Awareness and Skills Training",["CIS 14.9"]],["CIS 15.1","Establish and Maintain an Inventory of Service Providers",["CIS 15.1"]],["CIS 15.2","Establish and Maintain a Service Provider Management Policy",["CIS 15.2"]],["CIS 15.3","Classify Service Providers",["CIS 15.3"]],["CIS 15.4","Ensure Service Provider Contracts Include Security Requirements",["CIS 15.4"]],["CIS 15.5","Assess Service Providers",["CIS 15.5"]],["CIS 15.6","Monitor Service Providers",["CIS 15.6"]],["CIS 15.7","Securely Decommission Service Providers",["CIS 15.7"]],["CIS 16.1","Establish and Maintain a Secure Application Development Process",["CIS 16.1"]],["CIS 16.2","Establish and Maintain a Process to Accept and Address Software Vulnerabilities",["CIS 16.2"]],["CIS 16.3","Perform Root Cause Analysis on Security Vulnerabilities",["CIS 16.3"]],["CIS 16.4","Establish and Manage an Inventory of Third-Party Software Components",["CIS 16.4"]],["CIS 16.5","Use Up-to-Date and Trusted Third-Party Software Components",["CIS 16.5"]],["CIS 16.6","Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities",["CIS 16.6"]],["CIS 16.7","Use Standard Hardening Configuration Templates for Application Infrastructure",["CIS 16.7"]],["CIS 16.8","Separate Production and Non-Production Systems",["CIS 16.8"]],["CIS 16.9","Train Developers in Application Security Concepts and Secure Coding",["CIS 16.9"]],["CIS 16.10","Apply Secure Design Principles in Application Architectures",["CIS 16.10"]],["CIS 16.11","Leverage Vetted Modules or Services for Application Security Components",["CIS 16.11"]],["CIS 16.12","Implement Code-Level Security Checks",["CIS 16.12"]],["CIS 16.13","Conduct Application Penetration Testing",["CIS 16.13"]],["CIS 16.14","Conduct Threat Modeling",["CIS 16.14"]],["CIS 17.1","Designate Personnel to Manage Incident Handling",["CIS 17.1"]],["CIS 17.2","Establish and Maintain Contact Information for Reporting Security Incidents",["CIS 17.2"]],["CIS 17.3","Establish and Maintain an Enterprise Process for Reporting Incidents",["CIS 17.3"]],["CIS 17.4","Establish and Maintain an Incident Response Process",["CIS 17.4"]],["CIS 17.5","Assign Key Roles and Responsibilities",["CIS 17.5"]],["CIS 17.6","Define Mechanisms for Communicating During Incident Response",["CIS 17.6"]],["CIS 17.7","Conduct Routine Incident Response Exercises",["CIS 17.7"]],["CIS 17.8","Conduct Post-Incident Reviews",["CIS 17.8"]],["CIS 17.9","Establish and Maintain Security Incident Thresholds",["CIS 17.9"]],["CIS 18.1","Establish and Maintain a Penetration Testing Program",["CIS 18.1"]],["CIS 18.2","Perform Periodic External Penetration Tests",["CIS 18.2"]],["CIS 18.3","Remediate Penetration Test Findings",["CIS 18.3"]],["CIS 18.4","Validate Security Measures",["CIS 18.4"]],["CIS 18.5","Perform Periodic Internal Penetration Tests",["CIS 18.5"]]],"soc2":[["A1.1","Capacity management to meet availability commitments",["A1.1"]],["A1.2","Environmental protections, backups and recovery infrastructure",["A1.2"]],["A1.3","Testing recovery plan procedures",["A1.3"]],["C1.1","Identifying and protecting confidential information",["C1.1"]],["C1.2","Disposing of confidential information",["C1.2"]],["CC1.1","Commitment to integrity and ethical values",["CC1.1"]],["CC1.2","Board independence and oversight of internal control",["CC1.2"]],["CC1.3","Structures, reporting lines, authorities and responsibilities",["CC1.3"]],["CC1.4","Commitment to attracting, developing and retaining competent people",["CC1.4"]],["CC1.5","Accountability for internal control responsibilities",["CC1.5"]],["CC2.1","Quality information to support internal control",["CC2.1"]],["CC2.2","Internal communication of objectives and responsibilities",["CC2.2"]],["CC2.3","Communication with external parties",["CC2.3"]],["CC3.1","Objectives specified clearly enough to identify risks",["CC3.1"]],["CC3.2","Risk identification and analysis",["CC3.2"]],["CC3.3","Considering the potential for fraud",["CC3.3"]],["CC3.4","Identifying and assessing significant changes",["CC3.4"]],["CC4.1","Ongoing and/or separate evaluations of controls",["CC4.1"]],["CC4.2","Communicating and remediating control deficiencies",["CC4.2"]],["CC5.1","Control activities that mitigate risks",["CC5.1"]],["CC5.2","General controls over technology",["CC5.2"]],["CC5.3","Control activities deployed through policies and procedures",["CC5.3"]],["CC6.1","Logical access security over information assets",["CC6.1"]],["CC6.2","User registration, authorization and removal",["CC6.2"]],["CC6.3","Role-based access, least privilege and segregation of duties",["CC6.3"]],["CC6.4","Physical access restrictions",["CC6.4"]],["CC6.5","Protection of data when assets are disposed of",["CC6.5"]],["CC6.6","Protection against threats from outside system boundaries",["CC6.6"]],["CC6.7","Restricting transmission, movement and removal of information",["CC6.7"]],["CC6.8","Preventing or detecting unauthorized or malicious software",["CC6.8"]],["CC7.1","Detecting configuration changes and new vulnerabilities",["CC7.1"]],["CC7.2","Monitoring system components for anomalies",["CC7.2"]],["CC7.3","Evaluating security events to determine if they are incidents",["CC7.3"]],["CC7.4","Responding to identified security incidents",["CC7.4"]],["CC7.5","Recovering from identified security incidents",["CC7.5"]],["CC8.1","Change management for infrastructure, data and software",["CC8.1"]],["CC9.1","Mitigating risks from business disruptions",["CC9.1"]],["CC9.2","Managing vendor and business partner risk",["CC9.2"]],["P1.1","Privacy notice",[]],["P2.1","Choice and consent",[]],["P3.1","Collection limited to privacy objectives",[]],["P3.2","Explicit consent where required",[]],["P4.1","Use limited to privacy objectives",[]],["P4.2","Retention of personal information",["P4.2"]],["P4.3","Disposal of personal information",["P4.3"]],["P5.1","Data subject access",[]],["P5.2","Correction of personal information",[]],["P6.1","Disclosure to third parties with consent",[]],["P6.2","Record of authorized disclosures",[]],["P6.3","Record of unauthorized disclosures",[]],["P6.4","Privacy commitments from third parties",[]],["P6.5","Notification by third parties of unauthorized disclosures",[]],["P6.6","Breach notification to affected individuals",["P6.6"]],["P6.7","Accounting of disclosures to data subjects",[]],["P7.1","Quality of personal information",[]],["P8.1","Handling privacy inquiries, complaints and disputes",[]],["PI1.1","Information about processing objectives",[]],["PI1.2","Controls over system inputs",[]],["PI1.3","Controls over system processing",[]],["PI1.4","Controls over system outputs",[]],["PI1.5","Storing inputs, items in processing and outputs",[]]],"pci":[["1.1.1","Network security policies documented and kept current",["1.1.1"]],["1.1.2","Roles for network security controls assigned",["1.1.2"]],["1.2.1","Configuration standards for network security controls",["1.2.1"]],["1.2.2","Network connection changes go through change control",[]],["1.2.3","Accurate network diagram maintained",["1.2.3"]],["1.2.4","Accurate account-data flow diagram maintained",["1.2.4"]],["1.2.5","Allowed services, protocols and ports approved",[]],["1.2.6","Security features defined for insecure services",[]],["1.2.7","Network security control rules reviewed every six months",[]],["1.2.8","Network security control configuration files secured",[]],["1.3.1","Inbound traffic to the CDE restricted",["1.3.1"]],["1.3.2","Outbound traffic from the CDE restricted",[]],["1.3.3","Network controls between wireless networks and the CDE",[]],["1.4.1","Network controls between trusted and untrusted networks",["1.4.1"]],["1.4.2","Inbound traffic from untrusted networks restricted",[]],["1.4.3","Anti-spoofing measures in place",[]],["1.4.4","Stored cardholder data not reachable from untrusted networks",[]],["1.4.5","Internal IP addresses and routing not disclosed",[]],["1.5.1","Controls on devices connecting to untrusted networks and the CDE",[]],["2.1.1","Secure configuration policies documented and kept current",["2.1.1"]],["2.1.2","Roles for secure configuration assigned",["2.1.2"]],["2.2.1","System configuration standards developed and maintained",["2.2.1"]],["2.2.2","Vendor default accounts managed or removed",["2.2.2"]],["2.2.3","Functions with different security levels kept apart",[]],["2.2.4","Only necessary services and functions enabled",[]],["2.2.5","Insecure services justified and secured",[]],["2.2.6","System security parameters set to prevent misuse",[]],["2.2.7","Non-console administrative access encrypted",[]],["2.3.1","Wireless vendor defaults changed",["2.3.1"]],["2.3.2","Wireless keys changed when key holders leave",[]],["3.1.1","Stored account data policies documented and kept current",["3.1.1"]],["3.1.2","Roles for protecting stored account data assigned",["3.1.2"]],["3.2.1","Account data storage minimised, with retention and disposal",["3.2.1"]],["3.3.1","Sensitive authentication data not kept after authorisation",["3.3.1"]],["3.3.1.1","Full track data not kept after authorisation",[]],["3.3.1.2","Card verification code not kept after authorisation",[]],["3.3.1.3","PIN and PIN block not kept after authorisation",[]],["3.3.2","Sensitive authentication data encrypted before authorisation",[]],["3.3.3","Issuer storage of sensitive authentication data limited and protected",[]],["3.4.1","PAN masked when displayed",["3.4.1"]],["3.4.2","PAN copying prevented over remote-access technologies",["3.4.2"]],["3.5.1","PAN rendered unreadable wherever stored",["3.5.1"]],["3.5.1.1","Hashes of PAN are keyed cryptographic hashes",[]],["3.5.1.2","Disk-level encryption used only where it suffices",[]],["3.5.1.3","Disk encryption access managed separately from OS access",["3.5.1.3"]],["3.6.1","Procedures protect keys that secure stored account data",["3.6.1"]],["3.6.1.1","Service providers document their cryptographic architecture",["3.6.1.1"]],["3.6.1.2","Secret and private keys stored in approved forms",["3.6.1.2"]],["3.6.1.3","Cleartext key components accessible to fewest custodians",["3.6.1.3"]],["3.6.1.4","Keys stored in the fewest possible locations",["3.6.1.4"]],["3.7.1","Key management: strong key generation",["3.7.1"]],["3.7.2","Key management: secure key distribution",[]],["3.7.3","Key management: secure key storage",[]],["3.7.4","Key management: key changes at end of cryptoperiod",["3.7.4"]],["3.7.5","Key management: retiring weakened or compromised keys",[]],["3.7.6","Key management: split knowledge and dual control",[]],["3.7.7","Key management: preventing unauthorised key substitution",[]],["3.7.8","Key custodians formally acknowledge their responsibilities",[]],["3.7.9","Service providers give customers key-handling guidance",[]],["4.1.1","Data-in-transit policies documented and kept current",["4.1.1"]],["4.1.2","Roles for protecting data in transit assigned",["4.1.2"]],["4.2.1","Strong cryptography for PAN over open, public networks",["4.2.1"]],["4.2.1.1","Inventory of trusted keys and certificates kept",["4.2.1.1"]],["4.2.1.2","Strong cryptography on wireless networks carrying PAN",[]],["4.2.2","PAN secured when sent by end-user messaging",[]],["5.1.1","Anti-malware policies documented and kept current",["5.1.1"]],["5.1.2","Roles for malware protection assigned",["5.1.2"]],["5.2.1","Anti-malware deployed on system components",["5.2.1"]],["5.2.2","Anti-malware detects, removes or contains known malware",["5.2.2"]],["5.2.3","Systems without anti-malware periodically re-evaluated",["5.2.3"]],["5.2.3.1","Re-evaluation frequency set by targeted risk analysis",["5.2.3.1"]],["5.3.1","Anti-malware kept up to date",[]],["5.3.2","Periodic scans or continuous behavioural analysis",["5.3.2"]],["5.3.2.1","Scan frequency set by targeted risk analysis",["5.3.2.1"]],["5.3.3","Removable media scanned or analysed",[]],["5.3.4","Anti-malware audit logs enabled and retained",[]],["5.3.5","Users cannot disable or alter anti-malware",[]],["5.4.1","Mechanisms to detect and protect against phishing",["5.4.1"]],["6.1.1","Secure systems and software policies documented",["6.1.1"]],["6.1.2","Roles for secure systems and software assigned",["6.1.2"]],["6.2.1","Bespoke and custom software developed securely",["6.2.1"]],["6.2.2","Developers trained in secure software development",["6.2.2"]],["6.2.3","Custom code reviewed before release",["6.2.3"]],["6.2.3.1","Manual code reviews approved by someone else",["6.2.3.1"]],["6.2.4","Coding techniques prevent common software attacks",["6.2.4"]],["6.3.1","Vulnerabilities identified and risk-ranked",["6.3.1"]],["6.3.2","Inventory of custom software and its components",["6.3.2"]],["6.3.3","Security patches installed promptly",["6.3.3"]],["6.4.1","Public web applications protected against attacks",["6.4.1"]],["6.4.2","Automated solution blocks attacks on public web apps",["6.4.2"]],["6.4.3","Payment page scripts authorised and integrity-checked",["6.4.3"]],["6.5.1","Production changes follow change control procedures",[]],["6.5.2","PCI DSS requirements re-confirmed after significant changes",[]],["6.5.3","Pre-production environments separated from production",[]],["6.5.4","Duties separated between production and pre-production",[]],["6.5.5","Live PANs not used in pre-production",[]],["6.5.6","Test data and accounts removed before go-live",[]],["7.1.1","Access restriction policies documented and kept current",["7.1.1"]],["7.1.2","Roles for access restriction assigned",["7.1.2"]],["7.2.1","Access control model defined",["7.2.1"]],["7.2.2","Access assigned by job function and least privilege",["7.2.2"]],["7.2.3","Privileges approved by authorised personnel",[]],["7.2.4","User accounts and privileges reviewed every six months",["7.2.4"]],["7.2.5","System and application accounts least privilege",[]],["7.2.5.1","System and application account access periodically reviewed",["7.2.5.1"]],["7.2.6","Access to cardholder data repositories restricted",[]],["7.3.1","Access control system restricts access by need",[]],["7.3.2","Access control system enforces assigned permissions",[]],["7.3.3","Access control system set to deny by default",[]],["8.1.1","Identification and authentication policies documented",["8.1.1"]],["8.1.2","Roles for identification and authentication assigned",["8.1.2"]],["8.2.1","Every user has a unique ID",["8.2.1"]],["8.2.2","Shared or generic accounts only by documented exception",["8.2.2"]],["8.2.3","Service providers use unique credentials per customer",[]],["8.2.4","User ID changes authorised and controlled",[]],["8.2.5","Access revoked immediately on termination",["8.2.5"]],["8.2.6","Inactive user accounts disabled within 90 days",["8.2.6"]],["8.2.7","Third-party remote access accounts enabled only when needed",[]],["8.2.8","Re-authentication after 15 minutes idle",["8.2.8"]],["8.3.1","User and admin access requires an authentication factor",["8.3.1"]],["8.3.2","Authentication factors unreadable in transit and storage",[]],["8.3.3","Identity verified before changing authentication factors",[]],["8.3.4","Account lockout after repeated failed attempts",[]],["8.3.5","First-use and reset passwords unique and changed",["8.3.5"]],["8.3.6","Minimum password length and complexity",["8.3.6"]],["8.3.7","Recent passwords cannot be reused",["8.3.7"]],["8.3.8","Authentication guidance communicated to users",["8.3.8"]],["8.3.9","Password-only access: change every 90 days or analyse risk",["8.3.9"]],["8.3.10","Service providers give customers password guidance",["8.3.10"]],["8.3.10.1","Service provider customer passwords: rotation or analysis",["8.3.10.1"]],["8.3.11","Tokens, smart cards and certificates assigned to individuals",[]],["8.4.1","MFA for non-console administrative access to the CDE",["8.4.1"]],["8.4.2","MFA for all access into the CDE",["8.4.2"]],["8.4.3","MFA for remote network access",["8.4.3"]],["8.5.1","MFA systems configured to resist misuse",["8.5.1"]],["8.6.1","Interactive use of system accounts managed",[]],["8.6.2","No hard-coded passwords for system accounts",["8.6.2"]],["8.6.3","System account passwords protected and changed",["8.6.3"]],["9.1.1","Physical security policies documented and kept current",["9.1.1"]],["9.1.2","Roles for physical security assigned",["9.1.2"]],["9.2.1","Facility entry controls restrict CDE access",["9.2.1"]],["9.2.1.1","Access to sensitive areas monitored by camera or access control",["9.2.1.1"]],["9.2.2","Publicly accessible network jacks restricted",[]],["9.2.3","Physical access to network hardware restricted",["9.2.3"]],["9.2.4","Consoles in sensitive areas locked when unattended",["9.2.4"]],["9.3.1","Personnel physical access authorised and managed",["9.3.1"]],["9.3.1.1","Sensitive-area access authorised and revoked promptly",["9.3.1.1"]],["9.3.2","Visitor access authorised, escorted and identifiable",["9.3.2"]],["9.3.3","Visitor badges returned or deactivated",[]],["9.3.4","Visitor log maintained and retained",[]],["9.4.1","Media with cardholder data physically secured",[]],["9.4.1.1","Offline backup media stored securely",["9.4.1.1"]],["9.4.1.2","Security of offline backup location reviewed annually",["9.4.1.2"]],["9.4.2","Media classified by data sensitivity",["9.4.2"]],["9.4.3","Media sent off site tracked and secured",[]],["9.4.4","Management approves media moved off site",[]],["9.4.5","Inventory logs of electronic media kept",[]],["9.4.5.1","Electronic media inventories at least annually",[]],["9.4.6","Hard-copy media destroyed when no longer needed",["9.4.6"]],["9.4.7","Electronic media destroyed or made unrecoverable",["9.4.7"]],["9.5.1","Card-reading (POI) devices protected from tampering",[]],["9.5.1.1","Inventory of POI devices kept",["9.5.1.1"]],["9.5.1.2","POI devices inspected for tampering",["9.5.1.2"]],["9.5.1.2.1","Inspection frequency set by targeted risk analysis",["9.5.1.2.1"]],["9.5.1.3","Staff trained to spot POI tampering",[]],["10.1.1","Logging and monitoring policies documented",["10.1.1"]],["10.1.2","Roles for logging and monitoring assigned",["10.1.2"]],["10.2.1","Audit logs enabled and active",["10.2.1"]],["10.2.1.1","Logs capture user access to cardholder data",[]],["10.2.1.2","Logs capture administrative actions",[]],["10.2.1.3","Logs capture access to audit logs",[]],["10.2.1.4","Logs capture invalid access attempts",[]],["10.2.1.5","Logs capture credential and privilege changes",[]],["10.2.1.6","Logs capture starting, stopping or pausing logging",[]],["10.2.1.7","Logs capture system-level object changes",[]],["10.2.2","Log entries record who, what, when, where and outcome",["10.2.2"]],["10.3.1","Read access to logs limited to need",["10.3.1"]],["10.3.2","Logs protected from modification",["10.3.2"]],["10.3.3","Logs promptly backed up to a central server",["10.3.3"]],["10.3.4","File-integrity monitoring on logs",["10.3.4"]],["10.4.1","Security event and critical logs reviewed daily",["10.4.1"]],["10.4.1.1","Automated mechanisms for log review",["10.4.1.1"]],["10.4.2","Other logs reviewed periodically",[]],["10.4.2.1","Review frequency set by targeted risk analysis",["10.4.2.1"]],["10.4.3","Exceptions and anomalies addressed",[]],["10.5.1","Audit logs retained 12 months, three immediately available",["10.5.1"]],["10.6.1","System clocks synchronised",["10.6.1"]],["10.6.2","Time configuration correct and consistent",[]],["10.6.3","Time settings protected from change",["10.6.3"]],["10.7.1","Service providers detect security control failures",["10.7.1"]],["10.7.2","Critical security control failures detected and reported",["10.7.2"]],["10.7.3","Security control failures responded to promptly",[]],["11.1.1","Security testing policies documented and kept current",["11.1.1"]],["11.1.2","Roles for security testing assigned",["11.1.2"]],["11.2.1","Wireless access points detected and unauthorised ones handled",["11.2.1"]],["11.2.2","Inventory of authorised wireless access points",[]],["11.3.1","Internal vulnerability scans every three months",["11.3.1"]],["11.3.1.1","Lower-ranked vulnerabilities handled by risk analysis",["11.3.1.1"]],["11.3.1.2","Internal scans use authenticated scanning",[]],["11.3.1.3","Internal scans after significant changes",[]],["11.3.2","External ASV scans every three months",["11.3.2"]],["11.3.2.1","External scans after significant changes",[]],["11.4.1","Penetration testing methodology defined",[]],["11.4.2","Internal penetration test at least annually",[]],["11.4.3","External penetration test at least annually",[]],["11.4.4","Penetration test findings corrected and retested",["11.4.4"]],["11.4.5","Segmentation controls tested at least annually",[]],["11.4.6","Service providers test segmentation every six months",[]],["11.4.7","Multi-tenant providers support customer penetration tests",[]],["11.5.1","Intrusion detection or prevention on network traffic",["11.5.1"]],["11.5.1.1","Service providers detect covert malware communication",[]],["11.5.2","Change-detection on critical files",[]],["11.6.1","Payment page changes and tampering detected",["11.6.1"]],["12.1.1","Information security policy established and published",["12.1.1"]],["12.1.2","Security policy reviewed at least annually",["12.1.2"]],["12.1.3","Security roles and responsibilities defined",["12.1.3"]],["12.1.4","Executive responsibility for information security assigned",["12.1.4"]],["12.2.1","Acceptable use policies for end-user technologies",[]],["12.3.1","Targeted risk analysis for flexible-frequency requirements",["12.3.1"]],["12.3.2","Targeted risk analysis for customised approach",["12.3.2"]],["12.3.3","Cipher suites and protocols reviewed annually",["12.3.3"]],["12.3.4","Hardware and software technologies reviewed annually",["12.3.4"]],["12.4.1","Service providers: executive responsibility for PCI DSS compliance",[]],["12.4.2","Service providers: quarterly reviews of operational tasks",["12.4.2"]],["12.4.2.1","Service providers: quarterly review results documented",["12.4.2.1"]],["12.5.1","Inventory of in-scope system components",["12.5.1"]],["12.5.2","PCI DSS scope confirmed annually and on change",["12.5.2"]],["12.5.2.1","Service providers confirm scope every six months",[]],["12.5.3","Service providers review scope after organisational change",["12.5.3"]],["12.6.1","Formal security awareness programme",["12.6.1"]],["12.6.2","Awareness programme reviewed annually",[]],["12.6.3","Awareness training on hire and at least annually",["12.6.3"]],["12.6.3.1","Training covers phishing and social engineering",[]],["12.6.3.2","Training covers acceptable use of technology",[]],["12.7.1","Personnel screened before hire",["12.7.1"]],["12.8.1","List of third-party service providers kept",["12.8.1"]],["12.8.2","Written agreements with service providers",["12.8.2"]],["12.8.3","Due diligence before engaging service providers",["12.8.3"]],["12.8.4","Service provider compliance monitored annually",["12.8.4"]],["12.8.5","Responsibilities split with each provider documented",["12.8.5"]],["12.9.1","Service providers acknowledge responsibilities to customers",["12.9.1"]],["12.9.2","Service providers support customer compliance requests",["12.9.2"]],["12.10.1","Incident response plan ready to activate",["12.10.1"]],["12.10.2","Incident response plan reviewed and tested annually",["12.10.2"]],["12.10.3","Incident response staff available around the clock",["12.10.3"]],["12.10.4","Incident response staff trained",["12.10.4"]],["12.10.4.1","Training frequency set by targeted risk analysis",["12.10.4.1"]],["12.10.5","Plan covers alerts from security monitoring",["12.10.5"]],["12.10.6","Plan updated from lessons learned and industry changes",["12.10.6"]],["12.10.7","Procedures for PAN found where it shouldn't be",["12.10.7"]],["A1.1.1","Multi-tenant providers: separate provider and customer environments",[]],["A1.1.2","Multi-tenant providers: customers confined to their own environment",[]],["A1.1.3","Multi-tenant providers: customers reach only their own data",[]],["A1.1.4","Multi-tenant providers: separation tested every six months",[]],["A1.2.1","Multi-tenant providers: audit logging for each customer",[]],["A1.2.2","Multi-tenant providers: support customer forensic investigations",[]],["A1.2.3","Multi-tenant providers: report suspected incidents to customers",[]],["A2.1.1","POI terminals using SSL or early TLS not exploitable",[]],["A2.1.2","Service providers: migration plan off SSL and early TLS",[]],["A2.1.3","Service providers offer a secure connection option",[]]],"cmmc":[["AC.L2-3.1.1","Authorized Access Control",["AC.L2-3.1.1"]],["AC.L2-3.1.2","Transaction & Function Control",["AC.L2-3.1.2"]],["AC.L2-3.1.3","Control CUI Flow",["AC.L2-3.1.3"]],["AC.L2-3.1.4","Separation of Duties",["AC.L2-3.1.4"]],["AC.L2-3.1.5","Least Privilege",["AC.L2-3.1.5"]],["AC.L2-3.1.6","Non-Privileged Account Use",["AC.L2-3.1.6"]],["AC.L2-3.1.7","Privileged Functions",["AC.L2-3.1.7"]],["AC.L2-3.1.8","Unsuccessful Logon Attempts",["AC.L2-3.1.8"]],["AC.L2-3.1.9","Privacy & Security Notices",["AC.L2-3.1.9"]],["AC.L2-3.1.10","Session Lock",["AC.L2-3.1.10"]],["AC.L2-3.1.11","Session Termination",["AC.L2-3.1.11"]],["AC.L2-3.1.12","Control Remote Access",["AC.L2-3.1.12"]],["AC.L2-3.1.13","Remote Access Confidentiality",["AC.L2-3.1.13"]],["AC.L2-3.1.14","Remote Access Routing",["AC.L2-3.1.14"]],["AC.L2-3.1.15","Privileged Remote Access",["AC.L2-3.1.15"]],["AC.L2-3.1.16","Wireless Access Authorization",["AC.L2-3.1.16"]],["AC.L2-3.1.17","Wireless Access Protection",["AC.L2-3.1.17"]],["AC.L2-3.1.18","Mobile Device Connection",["AC.L2-3.1.18"]],["AC.L2-3.1.19","Encrypt CUI on Mobile",["AC.L2-3.1.19"]],["AC.L2-3.1.20","External Connections",["AC.L2-3.1.20"]],["AC.L2-3.1.21","Portable Storage Use",["AC.L2-3.1.21"]],["AC.L2-3.1.22","Control Public Information",["AC.L2-3.1.22"]],["AT.L2-3.2.1","Role-Based Risk Awareness",["AT.L2-3.2.1"]],["AT.L2-3.2.2","Role-Based Training",["AT.L2-3.2.2"]],["AT.L2-3.2.3","Insider Threat Awareness",["AT.L2-3.2.3"]],["AU.L2-3.3.1","System Auditing",["AU.L2-3.3.1"]],["AU.L2-3.3.2","User Accountability",["AU.L2-3.3.2"]],["AU.L2-3.3.3","Event Review",["AU.L2-3.3.3"]],["AU.L2-3.3.4","Audit Failure Alerting",["AU.L2-3.3.4"]],["AU.L2-3.3.5","Audit Correlation",["AU.L2-3.3.5"]],["AU.L2-3.3.6","Reduction & Reporting",["AU.L2-3.3.6"]],["AU.L2-3.3.7","Authoritative Time Source",["AU.L2-3.3.7"]],["AU.L2-3.3.8","Audit Protection",["AU.L2-3.3.8"]],["AU.L2-3.3.9","Audit Management",["AU.L2-3.3.9"]],["CA.L2-3.12.1","Security Control Assessment",["CA.L2-3.12.1"]],["CA.L2-3.12.2","Plan of Action",["CA.L2-3.12.2"]],["CA.L2-3.12.3","Security Control Monitoring",["CA.L2-3.12.3"]],["CA.L2-3.12.4","System Security Plan",["CA.L2-3.12.4"]],["CM.L2-3.4.1","System Baselining",["CM.L2-3.4.1"]],["CM.L2-3.4.2","Security Configuration Enforcement",["CM.L2-3.4.2"]],["CM.L2-3.4.3","System Change Management",["CM.L2-3.4.3"]],["CM.L2-3.4.4","Security Impact Analysis",["CM.L2-3.4.4"]],["CM.L2-3.4.5","Access Restrictions for Change",["CM.L2-3.4.5"]],["CM.L2-3.4.6","Least Functionality",["CM.L2-3.4.6"]],["CM.L2-3.4.7","Nonessential Functionality",["CM.L2-3.4.7"]],["CM.L2-3.4.8","Application Execution Policy",["CM.L2-3.4.8"]],["CM.L2-3.4.9","User-Installed Software",["CM.L2-3.4.9"]],["IA.L2-3.5.1","Identification",["IA.L2-3.5.1"]],["IA.L2-3.5.2","Authentication",["IA.L2-3.5.2"]],["IA.L2-3.5.3","Multifactor Authentication",["IA.L2-3.5.3"]],["IA.L2-3.5.4","Replay-Resistant Authentication",["IA.L2-3.5.4"]],["IA.L2-3.5.5","Identifier Reuse",["IA.L2-3.5.5"]],["IA.L2-3.5.6","Identifier Handling",["IA.L2-3.5.6"]],["IA.L2-3.5.7","Password Complexity",["IA.L2-3.5.7"]],["IA.L2-3.5.8","Password Reuse",["IA.L2-3.5.8"]],["IA.L2-3.5.9","Temporary Passwords",["IA.L2-3.5.9"]],["IA.L2-3.5.10","Cryptographically-Protected Passwords",["IA.L2-3.5.10"]],["IA.L2-3.5.11","Obscure Feedback",["IA.L2-3.5.11"]],["IR.L2-3.6.1","Incident Handling",["IR.L2-3.6.1"]],["IR.L2-3.6.2","Incident Reporting",["IR.L2-3.6.2"]],["IR.L2-3.6.3","Incident Response Testing",["IR.L2-3.6.3"]],["MA.L2-3.7.1","Perform Maintenance",["MA.L2-3.7.1"]],["MA.L2-3.7.2","System Maintenance Control",["MA.L2-3.7.2"]],["MA.L2-3.7.3","Equipment Sanitization",["MA.L2-3.7.3"]],["MA.L2-3.7.4","Media Inspection",["MA.L2-3.7.4"]],["MA.L2-3.7.5","Nonlocal Maintenance",["MA.L2-3.7.5"]],["MA.L2-3.7.6","Maintenance Personnel",["MA.L2-3.7.6"]],["MP.L2-3.8.1","Media Protection",["MP.L2-3.8.1"]],["MP.L2-3.8.2","Media Access",["MP.L2-3.8.2"]],["MP.L2-3.8.3","Media Disposal",["MP.L2-3.8.3"]],["MP.L2-3.8.4","Media Markings",["MP.L2-3.8.4"]],["MP.L2-3.8.5","Media Accountability",["MP.L2-3.8.5"]],["MP.L2-3.8.6","Portable Storage Encryption",["MP.L2-3.8.6"]],["MP.L2-3.8.7","Removable Media",["MP.L2-3.8.7"]],["MP.L2-3.8.8","Shared Media",["MP.L2-3.8.8"]],["MP.L2-3.8.9","Protect Backups",["MP.L2-3.8.9"]],["PE.L2-3.10.1","Limit Physical Access",["PE.L2-3.10.1"]],["PE.L2-3.10.2","Monitor Facility",["PE.L2-3.10.2"]],["PE.L2-3.10.3","Escort Visitors",["PE.L2-3.10.3"]],["PE.L2-3.10.4","Physical Access Logs",["PE.L2-3.10.4"]],["PE.L2-3.10.5","Manage Physical Access",["PE.L2-3.10.5"]],["PE.L2-3.10.6","Alternative Work Sites",["PE.L2-3.10.6"]],["PS.L2-3.9.1","Screen Individuals",["PS.L2-3.9.1"]],["PS.L2-3.9.2","Personnel Actions",["PS.L2-3.9.2"]],["RA.L2-3.11.1","Risk Assessments",["RA.L2-3.11.1"]],["RA.L2-3.11.2","Vulnerability Scan",["RA.L2-3.11.2"]],["RA.L2-3.11.3","Vulnerability Remediation",["RA.L2-3.11.3"]],["SC.L2-3.13.1","Boundary Protection",["SC.L2-3.13.1"]],["SC.L2-3.13.2","Security Engineering",["SC.L2-3.13.2"]],["SC.L2-3.13.3","Role Separation",["SC.L2-3.13.3"]],["SC.L2-3.13.4","Shared Resource Control",["SC.L2-3.13.4"]],["SC.L2-3.13.5","Public-Access System Separation",["SC.L2-3.13.5"]],["SC.L2-3.13.6","Network Communication by Exception",["SC.L2-3.13.6"]],["SC.L2-3.13.7","Split Tunneling",["SC.L2-3.13.7"]],["SC.L2-3.13.8","Data in Transit",["SC.L2-3.13.8"]],["SC.L2-3.13.9","Connections Termination",["SC.L2-3.13.9"]],["SC.L2-3.13.10","Key Management",["SC.L2-3.13.10"]],["SC.L2-3.13.11","CUI Encryption",["SC.L2-3.13.11"]],["SC.L2-3.13.12","Collaborative Device Control",["SC.L2-3.13.12"]],["SC.L2-3.13.13","Mobile Code",["SC.L2-3.13.13"]],["SC.L2-3.13.14","Voice over Internet Protocol",[]],["SC.L2-3.13.15","Communications Authenticity",["SC.L2-3.13.15"]],["SC.L2-3.13.16","Data at Rest",["SC.L2-3.13.16"]],["SI.L2-3.14.1","Flaw Remediation",["SI.L2-3.14.1"]],["SI.L2-3.14.2","Malicious Code Protection",["SI.L2-3.14.2"]],["SI.L2-3.14.3","Security Alerts & Advisories",["SI.L2-3.14.3"]],["SI.L2-3.14.4","Update Malicious Code Protection",["SI.L2-3.14.4"]],["SI.L2-3.14.5","System & File Scanning",["SI.L2-3.14.5"]],["SI.L2-3.14.6","Monitor Communications for Attacks",["SI.L2-3.14.6"]],["SI.L2-3.14.7","Identify Unauthorized Use",["SI.L2-3.14.7"]]],"hipaa":[["§164.308(a)(1)","Security Management Process",["§164.308(a)(1)"]],["§164.308(a)(1)(ii)(A)","Risk Analysis",["§164.308(a)(1)(ii)(A)"],{"s":"Required"}],["§164.308(a)(1)(ii)(B)","Risk Management",["§164.308(a)(1)(ii)(B)"],{"s":"Required"}],["§164.308(a)(1)(ii)(C)","Sanction Policy",["§164.308(a)(1)(ii)(C)"],{"s":"Required"}],["§164.308(a)(1)(ii)(D)","Information System Activity Review",["§164.308(a)(1)(ii)(D)"],{"s":"Required"}],["§164.308(a)(2)","Assigned Security Responsibility",["§164.308(a)(2)"]],["§164.308(a)(3)","Workforce Security",["§164.308(a)(3)"]],["§164.308(a)(3)(ii)(A)","Authorization and/or Supervision",["§164.308(a)(3)(ii)(A)"],{"s":"Addressable"}],["§164.308(a)(3)(ii)(B)","Workforce Clearance Procedure",["§164.308(a)(3)(ii)(B)"],{"s":"Addressable"}],["§164.308(a)(3)(ii)(C)","Termination Procedures",["§164.308(a)(3)(ii)(C)"],{"s":"Addressable"}],["§164.308(a)(4)","Information Access Management",["§164.308(a)(4)"]],["§164.308(a)(4)(ii)(A)","Isolating Health care Clearinghouse Function",["§164.308(a)(4)(ii)(A)"],{"s":"Required"}],["§164.308(a)(4)(ii)(B)","Access Authorization",["§164.308(a)(4)(ii)(B)"],{"s":"Addressable"}],["§164.308(a)(4)(ii)(C)","Access Establishment and Modification",["§164.308(a)(4)(ii)(C)"],{"s":"Addressable"}],["§164.308(a)(5)","Security Awareness and Training",["§164.308(a)(5)"]],["§164.308(a)(5)(ii)(A)","Security Reminders",["§164.308(a)(5)(ii)(A)"],{"s":"Addressable"}],["§164.308(a)(5)(ii)(B)","Protection from Malicious Software",["§164.308(a)(5)(ii)(B)"],{"s":"Addressable"}],["§164.308(a)(5)(ii)(C)","Log-in Monitoring",["§164.308(a)(5)(ii)(C)"],{"s":"Addressable"}],["§164.308(a)(5)(ii)(D)","Password Management",["§164.308(a)(5)(ii)(D)"],{"s":"Addressable"}],["§164.308(a)(6)","Security Incident Procedures",["§164.308(a)(6)"]],["§164.308(a)(6)(ii)","Response and Reporting",["§164.308(a)(6)(ii)"],{"s":"Required"}],["§164.308(a)(7)","Contingency Plan",["§164.308(a)(7)"]],["§164.308(a)(7)(ii)(A)","Data Backup Plan",["§164.308(a)(7)(ii)(A)"],{"s":"Required"}],["§164.308(a)(7)(ii)(B)","Disaster Recovery Plan",["§164.308(a)(7)(ii)(B)"],{"s":"Required"}],["§164.308(a)(7)(ii)(C)","Emergency Mode Operation Plan",["§164.308(a)(7)(ii)(C)"],{"s":"Required"}],["§164.308(a)(7)(ii)(D)","Testing and Revision Procedure",["§164.308(a)(7)(ii)(D)"],{"s":"Addressable"}],["§164.308(a)(7)(ii)(E)","Applications and Data Criticality Analysis",["§164.308(a)(7)(ii)(E)"],{"s":"Addressable"}],["§164.308(a)(8)","Evaluation",["§164.308(a)(8)"]],["§164.308(b)(1)","Business Associate Contracts and Other Arrangements",["§164.308(b)(1)"]],["§164.308(b)(4)","Written Contract or Other Arrangement",["§164.308(b)(4)"],{"s":"Required"}],["§164.310(a)","Facility Access Controls",["§164.310(a)"]],["§164.310(a)(2)(i)","Contingency Operations",["§164.310(a)(2)(i)"],{"s":"Addressable"}],["§164.310(a)(2)(ii)","Facility Security Plan",["§164.310(a)(2)(ii)"],{"s":"Addressable"}],["§164.310(a)(2)(iii)","Access Control and Validation Procedures",["§164.310(a)(2)(iii)"],{"s":"Addressable"}],["§164.310(a)(2)(iv)","Maintenance Records",["§164.310(a)(2)(iv)"],{"s":"Addressable"}],["§164.310(b)","Workstation Use",["§164.310(b)"]],["§164.310(c)","Workstation Security",["§164.310(c)"]],["§164.310(d)","Device and Media Controls",["§164.310(d)"]],["§164.310(d)(2)(i)","Disposal",["§164.310(d)(2)(i)"],{"s":"Required"}],["§164.310(d)(2)(ii)","Media Re-use",["§164.310(d)(2)(ii)"],{"s":"Required"}],["§164.310(d)(2)(iii)","Accountability",["§164.310(d)(2)(iii)"],{"s":"Addressable"}],["§164.310(d)(2)(iv)","Data Backup and Storage",["§164.310(d)(2)(iv)"],{"s":"Addressable"}],["§164.312(a)","Access Control",["§164.312(a)"]],["§164.312(a)(2)(i)","Unique User Identification",["§164.312(a)(2)(i)"],{"s":"Required"}],["§164.312(a)(2)(ii)","Emergency Access Procedure",["§164.312(a)(2)(ii)"],{"s":"Required"}],["§164.312(a)(2)(iii)","Automatic Logoff",["§164.312(a)(2)(iii)"],{"s":"Addressable"}],["§164.312(a)(2)(iv)","Encryption and Decryption",["§164.312(a)(2)(iv)"],{"s":"Addressable"}],["§164.312(b)","Audit Controls",["§164.312(b)"]],["§164.312(c)","Integrity",["§164.312(c)"]],["§164.312(c)(2)","Mechanism to Authenticate Electronic Protected Health Information",["§164.312(c)(2)"],{"s":"Addressable"}],["§164.312(d)","Person or Entity Authentication",["§164.312(d)"]],["§164.312(e)(1)","Transmission Security",["§164.312(e)(1)"]],["§164.312(e)(2)(i)","Integrity Controls",["§164.312(e)(2)(i)"],{"s":"Addressable"}],["§164.312(e)(2)(ii)","Encryption",["§164.312(e)(2)(ii)"],{"s":"Addressable"}],["§164.314(a)","Business Associate Contracts or Other Arrangements",["§164.314(a)"]],["§164.314(a)(2)(i)","Business Associate Contracts",["§164.314(a)(2)(i)"],{"s":"Required"}],["§164.314(a)(2)(ii)","Other Arrangements",["§164.314(a)(2)(ii)"],{"s":"Required"}],["§164.314(a)(2)(iii)","Business associate contracts with subcontractors",["§164.314(a)(2)(iii)"],{"s":"Required"}],["§164.314(a)(3)(i)","Business Associate Contracts",[],{"s":"Required"}],["§164.314(b)","Requirements for Group Health Plans",["§164.314(b)"]],["§164.314(b)(2)(i)","Group Health Plan Implementation Specification",["§164.314(b)(2)(i)"],{"s":"Required"}],["§164.314(b)(2)(ii)","Group Health Plan Implementation Specification",["§164.314(b)(2)(ii)"],{"s":"Required"}],["§164.314(b)(2)(iii)","Group Health Plan Implementation Specification",["§164.314(b)(2)(iii)"],{"s":"Required"}],["§164.314(b)(2)(iv)","Group Health Plan Implementation Specification",["§164.314(b)(2)(iv)"],{"s":"Required"}],["§164.316(a)","Policies and Procedures",["§164.316(a)"]],["§164.316(b)","Documentation",["§164.316(b)"]],["§164.316(b)(2)(i)","Time Limit",["§164.316(b)(2)(i)"],{"s":"Required"}],["§164.316(b)(2)(ii)","Availability",["§164.316(b)(2)(ii)"],{"s":"Required"}],["§164.316(b)(2)(iii)","Updates",["§164.316(b)(2)(iii)"],{"s":"Required"}]],"gdpr":[["Art.5","Principles relating to processing of personal data",["Art.5(1)(e)","Art.5(1)(f)","Art.5(2)"]],["Art.24","Responsibility of the controller",["Art.24(1)","Art.24(2)"]],["Art.25","Data protection by design and by default",["Art.25(1)","Art.25(2)"]],["Art.28","Processor",["Art.28(1)","Art.28(3)"]],["Art.29","Processing under the authority of the controller or processor",["Art.29"]],["Art.30","Records of processing activities",["Art.30(1)"]],["Art.32","Security of processing",["Art.32(1)(a)","Art.32(1)(b)","Art.32(1)(c)","Art.32(1)(d)","Art.32(2)","Art.32(4)"]],["Art.33","Notification of a personal data breach to the supervisory authority",["Art.33(1)","Art.33(5)"]],["Art.34","Communication of a personal data breach to the data subject",["Art.34(1)","Art.34(3)(a)"]],["Art.35","Data protection impact assessment",["Art.35(1)","Art.35(7)"]],["Art.37","Designation of the data protection officer",["Art.37(1)"]],["Art.38","Position of the data protection officer",[]],["Art.39","Tasks of the data protection officer",["Art.39(1)","Art.39(1)(b)"]]],"nis2":[["1.1","Policy on the security of network and information systems",["1.1"]],["1.2","Roles, responsibilities and authorities",["1.2"]],["2.1","Risk management framework",["2.1"]],["2.2","Compliance monitoring",["2.2"]],["2.3","Independent review of information and network security",["2.3"]],["3.1","Incident handling policy",["3.1"]],["3.2","Monitoring and logging",["3.2"]],["3.3","Event reporting",["3.3"]],["3.4","Event assessment and classification",["3.4"]],["3.5","Incident response",["3.5"]],["3.6","Post-incident reviews",["3.6"]],["4.1","Business continuity and disaster recovery plan",["4.1"]],["4.2","Backup management",["4.2"]],["4.3","Crisis management",["4.3"]],["5.1","Supply chain security policy",["5.1"]],["5.2","Directory of suppliers and service providers",["5.2"]],["6.1","Security in acquisition of ICT services, ICT systems or ICT products",["6.1"]],["6.2","Secure development life cycle",["6.2"]],["6.3","Configuration management",["6.3"]],["6.4","Change management, repairs and maintenance",["6.4"]],["6.5","Security testing",["6.5"]],["6.6","Security patch management",["6.6"]],["6.7","Network security",["6.7"]],["6.8","Network segmentation",["6.8"]],["6.9","Protection against malicious and unauthorised software",["6.9"]],["6.10","Vulnerability handling and disclosure",["6.10"]],["7.1","Policies and procedures to assess the effectiveness of cybersecurity risk-management measures",["7.1"]],["8.1","Awareness raising and basic cyber hygiene practices",["8.1"]],["8.2","Security training",["8.2"]],["9.1","Cryptography",["9.1"]],["10.1","Human resources security",["10.1"]],["10.2","Verification of Background",["10.2"]],["10.3","Termination or change of employment procedures",["10.3"]],["10.4","Disciplinary process",["10.4"]],["11.1","Access control policy",["11.1"]],["11.2","Management of access rights",["11.2"]],["11.3","Privileged accounts and system administration accounts",["11.3"]],["11.4","Administration systems",["11.4"]],["11.5","Identification",["11.5"]],["11.6","Authentication",["11.6"]],["11.7","Multi-factor authentication",["11.7"]],["12.1","Asset classification",["12.1"]],["12.2","Handling of assets",["12.2"]],["12.3","Removable media policy",["12.3"]],["12.4","Asset inventory",["12.4"]],["12.5","Deposit, return or deletion of assets upon termination of employment",["12.5"]],["13.1","Supporting utilities",["13.1"]],["13.2","Protection against physical and environmental threats",["13.2"]],["13.3","Perimeter and physical access control",["13.3"]]],"e8":[["ISM-0109","Event logs from workstations are analysed in a timely manner to detect cyber security…",["ISM-0109"],{"g":"All strategies","s":"ML3"}],["ISM-0123","Cyber security incidents are reported to the chief information security officer, or one…",["ISM-0123"],{"g":"All strategies","s":"ML2, ML3"}],["ISM-0140","Cyber security incidents are reported to ASD as soon as possible after they occur or…",["ISM-0140"],{"g":"All strategies","s":"ML2, ML3"}],["ISM-0304","Applications other than office productivity suites, web browsers and their extensions…",["ISM-0304"],{"g":"Patch applications","s":"ML3"}],["ISM-0445","Privileged human users are assigned a dedicated privileged user account to be used…",["ISM-0445"],{"g":"Restrict administrative privileges","s":"ML1, ML2, ML3"}],["ISM-0843","Application control is implemented on workstations",["ISM-0843"],{"g":"Application control","s":"ML1, ML2, ML3"}],["ISM-0974","Multi-factor authentication is used to authenticate unprivileged human users of systems",["ISM-0974"],{"g":"Multi-factor authentication","s":"ML2, ML3"}],["ISM-1173","Multi-factor authentication is used to authenticate privileged human users of systems",["ISM-1173"],{"g":"Multi-factor authentication","s":"ML2, ML3"}],["ISM-1175","Privileged user accounts (excluding those explicitly authorised to access online…",["ISM-1175"],{"g":"Restrict administrative privileges","s":"ML1, ML2, ML3"}],["ISM-1228","Cyber security events are analysed in a timely manner to identify cyber security incidents",["ISM-1228"],{"g":"All strategies","s":"ML2, ML3"}],["ISM-1380","Privileged human users use separate privileged and unprivileged operating environments",["ISM-1380"],{"g":"Restrict administrative privileges","s":"ML1, ML2, ML3"}],["ISM-1387","Administrative activities are conducted through jump servers",["ISM-1387"],{"g":"Restrict administrative privileges","s":"ML2, ML3"}],["ISM-1401","Multi-factor authentication uses either: something people have and something people…",["ISM-1401"],{"g":"Multi-factor authentication","s":"ML1, ML2, ML3"}],["ISM-1407","The latest release, or the previous release, of operating systems are used",["ISM-1407"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1412","Web browsers are hardened using ASD and vendor hardening guidance, with the most…",["ISM-1412"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1485","Web browsers do not process web advertisements from the internet",["ISM-1485"],{"g":"User application hardening","s":"ML1, ML2, ML3"}],["ISM-1486","Web browsers do not process Java from the internet",["ISM-1486"],{"g":"User application hardening","s":"ML1, ML2, ML3"}],["ISM-1487","Only privileged human users responsible for checking that Microsoft Office macros are…",["ISM-1487"],{"g":"Restrict Microsoft Office macros","s":"ML3"}],["ISM-1488","Microsoft Office macros in files originating from the internet are blocked",["ISM-1488"],{"g":"Restrict Microsoft Office macros","s":"ML1, ML2, ML3"}],["ISM-1489","Microsoft Office macro security settings cannot be changed by human users",["ISM-1489"],{"g":"Restrict Microsoft Office macros","s":"ML1, ML2, ML3"}],["ISM-1490","Application control is implemented on internet-facing servers",["ISM-1490"],{"g":"Application control","s":"ML2, ML3"}],["ISM-1501","Operating systems that are no longer supported by vendors are replaced",["ISM-1501"],{"g":"Patch operating systems","s":"ML1, ML2, ML3"}],["ISM-1504","Multi-factor authentication is used to authenticate human users to their organisation’s online services that process…",["ISM-1504"],{"g":"Multi-factor authentication","s":"ML1, ML2, ML3"}],["ISM-1505","Multi-factor authentication is used to authenticate human users of data repositories",["ISM-1505"],{"g":"Multi-factor authentication","s":"ML3"}],["ISM-1507","Requests for privileged access to systems and their resources are validated when first…",["ISM-1507"],{"g":"Restrict administrative privileges","s":"ML1, ML2, ML3"}],["ISM-1508","Privileged access to systems and their resources is limited to only what is required…",["ISM-1508"],{"g":"Restrict administrative privileges","s":"ML3"}],["ISM-1509","Privileged access events are centrally logged",["ISM-1509"],{"g":"Restrict administrative privileges","s":"ML2, ML3"}],["ISM-1511","Backups of data, applications and settings are performed and retained in accordance…",["ISM-1511"],{"g":"Regular backups","s":"ML1, ML2, ML3"}],["ISM-1515","Restoration of data, applications and settings from backups to a common point in time…",["ISM-1515"],{"g":"Regular backups","s":"ML1, ML2, ML3"}],["ISM-1542","Microsoft Office is configured to prevent activation of Object Linking and Embedding…",["ISM-1542"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1544","Microsoft’s recommended application blocklist is implemented",["ISM-1544"],{"g":"Application control","s":"ML2, ML3"}],["ISM-1582","Application control rulesets are validated at least annually",["ISM-1582"],{"g":"Application control","s":"ML2, ML3"}],["ISM-1585","Web browser security settings cannot be changed by human users",["ISM-1585"],{"g":"User application hardening","s":"ML1, ML2, ML3"}],["ISM-1621","Windows PowerShell 2.0 is disabled or removed",["ISM-1621"],{"g":"User application hardening","s":"ML3"}],["ISM-1622","PowerShell is configured to use Constrained Language Mode",["ISM-1622"],{"g":"User application hardening","s":"ML3"}],["ISM-1623","PowerShell module logging, script block logging and transcription events are centrally…",["ISM-1623"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1647","Privileged access to systems and their resources are disabled after 12 months unless…",["ISM-1647"],{"g":"Restrict administrative privileges","s":"ML2, ML3"}],["ISM-1648","Privileged access to systems and their resources are disabled after 45 days of inactivity",["ISM-1648"],{"g":"Restrict administrative privileges","s":"ML2, ML3"}],["ISM-1649","Just-in-time administration is used for the administration of systems and their resources",["ISM-1649"],{"g":"Restrict administrative privileges","s":"ML3"}],["ISM-1650","Privileged user account and security group management events are centrally logged",["ISM-1650"],{"g":"Restrict administrative privileges","s":"ML2, ML3"}],["ISM-1654","Internet Explorer 11 is disabled or removed",["ISM-1654"],{"g":"User application hardening","s":"ML1, ML2, ML3"}],["ISM-1655",".NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed",["ISM-1655"],{"g":"User application hardening","s":"ML3"}],["ISM-1656","Application control is implemented on non-internet-facing servers",["ISM-1656"],{"g":"Application control","s":"ML3"}],["ISM-1657","Application control restricts the execution of executables, libraries, scripts…",["ISM-1657"],{"g":"Application control","s":"ML1, ML2, ML3"}],["ISM-1658","Application control restricts the execution of drivers to an organisation-approved set",["ISM-1658"],{"g":"Application control","s":"ML3"}],["ISM-1659","Microsoft’s vulnerable driver blocklist is implemented",["ISM-1659"],{"g":"Application control","s":"ML3"}],["ISM-1660","Allowed and blocked application control events are centrally logged",["ISM-1660"],{"g":"Application control","s":"ML2, ML3"}],["ISM-1667","Microsoft Office is blocked from creating child processes",["ISM-1667"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1668","Microsoft Office is blocked from creating executable content",["ISM-1668"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1669","Microsoft Office is blocked from injecting code into other processes",["ISM-1669"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1670","PDF applications are blocked from creating child processes",["ISM-1670"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1671","Microsoft Office macros are disabled for human users that do not have a demonstrated…",["ISM-1671"],{"g":"Restrict Microsoft Office macros","s":"ML1, ML2, ML3"}],["ISM-1672","Microsoft Office macro antivirus scanning is enabled",["ISM-1672"],{"g":"Restrict Microsoft Office macros","s":"ML1, ML2, ML3"}],["ISM-1673","Microsoft Office macros are blocked from making Win32 API calls",["ISM-1673"],{"g":"Restrict Microsoft Office macros","s":"ML2, ML3"}],["ISM-1674","Only Microsoft Office macros running from within a sandboxed environment, a Trusted…",["ISM-1674"],{"g":"Restrict Microsoft Office macros","s":"ML3"}],["ISM-1675","Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled…",["ISM-1675"],{"g":"Restrict Microsoft Office macros","s":"ML3"}],["ISM-1676","Microsoft Office’s list of trusted publishers is validated at least annually",["ISM-1676"],{"g":"Restrict Microsoft Office macros","s":"ML3"}],["ISM-1679","Multi-factor authentication is used to authenticate human users to third-party online services that process, store or…",["ISM-1679"],{"g":"Multi-factor authentication","s":"ML1, ML2, ML3"}],["ISM-1680","Multi-factor authentication (where available) is used to authenticate human users to…",["ISM-1680"],{"g":"Multi-factor authentication","s":"ML1, ML2, ML3"}],["ISM-1681","Multi-factor authentication is used to authenticate customers to online customer…",["ISM-1681"],{"g":"Multi-factor authentication","s":"ML1, ML2, ML3"}],["ISM-1682","Multi-factor authentication used for authenticating human users of systems is…",["ISM-1682"],{"g":"Multi-factor authentication","s":"ML2, ML3"}],["ISM-1683","Successful and unsuccessful multi-factor authentication events are centrally logged",["ISM-1683"],{"g":"Multi-factor authentication","s":"ML2, ML3"}],["ISM-1685","Credentials for break glass accounts, local administrator accounts and service accounts…",["ISM-1685"],{"g":"Restrict administrative privileges","s":"ML2, ML3"}],["ISM-1686","Credential Guard functionality is enabled",["ISM-1686"],{"g":"Restrict administrative privileges","s":"ML3"}],["ISM-1687","Privileged operating environments are not virtualised within unprivileged operating…",["ISM-1687"],{"g":"Restrict administrative privileges","s":"ML2, ML3"}],["ISM-1688","Unprivileged user accounts cannot be used to log on to privileged operating environments",["ISM-1688"],{"g":"Restrict administrative privileges","s":"ML1, ML2, ML3"}],["ISM-1689","Privileged user accounts (excluding local administrator accounts) cannot be used to log…",["ISM-1689"],{"g":"Restrict administrative privileges","s":"ML1, ML2, ML3"}],["ISM-1690","Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of…",["ISM-1690"],{"g":"Patch applications","s":"ML1, ML2, ML3"}],["ISM-1691","Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release",["ISM-1691"],{"g":"Patch applications","s":"ML1, ML2"}],["ISM-1692","Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48…",["ISM-1692"],{"g":"Patch applications","s":"ML3"}],["ISM-1693","Patches, updates or other vendor mitigations for vulnerabilities in applications other…",["ISM-1693"],{"g":"Patch applications","s":"ML2, ML3"}],["ISM-1694","Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks…",["ISM-1694"],{"g":"Patch operating systems","s":"ML1, ML2, ML3"}],["ISM-1695","Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release",["ISM-1695"],{"g":"Patch operating systems","s":"ML1, ML2"}],["ISM-1696","Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of…",["ISM-1696"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1697","Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release…",["ISM-1697"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1698","A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…",["ISM-1698"],{"g":"Patch applications","s":"ML1, ML2, ML3"}],["ISM-1699","A vulnerability scanner is used at least weekly to identify missing patches or updates…",["ISM-1699"],{"g":"Patch applications","s":"ML1, ML2, ML3"}],["ISM-1700","A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office…",["ISM-1700"],{"g":"Patch applications","s":"ML2, ML3"}],["ISM-1701","A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in…",["ISM-1701"],{"g":"Patch operating systems","s":"ML1, ML2, ML3"}],["ISM-1702","A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of…",["ISM-1702"],{"g":"Patch operating systems","s":"ML1, ML2, ML3"}],["ISM-1703","A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers",["ISM-1703"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1704","Office productivity suites, web browsers and their extensions, email clients, PDF…",["ISM-1704"],{"g":"Patch applications","s":"ML1, ML2, ML3"}],["ISM-1705","Privileged user accounts (excluding backup administrator accounts) cannot access…",["ISM-1705"],{"g":"Regular backups","s":"ML2, ML3"}],["ISM-1706","Privileged user accounts (excluding backup administrator accounts) cannot access their…",["ISM-1706"],{"g":"Regular backups","s":"ML3"}],["ISM-1707","Privileged user accounts (excluding backup administrator accounts) are prevented from…",["ISM-1707"],{"g":"Regular backups","s":"ML2, ML3"}],["ISM-1708","Backup administrator accounts are prevented from modifying and deleting backups during…",["ISM-1708"],{"g":"Regular backups","s":"ML3"}],["ISM-1807","An automated method of asset discovery is used at least fortnightly to support the…",["ISM-1807"],{"g":"Patch applications & Patch operating systems","s":"ML1, ML2, ML3"}],["ISM-1808","A vulnerability scanner with an up-to-date vulnerability database is used for…",["ISM-1808"],{"g":"Patch applications & Patch operating systems","s":"ML1, ML2, ML3"}],["ISM-1810","Backups of data, applications and settings are synchronised to enable restoration to a…",["ISM-1810"],{"g":"Regular backups","s":"ML1, ML2, ML3"}],["ISM-1811","Backups of data, applications and settings are retained in a secure and resilient manner",["ISM-1811"],{"g":"Regular backups","s":"ML1, ML2, ML3"}],["ISM-1812","Unprivileged user accounts cannot access backups belonging to other user accounts",["ISM-1812"],{"g":"Regular backups","s":"ML1, ML2, ML3"}],["ISM-1813","Unprivileged user accounts cannot access their own backups",["ISM-1813"],{"g":"Regular backups","s":"ML3"}],["ISM-1814","Unprivileged user accounts are prevented from modifying and deleting backups",["ISM-1814"],{"g":"Regular backups","s":"ML1, ML2, ML3"}],["ISM-1815","Event logs are protected from unauthorised modification and deletion",["ISM-1815"],{"g":"All strategies","s":"ML2, ML3"}],["ISM-1819","Following the identification of a cyber security incident, the cyber security incident…",["ISM-1819"],{"g":"All strategies","s":"ML2, ML3"}],["ISM-1823","Office productivity suite security settings cannot be changed by human users",["ISM-1823"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1824","PDF application security settings cannot be changed by human users",["ISM-1824"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1859","Office productivity suites are hardened using ASD and vendor hardening guidance, with…",["ISM-1859"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1860","PDF applications are hardened using ASD and vendor hardening guidance, with the most…",["ISM-1860"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1861","Local Security Authority protection functionality is enabled",["ISM-1861"],{"g":"Restrict administrative privileges","s":"ML3"}],["ISM-1870","Application control is applied to user profiles and temporary folders used by operating…",["ISM-1870"],{"g":"Application control","s":"ML1, ML2, ML3"}],["ISM-1871","Application control is applied to all locations other than user profiles and temporary…",["ISM-1871"],{"g":"Application control","s":"ML2, ML3"}],["ISM-1872","Multi-factor authentication used for authenticating human users of online services is…",["ISM-1872"],{"g":"Multi-factor authentication","s":"ML2, ML3"}],["ISM-1873","Multi-factor authentication used for authenticating customers of online customer services provides a…",["ISM-1873"],{"g":"Multi-factor authentication","s":"ML2"}],["ISM-1874","Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant",["ISM-1874"],{"g":"Multi-factor authentication","s":"ML3"}],["ISM-1876","Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of…",["ISM-1876"],{"g":"Patch applications","s":"ML1, ML2, ML3"}],["ISM-1877","Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours…",["ISM-1877"],{"g":"Patch operating systems","s":"ML1, ML2, ML3"}],["ISM-1879","Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release…",["ISM-1879"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1883","Privileged user accounts explicitly authorised to access online services are strictly…",["ISM-1883"],{"g":"Restrict administrative privileges","s":"ML1, ML2, ML3"}],["ISM-1889","Command line process creation events are centrally logged",["ISM-1889"],{"g":"User application hardening","s":"ML2, ML3"}],["ISM-1890","Microsoft Office macros are checked to ensure they are free of malicious code before…",["ISM-1890"],{"g":"Restrict Microsoft Office macros","s":"ML3"}],["ISM-1891","Microsoft Office macros digitally signed by signatures other than V3 signatures cannot…",["ISM-1891"],{"g":"Restrict Microsoft Office macros","s":"ML3"}],["ISM-1892","Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that…",["ISM-1892"],{"g":"Multi-factor authentication","s":"ML1, ML2, ML3"}],["ISM-1893","Multi-factor authentication is used to authenticate human users to third-party online customer services that process…",["ISM-1893"],{"g":"Multi-factor authentication","s":"ML1, ML2, ML3"}],["ISM-1894","Multi-factor authentication used for authenticating human users of data repositories is…",["ISM-1894"],{"g":"Multi-factor authentication","s":"ML3"}],["ISM-1896","Memory integrity functionality is enabled",["ISM-1896"],{"g":"User application hardening","s":"ML3"}],["ISM-1897","Remote Credential Guard functionality is enabled",["ISM-1897"],{"g":"Restrict administrative privileges","s":"ML3"}],["ISM-1898","Secure Admin Workstations are used in the performance of administrative activities",["ISM-1898"],{"g":"Restrict administrative privileges","s":"ML3"}],["ISM-1900","A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware",["ISM-1900"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1901","Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when…",["ISM-1901"],{"g":"Patch applications","s":"ML3"}],["ISM-1902","Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of…",["ISM-1902"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1903","Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release…",["ISM-1903"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1904","Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release…",["ISM-1904"],{"g":"Patch operating systems","s":"ML3"}],["ISM-1905","Online services that are no longer supported by vendors are removed",["ISM-1905"],{"g":"Patch applications","s":"ML1, ML2, ML3"}],["ISM-1906","Event logs from internet-facing servers are analysed in a timely manner to detect cyber…",["ISM-1906"],{"g":"All strategies","s":"ML2, ML3"}],["ISM-1907","Event logs from non-internet-facing servers are analysed in a timely manner to detect…",["ISM-1907"],{"g":"All strategies","s":"ML3"}]],"dora":[["Art.5","Governance and organisation",["Art.5(2)(a)","Art.5(2)(b)","Art.5(2)(c)","Art.5(2)(f)","Art.5(3)","Art.5(4)"]],["Art.6","ICT risk management framework",["Art.6(1)","Art.6(2)","Art.6(4)","Art.6(5)","Art.6(6)","Art.6(7)","Art.6(8)"]],["Art.7","ICT systems, protocols and tools",[]],["Art.8","Identification",["Art.8(1)","Art.8(2)","Art.8(3)","Art.8(4)","Art.8(6)","Art.8(7)"]],["Art.9","Protection and prevention",["Art.9(1)","Art.9(2)","Art.9(3)(a)","Art.9(3)(c)","Art.9(3)(d)","Art.9(4)(a)","Art.9(4)(b)","Art.9(4)(c)","Art.9(4)(d)","Art.9(4)(e)","Art.9(4)(f)"]],["Art.10","Detection",["Art.10(1)","Art.10(2)","Art.10(3)"]],["Art.11","Response and recovery",["Art.11(1)","Art.11(2)(b)","Art.11(2)(c)","Art.11(2)(e)","Art.11(3)","Art.11(4)","Art.11(5)","Art.11(6)","Art.11(7)"]],["Art.12","Backup policies and procedures, restoration and recovery procedures and methods",["Art.12(1)","Art.12(2)","Art.12(3)","Art.12(4)","Art.12(6)"]],["Art.13","Learning and evolving",["Art.13(1)","Art.13(2)","Art.13(3)","Art.13(6)"]],["Art.14","Communication",["Art.14(1)","Art.14(2)"]],["Art.16","Simplified ICT risk management framework",["Art.16(1)"]],["Art.17","ICT-related incident management process",["Art.17(1)","Art.17(2)","Art.17(3)","Art.17(3)(d)","Art.17(3)(f)"]],["Art.18","Classification of ICT-related incidents and cyber threats",["Art.18(1)"]],["Art.19","Reporting of major ICT-related incidents and voluntary notification of significant cyber threats",["Art.19(1)","Art.19(3)","Art.19(4)"]],["Art.24","General requirements for the performance of digital operational resilience testing",["Art.24(1)"]],["Art.25","Testing of ICT tools and systems",["Art.25(1)"]],["Art.26","Advanced testing of ICT tools, systems and processes based on TLPT",["Art.26(1)"]],["Art.27","Requirements for testers for the carrying out of TLPT",["Art.27(1)"]],["Art.28","General principles",["Art.28(2)","Art.28(3)","Art.28(4)","Art.28(5)","Art.28(8)"]],["Art.29","Preliminary assessment of ICT concentration risk at entity level",["Art.29(1)","Art.29(2)"]],["Art.30","Key contractual provisions",["Art.30(2)","Art.30(2)(d)","Art.30(3)"]],["Art.45","Information-sharing arrangements on cyber threat information and intelligence",["Art.45(1)"]]],"cps234":[["Para 13","Board ultimately responsible for information security",["Para 13"]],["Para 14","Define information security roles and responsibilities",["Para 14"]],["Para 15","Maintain a capability commensurate with threats",["Para 15"]],["Para 16","Assess third parties' information security capability",["Para 16"]],["Para 17","Keep capability current as threats and vulnerabilities change",["Para 17"]],["Para 18","Maintain an information security policy framework",["Para 18"]],["Para 19","Policies direct everyone with security obligations",["Para 19"]],["Para 20","Classify information assets by criticality and sensitivity",["Para 20"]],["Para 21","Timely controls commensurate with risk and asset life-cycle",["Para 21"]],["Para 22","Evaluate the design of third parties' controls",["Para 22"]],["Para 23","Detect and respond to incidents in a timely manner",["Para 23"]],["Para 24","Maintain information security response plans",["Para 24"]],["Para 25","Response plans cover all stages and escalation",["Para 25"]],["Para 26","Review and test response plans annually",["Para 26"]],["Para 27","Systematic testing programme for control effectiveness",["Para 27"]],["Para 28","Check third parties' control testing is adequate",["Para 28"]],["Para 29","Escalate deficiencies that can't be fixed quickly",[]],["Para 30","Testing by skilled, functionally independent specialists",["Para 30"]],["Para 31","Review the testing programme at least annually",["Para 31"]],["Para 32","Internal audit reviews control design and effectiveness",["Para 32"]],["Para 33","Assurance provided by appropriately skilled personnel",["Para 33"]],["Para 34","Internal audit assesses third-party assurance relied on",["Para 34"]],["Para 35","Notify APRA of material incidents within 72 hours",["Para 35"]],["Para 36","Notify APRA of material control weaknesses within 10 business days",["Para 36"]]],"ce":[["CE 1","Firewalls",["CE 1"]],["CE 2","Secure Configuration",["CE 2"]],["CE 3","Security Update Management",["CE 3"]],["CE 4","User Access Control",["CE 4"]],["CE 5","Malware protection",["CE 5"]]]},"requirements":[{"fw":"nist","id":"DE.AE-02","title":"Potentially adverse events are analyzed to better understand associated activities","csf":[["DE.AE-02","c",""]],"topics":["Id","An"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.AE-03","title":"Information is correlated from multiple sources","csf":[["DE.AE-03","c",""]],"topics":["Lg","Sg"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.AE-04","title":"The estimated impact and scope of adverse events are understood","csf":[["DE.AE-04","c",""]],"topics":["An"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.AE-06","title":"Information on adverse events is provided to authorized staff and tools","csf":[["DE.AE-06","c",""]],"topics":["Sg"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.AE-07","title":"Cyber threat intelligence and other contextual information are integrated into the analysis","csf":[["DE.AE-07","c",""]],"topics":["Ti"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.AE-08","title":"Incidents are declared when adverse events meet the defined incident criteria","csf":[["DE.AE-08","c",""]],"topics":["Sg"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.CM-01","title":"Networks and network services are monitored to find potentially adverse events","csf":[["DE.CM-01","c",""]],"topics":["Ds","Wf","Sm","Id"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.CM-02","title":"The physical environment is monitored to find potentially adverse events","csf":[["DE.CM-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.CM-03","title":"Personnel activity and technology usage are monitored to find potentially adverse events","csf":[["DE.CM-03","c",""]],"topics":["Sm","It"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.CM-06","title":"External service provider activities and services are monitored to find potentially adverse events","csf":[["DE.CM-06","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"DE.CM-09","title":"Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events","csf":[["DE.CM-09","c",""]],"topics":["Ep","Ml","Sm","An"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OC-01","title":"The organizational mission is understood and informs cybersecurity risk management","csf":[["GV.OC-01","c",""]],"topics":["Be"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OC-02","title":"Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered","csf":[["GV.OC-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OC-03","title":"Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed","csf":[["GV.OC-03","c",""]],"topics":["Cm"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OC-04","title":"Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated","csf":[["GV.OC-04","c",""]],"topics":["Be","Bc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OC-05","title":"Outcomes, capabilities, and services that the organization depends on are understood and communicated","csf":[["GV.OC-05","c",""]],"topics":["Be"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OV-01","title":"Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction","csf":[["GV.OV-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OV-02","title":"The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks","csf":[["GV.OV-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.OV-03","title":"Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed","csf":[["GV.OV-03","c",""]],"topics":["Cm"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.PO-01","title":"Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced","csf":[["GV.PO-01","c",""]],"topics":["Gp"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.PO-02","title":"Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission","csf":[["GV.PO-02","c",""]],"topics":["Gp"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RM-01","title":"Risk management objectives are established and agreed to by organizational stakeholders","csf":[["GV.RM-01","c",""]],"topics":["Rm"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RM-02","title":"Risk appetite and risk tolerance statements are established, communicated, and maintained","csf":[["GV.RM-02","c",""]],"topics":["Rm"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RM-03","title":"Cybersecurity risk management activities and outcomes are included in enterprise risk management processes","csf":[["GV.RM-03","c",""]],"topics":["Rm"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RM-04","title":"Strategic direction that describes appropriate risk response options is established and communicated","csf":[["GV.RM-04","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RM-05","title":"Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties","csf":[["GV.RM-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RM-06","title":"A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated","csf":[["GV.RM-06","c",""]],"topics":["Rm"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RM-07","title":"Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions","csf":[["GV.RM-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RR-01","title":"Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving","csf":[["GV.RR-01","c",""]],"topics":["Rr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RR-02","title":"Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced","csf":[["GV.RR-02","c",""]],"topics":["Rr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RR-03","title":"Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies","csf":[["GV.RR-03","c",""]],"topics":["Rr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.RR-04","title":"Cybersecurity is included in human resources practices","csf":[["GV.RR-04","c",""]],"topics":["It"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-01","title":"A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders","csf":[["GV.SC-01","c",""]],"topics":["Sc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-02","title":"Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally","csf":[["GV.SC-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-03","title":"Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes","csf":[["GV.SC-03","c",""]],"topics":["Sc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-04","title":"Suppliers are known and prioritized by criticality","csf":[["GV.SC-04","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-05","title":"Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties","csf":[["GV.SC-05","c",""]],"topics":["Sc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-06","title":"Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships","csf":[["GV.SC-06","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-07","title":"The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship","csf":[["GV.SC-07","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-08","title":"Relevant suppliers and other third parties are included in incident planning, response, and recovery activities","csf":[["GV.SC-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-09","title":"Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle","csf":[["GV.SC-09","c",""]],"topics":["Sc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"GV.SC-10","title":"Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement","csf":[["GV.SC-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.AM-01","title":"Inventories of hardware managed by the organization are maintained","csf":[["ID.AM-01","c",""]],"topics":["Am"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.AM-02","title":"Inventories of software, services, and systems managed by the organization are maintained","csf":[["ID.AM-02","c",""]],"topics":["Am"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.AM-03","title":"Representations of the organization's authorized network communication and internal and external network data flows are maintained","csf":[["ID.AM-03","c",""]],"topics":["Fw"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.AM-04","title":"Inventories of services provided by suppliers are maintained","csf":[["ID.AM-04","c",""]],"topics":["Am","Cl"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.AM-05","title":"Assets are prioritized based on classification, criticality, resources, and impact on the mission","csf":[["ID.AM-05","c",""]],"topics":["Da"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.AM-07","title":"Inventories of data and corresponding metadata for designated data types are maintained","csf":[["ID.AM-07","c",""]],"topics":["Da"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.AM-08","title":"Systems, hardware, software, services, and data are managed throughout their life cycles","csf":[["ID.AM-08","c",""]],"topics":["Am"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.IM-01","title":"Improvements are identified from evaluations","csf":[["ID.IM-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.IM-02","title":"Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties","csf":[["ID.IM-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.IM-03","title":"Improvements are identified from execution of operational processes, procedures, and activities","csf":[["ID.IM-03","c",""]],"topics":["Ll"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.IM-04","title":"Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved","csf":[["ID.IM-04","c",""]],"topics":["Ir","Rc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-01","title":"Vulnerabilities in assets are identified, validated, and recorded","csf":[["ID.RA-01","c",""]],"topics":["Vn"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-02","title":"Cyber threat intelligence is received from information sharing forums and sources","csf":[["ID.RA-02","c",""]],"topics":["Ti"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-03","title":"Internal and external threats to the organization are identified and recorded","csf":[["ID.RA-03","c",""]],"topics":["Ra","Ti"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-04","title":"Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded","csf":[["ID.RA-04","c",""]],"topics":["Ra"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-05","title":"Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization","csf":[["ID.RA-05","c",""]],"topics":["Ra"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-06","title":"Risk responses are chosen, prioritized, planned, tracked, and communicated","csf":[["ID.RA-06","c",""]],"topics":["Ra"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-07","title":"Changes and exceptions are managed, assessed for risk impact, recorded, and tracked","csf":[["ID.RA-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-08","title":"Processes for receiving, analyzing, and responding to vulnerability disclosures are established","csf":[["ID.RA-08","c",""]],"topics":["Vn"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-09","title":"The authenticity and integrity of hardware and software are assessed prior to acquisition and use","csf":[["ID.RA-09","c",""]],"topics":["Sc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"ID.RA-10","title":"Critical suppliers are assessed prior to acquisition","csf":[["ID.RA-10","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AA-01","title":"Identities and credentials for authorized users, services, and hardware are managed by the organization","csf":[["PR.AA-01","c",""]],"topics":["Ac"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AA-02","title":"Identities are proofed and bound to credentials based on the context of interactions","csf":[["PR.AA-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AA-03","title":"Users, services, and hardware are authenticated","csf":[["PR.AA-03","c",""]],"topics":["Mf","Zt","Ap"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AA-04","title":"Identity assertions are protected, conveyed, and verified","csf":[["PR.AA-04","c",""]],"topics":["Zt"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AA-05","title":"Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties","csf":[["PR.AA-05","c",""]],"topics":["Ac","Pa","Zt","Mb"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AA-06","title":"Physical access to assets is managed, monitored, and enforced commensurate with risk","csf":[["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AT-01","title":"Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind","csf":[["PR.AT-01","c",""]],"topics":["Aw"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.AT-02","title":"Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind","csf":[["PR.AT-02","c",""]],"topics":["Aw"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.DS-01","title":"The confidentiality, integrity, and availability of data-at-rest are protected","csf":[["PR.DS-01","c",""]],"topics":["En","Dp","Dl"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.DS-02","title":"The confidentiality, integrity, and availability of data-in-transit are protected","csf":[["PR.DS-02","c",""]],"topics":["En","Dp","Ml","Dl"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.DS-10","title":"The confidentiality, integrity, and availability of data-in-use are protected","csf":[["PR.DS-10","c",""]],"topics":["Dp","Dl"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.DS-11","title":"Backups of data are created, protected, maintained, and tested","csf":[["PR.DS-11","c",""]],"topics":["Bk"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.IR-01","title":"Networks and environments are protected from unauthorized logical access and usage","csf":[["PR.IR-01","c",""]],"topics":["Fw","Ws","Zt","Cl","Ds","Wf","Ap"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.IR-02","title":"The organization's technology assets are protected from environmental threats","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.IR-03","title":"Mechanisms are implemented to achieve resilience requirements in normal and adverse situations","csf":[["PR.IR-03","c",""]],"topics":["Bc","Dr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.IR-04","title":"Adequate resource capacity to ensure availability is maintained","csf":[["PR.IR-04","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.PS-01","title":"Configuration management practices are established and applied","csf":[["PR.PS-01","c",""]],"topics":["Cf","Mb","Cl"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.PS-02","title":"Software is maintained, replaced, and removed commensurate with risk","csf":[["PR.PS-02","c",""]],"topics":["Pm"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.PS-03","title":"Hardware is maintained, replaced, and removed commensurate with risk","csf":[["PR.PS-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.PS-04","title":"Log records are generated and made available for continuous monitoring","csf":[["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.PS-05","title":"Installation and execution of unauthorized software are prevented","csf":[["PR.PS-05","c",""]],"topics":["Ep"],"edTopics":[],"direct":[]},{"fw":"nist","id":"PR.PS-06","title":"Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle","csf":[["PR.PS-06","c",""]],"topics":["Sd","Ws","Ap"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.CO-03","title":"Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders","csf":[["RC.CO-03","c",""]],"topics":["Cr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.CO-04","title":"Public updates on incident recovery are shared using approved methods and messaging","csf":[["RC.CO-04","c",""]],"topics":["Cr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.RP-01","title":"The recovery portion of the incident response plan is executed once initiated from the incident response process","csf":[["RC.RP-01","c",""]],"topics":["Rc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.RP-02","title":"Recovery actions are selected, scoped, prioritized, and performed","csf":[["RC.RP-02","c",""]],"topics":["Rc","Dr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.RP-03","title":"The integrity of backups and other restoration assets is verified before using them for restoration","csf":[["RC.RP-03","c",""]],"topics":["Bk"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.RP-04","title":"Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms","csf":[["RC.RP-04","c",""]],"topics":["Bc"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.RP-05","title":"The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed","csf":[["RC.RP-05","c",""]],"topics":["Cr","Dr"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RC.RP-06","title":"The end of incident recovery is declared based on criteria, and incident-related documentation is completed","csf":[["RC.RP-06","c",""]],"topics":["Ll"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.AN-03","title":"Analysis is performed to establish what has taken place during an incident and the root cause of the incident","csf":[["RS.AN-03","c",""]],"topics":["Fn"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.AN-06","title":"Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved","csf":[["RS.AN-06","c",""]],"topics":["Fn"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.AN-07","title":"Incident data and metadata are collected, and their integrity and provenance are preserved","csf":[["RS.AN-07","c",""]],"topics":["Fn"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.AN-08","title":"An incident's magnitude is estimated and validated","csf":[["RS.AN-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.CO-02","title":"Internal and external stakeholders are notified of incidents","csf":[["RS.CO-02","c",""]],"topics":["Rp"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.CO-03","title":"Information is shared with designated internal and external stakeholders","csf":[["RS.CO-03","c",""]],"topics":["Co"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.MA-01","title":"The incident response plan is executed in coordination with relevant third parties once an incident is declared","csf":[["RS.MA-01","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.MA-02","title":"Incident reports are triaged and validated","csf":[["RS.MA-02","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.MA-03","title":"Incidents are categorized and prioritized","csf":[["RS.MA-03","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.MA-04","title":"Incidents are escalated or elevated as needed","csf":[["RS.MA-04","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.MA-05","title":"The criteria for initiating incident recovery are applied","csf":[["RS.MA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.MI-01","title":"Incidents are contained","csf":[["RS.MI-01","c",""]],"topics":["Mt"],"edTopics":[],"direct":[]},{"fw":"nist","id":"RS.MI-02","title":"Incidents are eradicated","csf":[["RS.MI-02","c",""]],"topics":["Mt"],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"AC-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the access control policy and the associated access controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the access control policy and procedures; and\nc. Review and update the current access control:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["PR.AA-01","c",""],["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.15","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AC-2","title":"Account Management","text":"a. Define and document the types of accounts allowed and specifically prohibited for use within the system;\nb. Assign account managers;\nc. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership;\nd. Specify:\n  1. Authorized users of the system;\n  2. Group and role membership; and\n  3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account;\ne. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts;\nf. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];\ng. Monitor the use of accounts;\nh. Notify account managers and [Assignment: organization-defined personnel or roles] within:\n  1. [Assignment: organization-defined time period] when accounts are no longer required;\n  2. [Assignment: organization-defined time period] when users are terminated or transferred; and\n  3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual;\ni. Authorize access to the system based on:\n  1. A valid access authorization;\n  2. Intended system usage; and\n  3. [Assignment: organization-defined attributes (as required)];\nj. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency];\nk. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and\nl. Align account management processes with personnel termination and transfer processes.","csf":[["DE.CM-01","c",""],["DE.CM-03","c",""],["PR.AA-01","c",""],["PR.AA-05","c",""],["PR.DS-10","c",""]],"topics":["Ac"],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.18","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.2","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.1","NIST SP 800-171r3 03.01.01 → SP 800-53"],["cmmc","SC.L2-3.13.3","NIST SP 800-171r3 03.01.01 → SP 800-53"],["cmmc","AC.L2-3.1.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AC-2(7)","title":"Account Management | Privileged User Accounts","text":"(a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme];\n(b) Monitor privileged role or attribute assignments;\n(c) Monitor changes to roles or attributes; and\n(d) Revoke access when privileged role or attribute assignments are no longer appropriate.","csf":[["PR.AA-05","e","topic: Privileged Access"]],"topics":["Pa"],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"AC-2(12)","title":"Account Management | Account Monitoring for Atypical Usage","text":"(a) Monitor system accounts for [Assignment: organization-defined atypical usage]; and\n(b) Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"]],"topics":["It"],"edTopics":[],"direct":[["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AC-3","title":"Access Enforcement","text":"Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.","csf":[["PR.AA-05","c",""],["PR.DS-10","c",""],["PR.IR-01","c",""]],"topics":["Ac","Zt"],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.15","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.33","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.18","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.26","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.2","NIST SP 800-171r3 03.01.02 → SP 800-53"],["cmmc","SC.L2-3.13.3","NIST SP 800-171r3 03.01.02 → SP 800-53"],["cmmc","AC.L2-3.1.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AC-4","title":"Information Flow Enforcement","text":"Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].","csf":[["DE.CM-09","c",""],["ID.AM-03","c",""],["PR.DS-10","c",""],["PR.IR-01","c",""]],"topics":["Fw","Zt","Dl"],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.22","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.23","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.11","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.3","NIST SP 800-171r3 03.01.03 → SP 800-53"],["cmmc","SC.L2-3.13.3","NIST SP 800-171r3 03.01.03 → SP 800-53"]]},{"fw":"nist80053","id":"AC-5","title":"Separation of Duties","text":"a. Identify and document [Assignment: organization-defined duties of individuals]; and\nb. Define system access authorizations to support separation of duties.","csf":[["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.3","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.4","NIST SP 800-171r3 03.01.04 → SP 800-53"],["cmmc","SC.L2-3.13.3","NIST SP 800-171r3 03.01.04 → SP 800-53"]]},{"fw":"nist80053","id":"AC-6","title":"Least Privilege","text":"Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.","csf":[["PR.AA-05","c",""]],"topics":["Zt"],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.15","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.18","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.5","NIST SP 800-171r3 03.01.05 → SP 800-53"],["cmmc","AC.L2-3.1.6","NIST SP 800-171r3 03.01.06 → SP 800-53"],["cmmc","AC.L2-3.1.7","NIST SP 800-171r3 03.01.07 → SP 800-53"],["cmmc","CM.L2-3.4.9","NIST SP 800-171r3 03.01.05 → SP 800-53"],["cmmc","SC.L2-3.13.3","NIST SP 800-171r3 03.01.05 → SP 800-53"]]},{"fw":"nist80053","id":"AC-6(5)","title":"Least Privilege | Privileged Accounts","text":"Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].","csf":[["PR.AA-05","e","topic: Privileged Access"]],"topics":["Pa"],"edTopics":[],"direct":[["cmmc","AC.L2-3.1.6","NIST SP 800-171r3 03.01.06 → SP 800-53"],["cmmc","CM.L2-3.4.9","NIST SP 800-171r3 03.01.06 → SP 800-53"],["cmmc","SC.L2-3.13.3","NIST SP 800-171r3 03.01.06 → SP 800-53"],["cmmc","AC.L2-3.1.5","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AC-7","title":"Unsuccessful Logon Attempts","text":"a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]; and\nb. Automatically [Selection (one or more): lock the account or node for [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm]; notify system administrator; take other [Assignment: organization-defined action] ] when the maximum number of unsuccessful attempts is exceeded.","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.5","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.8","NIST SP 800-171r3 03.01.08 → SP 800-53"]]},{"fw":"nist80053","id":"AC-8","title":"System Use Notification","text":"a. Display [Assignment: organization-defined system use notification] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:\n  1. Users are accessing a U.S. Government system;\n  2. System usage may be monitored, recorded, and subject to audit;\n  3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and\n  4. Use of the system indicates consent to monitoring and recording;\nb. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and\nc. For publicly accessible systems:\n  1. Display system use information [Assignment: organization-defined conditions], before granting further access to the publicly accessible system;\n  2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and\n  3. Include a description of the authorized uses of the system.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.5","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.9","NIST SP 800-171r3 03.01.09 → SP 800-53"]]},{"fw":"nist80053","id":"AC-9","title":"Previous Logon Notification","text":"Notify the user, upon successful logon to the system, of the date and time of the last logon.","csf":[["DE.CM-09","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AC-10","title":"Concurrent Session Control","text":"Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account types] to [Assignment: organization-defined number].","csf":[["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"AC-11","title":"Device Lock","text":"a. Prevent further access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended]; and\nb. Retain the device lock until the user reestablishes access using established identification and authentication procedures.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.7","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.1","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.10","NIST SP 800-171r3 03.01.10 → SP 800-53"]]},{"fw":"nist80053","id":"AC-12","title":"Session Termination","text":"Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events].","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["cmmc","AC.L2-3.1.11","NIST SP 800-171r3 03.01.11 → SP 800-53"]]},{"fw":"nist80053","id":"AC-14","title":"Permitted Actions Without Identification or Authentication","text":"a. Identify [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and\nb. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.","csf":[["PR.AA-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"AC-16","title":"Security and Privacy Attributes","text":"a. Provide the means to associate [Assignment: organization-defined organization-defined types of security and privacy attributes] with [Assignment: organization-defined organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission;\nb. Ensure that the attribute associations are made and retained with the information;\nc. Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [Assignment: organization-defined organization-defined systems]: [Assignment: organization-defined organization-defined security and privacy attributes];\nd. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges];\ne. Audit changes to attributes; and\nf. Review [Assignment: organization-defined organization-defined security and privacy attributes] for applicability [Assignment: organization-defined organization-defined frequency].","csf":[["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"AC-17","title":"Remote Access","text":"a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and\nb. Authorize each type of remote access to the system prior to allowing such connections.","csf":[["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.7","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.12","NIST SP 800-171r3 03.01.12 → SP 800-53"],["cmmc","AC.L2-3.1.14","NIST SP 800-171r3 03.01.12 → SP 800-53"],["cmmc","AC.L2-3.1.15","NIST SP 800-171r3 03.01.12 → SP 800-53"],["cmmc","SC.L2-3.13.7","NIST SP 800-171r3 03.01.12 → SP 800-53"],["cmmc","AC.L2-3.1.1","NIST SP 800-171r2 Appendix D"],["cmmc","AC.L2-3.1.2","NIST SP 800-171r2 Appendix D"],["cmmc","AC.L2-3.1.13","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AC-18","title":"Wireless Access","text":"a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and\nb. Authorize each type of wireless access to the system prior to allowing such connections.","csf":[["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.16","NIST SP 800-171r3 03.01.16 → SP 800-53"],["cmmc","AC.L2-3.1.17","NIST SP 800-171r3 03.01.16 → SP 800-53"]]},{"fw":"nist80053","id":"AC-19","title":"Access Control for Mobile Devices","text":"a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and\nb. Authorize the connection of mobile devices to organizational systems.","csf":[["PR.AA-05","c",""]],"topics":["Mb"],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.9","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.18","NIST SP 800-171r3 03.01.18 → SP 800-53"],["cmmc","AC.L2-3.1.19","NIST SP 800-171r3 03.01.18 → SP 800-53"]]},{"fw":"nist80053","id":"AC-19(5)","title":"Access Control for Mobile Devices | Full Device or Container-based Encryption","text":"Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].","csf":[["PR.AA-05","e","topic: Mobile Security"],["PR.PS-01","e","topic: Mobile Security"]],"topics":["Mb"],"edTopics":[],"direct":[["cmmc","AC.L2-3.1.18","NIST SP 800-171r3 03.01.18 → SP 800-53"],["cmmc","AC.L2-3.1.19","NIST SP 800-171r3 03.01.18 → SP 800-53"]]},{"fw":"nist80053","id":"AC-20","title":"Use of External Systems","text":"a. [Selection (one or more): establish [Assignment: organization-defined terms and conditions]; identify [Assignment: organization-defined controls asserted] ], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:\n  1. Access the system from external systems; and\n  2. Process, store, or transmit organization-controlled information using external systems; or\nb. Prohibit the use of [Assignment: organization-defined prohibited types of external systems].","csf":[["ID.AM-02","c",""],["ID.AM-04","c",""]],"topics":["Cl"],"edTopics":[],"direct":[["iso","A.8.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.9","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.20","NIST SP 800-171r3 03.01.20 → SP 800-53"],["cmmc","AC.L2-3.1.21","NIST SP 800-171r3 03.01.20 → SP 800-53"]]},{"fw":"nist80053","id":"AC-22","title":"Publicly Accessible Content","text":"a. Designate individuals authorized to make information publicly accessible;\nb. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;\nc. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and\nd. Review the content on the publicly accessible system for nonpublic information [Assignment: organization-defined frequency] and remove such information, if discovered.","csf":[],"topics":[],"edTopics":[],"direct":[["cmmc","AC.L2-3.1.22","NIST SP 800-171r3 03.01.22 → SP 800-53"]]},{"fw":"nist80053","id":"AC-24","title":"Access Control Decisions","text":"[Selection (one or more): establish procedures; implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.","csf":[["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AT-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and\nc. Review and update the current awareness and training:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AT-2","title":"Literacy Training and Awareness","text":"a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):\n  1. As part of initial training for new users and [Assignment: organization-defined organization-defined frequency] thereafter; and\n  2. When required by system changes or following [Assignment: organization-defined organization-defined events];\nb. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques];\nc. Update literacy training and awareness content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\nd. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.","csf":[["PR.AT-01","c",""]],"topics":["Aw"],"edTopics":[],"direct":[["hipaa","§164.308(a)(5)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 7.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.7","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AT.L2-3.2.1","NIST SP 800-171r3 03.02.01 → SP 800-53"],["cmmc","AT.L2-3.2.3","NIST SP 800-171r3 03.02.01 → SP 800-53"],["cmmc","AT.L2-3.2.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AT-3","title":"Role-based Training","text":"a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined organization-defined roles and responsibilities]:\n  1. Before authorizing access to the system, information, or performing assigned duties, and [Assignment: organization-defined frequency] thereafter; and\n  2. When required by system changes;\nb. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\nc. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.","csf":[["PR.AT-01","c",""],["PR.AT-02","c",""]],"topics":["Aw"],"edTopics":[],"direct":[["hipaa","§164.308(a)(5)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(5)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.6.3","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AT.L2-3.2.2","NIST SP 800-171r3 03.02.02 → SP 800-53"],["cmmc","AT.L2-3.2.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AT-4","title":"Training Records","text":"a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and\nb. Retain individual training records for [Assignment: organization-defined time period].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(5)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"AU-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] audit and accountability policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and\nc. Review and update the current audit and accountability:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AU-2","title":"Event Logging","text":"a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types];\nb. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;\nc. Specify the following event types for logging within the system: [Assignment: organization-defined organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type];\nd. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and\ne. Review and update the event types selected for logging [Assignment: organization-defined frequency].","csf":[["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[["hipaa","§164.312(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.15","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AU.L2-3.3.1","NIST SP 800-171r3 03.03.01 → SP 800-53"],["cmmc","AU.L2-3.3.2","NIST SP 800-171r2 Appendix D"],["cmmc","AU.L2-3.3.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AU-3","title":"Content of Audit Records","text":"Ensure that audit records contain information that establishes the following:\n  a. What type of event occurred;\n  b. When the event occurred;\n  c. Where the event occurred;\n  d. Source of the event;\n  e. Outcome of the event; and\n  f. Identity of any individuals, subjects, or objects/entities associated with the event.","csf":[["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[["hipaa","§164.312(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.15","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.28","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AU.L2-3.3.2","NIST SP 800-171r3 03.03.02 → SP 800-53"],["cmmc","AU.L2-3.3.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AU-4","title":"Audit Log Storage Capacity","text":"Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.312(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AU-5","title":"Response to Audit Logging Process Failures","text":"a. Alert [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] in the event of an audit logging process failure; and\nb. Take the following additional actions: [Assignment: organization-defined additional actions].","csf":[],"topics":[],"edTopics":[],"direct":[["cmmc","AU.L2-3.3.4","NIST SP 800-171r3 03.03.04 → SP 800-53"]]},{"fw":"nist80053","id":"AU-6","title":"Audit Record Review, Analysis, and Reporting","text":"a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;\nb. Report findings to [Assignment: organization-defined personnel or roles]; and\nc. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["PR.PS-04","c",""]],"topics":["An","Sg"],"edTopics":[],"direct":[["hipaa","§164.308(a)(5)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.15","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.25","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.4","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AU.L2-3.3.5","NIST SP 800-171r3 03.03.05 → SP 800-53"],["cmmc","AU.L2-3.3.1","NIST SP 800-171r2 Appendix D"],["cmmc","AU.L2-3.3.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AU-6(3)","title":"Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories","text":"Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.","csf":[["DE.AE-03","e","topic: SIEM / SOC"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"]],"topics":["Sg"],"edTopics":[],"direct":[["cmmc","AU.L2-3.3.5","NIST SP 800-171r3 03.03.05 → SP 800-53"]]},{"fw":"nist80053","id":"AU-7","title":"Audit Record Reduction and Report Generation","text":"Provide and implement an audit record reduction and report generation capability that:\n  a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and\n  b. Does not alter the original content or time ordering of audit records.","csf":[["PR.PS-04","c",""],["RS.AN-03","c",""],["RS.AN-06","c",""],["RS.AN-07","c",""]],"topics":["Fn"],"edTopics":[],"direct":[["hipaa","§164.312(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["cmmc","AU.L2-3.3.6","NIST SP 800-171r3 03.03.06 → SP 800-53"]]},{"fw":"nist80053","id":"AU-8","title":"Time Stamps","text":"a. Use internal system clocks to generate time stamps for audit records; and\nb. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.312(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.17","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AU.L2-3.3.7","NIST SP 800-171r3 03.03.07 → SP 800-53"]]},{"fw":"nist80053","id":"AU-9","title":"Protection of Audit Information","text":"a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and\nb. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.","csf":[["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.5.33","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.15","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.5","NIST SP 800-171r3 03.01.05 → SP 800-53"],["cmmc","AU.L2-3.3.8","NIST SP 800-171r3 03.03.08 → SP 800-53"],["cmmc","AU.L2-3.3.9","NIST SP 800-171r3 03.03.08 → SP 800-53"],["cmmc","CM.L2-3.4.9","NIST SP 800-171r3 03.01.05 → SP 800-53"],["cmmc","SC.L2-3.13.3","NIST SP 800-171r3 03.01.05 → SP 800-53"]]},{"fw":"nist80053","id":"AU-10","title":"Non-repudiation","text":"Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions].","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.28","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AU-11","title":"Audit Record Retention","text":"Retain audit records for [Assignment: organization-defined time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.","csf":[["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[["iso","A.8.15","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.28","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AU.L2-3.3.3","NIST SP 800-171r3 03.03.03 → SP 800-53"],["cmmc","AU.L2-3.3.1","NIST SP 800-171r2 Appendix D"],["cmmc","AU.L2-3.3.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AU-12","title":"Audit Record Generation","text":"a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: organization-defined system components];\nb. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and\nc. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).","csf":[["DE.CM-01","c",""],["DE.CM-03","c",""],["DE.CM-09","c",""],["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[["iso","A.8.15","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AU.L2-3.3.3","NIST SP 800-171r3 03.03.03 → SP 800-53"],["cmmc","AU.L2-3.3.1","NIST SP 800-171r2 Appendix D"],["cmmc","AU.L2-3.3.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"AU-13","title":"Monitoring for Information Disclosure","text":"a. Monitor [Assignment: organization-defined open-source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information; and\nb. If an information disclosure is discovered:\n  1. Notify [Assignment: organization-defined personnel or roles]; and\n  2. Take the following additional actions: [Assignment: organization-defined additional actions].","csf":[["DE.CM-03","c",""],["PR.DS-10","c",""]],"topics":["It"],"edTopics":[],"direct":[["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.12","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AU-14","title":"Session Audit","text":"a. Provide and implement the capability for [Assignment: organization-defined users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances]; and\nb. Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.15","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"AU-16","title":"Cross-organizational Audit Logging","text":"Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries.","csf":[["PR.DS-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"CA-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and\nc. Review and update the current assessment, authorization, and monitoring:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(8)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.2.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CA-2","title":"Control Assessments","text":"a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;\nb. Develop a control assessment plan that describes the scope of the assessment including:\n  1. Controls and control enhancements under assessment;\n  2. Assessment procedures to be used to determine control effectiveness; and\n  3. Assessment environment, assessment team, and assessment roles and responsibilities;\nc. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;\nd. Assess the controls in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;\ne. Produce a control assessment report that document the results of the assessment; and\nf. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""]],"topics":["Cm"],"edTopics":["Cm"],"direct":[["hipaa","§164.308(a)(8)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.2.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.2.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.35","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CA.L2-3.12.1","NIST SP 800-171r3 03.12.01 → SP 800-53"],["cmmc","CA.L2-3.12.2","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.3","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.4","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CA-3","title":"Information Exchange","text":"a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: organization-defined type of agreement] ];\nb. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and\nc. Review and update the agreements [Assignment: organization-defined frequency].","csf":[["ID.AM-03","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(4)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(b)(1)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(b)(4)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.21","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CA-5","title":"Plan of Action and Milestones","text":"a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and\nb. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["iso","Clause 8.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.2","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CA.L2-3.12.2","NIST SP 800-171r3 03.12.02 → SP 800-53"],["cmmc","CA.L2-3.12.1","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.3","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.4","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CA-6","title":"Authorization","text":"a. Assign a senior official as the authorizing official for the system;\nb. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;\nc. Ensure that the authorizing official for the system, before commencing operations:\n  1. Accepts the use of common controls inherited by the system; and\n  2. Authorizes the system to operate;\nd. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;\ne. Update the authorizations [Assignment: organization-defined frequency].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(8)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(2)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 9.3.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CA-7","title":"Continuous Monitoring","text":"Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:\n  a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];\n  b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness;\n  c. Ongoing control assessments in accordance with the continuous monitoring strategy;\n  d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;\n  e. Correlation and analysis of information generated by control assessments and monitoring;\n  f. Response actions to address results of the analysis of control assessment and monitoring information; and\n  g. Reporting the security and privacy status of the system to [Assignment: organization-defined organization-defined personnel or roles] [Assignment: organization-defined organization-defined frequency].","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["DE.CM-01","c",""],["DE.CM-02","c",""],["DE.CM-03","c",""],["DE.CM-06","c",""],["DE.CM-09","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""],["ID.RA-07","c",""]],"topics":["Sm"],"edTopics":[],"direct":[["hipaa","§164.308(a)(1)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(8)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.2.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.2","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.9","NIST SP 800-171r3 03.12.03 → SP 800-53"],["cmmc","CA.L2-3.12.3","NIST SP 800-171r3 03.12.03 → SP 800-53"],["cmmc","CA.L2-3.12.1","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.2","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.4","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CA-8","title":"Penetration Testing","text":"Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined system(s) or system components].","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""]],"topics":["Vn"],"edTopics":[],"direct":[["hipaa","§164.308(a)(8)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"CA-9","title":"Internal System Connections","text":"a. Authorize internal connections of [Assignment: organization-defined system components] to the system;\nb. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;\nc. Terminate internal system connections after [Assignment: organization-defined conditions]; and\nd. Review [Assignment: organization-defined frequency] the continued need for each internal connection.","csf":[["ID.AM-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"CM-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] configuration management policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the configuration management policy and procedures; and\nc. Review and update the current configuration management:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["PR.PS-01","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CM-2","title":"Baseline Configuration","text":"a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and\nb. Review and update the baseline configuration of the system:\n  1. [Assignment: organization-defined frequency];\n  2. When required due to [Assignment: organization-defined circumstances]; and\n  3. When system components are installed or upgraded.","csf":[["PR.PS-01","c",""]],"topics":["Cf"],"edTopics":[],"direct":[["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.1","NIST SP 800-171r3 03.04.01 → SP 800-53"],["cmmc","CM.L2-3.4.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CM-3","title":"Configuration Change Control","text":"a. Determine and document the types of changes to the system that are configuration-controlled;\nb. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;\nc. Document configuration change decisions associated with the system;\nd. Implement approved configuration-controlled changes to the system;\ne. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period];\nf. Monitor and review activities associated with configuration-controlled changes to the system; and\ng. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; when [Assignment: organization-defined configuration change conditions] ].","csf":[["DE.CM-01","c",""],["DE.CM-09","c",""],["ID.RA-07","c",""],["PR.PS-01","c",""]],"topics":[],"edTopics":[],"direct":[["iso","Clause 9.3.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 8.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.32","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.3","NIST SP 800-171r3 03.04.03 → SP 800-53"]]},{"fw":"nist80053","id":"CM-4","title":"Impact Analyses","text":"Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.","csf":[["ID.RA-07","c",""],["PR.PS-01","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.31","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.4","NIST SP 800-171r3 03.04.04 → SP 800-53"]]},{"fw":"nist80053","id":"CM-5","title":"Access Restrictions for Change","text":"Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.","csf":[["PR.PS-01","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.32","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.19","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.5","NIST SP 800-171r3 03.04.05 → SP 800-53"]]},{"fw":"nist80053","id":"CM-6","title":"Configuration Settings","text":"a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations];\nb. Implement the configuration settings;\nc. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements]; and\nd. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.","csf":[["DE.CM-09","c",""],["PR.PS-01","c",""]],"topics":["Cf"],"edTopics":[],"direct":[["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.2","NIST SP 800-171r3 03.04.02 → SP 800-53"],["cmmc","SC.L2-3.13.7","NIST SP 800-171r3 03.04.02 → SP 800-53"],["cmmc","CM.L2-3.4.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CM-7","title":"Least Functionality","text":"a. Configure the system to provide only [Assignment: organization-defined mission-essential capabilities]; and\nb. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].","csf":[["PR.PS-01","c",""],["PR.PS-03","c","CM-7(9)"],["PR.PS-05","c","CM-7(2)"]],"topics":["Cf"],"edTopics":[],"direct":[["iso","A.8.19","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.6","NIST SP 800-171r3 03.04.06 → SP 800-53"],["cmmc","CM.L2-3.4.7","NIST SP 800-171r3 03.04.06 → SP 800-53"],["cmmc","SC.L2-3.13.7","NIST SP 800-171r3 03.04.06 → SP 800-53"],["cmmc","CM.L2-3.4.8","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CM-7(5)","title":"Least Functionality | Authorized Software — Allow-by-exception","text":"(a) Identify [Assignment: organization-defined software programs];\n(b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and\n(c) Review and update the list of authorized software programs [Assignment: organization-defined frequency].","csf":[["PR.PS-05","c",""]],"topics":["Ep"],"edTopics":[],"direct":[["iso","A.8.19","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.7","NIST SP 800-171r3 03.04.08 → SP 800-53"],["cmmc","CM.L2-3.4.8","NIST SP 800-171r3 03.04.08 → SP 800-53"],["cmmc","CM.L2-3.4.9","NIST SP 800-171r3 03.04.08 → SP 800-53"],["cmmc","CM.L2-3.4.5","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CM-8","title":"System Component Inventory","text":"a. Develop and document an inventory of system components that:\n  1. Accurately reflects the system;\n  2. Includes all components within the system;\n  3. Does not include duplicate accounting of components or components assigned to any other system;\n  4. Is at the level of granularity deemed necessary for tracking and reporting; and\n  5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information]; and\nb. Review and update the system component inventory [Assignment: organization-defined frequency].","csf":[["ID.AM-01","c",""],["ID.AM-02","c",""],["PR.PS-01","c",""]],"topics":["Am"],"edTopics":[],"direct":[["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.9","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.1","NIST SP 800-171r2 Appendix D"],["cmmc","CM.L2-3.4.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CM-9","title":"Configuration Management Plan","text":"Develop, document, and implement a configuration management plan for the system that:\n  a. Addresses roles, responsibilities, and configuration management processes and procedures;\n  b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;\n  c. Defines the configuration items for the system and places the configuration items under configuration management;\n  d. Is reviewed and approved by [Assignment: organization-defined personnel or roles]; and\n  e. Protects the configuration management plan from unauthorized disclosure and modification.","csf":[["ID.AM-08","c",""],["PR.PS-01","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CM-10","title":"Software Usage Restrictions","text":"a. Use software and associated documentation in accordance with contract agreements and copyright laws;\nb. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and\nc. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.","csf":[["DE.CM-03","c",""],["DE.CM-09","c",""],["PR.PS-01","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.5.32","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CM-11","title":"User-installed Software","text":"a. Establish [Assignment: organization-defined policies] governing the installation of software by users;\nb. Enforce software installation policies through the following methods: [Assignment: organization-defined methods]; and\nc. Monitor policy compliance [Assignment: organization-defined frequency].","csf":[["DE.CM-03","c",""],["DE.CM-09","c",""],["PR.PS-01","c",""],["PR.PS-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.19","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CM.L2-3.4.9","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"CM-12","title":"Information Location","text":"a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored;\nb. Identify and document the users who have access to the system and system components where the information is processed and stored; and\nc. Document changes to the location (i.e., system or system components) where the information is processed and stored.","csf":[["ID.AM-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"CM-13","title":"Data Action Mapping","text":"Develop and document a map of system data actions.","csf":[["ID.AM-07","c",""],["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"CP-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and\nc. Review and update the current contingency planning:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["GV.SC-08","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-2","title":"Contingency Plan","text":"a. Develop a contingency plan for the system that:\n  1. Identifies essential mission and business functions and associated contingency requirements;\n  2. Provides recovery objectives, restoration priorities, and metrics;\n  3. Addresses contingency roles, responsibilities, assigned individuals with contact information;\n  4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;\n  5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;\n  6. Addresses the sharing of contingency information; and\n  7. Is reviewed and approved by [Assignment: organization-defined organization-defined personnel or roles];\nb. Distribute copies of the contingency plan to [Assignment: organization-defined organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];\nc. Coordinate contingency planning activities with incident handling activities;\nd. Review the contingency plan for the system [Assignment: organization-defined frequency];\ne. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;\nf. Communicate contingency plan changes to [Assignment: organization-defined organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];\ng. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and\nh. Protect the contingency plan from unauthorized disclosure and modification.","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.IM-04","c",""],["PR.IR-02","c",""],["RC.CO-04","c",""],["RC.RP-03","c",""]],"topics":["Rc"],"edTopics":[],"direct":[["hipaa","§164.312(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)(ii)(E)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.6","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.14","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-2(8)","title":"Contingency Plan | Identify Critical Assets","text":"Identify critical system assets supporting [Selection: all; essential] mission and business functions.","csf":[["GV.OC-04","c",""]],"topics":["Bc"],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(E)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.30","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-3","title":"Contingency Training","text":"a. Provide contingency training to system users consistent with assigned roles and responsibilities:\n  1. Within [Assignment: organization-defined time period] of assuming a contingency role or responsibility;\n  2. When required by system changes; and\n  3. [Assignment: organization-defined frequency] thereafter; and\nb. Review and update contingency training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.6.3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-4","title":"Contingency Plan Testing","text":"a. Test the contingency plan for the system [Assignment: organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignment: organization-defined organization-defined tests].\nb. Review the contingency plan test results; and\nc. Initiate corrective actions, if needed.","csf":[["ID.IM-02","c",""],["RC.RP-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-6","title":"Alternate Storage Site","text":"a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and\nb. Ensure that the alternate storage site provides controls equivalent to that of the primary site.","csf":[["PR.DS-11","c",""],["PR.IR-04","c",""]],"topics":["Bk"],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-7","title":"Alternate Processing Site","text":"a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary processing capabilities are unavailable;\nb. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and\nc. Provide controls at the alternate processing site that are equivalent to those at the primary site.","csf":[["GV.OC-04","e","topic: Business Continuity"],["PR.IR-03","e","topic: Business Continuity"],["PR.IR-04","c",""],["RC.RP-02","e","topic: Disaster Recovery"],["RC.RP-04","e","topic: Business Continuity"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Bc","Dr"],"edTopics":["Bc","Dr"],"direct":[["hipaa","§164.308(a)(7)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-8","title":"Telecommunications Services","text":"Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","csf":[["PR.IR-04","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-9","title":"System Backup","text":"a. Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency];\nb. Conduct backups of system-level information contained in the system [Assignment: organization-defined frequency];\nc. Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency]; and\nd. Protect the confidentiality, integrity, and availability of backup information.","csf":[["PR.DS-01","c",""],["PR.DS-10","c",""],["PR.DS-11","c",""],["RC.RP-03","c",""]],"topics":["Bk"],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(iv)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(c)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.33","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.13","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MP.L2-3.8.9","NIST SP 800-171r3 03.08.09 → SP 800-53"]]},{"fw":"nist80053","id":"CP-10","title":"System Recovery and Reconstitution","text":"Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.","csf":[["RC.RP-01","c",""],["RC.RP-02","c",""],["RC.RP-05","c",""]],"topics":["Rc","Cr","Dr"],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(7)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-11","title":"Alternate Communications Protocols","text":"Provide the capability to employ [Assignment: organization-defined alternative communications protocols] in support of maintaining continuity of operations.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"CP-13","title":"Alternative Security Mechanisms","text":"Employ [Assignment: organization-defined alternative or supplemental security mechanisms] for satisfying [Assignment: organization-defined security functions] when the primary means of implementing the security function is unavailable or compromised.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.29","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"IA-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; and\nc. Review and update the current identification and authentication:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["PR.AA-01","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"IA-2","title":"Identification and Authentication (Organizational Users)","text":"Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":["Zt"],"edTopics":[],"direct":[["hipaa","§164.312(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(d)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.16","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","IA.L2-3.5.1","NIST SP 800-171r3 03.05.01 → SP 800-53"],["cmmc","IA.L2-3.5.4","NIST SP 800-171r3 03.05.04 → SP 800-53"],["cmmc","IA.L2-3.5.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IA-2(1)","title":"Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts","text":"Implement multi-factor authentication for access to privileged accounts.","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":[],"direct":[["cmmc","IA.L2-3.5.3","NIST SP 800-171r3 03.05.03 → SP 800-53"]]},{"fw":"nist80053","id":"IA-2(2)","title":"Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged Accounts","text":"Implement multi-factor authentication for access to non-privileged accounts.","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":[],"direct":[["cmmc","IA.L2-3.5.3","NIST SP 800-171r3 03.05.03 → SP 800-53"]]},{"fw":"nist80053","id":"IA-3","title":"Device Identification and Authentication","text":"Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection.","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.312(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(d)","NIST HIPAA → SP 800-53 crosswalk"],["cmmc","IA.L2-3.5.2","NIST SP 800-171r3 03.05.02 → SP 800-53"],["cmmc","IA.L2-3.5.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IA-4","title":"Identifier Management","text":"Manage system identifiers by:\n  a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier;\n  b. Selecting an identifier that identifies an individual, group, role, service, or device;\n  c. Assigning the identifier to the intended individual, group, role, service, or device; and\n  d. Preventing reuse of identifiers for [Assignment: organization-defined time period].","csf":[["PR.AA-01","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.312(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(d)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.16","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","IA.L2-3.5.5","NIST SP 800-171r3 03.05.05 → SP 800-53"],["cmmc","IA.L2-3.5.6","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IA-5","title":"Authenticator Management","text":"Manage system authenticators by:\n  a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;\n  b. Establishing initial authenticator content for any authenticators issued by the organization;\n  c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;\n  d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;\n  e. Changing default authenticators prior to first use;\n  f. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;\n  g. Protecting authenticator content from unauthorized disclosure and modification;\n  h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and\n  i. Changing authenticators for group or role accounts when membership to those accounts changes.","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.5.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.17","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","IA.L2-3.5.7","NIST SP 800-171r3 03.05.07 → SP 800-53"],["cmmc","IA.L2-3.5.10","NIST SP 800-171r3 03.05.07 → SP 800-53"],["cmmc","IA.L2-3.5.1","NIST SP 800-171r2 Appendix D"],["cmmc","IA.L2-3.5.2","NIST SP 800-171r2 Appendix D"],["cmmc","IA.L2-3.5.8","NIST SP 800-171r2 Appendix D"],["cmmc","IA.L2-3.5.9","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IA-6","title":"Authentication Feedback","text":"Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.","csf":[["PR.AA-01","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.5","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","IA.L2-3.5.11","NIST SP 800-171r3 03.05.11 → SP 800-53"]]},{"fw":"nist80053","id":"IA-7","title":"Cryptographic Module Authentication","text":"Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"IA-8","title":"Identification and Authentication (Non-organizational Users)","text":"Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.312(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(d)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.16","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"IA-9","title":"Service Identification and Authentication","text":"Uniquely identify and authenticate [Assignment: organization-defined system services and applications] before establishing communications with devices, users, or other services or applications.","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":["Ap"],"edTopics":[],"direct":[["hipaa","§164.312(d)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"IA-10","title":"Adaptive Authentication","text":"Require individuals accessing the system to employ [Assignment: organization-defined supplemental authentication techniques or mechanisms] under specific [Assignment: organization-defined circumstances or situations].","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"IA-11","title":"Re-authentication","text":"Require users to re-authenticate when [Assignment: organization-defined circumstances or situations].","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[["cmmc","IA.L2-3.5.1","NIST SP 800-171r3 03.05.01 → SP 800-53"]]},{"fw":"nist80053","id":"IA-12","title":"Identity Proofing","text":"a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;\nb. Resolve user identities to a unique individual; and\nc. Collect, validate, and verify identity evidence.","csf":[["PR.AA-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"IA-13","title":"Identity Providers and Authorization Servers","text":"Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignment: organization-defined policy] using [Assignment: organization-defined mechanisms].","csf":[["PR.AA-04","c",""],["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"IR-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the incident response policy and procedures; and\nc. Review and update the current incident response:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["GV.SC-08","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["RC.RP-04","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(6)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"IR-2","title":"Incident Response Training","text":"a. Provide incident response training to system users consistent with assigned roles and responsibilities:\n  1. Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access;\n  2. When required by system changes; and\n  3. [Assignment: organization-defined frequency] thereafter; and\nb. Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[["hipaa","§164.308(a)(6)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.6.3","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","IR.L2-3.6.1","NIST SP 800-171r2 Appendix D"],["cmmc","IR.L2-3.6.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IR-3","title":"Incident Response Testing","text":"Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests].","csf":[["ID.IM-02","c",""],["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[["hipaa","§164.308(a)(6)","NIST HIPAA → SP 800-53 crosswalk"],["cmmc","IR.L2-3.6.3","NIST SP 800-171r3 03.06.03 → SP 800-53"]]},{"fw":"nist80053","id":"IR-4","title":"Incident Handling","text":"a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;\nb. Coordinate incident handling activities with contingency planning activities;\nc. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and\nd. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["DE.AE-06","c",""],["DE.AE-08","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["RC.CO-03","c",""],["RC.CO-04","c",""],["RC.RP-01","c",""],["RC.RP-02","c",""],["RC.RP-06","c",""],["RS.AN-03","c",""],["RS.AN-06","c",""],["RS.AN-07","c",""],["RS.AN-08","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-02","c",""],["RS.MA-03","c",""],["RS.MA-04","c",""],["RS.MA-05","c",""],["RS.MI-01","c",""],["RS.MI-02","c",""]],"topics":["Ir","Mt","Ll"],"edTopics":[],"direct":[["hipaa","§164.308(a)(6)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(6)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.25","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.26","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.27","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","IR.L2-3.6.1","NIST SP 800-171r3 03.06.01 → SP 800-53"],["cmmc","IR.L2-3.6.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IR-5","title":"Incident Monitoring","text":"Track and document incidents.","csf":[["DE.AE-03","c",""],["RS.MA-02","c",""],["RS.MA-03","c",""],["RS.MA-04","c",""]],"topics":["Sg"],"edTopics":[],"direct":[["hipaa","§164.308(a)(1)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(6)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["cmmc","IR.L2-3.6.2","NIST SP 800-171r3 03.06.02 → SP 800-53"],["cmmc","IR.L2-3.6.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IR-6","title":"Incident Reporting","text":"a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and\nb. Report incident information to [Assignment: organization-defined authorities].","csf":[["RC.CO-03","c",""],["RS.AN-06","c",""],["RS.AN-07","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""],["RS.MA-02","c",""],["RS.MA-03","c",""],["RS.MA-04","c",""]],"topics":["Rp","Cr"],"edTopics":[],"direct":[["hipaa","§164.308(a)(1)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(6)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(b)(2)(iv)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.6.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.5","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","IR.L2-3.6.2","NIST SP 800-171r3 03.06.02 → SP 800-53"],["cmmc","IR.L2-3.6.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IR-7","title":"Incident Response Assistance","text":"Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.","csf":[["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""],["RS.MA-04","c",""]],"topics":["Co"],"edTopics":[],"direct":[["hipaa","§164.308(a)(6)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["cmmc","IR.L2-3.6.2","NIST SP 800-171r3 03.06.02 → SP 800-53"],["cmmc","IR.L2-3.6.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"IR-8","title":"Incident Response Plan","text":"a. Develop an incident response plan that:\n  1. Provides the organization with a roadmap for implementing its incident response capability;\n  2. Describes the structure and organization of the incident response capability;\n  3. Provides a high-level approach for how the incident response capability fits into the overall organization;\n  4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;\n  5. Defines reportable incidents;\n  6. Provides metrics for measuring the incident response capability within the organization;\n  7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;\n  8. Addresses the sharing of incident information;\n  9. Is reviewed and approved by [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]; and\n  10. Explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles].\nb. Distribute copies of the incident response plan to [Assignment: organization-defined incident response personnel];\nc. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;\nd. Communicate incident response plan changes to [Assignment: organization-defined organization-defined incident response personnel (identified by name and/or by role) and organizational elements]; and\ne. Protect the incident response plan from unauthorized disclosure and modification.","csf":[["DE.AE-03","c",""],["DE.AE-08","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.IM-04","c",""],["RC.RP-01","c",""],["RC.RP-02","c",""],["RC.RP-04","c",""],["RC.RP-06","c",""],["RS.AN-08","c",""],["RS.MA-01","c",""],["RS.MA-05","c",""]],"topics":["Ir"],"edTopics":[],"direct":[["hipaa","§164.308(a)(6)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.24","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"IR-9","title":"Information Spillage Response","text":"Respond to information spills by:\n  a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills;\n  b. Identifying the specific information involved in the system contamination;\n  c. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;\n  d. Isolating the contaminated system or system component;\n  e. Eradicating the information from the contaminated system or component;\n  f. Identifying other systems or system components that may have been subsequently contaminated; and\n  g. Performing the following additional actions: [Assignment: organization-defined actions].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(6)(ii)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"MA-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and\nc. Review and update the current maintenance:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(iv)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"MA-2","title":"Controlled Maintenance","text":"a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;\nb. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;\nc. Require that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;\nd. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information];\ne. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and\nf. Include the following information in organizational maintenance records: [Assignment: organization-defined information].","csf":[["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(a)(2)(iv)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.13","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MA.L2-3.7.1","NIST SP 800-171r2 Appendix D"],["cmmc","MA.L2-3.7.2","NIST SP 800-171r2 Appendix D"],["cmmc","MA.L2-3.7.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"MA-3","title":"Maintenance Tools","text":"a. Approve, control, and monitor the use of system maintenance tools; and\nb. Review previously approved system maintenance tools [Assignment: organization-defined frequency].","csf":[["PR.PS-02","c","MA-3(6)"]],"topics":[],"edTopics":[],"direct":[["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MA.L2-3.7.2","NIST SP 800-171r3 03.07.04 → SP 800-53"],["cmmc","MA.L2-3.7.4","NIST SP 800-171r3 03.07.04 → SP 800-53"],["cmmc","MA.L2-3.7.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"MA-4","title":"Nonlocal Maintenance","text":"a. Approve and monitor nonlocal maintenance and diagnostic activities;\nb. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;\nc. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;\nd. Maintain records for nonlocal maintenance and diagnostic activities; and\ne. Terminate session and network connections when nonlocal maintenance is completed.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MA.L2-3.7.5","NIST SP 800-171r3 03.07.05 → SP 800-53"]]},{"fw":"nist80053","id":"MA-5","title":"Maintenance Personnel","text":"a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;\nb. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and\nc. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["cmmc","MA.L2-3.7.2","NIST SP 800-171r3 03.07.06 → SP 800-53"],["cmmc","MA.L2-3.7.6","NIST SP 800-171r3 03.07.06 → SP 800-53"]]},{"fw":"nist80053","id":"MA-6","title":"Timely Maintenance","text":"Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure.","csf":[["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(a)(2)(iv)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.13","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"MP-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the media protection policy and procedures; and\nc. Review and update the current media protection:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"MP-2","title":"Media Access","text":"Restrict access to [Assignment: organization-defined organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined organization-defined personnel or roles].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(c)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.7","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MP.L2-3.8.2","NIST SP 800-171r3 03.08.02 → SP 800-53"],["cmmc","MP.L2-3.8.1","NIST SP 800-171r2 Appendix D"],["cmmc","MP.L2-3.8.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"MP-3","title":"Media Marking","text":"a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and\nb. Exempt [Assignment: organization-defined types of media exempted from marking] from marking if the media remain within [Assignment: organization-defined controlled areas].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.13","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MP.L2-3.8.4","NIST SP 800-171r3 03.08.04 → SP 800-53"]]},{"fw":"nist80053","id":"MP-4","title":"Media Storage","text":"a. Physically control and securely store [Assignment: organization-defined organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined organization-defined controlled areas]; and\nb. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(iv)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.7","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MP.L2-3.8.1","NIST SP 800-171r3 03.08.01 → SP 800-53"],["cmmc","MP.L2-3.8.2","NIST SP 800-171r2 Appendix D"],["cmmc","MP.L2-3.8.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"MP-5","title":"Media Transport","text":"a. Protect and control [Assignment: organization-defined types of system media] during transport outside of controlled areas using [Assignment: organization-defined organization-defined controls];\nb. Maintain accountability for system media during transport outside of controlled areas;\nc. Document activities associated with the transport of system media; and\nd. Restrict the activities associated with the transport of system media to authorized personnel.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(c)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.9","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MP.L2-3.8.5","NIST SP 800-171r3 03.08.05 → SP 800-53"]]},{"fw":"nist80053","id":"MP-6","title":"Media Sanitization","text":"a. Sanitize [Assignment: organization-defined organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined organization-defined sanitization techniques and procedures]; and\nb. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.14","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MA.L2-3.7.3","NIST SP 800-171r3 03.08.03 → SP 800-53"],["cmmc","MP.L2-3.8.3","NIST SP 800-171r3 03.08.03 → SP 800-53"],["cmmc","MP.L2-3.8.1","NIST SP 800-171r2 Appendix D"],["cmmc","MP.L2-3.8.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"MP-7","title":"Media Use","text":"a. [Selection: restrict; prohibit] the use of [Assignment: organization-defined types of system media] on [Assignment: organization-defined systems or system components] using [Assignment: organization-defined controls]; and\nb. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.7.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","MP.L2-3.8.7","NIST SP 800-171r3 03.08.07 → SP 800-53"],["cmmc","MP.L2-3.8.8","NIST SP 800-171r3 03.08.07 → SP 800-53"]]},{"fw":"nist80053","id":"MP-8","title":"Media Downgrading","text":"a. Establish [Assignment: organization-defined system media downgrading process] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;\nb. Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;\nc. Identify [Assignment: organization-defined system media requiring downgrading]; and\nd. Downgrade the identified system media using the established process.","csf":[["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PE-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and\nc. Review and update the current physical and environmental protection:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-2","title":"Physical Access Authorizations","text":"a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;\nb. Issue authorization credentials for facility access;\nc. Review the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and\nd. Remove individuals from the facility access list when access is no longer required.","csf":[["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["hipaa","§164.310(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.2","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PE.L2-3.10.1","NIST SP 800-171r3 03.10.01 → SP 800-53"],["cmmc","PE.L2-3.10.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PE-3","title":"Physical Access Control","text":"a. Enforce physical access authorizations at [Assignment: organization-defined entry and exit points] by:\n  1. Verifying individual access authorizations before granting access to the facility; and\n  2. Controlling ingress and egress to the facility using [Selection (one or more): [Assignment: organization-defined systems or devices]; guards];\nb. Maintain physical access audit logs for [Assignment: organization-defined entry or exit points];\nc. Control access to areas within the facility designated as publicly accessible by implementing the following controls: [Assignment: organization-defined physical access controls];\nd. Escort visitors and control visitor activity [Assignment: organization-defined circumstances];\ne. Secure keys, combinations, and other physical access devices;\nf. Inventory [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and\ng. Change combinations and keys [Assignment: organization-defined organization-defined frequency] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.","csf":[["DE.CM-02","c",""],["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.12","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.3","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PE.L2-3.10.3","NIST SP 800-171r3 03.10.07 → SP 800-53"],["cmmc","PE.L2-3.10.4","NIST SP 800-171r3 03.10.07 → SP 800-53"],["cmmc","PE.L2-3.10.5","NIST SP 800-171r3 03.10.07 → SP 800-53"]]},{"fw":"nist80053","id":"PE-4","title":"Access Control for Transmission","text":"Control physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security controls].","csf":[["PR.AA-06","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.12","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PE.L2-3.10.1","NIST SP 800-171r2 Appendix D"],["cmmc","PE.L2-3.10.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PE-5","title":"Access Control for Output Devices","text":"Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output.","csf":[["PR.AA-06","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.7","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.3","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PE.L2-3.10.3","NIST SP 800-171r3 03.10.07 → SP 800-53"],["cmmc","PE.L2-3.10.4","NIST SP 800-171r3 03.10.07 → SP 800-53"],["cmmc","PE.L2-3.10.5","NIST SP 800-171r3 03.10.07 → SP 800-53"],["cmmc","PE.L2-3.10.1","NIST SP 800-171r2 Appendix D"],["cmmc","PE.L2-3.10.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PE-6","title":"Monitoring Physical Access","text":"a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;\nb. Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events]; and\nc. Coordinate results of reviews and investigations with the organizational incident response capability.","csf":[["DE.CM-02","c",""],["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["hipaa","§164.310(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.4","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PE.L2-3.10.2","NIST SP 800-171r3 03.10.02 → SP 800-53"],["cmmc","PE.L2-3.10.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PE-8","title":"Visitor Access Records","text":"a. Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period];\nb. Review visitor access records [Assignment: organization-defined frequency]; and\nc. Report anomalies in visitor access records to [Assignment: organization-defined personnel].","csf":[["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["hipaa","§164.310(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"PE-9","title":"Power Equipment and Cabling","text":"Protect power equipment and power cabling for the system from damage and destruction.","csf":[["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.11","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.12","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-10","title":"Emergency Shutoff","text":"a. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations;\nb. Place emergency shutoff switches or devices in [Assignment: organization-defined location] to facilitate access for authorized personnel; and\nc. Protect emergency power shutoff capability from unauthorized activation.","csf":[["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.7.11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-11","title":"Emergency Power","text":"Provide an uninterruptible power supply to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.","csf":[["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.7.11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-12","title":"Emergency Lighting","text":"Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.","csf":[["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.7.11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-13","title":"Fire Protection","text":"Employ and maintain fire detection and suppression systems that are supported by an independent energy source.","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-14","title":"Environmental Controls","text":"a. Maintain [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control] ] levels within the facility where the system resides at [Assignment: organization-defined acceptable levels]; and\nb. Monitor environmental control levels [Assignment: organization-defined frequency].","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.11","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-15","title":"Water Damage Protection","text":"Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.","csf":[["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.11","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-16","title":"Delivery and Removal","text":"a. Authorize and control [Assignment: organization-defined organization-defined types of system components] entering and exiting the facility; and\nb. Maintain records of the system components.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-17","title":"Alternate Work Site","text":"a. Determine and document the [Assignment: organization-defined alternate work sites] allowed for use by employees;\nb. Employ the following controls at alternate work sites: [Assignment: organization-defined controls];\nc. Assess the effectiveness of controls at alternate work sites; and\nd. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.7","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.9","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PE.L2-3.10.6","NIST SP 800-171r3 03.10.06 → SP 800-53"]]},{"fw":"nist80053","id":"PE-18","title":"Location of System Components","text":"Position system components within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access.","csf":[["PR.AA-06","c",""],["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(c)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-19","title":"Information Leakage","text":"Protect the system from information leakage due to electromagnetic signals emanations.","csf":[["PR.AA-06","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.12","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-20","title":"Asset Monitoring and Tracking","text":"Employ [Assignment: organization-defined asset location technologies] to track and monitor the location and movement of [Assignment: organization-defined assets] within [Assignment: organization-defined controlled areas].","csf":[["DE.CM-02","c",""],["PR.AA-06","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(d)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-22","title":"Component Marking","text":"Mark [Assignment: organization-defined system hardware components] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.13","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PE-23","title":"Facility Location","text":"a. Plan the location or site of the facility where the system resides considering physical and environmental hazards; and\nb. For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.","csf":[["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.7.5","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.7.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PL-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the planning policy and the associated planning controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the planning policy and procedures; and\nc. Review and update the current planning:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":["Gp"],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(a)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PL-2","title":"System Security and Privacy Plans","text":"a. Develop security and privacy plans for the system that:\n  1. Are consistent with the organization’s enterprise architecture;\n  2. Explicitly define the constituent system components;\n  3. Describe the operational context of the system in terms of mission and business processes;\n  4. Identify the individuals that fulfill system roles and responsibilities;\n  5. Identify the information types processed, stored, and transmitted by the system;\n  6. Provide the security categorization of the system, including supporting rationale;\n  7. Describe any specific threats to the system that are of concern to the organization;\n  8. Provide the results of a privacy risk assessment for systems processing personally identifiable information;\n  9. Describe the operational environment for the system and any dependencies on or connections to other systems or system components;\n  10. Provide an overview of the security and privacy requirements for the system;\n  11. Identify any relevant control baselines or overlays, if applicable;\n  12. Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;\n  13. Include risk determinations for security and privacy architecture and design decisions;\n  14. Include security- and privacy-related activities affecting the system that require planning and coordination with [Assignment: organization-defined individuals or groups]; and\n  15. Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.\nb. Distribute copies of the plans and communicate subsequent changes to the plans to [Assignment: organization-defined personnel or roles];\nc. Review the plans [Assignment: organization-defined frequency];\nd. Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and\ne. Protect the plans from unauthorized disclosure and modification.","csf":[["ID.AM-03","c",""],["ID.AM-08","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.IM-04","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(b)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.34","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","CA.L2-3.12.4","NIST SP 800-171r3 03.15.02 → SP 800-53"],["cmmc","CA.L2-3.12.1","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.2","NIST SP 800-171r2 Appendix D"],["cmmc","CA.L2-3.12.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PL-4","title":"Rules of Behavior","text":"a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;\nb. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;\nc. Review and update the rules of behavior [Assignment: organization-defined frequency]; and\nd. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [Selection (one or more): [Assignment: organization-defined frequency]; when the rules are revised or updated].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PL-7","title":"Concept of Operations","text":"a. Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy; and\nb. Review and update the CONOPS [Assignment: organization-defined frequency].","csf":[],"topics":[],"edTopics":[],"direct":[["iso","Clause 8.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PL-8","title":"Security and Privacy Architectures","text":"a. Develop security and privacy architectures for the system that:\n  1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;\n  2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;\n  3. Describe how the architectures are integrated into and support the enterprise architecture; and\n  4. Describe any assumptions about, and dependencies on, external systems and services;\nb. Review and update the architectures [Assignment: organization-defined frequency] to reflect changes in the enterprise architecture; and\nc. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.","csf":[["ID.AM-03","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.5.8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-1","title":"Information Security Program Plan","text":"a. Develop and disseminate an organization-wide information security program plan that:\n  1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;\n  2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;\n  3. Reflects the coordination among organizational entities responsible for information security; and\n  4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;\nb. Review and update the organization-wide information security program plan [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\nc. Protect the information security program plan from unauthorized disclosure and modification.","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":["Gp"],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 8.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-2","title":"Information Security Program Leadership Role","text":"Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.","csf":[["GV.RR-01","c",""],["GV.RR-02","c",""]],"topics":["Rr"],"edTopics":[],"direct":[["hipaa","§164.308(a)(2)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-3","title":"Information Security and Privacy Resources","text":"a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;\nb. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and\nc. Make available for expenditure, the planned information security and privacy resources.","csf":[["GV.RM-03","c",""],["GV.RR-03","c",""],["PR.IR-04","c",""]],"topics":[],"edTopics":[],"direct":[["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-4","title":"Plan of Action and Milestones Process","text":"a. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:\n  1. Are developed and maintained;\n  2. Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and\n  3. Are reported in accordance with established reporting requirements.\nb. Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.","csf":[["GV.OV-03","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":["Cm"],"edTopics":[],"direct":[["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 8.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-5","title":"System Inventory","text":"Develop and update [Assignment: organization-defined frequency] an inventory of organizational systems.","csf":[["ID.AM-01","c",""],["ID.AM-02","c",""]],"topics":["Am"],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PM-6","title":"Measures of Performance","text":"Develop, monitor, and report on the results of information security and privacy measures of performance.","csf":[["GV.OV-03","c",""]],"topics":["Cm"],"edTopics":[],"direct":[["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-7","title":"Enterprise Architecture","text":"Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.","csf":[["ID.AM-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PM-8","title":"Critical Infrastructure Plan","text":"Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.","csf":[["GV.OC-04","c",""],["RC.RP-04","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PM-9","title":"Risk Management Strategy","text":"a. Develops a comprehensive strategy to manage:\n  1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and\n  2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;\nb. Implement the risk management strategy consistently across the organization; and\nc. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.","csf":[["DE.AE-04","c",""],["GV.OC-02","c",""],["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.RM-01","c",""],["GV.RM-02","c",""],["GV.RM-03","c",""],["GV.RM-04","c",""],["GV.RM-05","c",""],["GV.RM-06","c",""],["GV.RM-07","c",""],["GV.SC-03","c",""],["GV.SC-09","c",""],["ID.RA-04","c",""],["ID.RA-06","c",""],["PR.IR-04","c",""],["RC.RP-04","c",""]],"topics":["Rm"],"edTopics":[],"direct":[["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-10","title":"Authorization Process","text":"a. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;\nb. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and\nc. Integrate the authorization processes into an organization-wide risk management program.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-11","title":"Mission and Business Process Definition","text":"a. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and\nb. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and\nc. Review and revise the mission and business processes [Assignment: organization-defined frequency].","csf":[["DE.AE-04","c",""],["GV.OC-01","c",""],["GV.OC-04","c",""],["GV.OC-05","c",""],["ID.RA-04","c",""],["RC.RP-04","c",""]],"topics":["Be"],"edTopics":[],"direct":[["iso","Clause 4.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-12","title":"Insider Threat Program","text":"Implement an insider threat program that includes a cross-discipline insider threat incident handling team.","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"],["ID.RA-03","c",""]],"topics":["It"],"edTopics":["It"],"direct":[]},{"fw":"nist80053","id":"PM-13","title":"Security and Privacy Workforce","text":"Establish a security and privacy workforce development and improvement program.","csf":[["GV.RR-02","c",""],["GV.RR-04","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.6.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-14","title":"Testing, Training, and Monitoring","text":"a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:\n  1. Are developed and maintained; and\n  2. Continue to be executed; and\nb. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-15","title":"Security and Privacy Groups and Associations","text":"Establish and institutionalize contact with selected groups and associations within the security and privacy communities:\n  a. To facilitate ongoing security and privacy education and training for organizational personnel;\n  b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and\n  c. To share current security and privacy information, including threats, vulnerabilities, and incidents.","csf":[["DE.AE-06","c",""],["ID.RA-02","c",""]],"topics":["Ti"],"edTopics":[],"direct":[["iso","Clause 7.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-16","title":"Threat Awareness Program","text":"Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.","csf":[["DE.AE-03","c",""],["DE.AE-06","c",""],["DE.AE-07","c",""],["ID.RA-02","c",""],["ID.RA-03","c",""],["ID.RA-05","c",""]],"topics":["Ti"],"edTopics":[],"direct":[["iso","A.5.7","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-18","title":"Privacy Program Plan","text":"a. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:\n  1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;\n  2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;\n  3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;\n  4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;\n  5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and\n  6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and\nb. Update the plan [Assignment: organization-defined frequency] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.","csf":[["DE.AE-04","c",""],["GV.OC-02","c",""],["GV.OV-01","c",""],["GV.RM-06","c",""],["GV.RM-07","c",""],["GV.SC-03","c",""],["ID.RA-06","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.5.34","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-19","title":"Privacy Program Leadership Role","text":"Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.","csf":[["GV.OV-02","c",""],["GV.RR-01","c",""],["GV.RR-02","c",""],["GV.SC-09","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PM-22","title":"Personally Identifiable Information Quality Management","text":"Develop and document organization-wide policies and procedures for:\n  a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;\n  b. Correcting or deleting inaccurate or outdated personally identifiable information;\n  c. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and\n  d. Appeals of adverse decisions on correction or deletion requests.","csf":[["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PM-23","title":"Data Governance Body","text":"Establish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].","csf":[["GV.RR-01","c",""],["GV.RR-02","c",""],["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PM-24","title":"Data Integrity Board","text":"Establish a Data Integrity Board to:\n  a. Review proposals to conduct or participate in a matching program; and\n  b. Conduct an annual review of all matching programs in which the agency has participated.","csf":[["GV.RR-01","c",""],["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"PM-28","title":"Risk Framing","text":"a. Identify and document:\n  1. Assumptions affecting risk assessments, risk responses, and risk monitoring;\n  2. Constraints affecting risk assessments, risk responses, and risk monitoring;\n  3. Priorities and trade-offs considered by the organization for managing risk; and\n  4. Organizational risk tolerance;\nb. Distribute the results of risk framing activities to [Assignment: organization-defined personnel]; and\nc. Review and update risk framing considerations [Assignment: organization-defined frequency].","csf":[["DE.AE-04","c",""],["GV.OC-03","c",""],["GV.RM-04","c",""],["GV.RM-06","c",""],["GV.RM-07","c",""],["GV.SC-09","c",""]],"topics":["Rm"],"edTopics":[],"direct":[["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-29","title":"Risk Management Program Leadership Roles","text":"a. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and\nb. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.","csf":[["GV.RR-01","c",""],["GV.RR-02","c",""]],"topics":["Rr"],"edTopics":[],"direct":[["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.3.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-30","title":"Supply Chain Risk Management Strategy","text":"a. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;\nb. Implement the supply chain risk management strategy consistently across the organization; and\nc. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational changes.","csf":[["DE.AE-04","c",""],["GV.OC-02","c",""],["GV.OC-04","c","PM-30(1)"],["GV.OC-05","c",""],["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.RM-03","c",""],["GV.RM-04","c",""],["GV.RM-05","c",""],["GV.RM-06","c",""],["GV.RM-07","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-09","c",""],["ID.RA-06","c",""]],"topics":["Sc"],"edTopics":[],"direct":[["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PM-31","title":"Continuous Monitoring Strategy","text":"Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:\n  a. Establishing the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics];\n  b. Establishing [Assignment: organization-defined monitoring frequencies] and [Assignment: organization-defined assessment frequencies] for control effectiveness;\n  c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;\n  d. Correlation and analysis of information generated by control assessments and monitoring;\n  e. Response actions to address results of the analysis of control assessment and monitoring information; and\n  f. Reporting the security and privacy status of organizational systems to [Assignment: organization-defined organization-defined personnel or roles] [Assignment: organization-defined organization-defined frequency].","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.SC-03","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.2.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 9.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 4.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PS-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the personnel security policy and procedures; and\nc. Review and update the current personnel security:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.RR-04","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PS-2","title":"Position Risk Designation","text":"a. Assign a risk designation to all organizational positions;\nb. Establish screening criteria for individuals filling those positions; and\nc. Review and update position risk designations [Assignment: organization-defined frequency].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"PS-3","title":"Personnel Screening","text":"a. Screen individuals prior to authorizing access to the system; and\nb. Rescreen individuals in accordance with [Assignment: organization-defined organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.6.1","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PS.L2-3.9.1","NIST SP 800-171r3 03.09.01 → SP 800-53"],["cmmc","PS.L2-3.9.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PS-4","title":"Personnel Termination","text":"Upon termination of individual employment:\n  a. Disable system access within [Assignment: organization-defined time period];\n  b. Terminate or revoke any authenticators and credentials associated with the individual;\n  c. Conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics];\n  d. Retrieve all security-related organizational system-related property; and\n  e. Retain access to organizational information and systems formerly controlled by terminated individual.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.11","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.5","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PS.L2-3.9.2","NIST SP 800-171r3 03.09.02 → SP 800-53"],["cmmc","PS.L2-3.9.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PS-5","title":"Personnel Transfer","text":"a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization;\nb. Initiate [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action];\nc. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and\nd. Notify [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.11","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.5","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","PS.L2-3.9.2","NIST SP 800-171r3 03.09.02 → SP 800-53"],["cmmc","PS.L2-3.9.1","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"PS-6","title":"Access Agreements","text":"a. Develop and document access agreements for organizational systems;\nb. Review and update the access agreements [Assignment: organization-defined frequency]; and\nc. Verify that individuals requiring access to organizational information and systems:\n  1. Sign appropriate access agreements prior to being granted access; and\n  2. Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: organization-defined frequency].","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(b)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.310(d)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PS-7","title":"External Personnel Security","text":"a. Establish personnel security requirements, including security roles and responsibilities for external providers;\nb. Require external providers to comply with personnel security policies and procedures established by the organization;\nc. Document personnel security requirements;\nd. Require external providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [Assignment: organization-defined time period]; and\ne. Monitor provider compliance with personnel security requirements.","csf":[["DE.CM-06","c",""],["GV.RR-04","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(3)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(4)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(3)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(b)(1)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PS-8","title":"Personnel Sanctions","text":"a. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and\nb. Notify [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.","csf":[],"topics":[],"edTopics":[],"direct":[["hipaa","§164.308(a)(1)(ii)(C)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 7.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.6.4","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PS-9","title":"Position Descriptions","text":"Incorporate security and privacy roles and responsibilities into organizational position descriptions.","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"],["GV.RR-04","c",""]],"topics":["Rr"],"edTopics":["Rr"],"direct":[["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PT-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and\nc. Review and update the current personally identifiable information processing and transparency:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.34","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PT-3","title":"Personally Identifiable Information Processing Purposes","text":"a. Identify and document the [Assignment: organization-defined purpose(s)] for processing personally identifiable information;\nb. Describe the purpose(s) in the public privacy notices and policies of the organization;\nc. Restrict the [Assignment: organization-defined processing] of personally identifiable information to only that which is compatible with the identified purpose(s); and\nd. Monitor changes in processing personally identifiable information and implement [Assignment: organization-defined mechanisms] to ensure that any changes are made in accordance with [Assignment: organization-defined requirements].","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.34","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"PT-7","title":"Specific Categories of Personally Identifiable Information","text":"Apply [Assignment: organization-defined processing conditions] for specific categories of personally identifiable information.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.34","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"RA-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and\nc. Review and update the current risk assessment:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"RA-2","title":"Security Categorization","text":"a. Categorize the system and information it processes, stores, and transmits;\nb. Document the security categorization results, including supporting rationale, in the security plan for the system; and\nc. Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.","csf":[["ID.AM-05","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""]],"topics":["Da"],"edTopics":[],"direct":[["hipaa","§164.308(a)(7)(ii)(E)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.12","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"RA-3","title":"Risk Assessment","text":"a. Conduct a risk assessment, including:\n  1. Identifying threats to and vulnerabilities in the system;\n  2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and\n  3. Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;\nb. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;\nc. Document risk assessment results in [Selection: security and privacy plans; risk assessment report; [Assignment: organization-defined document] ];\nd. Review risk assessment results [Assignment: organization-defined frequency];\ne. Disseminate risk assessment results to [Assignment: organization-defined personnel or roles]; and\nf. Update the risk assessment [Assignment: organization-defined frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.","csf":[["DE.AE-07","c",""],["GV.RM-06","c",""],["GV.RM-07","c",""],["GV.SC-03","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-05","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""],["ID.RA-03","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""],["RS.AN-08","c",""]],"topics":["Ra"],"edTopics":[],"direct":[["hipaa","§164.316(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)(ii)(B)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(a)(1)(ii)(A)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 9.3.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 8.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.8","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","RA.L2-3.11.1","NIST SP 800-171r3 03.11.01 → SP 800-53"]]},{"fw":"nist80053","id":"RA-5","title":"Vulnerability Monitoring and Scanning","text":"a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;\nb. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:\n  1. Enumerating platforms, software flaws, and improper configurations;\n  2. Formatting checklists and test procedures; and\n  3. Measuring vulnerability impact;\nc. Analyze vulnerability scan reports and results from vulnerability monitoring;\nd. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;\ne. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and\nf. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.","csf":[["GV.SC-10","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""],["ID.RA-08","c",""]],"topics":["Vn"],"edTopics":[],"direct":[["iso","A.8.8","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","RA.L2-3.11.2","NIST SP 800-171r3 03.11.02 → SP 800-53"],["cmmc","RA.L2-3.11.3","NIST SP 800-171r3 03.11.02 → SP 800-53"]]},{"fw":"nist80053","id":"RA-7","title":"Risk Response","text":"Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.","csf":[["GV.OC-05","c",""],["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["GV.RM-01","c",""],["GV.RM-03","c",""],["GV.SC-03","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-05","c",""],["ID.RA-06","c",""],["RS.AN-08","c",""]],"topics":["Rm","Ra"],"edTopics":[],"direct":[["iso","Clause 8.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 10.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 6.1.3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"RA-8","title":"Privacy Impact Assessments","text":"Conduct privacy impact assessments for systems, programs, or other activities before:\n  a. Developing or procuring information technology that processes personally identifiable information; and\n  b. Initiating a new collection of personally identifiable information that:\n    1. Will be processed using information technology; and\n    2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.","csf":[["ID.RA-04","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"RA-9","title":"Criticality Analysis","text":"Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle].","csf":[["GV.OC-04","c",""],["GV.SC-04","c",""],["GV.SC-07","c",""],["ID.AM-05","c",""],["ID.RA-04","c",""]],"topics":["Be"],"edTopics":[],"direct":[["iso","A.5.22","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"RA-10","title":"Threat Hunting","text":"a. Establish and maintain a cyber threat hunting capability to:\n  1. Search for indicators of compromise in organizational systems; and\n  2. Detect, track, and disrupt threats that evade existing controls; and\nb. Employ the threat hunting capability [Assignment: organization-defined frequency].","csf":[["DE.AE-06","c",""],["DE.AE-07","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.5.7","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and\nc. Review and update the current system and services acquisition:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 8.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.23","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-3","title":"System Development Life Cycle","text":"a. Acquire, develop, and manage the system using [Assignment: organization-defined system-development life cycle] that incorporates information security and privacy considerations;\nb. Define and document information security and privacy roles and responsibilities throughout the system development life cycle;\nc. Identify individuals having information security and privacy roles and responsibilities; and\nd. Integrate the organizational information security and privacy risk management process into system development life cycle activities.","csf":[["ID.AM-08","c",""],["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.25","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.33","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-4","title":"Acquisition Process","text":"Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection (one or more): standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service:\n  a. Security and privacy functional requirements;\n  b. Strength of mechanism requirements;\n  c. Security and privacy assurance requirements;\n  d. Controls needed to satisfy the security and privacy requirements.\n  e. Security and privacy documentation requirements;\n  f. Requirements for protecting security and privacy documentation;\n  g. Description of the system development environment and environment in which the system is intended to operate;\n  h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and\n  i. Acceptance criteria.","csf":[["DE.CM-06","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-08","c",""],["ID.IM-03","c",""],["ID.RA-09","c",""]],"topics":["Vr"],"edTopics":[],"direct":[["hipaa","§164.308(b)(4)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 8.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.23","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.28","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-5","title":"System Documentation","text":"a. Obtain or develop administrator documentation for the system, system component, or system service that describes:\n  1. Secure configuration, installation, and operation of the system, component, or service;\n  2. Effective use and maintenance of security and privacy functions and mechanisms; and\n  3. Known vulnerabilities regarding configuration and use of administrative or privileged functions;\nb. Obtain or develop user documentation for the system, system component, or system service that describes:\n  1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;\n  2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and\n  3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;\nc. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [Assignment: organization-defined actions] in response; and\nd. Distribute documentation to [Assignment: organization-defined personnel or roles].","csf":[["ID.AM-02","c",""],["ID.RA-09","c",""]],"topics":[],"edTopics":[],"direct":[["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-8","title":"Security and Privacy Engineering Principles","text":"Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined organization-defined systems security and privacy engineering principles].","csf":[["ID.AM-08","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["PR.DS-10","c",""],["PR.IR-03","c",""],["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["iso","A.8.28","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.27","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SC.L2-3.13.1","NIST SP 800-171r2 Appendix D"],["cmmc","SC.L2-3.13.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"SA-9","title":"External System Services","text":"a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls];\nb. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and\nc. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].","csf":[["DE.CM-06","c",""],["GV.OC-05","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-02","c",""],["ID.AM-04","c",""]],"topics":["Cl","Vr"],"edTopics":[],"direct":[["hipaa","§164.308(b)(1)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.308(b)(4)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(a)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.314(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.21","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.22","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.23","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-10","title":"Developer Configuration Management","text":"Require the developer of the system, system component, or system service to:\n  a. Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation; disposal];\n  b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items];\n  c. Implement only organization-approved changes to the system, component, or service;\n  d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and\n  e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].","csf":[["ID.RA-09","c",""],["PR.PS-02","c","SA-10(1)"],["PR.PS-03","c","SA-10(3)"],["PR.PS-06","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.9","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.32","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.28","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-11","title":"Developer Testing and Evaluation","text":"Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:\n  a. Develop and implement a plan for ongoing security and privacy control assessments;\n  b. Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation [Assignment: organization-defined frequency to conduct] at [Assignment: organization-defined depth and coverage];\n  c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;\n  d. Implement a verifiable flaw remediation process; and\n  e. Correct flaws identified during testing and evaluation.","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-01","c","SA-11(2)"],["ID.RA-09","c",""],["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["iso","A.8.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.28","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-15","title":"Development Process, Standards, and Tools","text":"a. Require the developer of the system, system component, or system service to follow a documented development process that:\n  1. Explicitly addresses security and privacy requirements;\n  2. Identifies the standards and tools used in the development process;\n  3. Documents the specific tool options and tool configurations used in the development process; and\n  4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and\nb. Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined organization-defined security and privacy requirements].","csf":[["ID.RA-01","c","SA-15(7)"],["ID.RA-09","c",""],["PR.PS-04","c","SA-15(13)"],["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["iso","A.5.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.25","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.28","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-17","title":"Developer Security and Privacy Architecture and Design","text":"Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:\n  a. Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture;\n  b. Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and\n  c. Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.","csf":[["ID.IM-01","c","SA-17(6)"],["ID.RA-09","c",""],["PR.PS-06","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.25","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.27","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-21","title":"Developer Screening","text":"Require that the developer of [Assignment: organization-defined system, systems component, or system service]:\n  a. Has appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties]; and\n  b. Satisfies the following additional personnel screening criteria: [Assignment: organization-defined additional personnel screening criteria].","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.6.1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SA-22","title":"Unsupported System Components","text":"a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or\nb. Provide the following options for alternative sources for continued support for unsupported components [Selection (one or more): in-house support; [Assignment: organization-defined support from external providers] ].","csf":[["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SA-24","title":"Design For Cyber Resiliency","text":"a. Design organizational systems, system components, or system services to achieve cyber resiliency by:\n  1. Defining the following cyber resiliency goals: [Assignment: organization-defined cyber resiliency goals].\n  2. Defining the following cyber resiliency objectives: [Assignment: organization-defined cyber resiliency objectives].\n  3. Defining the following cyber resiliency techniques: [Assignment: organization-defined cyber resiliency techniques].\n  4. Defining the following cyber resiliency implementation approaches: [Assignment: organization-defined cyber resiliency implementation approaches].\n  5. Defining the following cyber resiliency design principles: [Assignment: organization-defined cyber resiliency design principles].\nb. Implement the selected cyber resiliency goals, objectives, techniques, implementation approaches, and design principles as part of an organizational risk management process or systems security engineering process.","csf":[["GV.RM-03","c",""],["PR.IR-03","c",""],["PR.PS-06","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and\nc. Review and update the current system and communications protection:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SC-2","title":"Separation of System and User Functionality","text":"Separate user functionality, including user interface services, from system management functionality.","csf":[],"topics":[],"edTopics":[],"direct":[["cmmc","SC.L2-3.13.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"SC-3","title":"Security Function Isolation","text":"Isolate security functions from nonsecurity functions.","csf":[["PR.PS-03","c","SC-3(1)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-4","title":"Information in Shared System Resources","text":"Prevent unauthorized and unintended information transfer via shared system resources.","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.IR-01","c",""]],"topics":[],"edTopics":[],"direct":[["cmmc","SC.L2-3.13.4","NIST SP 800-171r3 03.13.04 → SP 800-53"]]},{"fw":"nist80053","id":"SC-5","title":"Denial-of-service Protection","text":"a. [Selection: protect against; limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events]; and\nb. Employ the following controls to achieve the denial-of-service objective: [Assignment: organization-defined controls by type of denial-of-service event].","csf":[["DE.CM-01","c",""],["PR.IR-01","c",""]],"topics":["Ap"],"edTopics":[],"direct":[["iso","A.8.6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SC-6","title":"Resource Availability","text":"Protect the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more): priority; quota; [Assignment: organization-defined controls] ].","csf":[["PR.IR-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-7","title":"Boundary Protection","text":"a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;\nb. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and\nc. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.","csf":[["DE.CM-01","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.IR-01","c",""]],"topics":["Fw","Ws","Wf"],"edTopics":[],"direct":[["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.22","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.23","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SC.L2-3.13.1","NIST SP 800-171r3 03.13.01 → SP 800-53"],["cmmc","SC.L2-3.13.5","NIST SP 800-171r3 03.13.01 → SP 800-53"],["cmmc","SC.L2-3.13.6","NIST SP 800-171r3 03.13.06 → SP 800-53"],["cmmc","SC.L2-3.13.2","NIST SP 800-171r2 Appendix D"],["cmmc","SC.L2-3.13.7","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"SC-7(10)","title":"Boundary Protection | Prevent Exfiltration","text":"(a) Prevent the exfiltration of information; and\n(b) Conduct exfiltration tests [Assignment: organization-defined frequency].","csf":[["PR.DS-01","e","topic: DLP"],["PR.DS-02","e","topic: DLP"],["PR.DS-10","e","topic: DLP"]],"topics":["Dl"],"edTopics":[],"direct":[["iso","A.8.12","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SC-8","title":"Transmission Confidentiality and Integrity","text":"Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.","csf":[["PR.DS-02","c",""]],"topics":["En","Dp"],"edTopics":[],"direct":[["hipaa","§164.312(c)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(c)(2)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(e)(1)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(e)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(e)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.5.33","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.26","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.13","NIST SP 800-171r3 03.13.08 → SP 800-53"],["cmmc","MP.L2-3.8.6","NIST SP 800-171r3 03.13.08 → SP 800-53"],["cmmc","SC.L2-3.13.8","NIST SP 800-171r3 03.13.08 → SP 800-53"],["cmmc","SC.L2-3.13.16","NIST SP 800-171r3 03.13.08 → SP 800-53"]]},{"fw":"nist80053","id":"SC-10","title":"Network Disconnect","text":"Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.20","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SC.L2-3.13.9","NIST SP 800-171r3 03.13.09 → SP 800-53"]]},{"fw":"nist80053","id":"SC-11","title":"Trusted Path","text":"a. Provide a [Selection: physically; logically] isolated trusted communications path for communications between the user and the trusted components of the system; and\nb. Permit users to invoke the trusted communications path for communications between the user and the following security functions of the system, including at a minimum, authentication and re-authentication: [Assignment: organization-defined security functions].","csf":[["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-12","title":"Cryptographic Key Establishment and Management","text":"Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements].","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""]],"topics":["En"],"edTopics":[],"direct":[["hipaa","§164.312(e)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.24","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SC.L2-3.13.10","NIST SP 800-171r3 03.13.10 → SP 800-53"]]},{"fw":"nist80053","id":"SC-13","title":"Cryptographic Protection","text":"a. Determine the [Assignment: organization-defined cryptographic uses]; and\nb. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-defined types of cryptography].","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["En"],"edTopics":[],"direct":[["hipaa","§164.312(e)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(a)(2)(iv)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.26","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.24","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SC.L2-3.13.11","NIST SP 800-171r3 03.13.11 → SP 800-53"]]},{"fw":"nist80053","id":"SC-15","title":"Collaborative Computing Devices and Applications","text":"a. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed]; and\nb. Provide an explicit indication of use to users physically present at the devices.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.14","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SC.L2-3.13.12","NIST SP 800-171r3 03.13.12 → SP 800-53"]]},{"fw":"nist80053","id":"SC-16","title":"Transmission of Security and Privacy Attributes","text":"Associate [Assignment: organization-defined organization-defined security and privacy attributes] with information exchanged between systems and between system components.","csf":[["PR.DS-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-17","title":"Public Key Infrastructure Certificates","text":"a. Issue public key certificates under an [Assignment: organization-defined certificate policy] or obtain public key certificates from an approved service provider; and\nb. Include only approved trust anchors in trust stores or certificate stores managed by the organization.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.24","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SC-18","title":"Mobile Code","text":"a. Define acceptable and unacceptable mobile code and mobile code technologies; and\nb. Authorize, monitor, and control the use of mobile code within the system.","csf":[],"topics":[],"edTopics":[],"direct":[["cmmc","SC.L2-3.13.13","NIST SP 800-171r3 03.13.13 → SP 800-53"]]},{"fw":"nist80053","id":"SC-20","title":"Secure Name/Address Resolution Service (Authoritative Source)","text":"a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and\nb. Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.","csf":[["DE.CM-01","e","topic: DNS Security"],["PR.IR-01","e","topic: DNS Security"]],"topics":["Ds"],"edTopics":["Ds"],"direct":[]},{"fw":"nist80053","id":"SC-21","title":"Secure Name/Address Resolution Service (Recursive or Caching Resolver)","text":"Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.","csf":[["DE.CM-01","e","topic: DNS Security"],["PR.IR-01","e","topic: DNS Security"]],"topics":["Ds"],"edTopics":["Ds"],"direct":[]},{"fw":"nist80053","id":"SC-22","title":"Architecture and Provisioning for Name/Address Resolution Service","text":"Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.","csf":[["DE.CM-01","e","topic: DNS Security"],["PR.IR-01","e","topic: DNS Security"]],"topics":["Ds"],"edTopics":["Ds"],"direct":[]},{"fw":"nist80053","id":"SC-23","title":"Session Authenticity","text":"Protect the authenticity of communications sessions.","csf":[],"topics":[],"edTopics":[],"direct":[["cmmc","SC.L2-3.13.15","NIST SP 800-171r3 03.13.15 → SP 800-53"]]},{"fw":"nist80053","id":"SC-24","title":"Fail in Known State","text":"Fail to a [Assignment: organization-defined known system state] for the following failures on the indicated components while preserving [Assignment: organization-defined system state information] in failure: [Assignment: organization-defined types of system failures on system components].","csf":[["PR.DS-10","c",""],["PR.IR-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-28","title":"Protection of Information at Rest","text":"Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].","csf":[["PR.DS-01","c",""]],"topics":["En","Dp"],"edTopics":[],"direct":[["iso","A.5.33","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.10","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","AC.L2-3.1.13","NIST SP 800-171r3 03.13.08 → SP 800-53"],["cmmc","MP.L2-3.8.5","NIST SP 800-171r3 03.08.05 → SP 800-53"],["cmmc","MP.L2-3.8.6","NIST SP 800-171r3 03.13.08 → SP 800-53"],["cmmc","SC.L2-3.13.8","NIST SP 800-171r3 03.13.08 → SP 800-53"],["cmmc","SC.L2-3.13.16","NIST SP 800-171r3 03.13.08 → SP 800-53"]]},{"fw":"nist80053","id":"SC-32","title":"System Partitioning","text":"Partition the system into [Assignment: organization-defined system components] residing in separate [Selection: physical; logical] domains or environments based on [Assignment: organization-defined circumstances for the physical or logical separation of components].","csf":[["PR.DS-01","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-34","title":"Non-modifiable Executable Programs","text":"For [Assignment: organization-defined system components], load and execute:\n  a. The operating environment from hardware-enforced, read-only media; and\n  b. The following applications from hardware-enforced, read-only media: [Assignment: organization-defined applications].","csf":[["DE.CM-09","c",""],["PR.PS-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-35","title":"External Malicious Code Identification","text":"Include system components that proactively seek to identify network-based malicious code or malicious websites.","csf":[["DE.CM-09","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-36","title":"Distributed Processing and Storage","text":"Distribute the following processing and storage components across multiple [Selection: physical locations; logical domains]: [Assignment: organization-defined organization-defined processing and storage components].","csf":[["PR.IR-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-39","title":"Process Isolation","text":"Maintain a separate execution domain for each executing system process.","csf":[["PR.DS-01","c",""],["PR.DS-10","c",""],["PR.IR-03","c",""],["PR.PS-03","c","SC-39(1)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-40","title":"Wireless Link Protection","text":"Protect external and internal [Assignment: organization-defined organization-defined wireless links] from the following signal parameter attacks: [Assignment: organization-defined organization-defined types of signal parameter attacks or references to sources for such attacks].","csf":[["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-43","title":"Usage Restrictions","text":"a. Establish usage restrictions and implementation guidelines for the following system components: [Assignment: organization-defined components]; and\nb. Authorize, monitor, and control the use of such components within the system.","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-45","title":"System Time Synchronization","text":"Synchronize system clocks within and between systems and system components.","csf":[],"topics":[],"edTopics":[],"direct":[["cmmc","AU.L2-3.3.7","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"SC-49","title":"Hardware-enforced Separation and Policy Enforcement","text":"Implement hardware-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains].","csf":[["PR.PS-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SC-51","title":"Hardware-based Protection","text":"a. Employ hardware-based, write-protect for [Assignment: organization-defined system firmware components]; and\nb. Implement specific procedures for [Assignment: organization-defined authorized individuals] to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.","csf":[["PR.PS-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SI-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and\nc. Review and update the current system and information integrity:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(c)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SI-2","title":"Flaw Remediation","text":"a. Identify, report, and correct system flaws;\nb. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;\nc. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and\nd. Incorporate flaw remediation into the organizational configuration management process.","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["PR.PS-02","c",""]],"topics":["Pm"],"edTopics":[],"direct":[["iso","A.6.8","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.32","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.8","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SI.L2-3.14.1","NIST SP 800-171r3 03.14.01 → SP 800-53"],["cmmc","SI.L2-3.14.2","NIST SP 800-171r2 Appendix D"],["cmmc","SI.L2-3.14.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"SI-2(7)","title":"Flaw Remediation | Root Cause Analysis","text":"a. Conduct root cause analysis to identify underlying causes of issues or failures.\nb. Develop actions to address the root cause of the issue or failure.\nc. Implement the actions and monitor the implementation for effectiveness.","csf":[["RS.AN-03","c",""]],"topics":["Fn"],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SI-3","title":"Malicious Code Protection","text":"a. Implement [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;\nb. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;\nc. Configure malicious code protection mechanisms to:\n  1. Perform periodic scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection (one or more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and\n  2. [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: organization-defined action] ]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection; and\nd. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep","Ml"],"edTopics":["Ep"],"direct":[["iso","A.8.7","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SI.L2-3.14.2","NIST SP 800-171r3 03.14.02 → SP 800-53"],["cmmc","SI.L2-3.14.4","NIST SP 800-171r3 03.14.02 → SP 800-53"],["cmmc","SI.L2-3.14.5","NIST SP 800-171r3 03.14.02 → SP 800-53"],["cmmc","SI.L2-3.14.1","NIST SP 800-171r2 Appendix D"],["cmmc","SI.L2-3.14.3","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"SI-4","title":"System Monitoring","text":"a. Monitor the system to detect:\n  1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and\n  2. Unauthorized local, network, and remote connections;\nb. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];\nc. Invoke internal monitoring capabilities or deploy monitoring devices:\n  1. Strategically within the system to collect organization-determined essential information; and\n  2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;\nd. Analyze detected events and anomalies;\ne. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;\nf. Obtain legal opinion regarding system monitoring activities; and\ng. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency] ].","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["DE.CM-01","c",""],["DE.CM-06","c",""],["DE.CM-09","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["Ep","Sm","Id","An"],"edTopics":[],"direct":[["hipaa","§164.308(a)(1)(ii)(D)","NIST HIPAA → SP 800-53 crosswalk"],["iso","A.8.16","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SI.L2-3.14.6","NIST SP 800-171r3 03.14.06 → SP 800-53"],["cmmc","SI.L2-3.14.7","NIST SP 800-171r3 03.14.06 → SP 800-53"]]},{"fw":"nist80053","id":"SI-5","title":"Security Alerts, Advisories, and Directives","text":"a. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis;\nb. Generate internal security alerts, advisories, and directives as deemed necessary;\nc. Disseminate security alerts, advisories, and directives to: [Selection (one or more): [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined elements]; [Assignment: organization-defined external organizations] ]; and\nd. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.","csf":[["ID.RA-01","c",""],["ID.RA-02","c",""],["ID.RA-03","c",""]],"topics":["Ti"],"edTopics":[],"direct":[["iso","A.5.6","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.8","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","SI.L2-3.14.3","NIST SP 800-171r3 03.14.03 → SP 800-53"],["cmmc","SI.L2-3.14.1","NIST SP 800-171r2 Appendix D"],["cmmc","SI.L2-3.14.2","NIST SP 800-171r2 Appendix D"]]},{"fw":"nist80053","id":"SI-7","title":"Software, Firmware, and Information Integrity","text":"a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined organization-defined software, firmware, and information]; and\nb. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined organization-defined actions].","csf":[["DE.CM-09","c",""],["ID.RA-09","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.PS-02","c",""]],"topics":["Dp"],"edTopics":[],"direct":[["hipaa","§164.312(c)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(c)(2)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.312(e)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"SI-8","title":"Spam Protection","text":"a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and\nb. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.","csf":[["DE.CM-09","e","topic: Email Security"],["PR.DS-02","e","topic: Email Security"]],"topics":["Ml"],"edTopics":["Ml"],"direct":[]},{"fw":"nist80053","id":"SI-10","title":"Information Input Validation","text":"Check the validity of the following information inputs: [Assignment: organization-defined information inputs].","csf":[["PR.AA-03","e","topic: API Security"],["PR.DS-10","c",""],["PR.IR-01","e","topic: Web Security"],["PR.PS-06","e","topic: Web Security"]],"topics":["Ws","Ap"],"edTopics":["Ws","Ap"],"direct":[]},{"fw":"nist80053","id":"SI-12","title":"Information Management and Retention","text":"Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.","csf":[["ID.AM-07","c",""],["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(i)","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"nist80053","id":"SI-13","title":"Predictable Failure Prevention","text":"a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: organization-defined system components]; and\nb. Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: [Assignment: organization-defined mean time to failure (MTTF) substitution criteria].","csf":[["PR.IR-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SI-16","title":"Memory Protection","text":"Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: organization-defined controls].","csf":[["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SI-18","title":"Personally Identifiable Information Quality Operations","text":"a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined organization-defined frequency]; and\nb. Correct or delete inaccurate or outdated personally identifiable information.","csf":[["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SI-19","title":"De-identification","text":"a. Remove the following elements of personally identifiable information from datasets: [Assignment: organization-defined elements]; and\nb. Evaluate [Assignment: organization-defined frequency] for effectiveness of de-identification.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SI-20","title":"Tainting","text":"Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: organization-defined systems or system components].","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.12","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SI-21","title":"Information Refresh","text":"Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed.","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.10","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SR-1","title":"Policy and Procedures","text":"a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n  1. [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy that:\n    (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n    (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n  2. Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls;\nb. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; and\nc. Review and update the current supply chain risk management:\n  1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and\n  2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].","csf":[["GV.OC-03","c",""],["GV.OV-01","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.SC-03","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[["hipaa","§164.316(b)(2)(ii)","NIST HIPAA → SP 800-53 crosswalk"],["hipaa","§164.316(b)(2)(iii)","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","Clause 7.5.3","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.1","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.2","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.4","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.31","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.36","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.37","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.19","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SR-2","title":"Supply Chain Risk Management Plan","text":"a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignment: organization-defined systems, system components, or system services];\nb. Review and update the supply chain risk management plan [Assignment: organization-defined frequency] or as required, to address threat, organizational or environmental changes; and\nc. Protect the supply chain risk management plan from unauthorized disclosure and modification.","csf":[["GV.RM-01","c",""],["GV.RM-03","c",""],["GV.RM-04","c",""],["GV.SC-01","c",""],["GV.SC-02","c",""],["GV.SC-03","c",""],["GV.SC-08","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-04","c",""],["ID.IM-04","c",""]],"topics":["Sc"],"edTopics":[],"direct":[["iso","A.5.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.8.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.19","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.21","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SR-3","title":"Supply Chain Controls and Processes","text":"a. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component] in coordination with [Assignment: organization-defined supply chain personnel];\nb. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined supply chain controls]; and\nc. Document the selected and implemented supply chain processes and controls in [Selection (one or more): security and privacy plans; supply chain risk management plan; [Assignment: organization-defined document] ].","csf":[["GV.OC-02","c",""],["GV.SC-01","c",""],["GV.SC-02","c",""],["GV.SC-03","c",""],["GV.SC-05","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""]],"topics":["Sc"],"edTopics":[],"direct":[["iso","A.5.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.21","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SR-4","title":"Provenance","text":"Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: organization-defined systems, system components, and associated data].","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.30","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.21","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SR-5","title":"Acquisition Strategies, Tools, and Methods","text":"Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined strategies, tools, and methods].","csf":[["GV.OC-02","c",""],["GV.OC-05","c",""],["GV.SC-02","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-08","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.RA-09","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.8.29","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.23","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.20","NIST SP 800-53 → ISO 27001 mapping"],["iso","A.5.21","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SR-6","title":"Supplier Assessments and Reviews","text":"Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency].","csf":[["GV.OC-02","c",""],["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.RA-09","c",""],["ID.RA-10","c",""]],"topics":["Vr"],"edTopics":[],"direct":[["iso","A.5.22","NIST SP 800-53 → ISO 27001 mapping"],["cmmc","RA.L2-3.11.1","NIST SP 800-171r3 03.11.01 → SP 800-53"]]},{"fw":"nist80053","id":"SR-7","title":"Supply Chain Operations Security","text":"Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [Assignment: organization-defined OPSEC controls].","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.22","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"nist80053","id":"SR-8","title":"Notification Agreements","text":"Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compromises; [Assignment: organization-defined results of assessments or audits] ].","csf":[["GV.OC-02","c",""],["GV.SC-08","c",""],["RC.CO-03","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SR-10","title":"Inspection of Systems or Components","text":"Inspect the following systems or system components [Selection (one or more): at random; at [Assignment: organization-defined frequency]; upon [Assignment: organization-defined indications of need for inspection] ] to detect tampering: [Assignment: organization-defined systems or system components].","csf":[["GV.SC-05","c",""],["ID.RA-09","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SR-11","title":"Component Authenticity","text":"a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and\nb. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles] ].","csf":[["ID.RA-09","c",""]],"topics":["Sc"],"edTopics":[],"direct":[]},{"fw":"nist80053","id":"SR-12","title":"Component Disposal","text":"Dispose of [Assignment: organization-defined data, documentation, tools, or system components] using the following techniques and methods: [Assignment: organization-defined techniques and methods].","csf":[["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"iso","id":"A.5.1","title":"Policies for information security","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.RM-01","c",""],["GV.RM-02","c",""],["GV.RM-03","c",""],["GV.RM-04","c",""],["GV.RM-05","c",""],["GV.RM-06","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["PR.AA-05","c",""],["PR.DS-01","c",""]],"topics":["Gp"],"edTopics":[],"direct":[["nis2","1.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC2.2","Internal communication of objectives and responsibilities: communication (7.4), awareness (7.3) and communicating policies (A.5.1).","e"],["soc2","CC5.3","Control activities deployed through policies (A.5.1) and documented operating procedures (A.5.37).","e"]]},{"fw":"iso","id":"A.5.2","title":"Information security roles and responsibilities","csf":[["GV.RR-02","c",""],["GV.SC-02","c",""],["PR.AT-02","c",""]],"topics":["Rr"],"edTopics":[],"direct":[["nis2","1.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-10","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-29","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC1.3","Both require defined structures, reporting lines, roles and authorities for security.","e"]]},{"fw":"iso","id":"A.5.3","title":"Segregation of duties","csf":[["GV.OC-05","c",""],["GV.RR-02","c",""],["PR.AA-05","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","1.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","11.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-5","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC6.3","Role-based access with least privilege and segregation of duties: A.5.3, access rights (A.5.18) and privileged access (A.8.2).","e"]]},{"fw":"iso","id":"A.5.4","title":"Management responsibilities","csf":[["GV.RR-01","c",""],["GV.SC-02","c",""]],"topics":["Rr"],"edTopics":[],"direct":[["nis2","1.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","1.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.5","title":"Contact with authorities","csf":[["GV.OV-01","c",""]],"topics":["Rp"],"edTopics":[],"direct":[["nist80053","IR-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.6","title":"Contact with special interest groups","csf":[["GV.OV-01","c",""],["RS.CO-03","e","topic: Communication"]],"topics":["Co"],"edTopics":["Co"],"direct":[["nist80053","PM-15","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.7","title":"Threat intelligence","csf":[["DE.AE-07","c",""],["ID.RA-02","c",""],["ID.RA-03","c",""],["ID.RA-05","c",""],["ID.RA-06","c",""]],"topics":["Ti"],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PM-16","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-10","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.8","title":"Information security in project management","csf":[["GV.OC-05","c",""],["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","PL-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-15","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.9","title":"Inventory of information and other associated assets","csf":[["ID.AM-01","c",""],["ID.AM-02","c",""],["ID.AM-05","c",""],["ID.AM-07","c",""],["ID.AM-08","c",""],["PR.PS-02","c",""],["PR.PS-03","c",""]],"topics":["Am"],"edTopics":[],"direct":[["nis2","12.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","12.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","12.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CM-8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.10","title":"Acceptable use of information and other associated assets","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","12.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","MP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-16","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-18","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-20","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-28","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.11","title":"Return of assets","csf":[["ID.AM-08","c",""]],"topics":["Am"],"edTopics":[],"direct":[["nis2","12.5","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PS-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-5","NIST SP 800-53 → ISO 27001 mapping"],["dora","Art.30(2)(d)","Access to, return and deletion of data and assets when a contract or relationship ends.","e"]]},{"fw":"iso","id":"A.5.12","title":"Classification of information","csf":[["ID.AM-05","c",""],["ID.AM-08","c",""],["PR.DS-01","c",""]],"topics":["Da"],"edTopics":[],"direct":[["nis2","12.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","RA-2","NIST SP 800-53 → ISO 27001 mapping"],["soc2","C1.1","Identifying and maintaining confidential information: classification (A.5.12) and labelling (A.5.13).","e"]]},{"fw":"iso","id":"A.5.13","title":"Labelling of information","csf":[["ID.AM-05","c",""],["ID.AM-08","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["Da"],"edTopics":[],"direct":[["nis2","12.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","MP-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-22","NIST SP 800-53 → ISO 27001 mapping"],["soc2","C1.1","Identifying and maintaining confidential information: classification (A.5.12) and labelling (A.5.13).","e"]]},{"fw":"iso","id":"A.5.14","title":"Information transfer","csf":[["ID.AM-03","c",""],["PR.AA-05","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["Dp","Ml"],"edTopics":[],"direct":[["nis2","12.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-17","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-18","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-19","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-20","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-17","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-15","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.15","title":"Access control","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""],["PR.AA-05","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["Ac","Zt"],"edTopics":[],"direct":[["nis2","11.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.16","title":"Identity management","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""],["PR.AA-04","c",""],["PR.AA-05","c",""]],"topics":["Ac"],"edTopics":[],"direct":[["nis2","11.5","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.17","title":"Authentication information","csf":[["PR.AA-03","c",""],["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","11.6","ENISA NIS2 → ISO 27001 mapping"],["nist80053","IA-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.18","title":"Access rights","csf":[["PR.AA-01","c",""],["PR.AA-03","c",""],["PR.AA-05","c",""]],"topics":["Ac"],"edTopics":[],"direct":[["nis2","11.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","12.5","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-2","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC6.3","Role-based access with least privilege and segregation of duties: A.5.3, access rights (A.5.18) and privileged access (A.8.2).","e"]]},{"fw":"iso","id":"A.5.19","title":"Information security in supplier relationships","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["GV.RM-05","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-08","c",""],["ID.IM-02","c",""],["ID.RA-09","c",""],["ID.RA-10","c",""]],"topics":["Sc","Vr"],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","5.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-2","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC9.2","Vendor and business-partner risk: supplier relationships (A.5.19), agreements (A.5.20) and monitoring (A.5.22).","e"]]},{"fw":"iso","id":"A.5.20","title":"Addressing information security within supplier agreements","csf":[["GV.OC-03","c",""],["GV.OC-04","c",""],["GV.OV-03","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.RA-09","c",""],["ID.RA-10","c",""]],"topics":["Vr"],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","5.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-5","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC9.2","Vendor and business-partner risk: supplier relationships (A.5.19), agreements (A.5.20) and monitoring (A.5.22).","e"]]},{"fw":"iso","id":"A.5.21","title":"Managing information security in the ICT supply chain","csf":[["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""]],"topics":["Sc"],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","5.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","6.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SR-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.22","title":"Monitoring, review and change management of supplier services","csf":[["DE.CM-06","c",""],["GV.SC-01","c",""],["GV.SC-04","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-04","c",""],["ID.AM-08","c",""],["ID.RA-02","c",""],["ID.RA-03","c",""],["ID.RA-09","c",""],["ID.RA-10","c",""]],"topics":["Vr"],"edTopics":[],"direct":[["nis2","5.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","RA-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-7","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC9.2","Vendor and business-partner risk: supplier relationships (A.5.19), agreements (A.5.20) and monitoring (A.5.22).","e"]]},{"fw":"iso","id":"A.5.23","title":"Information security for use of cloud services","csf":[["PR.DS-10","c",""]],"topics":["Cl"],"edTopics":[],"direct":[["nis2","6.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.24","title":"Information security incident management planning and preparation","csf":[["DE.AE-02","c",""],["GV.OV-01","c",""],["ID.IM-04","c",""],["RS.MA-02","c",""]],"topics":["Ir"],"edTopics":[],"direct":[["nis2","3.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","IR-8","NIST SP 800-53 → ISO 27001 mapping"],["soc2","P6.6","Breach notification to affected parties and regulators: ISO's incident planning and response (A.5.24, A.5.26) plus legal PII obligations (A.5.34). ISO itself sets no notification deadline.","e"]]},{"fw":"iso","id":"A.5.25","title":"Assessment and decision on information security events","csf":[["DE.AE-02","c",""],["DE.AE-04","c",""],["DE.AE-08","c",""],["RS.AN-03","c",""],["RS.AN-08","c",""],["RS.MA-03","c",""],["RS.MA-05","c",""]],"topics":["Sg","Ir"],"edTopics":[],"direct":[["nis2","3.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AU-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-4","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC7.3","Evaluating security events to decide whether they are incidents: ISO's assessment and decision on events (A.5.25).","e"]]},{"fw":"iso","id":"A.5.26","title":"Response to information security incidents","csf":[["DE.AE-06","c",""],["DE.AE-08","c",""],["GV.SC-08","c",""],["ID.IM-04","c",""],["RC.RP-01","c",""],["RC.RP-02","c",""],["RC.RP-05","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""],["RS.MA-02","c",""],["RS.MA-04","c",""],["RS.MI-01","c",""],["RS.MI-02","c",""]],"topics":["Ir","Mt","Cr"],"edTopics":[],"direct":[["nis2","3.5","ENISA NIS2 → ISO 27001 mapping"],["nis2","4.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","IR-4","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC7.4","Responding to identified incidents: ISO A.5.26.","e"],["soc2","CC7.5","Recovering from incidents and learning from them: response (A.5.26) and lessons learned (A.5.27).","e"],["soc2","P6.6","Breach notification to affected parties and regulators: ISO's incident planning and response (A.5.24, A.5.26) plus legal PII obligations (A.5.34). ISO itself sets no notification deadline.","e"]]},{"fw":"iso","id":"A.5.27","title":"Learning from information security incidents","csf":[["GV.OV-02","c",""],["ID.IM-03","c",""],["ID.IM-04","c",""],["RC.RP-06","c",""],["RS.AN-03","c",""],["RS.MA-01","c",""],["RS.MA-02","c",""]],"topics":["Ll"],"edTopics":[],"direct":[["nis2","3.6","ENISA NIS2 → ISO 27001 mapping"],["nist80053","IR-4","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC7.5","Recovering from incidents and learning from them: response (A.5.26) and lessons learned (A.5.27).","e"]]},{"fw":"iso","id":"A.5.28","title":"Collection of evidence","csf":[["RC.CO-03","c",""],["RS.AN-06","c",""],["RS.AN-07","c",""],["RS.MA-01","c",""],["RS.MA-02","c",""]],"topics":["Fn"],"edTopics":[],"direct":[["nis2","3.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","10.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AU-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-10","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.29","title":"Information security during disruption","csf":[["PR.IR-03","c",""],["RC.RP-01","c",""]],"topics":["Rc","Bc"],"edTopics":[],"direct":[["nis2","4.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","4.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-10","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-13","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC9.1","Mitigating business-disruption risk: security during disruption (A.5.29) and ICT readiness for continuity (A.5.30).","e"]]},{"fw":"iso","id":"A.5.30","title":"ICT readiness for business continuity","csf":[["RC.RP-02","c",""]],"topics":["Rc","Bc","Dr"],"edTopics":[],"direct":[["nis2","4.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","4.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-2(8)","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-4","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC9.1","Mitigating business-disruption risk: security during disruption (A.5.29) and ICT readiness for continuity (A.5.30).","e"],["soc2","A1.3","Testing recovery plans: ISO A.5.30 requires ICT continuity to be planned and tested.","e"]]},{"fw":"iso","id":"A.5.31","title":"Legal, statutory, regulatory and contractual requirements","csf":[["GV.OC-03","c",""],["GV.OC-04","c",""],["GV.PO-02","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""]],"topics":["Cm"],"edTopics":[],"direct":[["nis2","2.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","9.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.32","title":"Intellectual property rights","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","6.9","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CM-10","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.5.33","title":"Protection of records","csf":[["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-28","NIST SP 800-53 → ISO 27001 mapping"],["soc2","P4.2","Retaining personal information only as long as needed: protection of records (A.5.33) and PII protection (A.5.34). ISO 27001 has no retention-schedule requirement of its own.","e"]]},{"fw":"iso","id":"A.5.34","title":"Privacy and protection of PII","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","PL-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-18","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PT-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PT-7","NIST SP 800-53 → ISO 27001 mapping"],["soc2","P4.2","Retaining personal information only as long as needed: protection of records (A.5.33) and PII protection (A.5.34). ISO 27001 has no retention-schedule requirement of its own.","e"],["soc2","P4.3","Securely disposing of personal information: information deletion (A.8.10) and PII protection (A.5.34).","e"],["soc2","P6.6","Breach notification to affected parties and regulators: ISO's incident planning and response (A.5.24, A.5.26) plus legal PII obligations (A.5.34). ISO itself sets no notification deadline.","e"]]},{"fw":"iso","id":"A.5.35","title":"Independent review of information security","csf":[["GV.OV-02","c",""],["ID.IM-01","c",""],["ID.IM-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","2.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","2.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CA-2","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC4.1","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"]]},{"fw":"iso","id":"A.5.36","title":"Compliance with policies, rules and standards for information security","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-02","c",""],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[["nis2","1.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","2.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC4.1","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"]]},{"fw":"iso","id":"A.5.37","title":"Documented operating procedures","csf":[["GV.PO-01","c",""]],"topics":["Gp"],"edTopics":[],"direct":[["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC5.3","Control activities deployed through policies (A.5.1) and documented operating procedures (A.5.37).","e"]]},{"fw":"iso","id":"A.6.1","title":"Screening","csf":[["GV.PO-01","c",""],["GV.RR-04","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["It"],"edTopics":[],"direct":[["nis2","10.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PS-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-21","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC1.4","Commitment to competence: ISO covers it as competence (7.2), screening (A.6.1) and awareness and training (A.6.3).","e"]]},{"fw":"iso","id":"A.6.2","title":"Terms and conditions of employment","csf":[["GV.PO-01","c",""],["GV.RR-04","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","10.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PL-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.6.3","title":"Information security awareness, education and training","csf":[["GV.RR-04","c",""],["PR.AT-01","c",""],["PR.AT-02","c",""]],"topics":["Aw"],"edTopics":[],"direct":[["nis2","8.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","8.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","10.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AT-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-13","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC1.4","Commitment to competence: ISO covers it as competence (7.2), screening (A.6.1) and awareness and training (A.6.3).","e"]]},{"fw":"iso","id":"A.6.4","title":"Disciplinary process","csf":[["GV.PO-01","c",""],["GV.RR-04","c",""]],"topics":["It"],"edTopics":[],"direct":[["nis2","10.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PS-8","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC1.1","Tone at the top: ISO 27001 requires leadership commitment (5.1) and a disciplinary process that enforces policy (A.6.4); SOC 2 frames the same as commitment to integrity and ethical values.","e"],["soc2","CC1.5","Holding people accountable for their security responsibilities: assigned responsibilities (5.3) and a disciplinary process (A.6.4).","e"]]},{"fw":"iso","id":"A.6.5","title":"Responsibilities after termination or change of employment","csf":[["GV.PO-01","c",""],["GV.RR-04","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","10.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PS-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.6.6","title":"Confidentiality or non-disclosure agreements","csf":[["GV.RR-03","c",""],["GV.RR-04","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","PS-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.6.7","title":"Remote working","csf":[["GV.PO-01","c",""],["GV.RR-04","c",""],["PR.AA-05","e","topic: Mobile Security"],["PR.PS-01","e","topic: Mobile Security"]],"topics":["Mb"],"edTopics":["Mb"],"direct":[["nist80053","AC-17","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-17","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.6.8","title":"Information security event reporting","csf":[["GV.PO-01","c",""],["GV.RR-04","c",""],["RS.MA-02","c",""]],"topics":["Rp"],"edTopics":[],"direct":[["nis2","3.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AU-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.1","title":"Physical security perimeters","csf":[["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nis2","13.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PE-3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.2","title":"Physical entry","csf":[["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nis2","11.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","13.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PE-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-16","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.3","title":"Securing offices, rooms and facilities","csf":[["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nis2","13.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PE-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.4","title":"Physical security monitoring","csf":[["DE.CM-02","c",""],["DE.CM-03","c",""],["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nis2","13.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AU-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.5","title":"Protecting against physical and environmental threats","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nis2","13.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CP-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-13","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-14","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-15","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-18","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-19","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-23","NIST SP 800-53 → ISO 27001 mapping"],["soc2","A1.2","Environmental protections, backups and recovery infrastructure: backup (A.8.13), redundancy (A.8.14) and protection against environmental threats (A.7.5).","e"]]},{"fw":"iso","id":"A.7.6","title":"Working in secure areas","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[]},{"fw":"iso","id":"A.7.7","title":"Clear desk and clear screen","csf":[["PR.DS-01","c",""],["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","12.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.8","title":"Equipment siting and protection","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-13","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-14","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-15","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-18","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-19","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-23","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.9","title":"Security of assets off-premises","csf":[["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-19","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-20","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-17","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.10","title":"Storage media","csf":[["ID.AM-08","c",""],["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","12.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","12.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","MA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-16","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.11","title":"Supporting utilities","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nis2","13.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CP-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-10","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-12","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-14","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-15","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.12","title":"Cabling security","csf":[["PR.AA-06","c",""],["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-9","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.13","title":"Equipment maintenance","csf":[["ID.AM-08","c",""],["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","6.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","MA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.7.14","title":"Secure disposal or re-use of equipment","csf":[["ID.AM-08","c",""],["PR.IR-02","c",""]],"topics":["Am"],"edTopics":[],"direct":[["nist80053","MP-6","NIST SP 800-53 → ISO 27001 mapping"],["soc2","C1.2","Disposing of confidential information: information deletion (A.8.10) and secure disposal of equipment (A.7.14).","e"]]},{"fw":"iso","id":"A.8.1","title":"User endpoint devices","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-03","c",""],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep","Mb"],"edTopics":["Ep"],"direct":[["nist80053","AC-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-19","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.2","title":"Privileged access rights","csf":[["PR.AA-01","c",""],["PR.AA-02","c",""],["PR.AA-05","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["Pa"],"edTopics":[],"direct":[["nis2","11.3","ENISA NIS2 → ISO 27001 mapping"],["nis2","11.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-5","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC6.3","Role-based access with least privilege and segregation of duties: A.5.3, access rights (A.5.18) and privileged access (A.8.2).","e"]]},{"fw":"iso","id":"A.8.3","title":"Information access restriction","csf":[["PR.AA-02","c",""],["PR.AA-05","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["Ac"],"edTopics":[],"direct":[["nis2","11.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-24","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.4","title":"Access to source code","csf":[["PR.AA-05","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.5","title":"Secure authentication","csf":[["PR.AA-01","c",""],["PR.AA-02","c",""],["PR.AA-03","c",""],["PR.AA-05","c",""]],"topics":["Mf","Zt","Ap"],"edTopics":[],"direct":[["nis2","11.7","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.6","title":"Capacity management","csf":[["DE.CM-09","c",""],["PR.IR-04","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","AU-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-5","NIST SP 800-53 → ISO 27001 mapping"],["soc2","A1.1","Capacity: ISO's capacity management (A.8.6).","e"]]},{"fw":"iso","id":"A.8.7","title":"Protection against malware","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.DS-01","c",""],["PR.PS-02","c",""],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[["nis2","6.9","ENISA NIS2 → ISO 27001 mapping"],["nis2","8.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AT-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.8","title":"Management of technical vulnerabilities","csf":[["ID.RA-01","c",""],["PR.DS-01","c",""],["PR.PS-01","c",""]],"topics":["Vn","Pm"],"edTopics":[],"direct":[["nis2","6.10","ENISA NIS2 → ISO 27001 mapping"],["nist80053","RA-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.9","title":"Configuration management","csf":[["PR.PS-01","c",""]],"topics":["Cf"],"edTopics":[],"direct":[["nis2","6.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-10","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC8.1","Authorising, testing and approving changes: change management (A.8.32) and configuration management (A.8.9).","e"]]},{"fw":"iso","id":"A.8.10","title":"Information deletion","csf":[["PR.DS-01","c",""]],"topics":["Dp"],"edTopics":[],"direct":[["nist80053","AC-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-21","NIST SP 800-53 → ISO 27001 mapping"],["soc2","C1.2","Disposing of confidential information: information deletion (A.8.10) and secure disposal of equipment (A.7.14).","e"],["soc2","P4.3","Securely disposing of personal information: information deletion (A.8.10) and PII protection (A.5.34).","e"]]},{"fw":"iso","id":"A.8.11","title":"Data masking","csf":[["PR.DS-01","c",""]],"topics":["Dp"],"edTopics":[],"direct":[["nist80053","AC-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-19","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.12","title":"Data leakage prevention","csf":[["PR.DS-01","c",""]],"topics":["Dl"],"edTopics":[],"direct":[["nist80053","AU-13","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-19","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-7(10)","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-20","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.13","title":"Information backup","csf":[["PR.DS-01","c",""],["PR.DS-11","c",""],["RC.RP-03","c",""],["RC.RP-06","c",""]],"topics":["Bk"],"edTopics":[],"direct":[["nis2","4.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CP-9","NIST SP 800-53 → ISO 27001 mapping"],["soc2","A1.2","Environmental protections, backups and recovery infrastructure: backup (A.8.13), redundancy (A.8.14) and protection against environmental threats (A.7.5).","e"]]},{"fw":"iso","id":"A.8.14","title":"Redundancy of information processing facilities","csf":[["PR.IR-03","c",""]],"topics":["Bc","Dr"],"edTopics":[],"direct":[["nis2","4.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-7","NIST SP 800-53 → ISO 27001 mapping"],["soc2","A1.2","Environmental protections, backups and recovery infrastructure: backup (A.8.13), redundancy (A.8.14) and protection against environmental threats (A.7.5).","e"]]},{"fw":"iso","id":"A.8.15","title":"Logging","csf":[["DE.AE-03","c",""],["DE.CM-01","c",""],["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[["nis2","3.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AU-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-12","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-14","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.16","title":"Monitoring activities","csf":[["DE.AE-03","c",""],["DE.CM-01","c",""],["DE.CM-03","c",""],["DE.CM-06","c",""],["DE.CM-09","c",""],["ID.RA-02","c",""],["ID.RA-03","c",""]],"topics":["Sm","Id","An","Sg","It"],"edTopics":[],"direct":[["nis2","3.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","6.7","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-2(12)","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-17","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-13","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-4","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.17","title":"Clock synchronization","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.IR-03","c",""],["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[["nis2","3.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AU-8","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.18","title":"Use of privileged utility programs","csf":[["PR.AA-05","c",""]],"topics":["Pa"],"edTopics":[],"direct":[["nis2","11.3","ENISA NIS2 → ISO 27001 mapping"],["nis2","11.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-6","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.19","title":"Installation of software on operational systems","csf":[["PR.DS-01","c",""],["PR.PS-05","c",""]],"topics":["Ep"],"edTopics":[],"direct":[["nist80053","CM-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-7(5)","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.20","title":"Networks security","csf":[["ID.AM-03","c",""],["PR.DS-02","c",""],["PR.IR-01","c",""]],"topics":["Fw","Ds","Wf"],"edTopics":[],"direct":[["nis2","6.7","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-18","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AC-20","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-10","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.21","title":"Security of network services","csf":[["ID.AM-03","c",""],["PR.IR-01","c",""]],"topics":["Fw","Ds"],"edTopics":[],"direct":[["nis2","11.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CA-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-9","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.22","title":"Segregation of networks","csf":[["ID.AM-03","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.IR-01","c",""]],"topics":["Fw","Zt"],"edTopics":[],"direct":[["nis2","6.8","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-7","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.23","title":"Web filtering","csf":[["PR.IR-01","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-7","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.24","title":"Use of cryptography","csf":[["PR.DS-02","c",""]],"topics":["En"],"edTopics":[],"direct":[["nis2","9.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","12.5","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SC-12","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-13","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-17","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.25","title":"Secure development life cycle","csf":[["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["nis2","6.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SA-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-15","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-17","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.26","title":"Application security requirements","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.PS-06","c",""]],"topics":["Sd","Ws","Ap"],"edTopics":[],"direct":[["nist80053","AC-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-13","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.27","title":"Secure system architecture and engineering principles","csf":[["PR.IR-03","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","SA-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-17","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.28","title":"Secure coding","csf":[["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["nist80053","SA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-10","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-15","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.29","title":"Security testing in development and acceptance","csf":[["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["nis2","6.5","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-5","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.30","title":"Outsourced development","csf":[["GV.OV-03","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","5.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SA-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-10","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-11","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-15","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-4","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.31","title":"Separation of development, test and production environments","csf":[["PR.PS-06","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","6.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","6.6","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.32","title":"Change management","csf":[["GV.OV-03","c",""],["ID.RA-07","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","6.4","ENISA NIS2 → ISO 27001 mapping"],["nis2","6.6","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CM-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-10","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-2","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC8.1","Authorising, testing and approving changes: change management (A.8.32) and configuration management (A.8.9).","e"],["dora","Art.9(4)(e)","All three require documented, risk-based change management in which changes are recorded, tested, approved and verified.","e"]]},{"fw":"iso","id":"A.8.33","title":"Test information","csf":[["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","6.5","ENISA NIS2 → ISO 27001 mapping"],["nist80053","SA-3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"A.8.34","title":"Protection of information systems during audit testing","csf":[["GV.OV-03","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","2.3","ENISA NIS2 → ISO 27001 mapping"],["nis2","6.5","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 4.1","title":"Understanding the organization and its context","csf":[["GV.OC-01","c",""],["GV.OC-02","c",""]],"topics":["Be"],"edTopics":[],"direct":[["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-11","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 4.2","title":"Understanding the needs and expectations of interested parties","csf":[["GV.OC-02","c",""],["GV.OC-03","c",""],["GV.OC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""],["PR.IR-03","c",""]],"topics":["Be"],"edTopics":[],"direct":[["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 4.3","title":"Determining the scope of the ISMS","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-28","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC3.1","Objectives specified clearly enough to identify risk: ISO's security objectives (6.2) within a defined ISMS scope (4.3).","e"]]},{"fw":"iso","id":"Clause 4.4","title":"Information security management system","csf":[["GV.OC-02","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-30","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 5.1","title":"Leadership and commitment","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","PM-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-29","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC1.1","Tone at the top: ISO 27001 requires leadership commitment (5.1) and a disciplinary process that enforces policy (A.6.4); SOC 2 frames the same as commitment to integrity and ethical values.","e"],["soc2","CC1.2","Oversight: SOC 2 asks for board-level oversight of internal control; ISO 27001 places it with top management (5.1) and the management review (9.3). ISO does not require board independence.","e"]]},{"fw":"iso","id":"Clause 5.2","title":"Policy","csf":[["GV.PO-01","c",""],["GV.PO-02","c",""],["PR.DS-01","c",""],["PR.DS-02","c",""],["PR.DS-10","c",""]],"topics":["Gp"],"edTopics":[],"direct":[["nis2","1.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-29","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 5.3","title":"Organizational roles, responsibilities and authorities","csf":[["GV.SC-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","1.2","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-29","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC1.3","Both require defined structures, reporting lines, roles and authorities for security.","e"],["soc2","CC1.5","Holding people accountable for their security responsibilities: assigned responsibilities (5.3) and a disciplinary process (A.6.4).","e"]]},{"fw":"iso","id":"Clause 6.1","title":"Actions to address risks and opportunities","csf":[["GV.OC-01","c",""],["GV.OC-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 6.1.1","title":"General","csf":[["GV.RM-01","c",""],["GV.RM-05","c",""],["GV.RM-07","c",""],["GV.SC-04","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.RA-03","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""],["PR.IR-03","c",""]],"topics":["Rm"],"edTopics":[],"direct":[["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 6.1.2","title":"Information security risk assessment","csf":[["GV.RM-01","c",""],["GV.RM-02","c",""],["GV.RM-06","c",""],["GV.SC-04","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.RA-03","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""],["ID.RA-08","c",""]],"topics":["Ra"],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-28","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-3","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC3.2","Risk identification and analysis: ISO's risk assessment process (6.1.2) and performing it (8.2).","e"],["hipaa","§164.308(a)(1)(ii)(A)","HIPAA's risk analysis is the ISO 27001 risk assessment (6.1.2, 8.2); both NIST crosswalks route it through SP 800-53 RA-3.","e"]]},{"fw":"iso","id":"Clause 6.1.3","title":"Information security risk treatment","csf":[["GV.RM-03","c",""],["GV.RM-04","c",""],["GV.RM-05","c",""],["GV.SC-04","c",""],["GV.SC-07","c",""],["GV.SC-10","c",""],["ID.RA-03","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""],["ID.RA-06","c",""],["ID.RA-07","c",""]],"topics":["Rm","Ra"],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","RA-7","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC5.1","Selecting control activities that reduce risk: ISO's risk treatment, planned (6.1.3) and carried out (8.3).","e"],["soc2","CC5.2","General controls over technology are chosen in ISO's risk treatment (6.1.3) and recorded in the Statement of Applicability.","e"],["hipaa","§164.308(a)(1)(ii)(B)","HIPAA's risk management (reduce risk to a reasonable level) is ISO 27001 risk treatment (6.1.3, 8.3).","e"]]},{"fw":"iso","id":"Clause 6.2","title":"Information security objectives and planning to achieve them","csf":[],"topics":[],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","7.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-14","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-28","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-30","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC3.1","Objectives specified clearly enough to identify risk: ISO's security objectives (6.2) within a defined ISMS scope (4.3).","e"]]},{"fw":"iso","id":"Clause 6.3","title":"Planning of changes","csf":[],"topics":[],"edTopics":[],"direct":[["nis2","6.4","ENISA NIS2 → ISO 27001 mapping"],["soc2","CC3.4","Assessing changes that affect internal control: ISO's planning of changes (6.3) and re-assessing risk on significant change (8.2).","e"]]},{"fw":"iso","id":"Clause 7.1","title":"Resources","csf":[["GV.RR-03","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","10.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PM-3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 7.2","title":"Competence","csf":[["GV.RR-01","c",""],["GV.RR-02","c",""],["GV.RR-03","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","8.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","10.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PM-13","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC1.4","Commitment to competence: ISO covers it as competence (7.2), screening (A.6.1) and awareness and training (A.6.3).","e"]]},{"fw":"iso","id":"Clause 7.3","title":"Awareness","csf":[["GV.RR-04","c",""],["PR.AT-01","c",""],["PR.AT-02","c",""]],"topics":["Aw"],"edTopics":[],"direct":[["nis2","8.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","AT-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-8","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC2.2","Internal communication of objectives and responsibilities: communication (7.4), awareness (7.3) and communicating policies (A.5.1).","e"]]},{"fw":"iso","id":"Clause 7.4","title":"Communication","csf":[["RC.CO-03","c",""],["RC.CO-04","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""]],"topics":["Co","Cr"],"edTopics":[],"direct":[["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-15","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-28","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC2.2","Internal communication of objectives and responsibilities: communication (7.4), awareness (7.3) and communicating policies (A.5.1).","e"],["soc2","CC2.3","External communication: ISO 27001 7.4 covers what, when and with whom to communicate, including external parties.","e"]]},{"fw":"iso","id":"Clause 7.5.1","title":"General","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-28","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-30","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 7.5.2","title":"Creating and updating","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-28","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-30","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 7.5.3","title":"Control of documented information","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AT-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","AU-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CP-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","IR-8","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","MP-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PE-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-28","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-30","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PS-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SC-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SI-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SR-1","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 8.1","title":"Operational planning and control","csf":[["GV.OC-01","c",""],["GV.OC-02","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["RC.RP-04","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","6.4","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CM-3","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","SA-4","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 8.2","title":"Information security risk assessment","csf":[["GV.OC-01","c",""],["GV.OC-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","RA-3","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC3.2","Risk identification and analysis: ISO's risk assessment process (6.1.2) and performing it (8.2).","e"],["soc2","CC3.4","Assessing changes that affect internal control: ISO's planning of changes (6.3) and re-assessing risk on significant change (8.2).","e"],["hipaa","§164.308(a)(1)(ii)(A)","HIPAA's risk analysis is the ISO 27001 risk assessment (6.1.2, 8.2); both NIST crosswalks route it through SP 800-53 RA-3.","e"]]},{"fw":"iso","id":"Clause 8.3","title":"Information security risk treatment","csf":[["GV.OC-01","c",""],["GV.OC-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","2.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-7","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC5.1","Selecting control activities that reduce risk: ISO's risk treatment, planned (6.1.3) and carried out (8.3).","e"],["hipaa","§164.308(a)(1)(ii)(B)","HIPAA's risk management (reduce risk to a reasonable level) is ISO 27001 risk treatment (6.1.3, 8.3).","e"]]},{"fw":"iso","id":"Clause 9.1","title":"Monitoring, measurement, analysis and evaluation","csf":[["DE.CM-03","c",""],["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["ID.IM-03","c",""],["ID.IM-04","c",""]],"topics":["Cm"],"edTopics":[],"direct":[["nis2","7.1","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CA-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC2.1","Information used to run internal control: ISO's monitoring, measurement, analysis and evaluation (9.1).","e"],["soc2","CC4.1","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"]]},{"fw":"iso","id":"Clause 9.2","title":"Internal audit","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","2.2","ENISA NIS2 → ISO 27001 mapping"],["nis2","2.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","CA-2","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC4.1","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"]]},{"fw":"iso","id":"Clause 9.2.1","title":"General","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","CA-2","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 9.2.2","title":"Internal audit programme","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 9.3","title":"Management review","csf":[["ID.IM-02","c",""],["PR.PS-01","c",""]],"topics":[],"edTopics":[],"direct":[["nis2","1.1","ENISA NIS2 → ISO 27001 mapping"],["nis2","7.1","ENISA NIS2 → ISO 27001 mapping"],["soc2","CC1.2","Oversight: SOC 2 asks for board-level oversight of internal control; ISO 27001 places it with top management (5.1) and the management review (9.3). ISO does not require board independence.","e"],["soc2","CC4.2","Communicating and correcting deficiencies: nonconformity and corrective action (10.2), reported through management review (9.3).","e"]]},{"fw":"iso","id":"Clause 9.3.1","title":"General","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","CA-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-29","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 9.3.2","title":"Management review inputs","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","CA-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 9.3.3","title":"Management review results","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","CA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-6","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CA-7","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","CM-3","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 10.1","title":"Continual improvement","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","e","topic: Lessons Learned"],["RC.RP-06","e","topic: Lessons Learned"]],"topics":["Ll"],"edTopics":["Ll"],"direct":[["nis2","2.3","ENISA NIS2 → ISO 27001 mapping"],["nist80053","PM-1","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-9","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"]]},{"fw":"iso","id":"Clause 10.2","title":"Nonconformity and corrective action","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""]],"topics":[],"edTopics":[],"direct":[["nist80053","CA-5","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PL-2","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-4","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","PM-31","NIST SP 800-53 → ISO 27001 mapping"],["nist80053","RA-7","NIST SP 800-53 → ISO 27001 mapping"],["soc2","CC4.2","Communicating and correcting deficiencies: nonconformity and corrective action (10.2), reported through management review (9.3).","e"]]},{"fw":"cis","id":"CIS 1.1","title":"Establish and Maintain Detailed Enterprise Asset Inventory","csf":[["ID.AM-01","c",""],["ID.AM-08","c",""]],"topics":["Am"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 1.2","title":"Address Unauthorized Assets","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"],["PR.PS-03","c",""]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"cis","id":"CIS 1.3","title":"Utilize an Active Discovery Tool","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"cis","id":"CIS 1.4","title":"Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"cis","id":"CIS 1.5","title":"Use a Passive Asset Discovery Tool","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"cis","id":"CIS 2.1","title":"Establish and Maintain a Software Inventory","csf":[["ID.AM-02","c",""]],"topics":["Am"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 2.2","title":"Ensure Authorized Software is Currently Supported","csf":[["PR.PS-02","c",""]],"topics":["Pm"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 2.3","title":"Address Unauthorized Software","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"],["PR.PS-02","c",""]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"cis","id":"CIS 2.4","title":"Utilize Automated Software Inventory Tools","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"cis","id":"CIS 2.5","title":"Allowlist Authorized Software","csf":[["PR.PS-05","c",""]],"topics":["Ep"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 2.6","title":"Allowlist Authorized Libraries","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 2.7","title":"Allowlist Authorized Scripts","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 3.1","title":"Establish and Maintain a Data Management Process","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"cis","id":"CIS 3.2","title":"Establish and Maintain a Data Inventory","csf":[["ID.AM-07","c",""]],"topics":["Da"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 3.3","title":"Configure Data Access Control Lists","csf":[["PR.AA-05","c",""]],"topics":["Ac"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 3.4","title":"Enforce Data Retention","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"cis","id":"CIS 3.5","title":"Securely Dispose of Data","csf":[["ID.AM-08","c",""],["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"cis","id":"CIS 3.6","title":"Encrypt Data on End-User Devices","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"cis","id":"CIS 3.7","title":"Establish and Maintain a Data Classification Scheme","csf":[["ID.AM-05","c",""]],"topics":["Da"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 3.8","title":"Document Data Flows","csf":[["ID.AM-03","c",""],["ID.AM-05","e","topic: Data Classification"],["ID.AM-07","e","topic: Data Classification"]],"topics":["Da"],"edTopics":["Da"],"direct":[]},{"fw":"cis","id":"CIS 3.9","title":"Encrypt Data on Removable Media","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"cis","id":"CIS 3.10","title":"Encrypt Sensitive Data in Transit","csf":[["PR.DS-02","c",""]],"topics":["En"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 3.11","title":"Encrypt Sensitive Data at Rest","csf":[["PR.DS-01","c",""]],"topics":["En","Dp"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 3.12","title":"Segment Data Processing and Storage Based on Sensitivity","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"],["PR.IR-01","c",""]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"cis","id":"CIS 3.13","title":"Deploy a Data Loss Prevention Solution","csf":[["PR.DS-01","e","topic: DLP"],["PR.DS-02","e","topic: DLP"],["PR.DS-10","e","topic: DLP"]],"topics":["Dl"],"edTopics":["Dl"],"direct":[]},{"fw":"cis","id":"CIS 3.14","title":"Log Sensitive Data Access","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 4.1","title":"Establish and Maintain a Secure Configuration Process","csf":[["PR.PS-01","c",""]],"topics":["Cf"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 4.2","title":"Establish and Maintain a Secure Configuration Process for Network Infrastructure","csf":[["PR.PS-01","c",""]],"topics":["Cf"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 4.3","title":"Configure Automatic Session Locking on Enterprise Assets","csf":[["PR.PS-01","e","topic: Secure Config"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"cis","id":"CIS 4.4","title":"Implement and Manage a Firewall on Servers","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"cis","id":"CIS 4.5","title":"Implement and Manage a Firewall on End-User Devices","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"cis","id":"CIS 4.6","title":"Securely Manage Enterprise Assets and Software","csf":[["PR.PS-01","e","topic: Secure Config"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"cis","id":"CIS 4.7","title":"Manage Default Accounts on Enterprise Assets and Software","csf":[["PR.PS-01","e","topic: Secure Config"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"cis","id":"CIS 4.8","title":"Uninstall or Disable Unnecessary Services on Enterprise Assets and Software","csf":[["PR.PS-01","e","topic: Secure Config"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"cis","id":"CIS 4.9","title":"Configure Trusted DNS Servers on Enterprise Assets","csf":[["DE.CM-01","e","topic: DNS Security"],["PR.IR-01","e","topic: DNS Security"]],"topics":["Ds"],"edTopics":["Ds"],"direct":[]},{"fw":"cis","id":"CIS 4.10","title":"Enforce Automatic Device Lockout on Portable End-User Devices","csf":[["PR.AA-05","e","topic: Mobile Security"],["PR.PS-01","e","topic: Mobile Security"]],"topics":["Mb"],"edTopics":["Mb"],"direct":[]},{"fw":"cis","id":"CIS 4.11","title":"Enforce Remote Wipe Capability on Portable End-User Devices","csf":[["PR.AA-05","e","topic: Mobile Security"],["PR.PS-01","e","topic: Mobile Security"]],"topics":["Mb"],"edTopics":["Mb"],"direct":[]},{"fw":"cis","id":"CIS 4.12","title":"Separate Enterprise Workspaces on Mobile End-User Devices","csf":[["PR.AA-05","e","topic: Mobile Security"],["PR.PS-01","e","topic: Mobile Security"]],"topics":["Mb"],"edTopics":["Mb"],"direct":[]},{"fw":"cis","id":"CIS 5.1","title":"Establish and Maintain an Inventory of Accounts","csf":[["PR.AA-01","c",""],["PR.AA-05","c",""]],"topics":["Ac"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 5.2","title":"Use Unique Passwords","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"cis","id":"CIS 5.3","title":"Disable Dormant Accounts","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"cis","id":"CIS 5.4","title":"Restrict Administrator Privileges to Dedicated Administrator Accounts","csf":[["PR.AA-05","e","topic: Privileged Access"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"cis","id":"CIS 5.5","title":"Establish and Maintain an Inventory of Service Accounts","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"cis","id":"CIS 5.6","title":"Centralize Account Management","csf":[["PR.AA-01","c",""]],"topics":["Ac"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 6.1","title":"Establish an Access Granting Process","csf":[["GV.RR-04","c",""],["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"cis","id":"CIS 6.2","title":"Establish an Access Revoking Process","csf":[["GV.RR-04","c",""],["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"cis","id":"CIS 6.3","title":"Require MFA for Externally-Exposed Applications","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"cis","id":"CIS 6.4","title":"Require MFA for Remote Network Access","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"cis","id":"CIS 6.5","title":"Require MFA for Administrative Access","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"cis","id":"CIS 6.6","title":"Establish and Maintain an Inventory of Authentication and Authorization Systems","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"cis","id":"CIS 6.7","title":"Centralize Access Control","csf":[["PR.AA-01","c",""]],"topics":["Ac"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 6.8","title":"Define and Maintain Role-Based Access Control","csf":[["PR.AA-05","c",""]],"topics":["Ac","Zt"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 7.1","title":"Establish and Maintain a Vulnerability Management Process","csf":[["ID.RA-01","c",""]],"topics":["Vn"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 7.2","title":"Establish and Maintain a Remediation Process","csf":[["ID.RA-08","c",""]],"topics":["Vn"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 7.3","title":"Perform Automated Operating System Patch Management","csf":[["PR.PS-02","e","topic: Patch Management"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"cis","id":"CIS 7.4","title":"Perform Automated Application Patch Management","csf":[["PR.PS-02","e","topic: Patch Management"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"cis","id":"CIS 7.5","title":"Perform Automated Vulnerability Scans of Internal Enterprise Assets","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 7.6","title":"Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 7.7","title":"Remediate Detected Vulnerabilities","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 8.1","title":"Establish and Maintain an Audit Log Management Process","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 8.2","title":"Collect Audit Logs","csf":[["PR.PS-04","c",""]],"topics":["Lg"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 8.3","title":"Ensure Adequate Audit Log Storage","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 8.4","title":"Standardize Time Synchronization","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 8.5","title":"Collect Detailed Audit Logs","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 8.6","title":"Collect DNS Query Audit Logs","csf":[["DE.CM-01","e","topic: DNS Security"],["PR.IR-01","e","topic: DNS Security"]],"topics":["Ds"],"edTopics":["Ds"],"direct":[]},{"fw":"cis","id":"CIS 8.7","title":"Collect URL Request Audit Logs","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 8.8","title":"Collect Command-Line Audit Logs","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 8.9","title":"Centralize Audit Logs","csf":[["DE.AE-03","e","topic: SIEM / SOC"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"]],"topics":["Sg"],"edTopics":["Sg"],"direct":[]},{"fw":"cis","id":"CIS 8.10","title":"Retain Audit Logs","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 8.11","title":"Conduct Audit Log Reviews","csf":[["DE.AE-02","c",""]],"topics":["An"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 8.12","title":"Collect Service Provider Logs","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"cis","id":"CIS 9.1","title":"Ensure Use of Only Fully Supported Browsers and Email Clients","csf":[["DE.CM-09","e","topic: Email Security"],["PR.DS-02","e","topic: Email Security"]],"topics":["Ml"],"edTopics":["Ml"],"direct":[]},{"fw":"cis","id":"CIS 9.2","title":"Use DNS Filtering Services","csf":[["DE.CM-01","e","topic: DNS Security"],["PR.IR-01","e","topic: DNS Security"]],"topics":["Ds"],"edTopics":["Ds"],"direct":[]},{"fw":"cis","id":"CIS 9.3","title":"Maintain and Enforce Network-Based URL Filters","csf":[["PR.IR-01","e","topic: Web Security"],["PR.PS-06","e","topic: Web Security"]],"topics":["Ws"],"edTopics":["Ws"],"direct":[]},{"fw":"cis","id":"CIS 9.4","title":"Restrict Unnecessary or Unauthorized Browser and Email Client Extensions","csf":[["DE.CM-09","e","topic: Email Security"],["PR.DS-02","e","topic: Email Security"]],"topics":["Ml"],"edTopics":["Ml"],"direct":[]},{"fw":"cis","id":"CIS 9.5","title":"Implement DMARC","csf":[["DE.CM-09","e","topic: Email Security"],["PR.DS-02","e","topic: Email Security"]],"topics":["Ml"],"edTopics":["Ml"],"direct":[]},{"fw":"cis","id":"CIS 9.6","title":"Block Unnecessary File Types","csf":[["DE.CM-09","e","topic: Email Security"],["PR.DS-02","e","topic: Email Security"]],"topics":["Ml"],"edTopics":["Ml"],"direct":[]},{"fw":"cis","id":"CIS 9.7","title":"Deploy and Maintain Email Server Anti-Malware Protections","csf":[["DE.CM-09","e","topic: Email Security"],["PR.DS-02","e","topic: Email Security"]],"topics":["Ml"],"edTopics":["Ml"],"direct":[]},{"fw":"cis","id":"CIS 10.1","title":"Deploy and Maintain Anti-Malware Software","csf":[["DE.CM-09","c",""]],"topics":["Ep"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 10.2","title":"Configure Automatic Anti-Malware Signature Updates","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 10.3","title":"Disable Autorun and Autoplay for Removable Media","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 10.4","title":"Configure Automatic Anti-Malware Scanning of Removable Media","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 10.5","title":"Enable Anti-Exploitation Features","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 10.6","title":"Centrally Manage Anti-Malware Software","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 10.7","title":"Use Behavior-Based Anti-Malware Software","csf":[["DE.CM-03","c",""],["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"cis","id":"CIS 11.1","title":"Establish and Maintain a Data Recovery Process","csf":[["ID.IM-04","e","topic: Recovery Planning"],["PR.IR-03","e","topic: Disaster Recovery"],["RC.RP-01","e","topic: Recovery Planning"],["RC.RP-02","e","topic: Recovery Planning"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Rc","Dr"],"edTopics":["Rc","Dr"],"direct":[]},{"fw":"cis","id":"CIS 11.2","title":"Perform Automated Backups","csf":[["PR.DS-11","c",""]],"topics":["Bk"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 11.3","title":"Protect Recovery Data","csf":[["PR.DS-11","c",""]],"topics":["Bk"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 11.4","title":"Establish and Maintain an Isolated Instance of Recovery Data","csf":[["PR.DS-11","e","topic: Backup & Recovery"],["RC.RP-03","e","topic: Backup & Recovery"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"cis","id":"CIS 11.5","title":"Test Data Recovery","csf":[["PR.DS-11","c",""],["RC.RP-03","c",""]],"topics":["Bk"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 12.1","title":"Ensure Network Infrastructure is Up-to-Date","csf":[["PR.PS-02","e","topic: Patch Management"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"cis","id":"CIS 12.2","title":"Establish and Maintain a Secure Network Architecture","csf":[["PR.IR-01","c",""]],"topics":["Fw","Zt"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 12.3","title":"Securely Manage Network Infrastructure","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"cis","id":"CIS 12.4","title":"Establish and Maintain Architecture Diagram(s)","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"cis","id":"CIS 12.5","title":"Centralize Network Authentication, Authorization, and Auditing (AAA)","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"cis","id":"CIS 12.6","title":"Use of Secure Network Management and Communication Protocols","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"cis","id":"CIS 12.7","title":"Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure","csf":[["PR.AA-03","e","topic: Zero Trust"],["PR.AA-04","e","topic: Zero Trust"],["PR.AA-05","e","topic: Zero Trust"],["PR.IR-01","e","topic: Zero Trust"]],"topics":["Zt"],"edTopics":["Zt"],"direct":[]},{"fw":"cis","id":"CIS 12.8","title":"Establish and Maintain Dedicated Computing Resources for All Administrative Work","csf":[["PR.AA-05","e","topic: Privileged Access"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"cis","id":"CIS 13.1","title":"Centralize Security Event Alerting","csf":[["DE.AE-03","e","topic: SIEM / SOC"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"],["DE.CM-01","c",""]],"topics":["Sm","Sg"],"edTopics":["Sg"],"direct":[]},{"fw":"cis","id":"CIS 13.2","title":"Deploy a Host-Based Intrusion Detection Solution","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.CM-01","e","topic: Intrusion Detection"]],"topics":["Id"],"edTopics":["Id"],"direct":[]},{"fw":"cis","id":"CIS 13.3","title":"Deploy a Network Intrusion Detection Solution","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.CM-01","e","topic: Intrusion Detection"]],"topics":["Id"],"edTopics":["Id"],"direct":[]},{"fw":"cis","id":"CIS 13.4","title":"Perform Traffic Filtering Between Network Segments","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"cis","id":"CIS 13.5","title":"Manage Access Control for Remote Assets","csf":[["PR.AA-03","e","topic: Zero Trust"],["PR.AA-04","e","topic: Zero Trust"],["PR.AA-05","e","topic: Zero Trust"],["PR.IR-01","e","topic: Zero Trust"]],"topics":["Zt"],"edTopics":["Zt"],"direct":[]},{"fw":"cis","id":"CIS 13.6","title":"Collect Network Traffic Flow Logs","csf":[["DE.CM-01","e","topic: Cont. Monitoring"],["DE.CM-03","e","topic: Cont. Monitoring"],["DE.CM-09","e","topic: Cont. Monitoring"]],"topics":["Sm"],"edTopics":["Sm"],"direct":[]},{"fw":"cis","id":"CIS 13.7","title":"Deploy a Host-Based Intrusion Prevention Solution","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.CM-01","e","topic: Intrusion Detection"]],"topics":["Id"],"edTopics":["Id"],"direct":[]},{"fw":"cis","id":"CIS 13.8","title":"Deploy a Network Intrusion Prevention Solution","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.CM-01","e","topic: Intrusion Detection"]],"topics":["Id"],"edTopics":["Id"],"direct":[]},{"fw":"cis","id":"CIS 13.9","title":"Deploy Port-Level Access Control","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"cis","id":"CIS 13.10","title":"Perform Application Layer Filtering","csf":[["DE.CM-01","e","topic: WAF"],["PR.IR-01","e","topic: Web Security"],["PR.PS-06","e","topic: Web Security"]],"topics":["Ws","Wf"],"edTopics":["Ws","Wf"],"direct":[]},{"fw":"cis","id":"CIS 13.11","title":"Tune Security Event Alerting Thresholds","csf":[["DE.AE-03","e","topic: SIEM / SOC"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"]],"topics":["Sg"],"edTopics":["Sg"],"direct":[]},{"fw":"cis","id":"CIS 14.1","title":"Establish and Maintain a Security Awareness Program","csf":[["GV.RR-01","c",""],["PR.AT-01","c",""]],"topics":["Aw"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 14.2","title":"Train Workforce Members to Recognize Social Engineering Attacks","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"cis","id":"CIS 14.3","title":"Train Workforce Members on Authentication Best Practices","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"cis","id":"CIS 14.4","title":"Train Workforce on Data Handling Best Practices","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"cis","id":"CIS 14.5","title":"Train Workforce Members on Causes of Unintentional Data Exposure","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"cis","id":"CIS 14.6","title":"Train Workforce Members on Recognizing and Reporting Security Incidents","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"cis","id":"CIS 14.7","title":"Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"cis","id":"CIS 14.8","title":"Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"cis","id":"CIS 14.9","title":"Conduct Role-Specific Security Awareness and Skills Training","csf":[["GV.RR-02","c",""],["PR.AT-02","c",""]],"topics":["Aw"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 15.1","title":"Establish and Maintain an Inventory of Service Providers","csf":[["GV.SC-04","c",""],["ID.AM-04","c",""]],"topics":["Cl","Vr"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 15.2","title":"Establish and Maintain a Service Provider Management Policy","csf":[["DE.CM-06","c",""],["GV.SC-01","c",""]],"topics":["Sc"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 15.3","title":"Classify Service Providers","csf":[["GV.SC-04","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 15.4","title":"Ensure Service Provider Contracts Include Security Requirements","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-02","c",""],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-05","c",""],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["GV.SC-08","c",""],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"cis","id":"CIS 15.5","title":"Assess Service Providers","csf":[["GV.SC-06","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 15.6","title":"Monitor Service Providers","csf":[["DE.CM-06","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 15.7","title":"Securely Decommission Service Providers","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["GV.SC-10","c",""],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"cis","id":"CIS 16.1","title":"Establish and Maintain a Secure Application Development Process","csf":[["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 16.2","title":"Establish and Maintain a Process to Accept and Address Software Vulnerabilities","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 16.3","title":"Perform Root Cause Analysis on Security Vulnerabilities","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 16.4","title":"Establish and Manage an Inventory of Third-Party Software Components","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"cis","id":"CIS 16.5","title":"Use Up-to-Date and Trusted Third-Party Software Components","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 16.6","title":"Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 16.7","title":"Use Standard Hardening Configuration Templates for Application Infrastructure","csf":[["PR.PS-01","e","topic: Secure Config"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"cis","id":"CIS 16.8","title":"Separate Production and Non-Production Systems","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 16.9","title":"Train Developers in Application Security Concepts and Secure Coding","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 16.10","title":"Apply Secure Design Principles in Application Architectures","csf":[["PR.AA-03","e","topic: API Security"],["PR.IR-01","e","topic: Web Security"],["PR.PS-06","e","topic: Web Security"]],"topics":["Ws","Ap"],"edTopics":["Ws","Ap"],"direct":[]},{"fw":"cis","id":"CIS 16.11","title":"Leverage Vetted Modules or Services for Application Security Components","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 16.12","title":"Implement Code-Level Security Checks","csf":[["PR.AA-03","e","topic: API Security"],["PR.IR-01","e","topic: API Security"],["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd","Ap"],"edTopics":["Sd","Ap"],"direct":[]},{"fw":"cis","id":"CIS 16.13","title":"Conduct Application Penetration Testing","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 16.14","title":"Conduct Threat Modeling","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"cis","id":"CIS 17.1","title":"Designate Personnel to Manage Incident Handling","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"cis","id":"CIS 17.2","title":"Establish and Maintain Contact Information for Reporting Security Incidents","csf":[["RC.CO-04","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""]],"topics":["Co"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 17.3","title":"Establish and Maintain an Enterprise Process for Reporting Incidents","csf":[["RS.CO-02","e","topic: Reporting"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"cis","id":"CIS 17.4","title":"Establish and Maintain an Incident Response Process","csf":[["RS.MA-01","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"cis","id":"CIS 17.5","title":"Assign Key Roles and Responsibilities","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"cis","id":"CIS 17.6","title":"Define Mechanisms for Communicating During Incident Response","csf":[["RC.CO-04","c",""],["RS.CO-03","e","topic: Communication"]],"topics":["Co","Cr"],"edTopics":["Co"],"direct":[]},{"fw":"cis","id":"CIS 17.7","title":"Conduct Routine Incident Response Exercises","csf":[["ID.IM-02","c",""],["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"cis","id":"CIS 17.8","title":"Conduct Post-Incident Reviews","csf":[["ID.IM-03","e","topic: Lessons Learned"],["RC.RP-06","e","topic: Lessons Learned"],["RS.AN-03","c",""]],"topics":["Ll"],"edTopics":["Ll"],"direct":[]},{"fw":"cis","id":"CIS 17.9","title":"Establish and Maintain Security Incident Thresholds","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"],["RS.MA-05","c",""]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"cis","id":"CIS 18.1","title":"Establish and Maintain a Penetration Testing Program","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 18.2","title":"Perform Periodic External Penetration Tests","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 18.3","title":"Remediate Penetration Test Findings","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 18.4","title":"Validate Security Measures","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cis","id":"CIS 18.5","title":"Perform Periodic Internal Penetration Tests","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"soc2","id":"A1.1","title":"Capacity management to meet availability commitments","csf":[["GV.OC-04","e","topic: Business Continuity"],["PR.IR-03","e","topic: Business Continuity"],["RC.RP-04","e","topic: Business Continuity"]],"topics":["Bc"],"edTopics":["Bc"],"direct":[["iso","A.8.6","Capacity: ISO's capacity management (A.8.6).","e"]]},{"fw":"soc2","id":"A1.2","title":"Environmental protections, backups and recovery infrastructure","csf":[["GV.OC-04","e","topic: Business Continuity"],["PR.DS-11","e","topic: Backup & Recovery"],["PR.IR-03","e","topic: Business Continuity"],["RC.RP-02","e","topic: Disaster Recovery"],["RC.RP-03","e","topic: Backup & Recovery"],["RC.RP-04","e","topic: Business Continuity"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Bk","Bc","Dr"],"edTopics":["Bk","Bc","Dr"],"direct":[["iso","A.8.13","Environmental protections, backups and recovery infrastructure: backup (A.8.13), redundancy (A.8.14) and protection against environmental threats (A.7.5).","e"],["iso","A.8.14","Environmental protections, backups and recovery infrastructure: backup (A.8.13), redundancy (A.8.14) and protection against environmental threats (A.7.5).","e"],["iso","A.7.5","Environmental protections, backups and recovery infrastructure: backup (A.8.13), redundancy (A.8.14) and protection against environmental threats (A.7.5).","e"]]},{"fw":"soc2","id":"A1.3","title":"Testing recovery plan procedures","csf":[["ID.IM-04","e","topic: Recovery Planning"],["PR.IR-03","e","topic: Disaster Recovery"],["RC.RP-01","e","topic: Recovery Planning"],["RC.RP-02","e","topic: Recovery Planning"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Rc","Dr"],"edTopics":["Rc","Dr"],"direct":[["iso","A.5.30","Testing recovery plans: ISO A.5.30 requires ICT continuity to be planned and tested.","e"]]},{"fw":"soc2","id":"C1.1","title":"Identifying and protecting confidential information","csf":[["ID.AM-05","e","topic: Data Classification"],["ID.AM-07","e","topic: Data Classification"]],"topics":["Da"],"edTopics":["Da"],"direct":[["iso","A.5.12","Identifying and maintaining confidential information: classification (A.5.12) and labelling (A.5.13).","e"],["iso","A.5.13","Identifying and maintaining confidential information: classification (A.5.12) and labelling (A.5.13).","e"]]},{"fw":"soc2","id":"C1.2","title":"Disposing of confidential information","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[["iso","A.8.10","Disposing of confidential information: information deletion (A.8.10) and secure disposal of equipment (A.7.14).","e"],["iso","A.7.14","Disposing of confidential information: information deletion (A.8.10) and secure disposal of equipment (A.7.14).","e"]]},{"fw":"soc2","id":"CC1.1","title":"Commitment to integrity and ethical values","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[["iso","Clause 5.1","Tone at the top: ISO 27001 requires leadership commitment (5.1) and a disciplinary process that enforces policy (A.6.4); SOC 2 frames the same as commitment to integrity and ethical values.","e"],["iso","A.6.4","Tone at the top: ISO 27001 requires leadership commitment (5.1) and a disciplinary process that enforces policy (A.6.4); SOC 2 frames the same as commitment to integrity and ethical values.","e"]]},{"fw":"soc2","id":"CC1.2","title":"Board independence and oversight of internal control","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[["iso","Clause 5.1","Oversight: SOC 2 asks for board-level oversight of internal control; ISO 27001 places it with top management (5.1) and the management review (9.3). ISO does not require board independence.","e"],["iso","Clause 9.3","Oversight: SOC 2 asks for board-level oversight of internal control; ISO 27001 places it with top management (5.1) and the management review (9.3). ISO does not require board independence.","e"]]},{"fw":"soc2","id":"CC1.3","title":"Structures, reporting lines, authorities and responsibilities","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[["iso","Clause 5.3","Both require defined structures, reporting lines, roles and authorities for security.","e"],["iso","A.5.2","Both require defined structures, reporting lines, roles and authorities for security.","e"]]},{"fw":"soc2","id":"CC1.4","title":"Commitment to attracting, developing and retaining competent people","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[["iso","Clause 7.2","Commitment to competence: ISO covers it as competence (7.2), screening (A.6.1) and awareness and training (A.6.3).","e"],["iso","A.6.1","Commitment to competence: ISO covers it as competence (7.2), screening (A.6.1) and awareness and training (A.6.3).","e"],["iso","A.6.3","Commitment to competence: ISO covers it as competence (7.2), screening (A.6.1) and awareness and training (A.6.3).","e"],["nis2","10.2","Background verification: SOC 2's commitment to competence includes screening; NIS2 point 10.2 requires background checks where appropriate.","e"]]},{"fw":"soc2","id":"CC1.5","title":"Accountability for internal control responsibilities","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[["iso","Clause 5.3","Holding people accountable for their security responsibilities: assigned responsibilities (5.3) and a disciplinary process (A.6.4).","e"],["iso","A.6.4","Holding people accountable for their security responsibilities: assigned responsibilities (5.3) and a disciplinary process (A.6.4).","e"],["nis2","10.4","Accountability: SOC 2 holds people accountable for their responsibilities; NIS2 point 10.4 requires a disciplinary process for violations.","e"]]},{"fw":"soc2","id":"CC2.1","title":"Quality information to support internal control","csf":[],"topics":[],"edTopics":[],"direct":[["iso","Clause 9.1","Information used to run internal control: ISO's monitoring, measurement, analysis and evaluation (9.1).","e"]]},{"fw":"soc2","id":"CC2.2","title":"Internal communication of objectives and responsibilities","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[["iso","Clause 7.4","Internal communication of objectives and responsibilities: communication (7.4), awareness (7.3) and communicating policies (A.5.1).","e"],["iso","Clause 7.3","Internal communication of objectives and responsibilities: communication (7.4), awareness (7.3) and communicating policies (A.5.1).","e"],["iso","A.5.1","Internal communication of objectives and responsibilities: communication (7.4), awareness (7.3) and communicating policies (A.5.1).","e"]]},{"fw":"soc2","id":"CC2.3","title":"Communication with external parties","csf":[["RC.CO-03","e","topic: Comms & Restore"],["RC.CO-04","e","topic: Comms & Restore"],["RC.RP-05","e","topic: Comms & Restore"],["RS.CO-02","e","topic: Reporting"],["RS.CO-03","e","topic: Communication"]],"topics":["Co","Rp","Cr"],"edTopics":["Co","Rp","Cr"],"direct":[["iso","Clause 7.4","External communication: ISO 27001 7.4 covers what, when and with whom to communicate, including external parties.","e"]]},{"fw":"soc2","id":"CC3.1","title":"Objectives specified clearly enough to identify risks","csf":[["GV.OC-01","e","topic: Business Environment"],["GV.OC-04","e","topic: Business Environment"],["GV.OC-05","e","topic: Business Environment"],["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm","Be"],"edTopics":["Rm","Be"],"direct":[["iso","Clause 6.2","Objectives specified clearly enough to identify risk: ISO's security objectives (6.2) within a defined ISMS scope (4.3).","e"],["iso","Clause 4.3","Objectives specified clearly enough to identify risk: ISO's security objectives (6.2) within a defined ISMS scope (4.3).","e"]]},{"fw":"soc2","id":"CC3.2","title":"Risk identification and analysis","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"]],"topics":["Ra"],"edTopics":["Ra"],"direct":[["iso","Clause 6.1.2","Risk identification and analysis: ISO's risk assessment process (6.1.2) and performing it (8.2).","e"],["iso","Clause 8.2","Risk identification and analysis: ISO's risk assessment process (6.1.2) and performing it (8.2).","e"]]},{"fw":"soc2","id":"CC3.3","title":"Considering the potential for fraud","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"]],"topics":["Ra"],"edTopics":["Ra"],"direct":[]},{"fw":"soc2","id":"CC3.4","title":"Identifying and assessing significant changes","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"]],"topics":["Ra"],"edTopics":["Ra"],"direct":[["iso","Clause 6.3","Assessing changes that affect internal control: ISO's planning of changes (6.3) and re-assessing risk on significant change (8.2).","e"],["iso","Clause 8.2","Assessing changes that affect internal control: ISO's planning of changes (6.3) and re-assessing risk on significant change (8.2).","e"]]},{"fw":"soc2","id":"CC4.1","title":"Ongoing and/or separate evaluations of controls","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[["iso","Clause 9.1","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"],["iso","Clause 9.2","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"],["iso","A.5.35","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"],["iso","A.5.36","Ongoing and separate evaluations: monitoring (9.1), internal audit (9.2), independent review (A.5.35) and compliance checks (A.5.36).","e"]]},{"fw":"soc2","id":"CC4.2","title":"Communicating and remediating control deficiencies","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[["iso","Clause 10.2","Communicating and correcting deficiencies: nonconformity and corrective action (10.2), reported through management review (9.3).","e"],["iso","Clause 9.3","Communicating and correcting deficiencies: nonconformity and corrective action (10.2), reported through management review (9.3).","e"]]},{"fw":"soc2","id":"CC5.1","title":"Control activities that mitigate risks","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[["iso","Clause 6.1.3","Selecting control activities that reduce risk: ISO's risk treatment, planned (6.1.3) and carried out (8.3).","e"],["iso","Clause 8.3","Selecting control activities that reduce risk: ISO's risk treatment, planned (6.1.3) and carried out (8.3).","e"]]},{"fw":"soc2","id":"CC5.2","title":"General controls over technology","csf":[["PR.PS-01","e","topic: Secure Config"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[["iso","Clause 6.1.3","General controls over technology are chosen in ISO's risk treatment (6.1.3) and recorded in the Statement of Applicability.","e"]]},{"fw":"soc2","id":"CC5.3","title":"Control activities deployed through policies and procedures","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[["iso","A.5.1","Control activities deployed through policies (A.5.1) and documented operating procedures (A.5.37).","e"],["iso","A.5.37","Control activities deployed through policies (A.5.1) and documented operating procedures (A.5.37).","e"]]},{"fw":"soc2","id":"CC6.1","title":"Logical access security over information assets","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"],["PR.AA-01","e","topic: Access Control"],["PR.AA-03","e","topic: Multi-Factor Auth"],["PR.AA-05","e","topic: Access Control"],["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["Am","Ac","Mf","En"],"edTopics":["Am","Ac","Mf","En"],"direct":[]},{"fw":"soc2","id":"CC6.2","title":"User registration, authorization and removal","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[["nis2","10.3","Leavers and movers: SOC 2 requires access to be removed when no longer needed; NIS2 point 10.3 covers termination or change of employment.","e"]]},{"fw":"soc2","id":"CC6.3","title":"Role-based access, least privilege and segregation of duties","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac","Pa"],"edTopics":["Ac","Pa"],"direct":[["iso","A.5.3","Role-based access with least privilege and segregation of duties: A.5.3, access rights (A.5.18) and privileged access (A.8.2).","e"],["iso","A.5.18","Role-based access with least privilege and segregation of duties: A.5.3, access rights (A.5.18) and privileged access (A.8.2).","e"],["iso","A.8.2","Role-based access with least privilege and segregation of duties: A.5.3, access rights (A.5.18) and privileged access (A.8.2).","e"]]},{"fw":"soc2","id":"CC6.4","title":"Physical access restrictions","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[]},{"fw":"soc2","id":"CC6.5","title":"Protection of data when assets are disposed of","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"soc2","id":"CC6.6","title":"Protection against threats from outside system boundaries","csf":[["DE.CM-01","e","topic: WAF"],["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.AA-03","e","topic: Zero Trust"],["PR.AA-04","e","topic: Zero Trust"],["PR.AA-05","e","topic: Zero Trust"],["PR.IR-01","e","topic: Firewall / Net Seg"],["PR.PS-06","e","topic: Web Security"]],"topics":["Fw","Ws","Zt","Wf"],"edTopics":["Fw","Ws","Zt","Wf"],"direct":[]},{"fw":"soc2","id":"CC6.7","title":"Restricting transmission, movement and removal of information","csf":[["PR.AA-05","e","topic: Mobile Security"],["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"],["PR.DS-10","e","topic: DLP"],["PR.PS-01","e","topic: Mobile Security"]],"topics":["En","Mb","Dl"],"edTopics":["En","Mb","Dl"],"direct":[]},{"fw":"soc2","id":"CC6.8","title":"Preventing or detecting unauthorized or malicious software","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.DS-02","e","topic: Email Security"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep","Ml"],"edTopics":["Ep","Ml"],"direct":[]},{"fw":"soc2","id":"CC7.1","title":"Detecting configuration changes and new vulnerabilities","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-01","e","topic: Secure Config"],["PR.PS-02","e","topic: Patch Management"]],"topics":["Vn","Pm","Cf"],"edTopics":["Vn","Pm","Cf"],"direct":[]},{"fw":"soc2","id":"CC7.2","title":"Monitoring system components for anomalies","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.AE-03","e","topic: Logging & Audit"],["DE.AE-04","e","topic: Anomaly Detection"],["DE.CM-01","e","topic: Cont. Monitoring"],["DE.CM-03","e","topic: Cont. Monitoring"],["DE.CM-09","e","topic: Cont. Monitoring"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Sm","Lg","Id","An"],"edTopics":["Sm","Lg","Id","An"],"direct":[]},{"fw":"soc2","id":"CC7.3","title":"Evaluating security events to determine if they are incidents","csf":[["DE.AE-03","e","topic: SIEM / SOC"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"],["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Sg","Ir"],"edTopics":["Sg","Ir"],"direct":[["iso","A.5.25","Evaluating security events to decide whether they are incidents: ISO's assessment and decision on events (A.5.25).","e"]]},{"fw":"soc2","id":"CC7.4","title":"Responding to identified security incidents","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.AN-03","e","topic: Forensics"],["RS.AN-06","e","topic: Forensics"],["RS.AN-07","e","topic: Forensics"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"],["RS.MI-01","e","topic: Mitigation"],["RS.MI-02","e","topic: Mitigation"]],"topics":["Ir","Fn","Mt"],"edTopics":["Ir","Fn","Mt"],"direct":[["iso","A.5.26","Responding to identified incidents: ISO A.5.26.","e"]]},{"fw":"soc2","id":"CC7.5","title":"Recovering from identified security incidents","csf":[["ID.IM-03","e","topic: Lessons Learned"],["ID.IM-04","e","topic: Recovery Planning"],["RC.CO-03","e","topic: Comms & Restore"],["RC.CO-04","e","topic: Comms & Restore"],["RC.RP-01","e","topic: Recovery Planning"],["RC.RP-02","e","topic: Recovery Planning"],["RC.RP-05","e","topic: Comms & Restore"],["RC.RP-06","e","topic: Lessons Learned"]],"topics":["Rc","Ll","Cr"],"edTopics":["Rc","Ll","Cr"],"direct":[["iso","A.5.26","Recovering from incidents and learning from them: response (A.5.26) and lessons learned (A.5.27).","e"],["iso","A.5.27","Recovering from incidents and learning from them: response (A.5.26) and lessons learned (A.5.27).","e"]]},{"fw":"soc2","id":"CC8.1","title":"Change management for infrastructure, data and software","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[["iso","A.8.32","Authorising, testing and approving changes: change management (A.8.32) and configuration management (A.8.9).","e"],["iso","A.8.9","Authorising, testing and approving changes: change management (A.8.32) and configuration management (A.8.9).","e"],["nis2","6.4","Change management: SOC 2 requires changes to be authorised, tested and approved; NIS2 point 6.4 requires change management, repairs and maintenance procedures.","e"]]},{"fw":"soc2","id":"CC9.1","title":"Mitigating risks from business disruptions","csf":[["GV.OC-04","e","topic: Business Continuity"],["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"],["PR.IR-03","e","topic: Business Continuity"],["RC.RP-04","e","topic: Business Continuity"]],"topics":["Rm","Bc"],"edTopics":["Rm","Bc"],"direct":[["iso","A.5.29","Mitigating business-disruption risk: security during disruption (A.5.29) and ICT readiness for continuity (A.5.30).","e"],["iso","A.5.30","Mitigating business-disruption risk: security during disruption (A.5.29) and ICT readiness for continuity (A.5.30).","e"]]},{"fw":"soc2","id":"CC9.2","title":"Managing vendor and business partner risk","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-01","e","topic: Supply Chain Risk"],["GV.SC-03","e","topic: Supply Chain Risk"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-05","e","topic: Supply Chain Risk"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["GV.SC-09","e","topic: Supply Chain Risk"],["ID.AM-04","e","topic: Cloud Security"],["ID.RA-09","e","topic: Supply Chain Risk"],["ID.RA-10","e","topic: Vendor Risk Mgmt"],["PR.IR-01","e","topic: Cloud Security"],["PR.PS-01","e","topic: Cloud Security"]],"topics":["Sc","Cl","Vr"],"edTopics":["Sc","Cl","Vr"],"direct":[["iso","A.5.19","Vendor and business-partner risk: supplier relationships (A.5.19), agreements (A.5.20) and monitoring (A.5.22).","e"],["iso","A.5.20","Vendor and business-partner risk: supplier relationships (A.5.19), agreements (A.5.20) and monitoring (A.5.22).","e"],["iso","A.5.22","Vendor and business-partner risk: supplier relationships (A.5.19), agreements (A.5.20) and monitoring (A.5.22).","e"]]},{"fw":"soc2","id":"P4.2","title":"Retention of personal information","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.33","Retaining personal information only as long as needed: protection of records (A.5.33) and PII protection (A.5.34). ISO 27001 has no retention-schedule requirement of its own.","e"],["iso","A.5.34","Retaining personal information only as long as needed: protection of records (A.5.33) and PII protection (A.5.34). ISO 27001 has no retention-schedule requirement of its own.","e"]]},{"fw":"soc2","id":"P4.3","title":"Disposal of personal information","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.8.10","Securely disposing of personal information: information deletion (A.8.10) and PII protection (A.5.34).","e"],["iso","A.5.34","Securely disposing of personal information: information deletion (A.8.10) and PII protection (A.5.34).","e"]]},{"fw":"soc2","id":"P6.6","title":"Breach notification to affected individuals","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.24","Breach notification to affected parties and regulators: ISO's incident planning and response (A.5.24, A.5.26) plus legal PII obligations (A.5.34). ISO itself sets no notification deadline.","e"],["iso","A.5.26","Breach notification to affected parties and regulators: ISO's incident planning and response (A.5.24, A.5.26) plus legal PII obligations (A.5.34). ISO itself sets no notification deadline.","e"],["iso","A.5.34","Breach notification to affected parties and regulators: ISO's incident planning and response (A.5.24, A.5.26) plus legal PII obligations (A.5.34). ISO itself sets no notification deadline.","e"]]},{"fw":"pci","id":"1.1.1","title":"Network security policies documented and kept current","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"1.1.2","title":"Roles for network security controls assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"1.2.1","title":"Configuration standards for network security controls","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"pci","id":"1.2.3","title":"Accurate network diagram maintained","csf":[["DE.AE-04","c",""],["GV.OC-05","c",""],["GV.SC-01","c",""],["GV.SC-06","c",""],["GV.SC-08","c",""],["GV.SC-10","c",""],["ID.AM-01","c",""],["ID.AM-03","c",""],["PR.IR-01","c",""],["RC.RP-02","c",""],["RC.RP-04","c",""],["RS.AN-08","c",""]],"topics":["Fw"],"edTopics":[],"direct":[]},{"fw":"pci","id":"1.2.4","title":"Accurate account-data flow diagram maintained","csf":[["DE.AE-03","c",""],["DE.AE-04","c",""],["DE.CM-01","c",""],["GV.OC-05","c",""],["GV.SC-01","c",""],["GV.SC-04","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""],["GV.SC-10","c",""],["ID.AM-03","c",""],["PR.IR-01","c",""],["RC.RP-02","c",""],["RC.RP-04","c",""],["RS.AN-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"1.3.1","title":"Inbound traffic to the CDE restricted","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"pci","id":"1.4.1","title":"Network controls between trusted and untrusted networks","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"pci","id":"2.1.1","title":"Secure configuration policies documented and kept current","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"2.1.2","title":"Roles for secure configuration assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"2.2.1","title":"System configuration standards developed and maintained","csf":[["PR.PS-01","c",""],["PR.PS-05","c",""],["RS.MI-02","c",""]],"topics":["Cf"],"edTopics":[],"direct":[]},{"fw":"pci","id":"2.2.2","title":"Vendor default accounts managed or removed","csf":[["PR.AA-03","c",""],["PR.PS-01","c",""]],"topics":["Cf"],"edTopics":[],"direct":[]},{"fw":"pci","id":"2.3.1","title":"Wireless vendor defaults changed","csf":[["PR.AA-03","c",""],["PR.DS-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.1.1","title":"Stored account data policies documented and kept current","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.1.2","title":"Roles for protecting stored account data assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.2.1","title":"Account data storage minimised, with retention and disposal","csf":[["GV.OC-03","c",""],["GV.SC-10","c",""],["ID.AM-07","c",""],["PR.DS-10","c",""]],"topics":["Dp"],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.3.1","title":"Sensitive authentication data not kept after authorisation","csf":[["PR.DS-01","c",""]],"topics":["Dp"],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.4.1","title":"PAN masked when displayed","csf":[["ID.AM-07","c",""],["PR.DS-10","c",""]],"topics":["Dp"],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.4.2","title":"PAN copying prevented over remote-access technologies","csf":[["ID.AM-07","c",""],["PR.DS-01","e","topic: DLP"],["PR.DS-02","e","topic: DLP"],["PR.DS-10","e","topic: DLP"]],"topics":["Dl"],"edTopics":["Dl"],"direct":[]},{"fw":"pci","id":"3.5.1","title":"PAN rendered unreadable wherever stored","csf":[["PR.DS-01","c",""]],"topics":["En"],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.5.1.3","title":"Disk encryption access managed separately from OS access","csf":[["PR.AA-03","c",""],["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.6.1","title":"Procedures protect keys that secure stored account data","csf":[["PR.AA-01","c",""],["PR.AA-04","c",""],["PR.DS-01","c",""]],"topics":["En"],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.6.1.1","title":"Service providers document their cryptographic architecture","csf":[["PR.AA-01","c",""],["PR.AA-04","c",""],["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.6.1.2","title":"Secret and private keys stored in approved forms","csf":[["PR.AA-01","c",""],["PR.AA-04","c",""],["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.6.1.3","title":"Cleartext key components accessible to fewest custodians","csf":[["PR.AA-01","c",""],["PR.AA-04","c",""],["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.6.1.4","title":"Keys stored in the fewest possible locations","csf":[["PR.AA-01","c",""],["PR.AA-04","c",""],["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"3.7.1","title":"Key management: strong key generation","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"pci","id":"3.7.4","title":"Key management: key changes at end of cryptoperiod","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"pci","id":"4.1.1","title":"Data-in-transit policies documented and kept current","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"4.1.2","title":"Roles for protecting data in transit assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"4.2.1","title":"Strong cryptography for PAN over open, public networks","csf":[["PR.AA-04","c",""],["PR.DS-02","c",""]],"topics":["En"],"edTopics":[],"direct":[]},{"fw":"pci","id":"4.2.1.1","title":"Inventory of trusted keys and certificates kept","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"pci","id":"5.1.1","title":"Anti-malware policies documented and kept current","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.1.2","title":"Roles for malware protection assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.2.1","title":"Anti-malware deployed on system components","csf":[["DE.CM-09","c",""],["PR.IR-01","c",""],["RS.MI-01","c",""]],"topics":["Ep"],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.2.2","title":"Anti-malware detects, removes or contains known malware","csf":[["DE.CM-09","c",""],["PR.IR-01","c",""],["RS.MI-01","c",""],["RS.MI-02","c",""]],"topics":["Ep"],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.2.3","title":"Systems without anti-malware periodically re-evaluated","csf":[["PR.IR-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.2.3.1","title":"Re-evaluation frequency set by targeted risk analysis","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["PR.IR-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.3.2","title":"Periodic scans or continuous behavioural analysis","csf":[["DE.CM-09","c",""],["PR.PS-05","c",""],["RC.RP-03","c",""],["RS.MI-01","c",""]],"topics":["Ep"],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.3.2.1","title":"Scan frequency set by targeted risk analysis","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"5.4.1","title":"Mechanisms to detect and protect against phishing","csf":[["DE.CM-09","e","topic: Email Security"],["PR.DS-02","e","topic: Email Security"]],"topics":["Ml"],"edTopics":["Ml"],"direct":[]},{"fw":"pci","id":"6.1.1","title":"Secure systems and software policies documented","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.1.2","title":"Roles for secure systems and software assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.2.1","title":"Bespoke and custom software developed securely","csf":[["ID.AM-08","c",""],["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"pci","id":"6.2.2","title":"Developers trained in secure software development","csf":[["GV.RR-01","c",""],["ID.AM-08","c",""],["PR.AT-02","c",""],["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.2.3","title":"Custom code reviewed before release","csf":[["GV.SC-03","c",""],["GV.SC-09","c",""],["ID.AM-08","c",""],["PR.PS-06","c",""],["RC.RP-05","c",""],["RS.MI-02","c",""]],"topics":["Sd","Ap"],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.2.3.1","title":"Manual code reviews approved by someone else","csf":[["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.2.4","title":"Coding techniques prevent common software attacks","csf":[["ID.AM-08","c",""],["PR.AA-03","e","topic: API Security"],["PR.IR-01","e","topic: API Security"],["PR.PS-06","e","topic: API Security"]],"topics":["Ap"],"edTopics":["Ap"],"direct":[]},{"fw":"pci","id":"6.3.1","title":"Vulnerabilities identified and risk-ranked","csf":[["DE.AE-02","c",""],["DE.AE-07","c",""],["GV.RM-03","c",""],["GV.RM-06","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["ID.AM-05","c",""],["ID.AM-08","c",""],["ID.RA-01","c",""],["ID.RA-05","c",""],["PR.PS-02","c",""],["RS.AN-03","c",""]],"topics":["Vn","Ti","Pm"],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.3.2","title":"Inventory of custom software and its components","csf":[["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-04","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["ID.AM-02","c",""],["ID.RA-01","c",""],["PR.PS-02","c",""],["PR.PS-06","c",""]],"topics":["Sc","Am"],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.3.3","title":"Security patches installed promptly","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["GV.SC-09","c",""],["ID.AM-08","c",""],["ID.IM-03","c",""],["ID.RA-05","c",""],["ID.RA-06","c",""],["PR.PS-02","c",""],["RS.MI-02","c",""]],"topics":["Pm"],"edTopics":[],"direct":[]},{"fw":"pci","id":"6.4.1","title":"Public web applications protected against attacks","csf":[["PR.IR-01","e","topic: Web Security"],["PR.PS-06","e","topic: Web Security"]],"topics":["Ws"],"edTopics":["Ws"],"direct":[]},{"fw":"pci","id":"6.4.2","title":"Automated solution blocks attacks on public web apps","csf":[["DE.CM-01","e","topic: WAF"],["PR.IR-01","e","topic: WAF"]],"topics":["Wf"],"edTopics":["Wf"],"direct":[]},{"fw":"pci","id":"6.4.3","title":"Payment page scripts authorised and integrity-checked","csf":[["DE.AE-07","c",""],["DE.CM-09","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-02","c",""],["ID.RA-09","c",""],["PR.IR-01","e","topic: Web Security"],["PR.PS-05","c",""],["PR.PS-06","e","topic: Web Security"]],"topics":["Ws"],"edTopics":["Ws"],"direct":[]},{"fw":"pci","id":"7.1.1","title":"Access restriction policies documented and kept current","csf":[["GV.PO-02","c",""],["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"7.1.2","title":"Roles for access restriction assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"7.2.1","title":"Access control model defined","csf":[["PR.AA-05","c",""]],"topics":["Ac","Zt"],"edTopics":[],"direct":[]},{"fw":"pci","id":"7.2.2","title":"Access assigned by job function and least privilege","csf":[["GV.RR-04","c",""],["PR.AA-05","c",""],["PR.DS-10","c",""]],"topics":["Ac","Pa"],"edTopics":[],"direct":[]},{"fw":"pci","id":"7.2.4","title":"User accounts and privileges reviewed every six months","csf":[["DE.CM-06","c",""],["PR.AA-05","c",""]],"topics":["Ac"],"edTopics":[],"direct":[]},{"fw":"pci","id":"7.2.5.1","title":"System and application account access periodically reviewed","csf":[["GV.OV-03","c",""],["GV.RM-03","c",""],["GV.RM-06","c",""],["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.1.1","title":"Identification and authentication policies documented","csf":[["GV.PO-02","c",""],["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.1.2","title":"Roles for identification and authentication assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.2.1","title":"Every user has a unique ID","csf":[["PR.AA-01","c",""],["PR.AA-02","c",""]],"topics":["Ac"],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.2.2","title":"Shared or generic accounts only by documented exception","csf":[["DE.CM-03","c",""],["PR.AA-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.2.5","title":"Access revoked immediately on termination","csf":[["GV.RR-04","c",""],["GV.SC-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.2.6","title":"Inactive user accounts disabled within 90 days","csf":[["PR.AA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.2.8","title":"Re-authentication after 15 minutes idle","csf":[["PR.AA-03","c",""],["PR.DS-10","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.1","title":"User and admin access requires an authentication factor","csf":[["PR.AA-03","c",""]],"topics":["Zt"],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.5","title":"First-use and reset passwords unique and changed","csf":[["PR.AA-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.6","title":"Minimum password length and complexity","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.7","title":"Recent passwords cannot be reused","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.8","title":"Authentication guidance communicated to users","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.9","title":"Password-only access: change every 90 days or analyse risk","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.10","title":"Service providers give customers password guidance","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.3.10.1","title":"Service provider customer passwords: rotation or analysis","csf":[["PR.AA-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.4.1","title":"MFA for non-console administrative access to the CDE","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"pci","id":"8.4.2","title":"MFA for all access into the CDE","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"pci","id":"8.4.3","title":"MFA for remote network access","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"pci","id":"8.5.1","title":"MFA systems configured to resist misuse","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"pci","id":"8.6.2","title":"No hard-coded passwords for system accounts","csf":[["PR.AA-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"8.6.3","title":"System account passwords protected and changed","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["ID.RA-07","c",""],["PR.AA-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.1.1","title":"Physical security policies documented and kept current","csf":[["GV.PO-02","c",""],["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.1.2","title":"Roles for physical security assigned","csf":[["GV.RR-02","c",""],["PR.IR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.2.1","title":"Facility entry controls restrict CDE access","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[]},{"fw":"pci","id":"9.2.1.1","title":"Access to sensitive areas monitored by camera or access control","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[]},{"fw":"pci","id":"9.2.3","title":"Physical access to network hardware restricted","csf":[["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.2.4","title":"Consoles in sensitive areas locked when unattended","csf":[["PR.AA-03","c",""],["PR.AA-06","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.3.1","title":"Personnel physical access authorised and managed","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[]},{"fw":"pci","id":"9.3.1.1","title":"Sensitive-area access authorised and revoked promptly","csf":[["DE.CM-02","c",""],["GV.RR-04","c",""],["GV.SC-10","c",""],["PR.AA-06","c",""],["PR.DS-11","c",""]],"topics":["Ph"],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.3.2","title":"Visitor access authorised, escorted and identifiable","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[]},{"fw":"pci","id":"9.4.1.1","title":"Offline backup media stored securely","csf":[["PR.DS-11","c",""],["RC.RP-03","c",""]],"topics":["Bk"],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.4.1.2","title":"Security of offline backup location reviewed annually","csf":[["DE.CM-02","c",""],["PR.DS-11","c",""],["RC.RP-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.4.2","title":"Media classified by data sensitivity","csf":[["ID.AM-05","e","topic: Data Classification"],["ID.AM-07","e","topic: Data Classification"]],"topics":["Da"],"edTopics":["Da"],"direct":[]},{"fw":"pci","id":"9.4.6","title":"Hard-copy media destroyed when no longer needed","csf":[["GV.OC-03","c",""],["GV.SC-10","c",""],["PR.DS-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.4.7","title":"Electronic media destroyed or made unrecoverable","csf":[["GV.OC-03","c",""],["GV.SC-10","c",""],["PR.DS-01","c",""],["PR.DS-11","c",""],["PR.PS-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.5.1.1","title":"Inventory of POI devices kept","csf":[["GV.SC-09","c",""],["ID.AM-01","c",""],["ID.RA-09","c",""],["PR.AA-01","c",""],["PR.PS-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.5.1.2","title":"POI devices inspected for tampering","csf":[["DE.CM-02","c",""],["GV.SC-09","c",""],["ID.AM-01","c",""],["PR.AA-06","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"9.5.1.2.1","title":"Inspection frequency set by targeted risk analysis","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["GV.SC-09","c",""],["ID.AM-05","c",""],["ID.RA-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.1.1","title":"Logging and monitoring policies documented","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.1.2","title":"Roles for logging and monitoring assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.2.1","title":"Audit logs enabled and active","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["DE.AE-04","c",""],["DE.CM-01","c",""],["DE.CM-03","c",""],["DE.CM-06","c",""],["PR.IR-01","c",""],["PR.PS-04","c",""],["RC.RP-04","c",""],["RS.AN-03","c",""],["RS.AN-07","c",""],["RS.MA-02","c",""]],"topics":["Lg","It"],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.2.2","title":"Log entries record who, what, when, where and outcome","csf":[["RS.AN-03","c",""],["RS.AN-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.3.1","title":"Read access to logs limited to need","csf":[["DE.AE-06","c",""],["PR.PS-04","c",""],["RS.AN-06","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.3.2","title":"Logs protected from modification","csf":[["PR.PS-04","c",""],["RS.AN-06","c",""],["RS.AN-07","c",""]],"topics":["Lg","Fn"],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.3.3","title":"Logs promptly backed up to a central server","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["DE.AE-06","c",""],["PR.PS-04","c",""],["RS.AN-06","c",""],["RS.AN-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.3.4","title":"File-integrity monitoring on logs","csf":[["DE.AE-02","c",""],["DE.CM-09","c",""],["PR.PS-04","c",""],["RS.AN-06","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.4.1","title":"Security event and critical logs reviewed daily","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["DE.AE-04","c",""],["DE.CM-01","c",""],["DE.CM-03","c",""],["RC.RP-05","c",""],["RS.AN-03","c",""],["RS.AN-08","c",""],["RS.MA-02","c",""],["RS.MA-03","c",""]],"topics":["Sm","Sg"],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.4.1.1","title":"Automated mechanisms for log review","csf":[["DE.AE-02","e","topic: Anomaly Detection"],["DE.AE-04","e","topic: Anomaly Detection"],["DE.CM-09","e","topic: Anomaly Detection"]],"topics":["An"],"edTopics":["An"],"direct":[]},{"fw":"pci","id":"10.4.2.1","title":"Review frequency set by targeted risk analysis","csf":[["DE.AE-02","c",""],["GV.RM-03","c",""],["GV.RM-06","c",""],["ID.AM-05","c",""],["ID.RA-07","c",""],["PR.PS-04","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.5.1","title":"Audit logs retained 12 months, three immediately available","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"],["RC.RP-06","c",""],["RS.AN-06","c",""]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"pci","id":"10.6.1","title":"System clocks synchronised","csf":[["DE.CM-03","c",""],["PR.PS-04","c",""],["RS.AN-06","c",""],["RS.AN-07","c",""]],"topics":["Lg"],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.6.3","title":"Time settings protected from change","csf":[["PR.PS-04","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.7.1","title":"Service providers detect security control failures","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.RM-05","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"10.7.2","title":"Critical security control failures detected and reported","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["GV.RM-05","c",""],["ID.IM-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.1.1","title":"Security testing policies documented and kept current","csf":[["GV.PO-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.1.2","title":"Roles for security testing assigned","csf":[["GV.RR-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.2.1","title":"Wireless access points detected and unauthorised ones handled","csf":[["DE.CM-01","c",""],["PR.IR-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.3.1","title":"Internal vulnerability scans every three months","csf":[["DE.CM-09","c",""],["GV.OV-03","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""],["ID.RA-06","c",""]],"topics":["Vn"],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.3.1.1","title":"Lower-ranked vulnerabilities handled by risk analysis","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["ID.RA-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.3.2","title":"External ASV scans every three months","csf":[["DE.CM-09","c",""],["GV.OV-03","c",""],["ID.IM-03","c",""],["ID.RA-01","c",""],["ID.RA-06","c",""]],"topics":["Vn"],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.4.4","title":"Penetration test findings corrected and retested","csf":[["GV.OV-02","c",""],["GV.OV-03","c",""],["ID.IM-02","c",""],["ID.RA-01","c",""],["PR.PS-06","c",""],["RC.RP-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"11.5.1","title":"Intrusion detection or prevention on network traffic","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.CM-01","e","topic: Intrusion Detection"]],"topics":["Id"],"edTopics":["Id"],"direct":[]},{"fw":"pci","id":"11.6.1","title":"Payment page changes and tampering detected","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["GV.SC-01","c",""],["GV.SC-03","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["ID.AM-05","c",""],["ID.AM-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.1.1","title":"Information security policy established and published","csf":[["GV.OC-01","c",""],["GV.PO-01","c",""],["GV.RM-01","c",""]],"topics":["Gp"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.1.2","title":"Security policy reviewed at least annually","csf":[["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.RM-01","c",""]],"topics":["Gp"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.1.3","title":"Security roles and responsibilities defined","csf":[["GV.PO-01","c",""],["GV.RR-01","c",""],["GV.RR-02","c",""],["PR.AA-05","c",""]],"topics":["Rr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.1.4","title":"Executive responsibility for information security assigned","csf":[["GV.OC-02","c",""],["GV.PO-01","c",""],["GV.RM-01","c",""],["GV.RR-01","c",""],["GV.RR-03","c",""],["GV.SC-01","c",""],["GV.SC-02","c",""]],"topics":["Rr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.3.1","title":"Targeted risk analysis for flexible-frequency requirements","csf":[["GV.OV-01","c",""],["GV.OV-03","c",""],["GV.RM-06","c",""],["ID.AM-05","c",""],["ID.IM-01","c",""],["ID.RA-03","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""],["ID.RA-07","c",""]],"topics":["Rm","Ra"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.3.2","title":"Targeted risk analysis for customised approach","csf":[["GV.RM-06","c",""],["ID.RA-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.3.3","title":"Cipher suites and protocols reviewed annually","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["PR.AA-04","c",""],["PR.DS-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.3.4","title":"Hardware and software technologies reviewed annually","csf":[["DE.AE-07","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["GV.RM-03","c",""],["GV.RM-06","c",""],["GV.SC-03","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-08","c",""],["ID.IM-01","c",""],["PR.PS-02","c",""],["PR.PS-03","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.4.2","title":"Service providers: quarterly reviews of operational tasks","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.OV-03","c",""],["ID.IM-01","c",""]],"topics":["Cm"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.4.2.1","title":"Service providers: quarterly review results documented","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["ID.IM-01","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.5.1","title":"Inventory of in-scope system components","csf":[["DE.AE-03","c",""],["DE.AE-04","c",""],["DE.AE-07","c",""],["GV.OC-04","c",""],["GV.OC-05","c",""],["ID.AM-01","c",""],["ID.AM-02","c",""],["PR.AA-01","c",""],["RC.RP-04","c",""],["RS.AN-08","c",""]],"topics":["Am"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.5.2","title":"PCI DSS scope confirmed annually and on change","csf":[["GV.OC-04","c",""],["GV.OC-05","c",""],["GV.OV-02","c",""],["GV.SC-04","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-10","c",""],["ID.AM-03","c",""],["ID.AM-07","c",""]],"topics":["Be"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.5.3","title":"Service providers review scope after organisational change","csf":[["GV.OV-02","c",""],["GV.RM-03","c",""],["GV.RM-05","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.6.1","title":"Formal security awareness programme","csf":[["GV.PO-01","c",""],["GV.RR-01","c",""],["PR.AT-01","c",""]],"topics":["Aw"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.6.3","title":"Awareness training on hire and at least annually","csf":[["GV.RR-04","c",""],["PR.AT-01","c",""]],"topics":["Aw"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.7.1","title":"Personnel screened before hire","csf":[["GV.RR-04","c",""],["PR.AA-02","c",""]],"topics":["It"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.8.1","title":"List of third-party service providers kept","csf":[["GV.OC-02","c",""],["GV.OC-03","c",""],["GV.OC-05","c",""],["GV.SC-01","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""],["GV.SC-09","c",""],["ID.AM-02","c",""],["ID.AM-04","c",""],["ID.RA-10","c",""]],"topics":["Sc","Cl","Vr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.8.2","title":"Written agreements with service providers","csf":[["GV.OC-03","c",""],["GV.RM-05","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""],["GV.SC-10","c",""],["ID.RA-10","c",""],["RC.CO-03","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.8.3","title":"Due diligence before engaging service providers","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["GV.SC-01","c",""],["GV.SC-02","c",""],["GV.SC-03","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-10","c",""],["ID.AM-04","c",""],["ID.RA-10","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.8.4","title":"Service provider compliance monitored annually","csf":[["DE.CM-06","c",""],["GV.OC-03","c",""],["GV.OC-05","c",""],["GV.OV-02","c",""],["GV.RM-05","c",""],["GV.SC-01","c",""],["GV.SC-02","c",""],["GV.SC-04","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["ID.AM-04","c",""],["ID.IM-02","c",""],["RC.CO-03","c",""],["RS.CO-03","c",""]],"topics":["Vr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.8.5","title":"Responsibilities split with each provider documented","csf":[["GV.OC-02","c",""],["GV.OC-03","c",""],["GV.RM-05","c",""],["GV.SC-01","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.AM-04","c",""],["RS.CO-02","c",""]],"topics":["Cl","Vr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.9.1","title":"Service providers acknowledge responsibilities to customers","csf":[["GV.OC-02","c",""],["GV.OC-03","c",""],["GV.OC-05","c",""],["GV.RM-05","c",""],["GV.SC-01","c",""],["GV.SC-05","c",""],["GV.SC-07","c",""],["GV.SC-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.9.2","title":"Service providers support customer compliance requests","csf":[["GV.OC-02","c",""],["GV.OC-03","c",""],["GV.OC-05","c",""],["GV.RM-05","c",""],["GV.SC-01","c",""],["GV.SC-05","c",""],["GV.SC-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.1","title":"Incident response plan ready to activate","csf":[["DE.AE-06","c",""],["DE.AE-08","c",""],["GV.OC-04","c",""],["GV.RM-04","c",""],["GV.RM-05","c",""],["GV.SC-02","c",""],["GV.SC-08","c",""],["GV.SC-10","c",""],["ID.IM-04","c",""],["ID.RA-06","c",""],["PR.DS-11","c",""],["PR.IR-02","c",""],["PR.IR-03","c",""],["RC.CO-03","c",""],["RC.CO-04","c",""],["RC.RP-01","c",""],["RC.RP-02","c",""],["RC.RP-03","c",""],["RC.RP-04","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""],["RS.MA-02","c",""],["RS.MA-03","c",""],["RS.MA-04","c",""],["RS.MA-05","c",""],["RS.MI-01","c",""],["RS.MI-02","c",""]],"topics":["Ir","Mt","Rp","Rc","Bc","Dr"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.2","title":"Incident response plan reviewed and tested annually","csf":[["DE.AE-08","c",""],["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.RM-04","c",""],["GV.SC-08","c",""],["ID.IM-02","c",""],["ID.IM-04","c",""],["PR.IR-03","c",""],["RC.RP-01","c",""],["RC.RP-02","c",""],["RC.RP-06","c",""],["RS.MA-01","c",""],["RS.MA-03","c",""],["RS.MA-04","c",""],["RS.MA-05","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.3","title":"Incident response staff available around the clock","csf":[["DE.AE-06","c",""],["GV.RR-03","c",""],["ID.IM-04","c",""],["RC.CO-03","c",""],["RC.CO-04","c",""],["RC.RP-01","c",""],["RS.CO-02","c",""],["RS.MA-01","c",""],["RS.MA-04","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.4","title":"Incident response staff trained","csf":[["DE.AE-08","c",""],["PR.AT-02","c",""],["RS.MA-02","c",""]],"topics":["Ir"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.4.1","title":"Training frequency set by targeted risk analysis","csf":[["GV.RM-03","c",""],["GV.RM-06","c",""],["PR.AT-02","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.5","title":"Plan covers alerts from security monitoring","csf":[["GV.SC-08","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.6","title":"Plan updated from lessons learned and industry changes","csf":[["GV.OV-01","c",""],["GV.OV-02","c",""],["GV.RM-04","c",""],["GV.RR-01","c",""],["GV.SC-08","c",""],["ID.IM-02","c",""],["ID.IM-04","c",""],["PR.IR-03","c",""],["RC.RP-02","c",""],["RC.RP-06","c",""],["RS.CO-03","c",""],["RS.MA-03","c",""],["RS.MA-05","c",""]],"topics":["Ll"],"edTopics":[],"direct":[]},{"fw":"pci","id":"12.10.7","title":"Procedures for PAN found where it shouldn't be","csf":[["ID.AM-07","c",""]],"topics":[],"edTopics":[],"direct":[]},{"fw":"cmmc","id":"AC.L2-3.1.1","title":"Authorized Access Control","text":"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).","csf":[["DE.CM-01","c","800-171r3 03.01.01"],["DE.CM-03","c","800-171r3 03.01.01"],["PR.AA-01","c","800-171r3 03.01.01"],["PR.AA-05","c","800-171r3 03.01.01"],["PR.DS-10","c","800-171r3 03.01.01"]],"topics":["Ac","Zt"],"edTopics":[],"direct":[["nist80053","AC-2","NIST SP 800-171r3 03.01.01 → SP 800-53"],["nist80053","AC-3","NIST SP 800-171r2 Appendix D"],["nist80053","AC-17","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AC.L2-3.1.2","title":"Transaction & Function Control","text":"Limit system access to the types of transactions and functions that authorized users are permitted to execute.","csf":[["PR.AA-05","c","800-171r3 03.01.02"],["PR.DS-10","c","800-171r3 03.01.02"],["PR.IR-01","c","800-171r3 03.01.02"]],"topics":["Ac"],"edTopics":[],"direct":[["nist80053","AC-3","NIST SP 800-171r3 03.01.02 → SP 800-53"],["nist80053","AC-2","NIST SP 800-171r2 Appendix D"],["nist80053","AC-17","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AC.L2-3.1.3","title":"Control CUI Flow","text":"Control the flow of CUI in accordance with approved authorizations.","csf":[["DE.CM-09","c","800-171r3 03.01.03"],["PR.DS-10","c","800-171r3 03.01.03"],["PR.IR-01","c","800-171r3 03.01.03"]],"topics":["Dl"],"edTopics":[],"direct":[["nist80053","AC-4","NIST SP 800-171r3 03.01.03 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.4","title":"Separation of Duties","text":"Separate the duties of individuals to reduce the risk of malevolent activity without collusion.","csf":[["PR.AA-05","c","800-171r3 03.01.04"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-5","NIST SP 800-171r3 03.01.04 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.5","title":"Least Privilege","text":"Employ the principle of least privilege, including for specific security functions and privileged accounts.","csf":[["PR.AA-05","c","800-171r3 03.01.05"]],"topics":["Pa"],"edTopics":[],"direct":[["nist80053","AC-6","NIST SP 800-171r3 03.01.05 → SP 800-53"],["nist80053","AU-9","NIST SP 800-171r3 03.01.05 → SP 800-53"],["nist80053","AC-6(5)","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AC.L2-3.1.6","title":"Non-Privileged Account Use","text":"Use non-privileged accounts or roles when accessing nonsecurity functions.","csf":[["PR.AA-05","c","800-171r3 03.01.06"]],"topics":["Pa"],"edTopics":[],"direct":[["nist80053","AC-6","NIST SP 800-171r3 03.01.06 → SP 800-53"],["nist80053","AC-6(5)","NIST SP 800-171r3 03.01.06 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.7","title":"Privileged Functions","text":"Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.","csf":[["PR.AA-05","c","800-171r3 03.01.07"]],"topics":["Pa"],"edTopics":[],"direct":[["nist80053","AC-6","NIST SP 800-171r3 03.01.07 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.8","title":"Unsuccessful Logon Attempts","text":"Limit unsuccessful logon attempts.","csf":[["PR.AA-03","c","800-171r3 03.01.08 → AC-7"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-7","NIST SP 800-171r3 03.01.08 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.9","title":"Privacy & Security Notices","text":"Provide privacy and security notices consistent with applicable CUI rules.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","AC-8","NIST SP 800-171r3 03.01.09 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.10","title":"Session Lock","text":"Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","AC-11","NIST SP 800-171r3 03.01.10 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.11","title":"Session Termination","text":"Terminate (automatically) a user session after a defined condition.","csf":[["PR.AA-03","c","800-171r3 03.01.11"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-12","NIST SP 800-171r3 03.01.11 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.12","title":"Control Remote Access","text":"Monitor and control remote access sessions.","csf":[["PR.AA-05","c","800-171r3 03.01.12"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-17","NIST SP 800-171r3 03.01.12 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.13","title":"Remote Access Confidentiality","text":"Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.","csf":[["PR.AA-05","c","800-171r3 03.13.08"],["PR.DS-01","c","800-171r3 03.13.08"],["PR.DS-02","c","800-171r3 03.13.08"]],"topics":["En"],"edTopics":[],"direct":[["nist80053","SC-8","NIST SP 800-171r3 03.13.08 → SP 800-53"],["nist80053","SC-28","NIST SP 800-171r3 03.13.08 → SP 800-53"],["nist80053","AC-17","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AC.L2-3.1.14","title":"Remote Access Routing","text":"Route remote access via managed access control points.","csf":[["PR.AA-05","c","800-171r3 03.01.12"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-17","NIST SP 800-171r3 03.01.12 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.15","title":"Privileged Remote Access","text":"Authorize remote execution of privileged commands and remote access to security-relevant information.","csf":[["PR.AA-05","c","800-171r3 03.01.12"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-17","NIST SP 800-171r3 03.01.12 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.16","title":"Wireless Access Authorization","text":"Authorize wireless access prior to allowing such connections.","csf":[["PR.AA-05","c","800-171r3 03.01.16"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-18","NIST SP 800-171r3 03.01.16 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.17","title":"Wireless Access Protection","text":"Protect wireless access using authentication and encryption.","csf":[["PR.AA-05","c","800-171r3 03.01.16"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-18","NIST SP 800-171r3 03.01.16 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.18","title":"Mobile Device Connection","text":"Control connection of mobile devices.","csf":[["PR.AA-05","c","800-171r3 03.01.18"]],"topics":["Mb"],"edTopics":[],"direct":[["nist80053","AC-19","NIST SP 800-171r3 03.01.18 → SP 800-53"],["nist80053","AC-19(5)","NIST SP 800-171r3 03.01.18 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.19","title":"Encrypt CUI on Mobile","text":"Encrypt CUI on mobile devices and mobile computing platforms.","csf":[["PR.AA-05","c","800-171r3 03.01.18"],["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En","Mb"],"edTopics":["En"],"direct":[["nist80053","AC-19","NIST SP 800-171r3 03.01.18 → SP 800-53"],["nist80053","AC-19(5)","NIST SP 800-171r3 03.01.18 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.20","title":"External Connections","text":"Verify and control/limit connections to and use of external systems.","csf":[["ID.AM-02","c","800-171r3 03.01.20 → AC-20"],["ID.AM-04","c","800-171r3 03.01.20 → AC-20"]],"topics":["Cl"],"edTopics":[],"direct":[["nist80053","AC-20","NIST SP 800-171r3 03.01.20 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.21","title":"Portable Storage Use","text":"Limit use of portable storage devices on external systems.","csf":[["ID.AM-02","c","800-171r3 03.01.20 → AC-20"],["ID.AM-04","c","800-171r3 03.01.20 → AC-20"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-20","NIST SP 800-171r3 03.01.20 → SP 800-53"]]},{"fw":"cmmc","id":"AC.L2-3.1.22","title":"Control Public Information","text":"Control CUI posted or processed on publicly accessible systems.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","AC-22","NIST SP 800-171r3 03.01.22 → SP 800-53"]]},{"fw":"cmmc","id":"AT.L2-3.2.1","title":"Role-Based Risk Awareness","text":"Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.","csf":[["PR.AT-01","c","800-171r3 03.02.01 → AT-2"]],"topics":["Aw"],"edTopics":[],"direct":[["nist80053","AT-2","NIST SP 800-171r3 03.02.01 → SP 800-53"],["nist80053","AT-3","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AT.L2-3.2.2","title":"Role-Based Training","text":"Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.","csf":[["PR.AT-01","c","800-171r3 03.02.02"],["PR.AT-02","c","800-171r3 03.02.02"]],"topics":["Aw"],"edTopics":[],"direct":[["nist80053","AT-3","NIST SP 800-171r3 03.02.02 → SP 800-53"],["nist80053","AT-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AT.L2-3.2.3","title":"Insider Threat Awareness","text":"Provide security awareness training on recognizing and reporting potential indicators of insider threat.","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"],["PR.AT-01","c","800-171r3 03.02.01 → AT-2"]],"topics":["Aw","It"],"edTopics":["It"],"direct":[["nist80053","AT-2","NIST SP 800-171r3 03.02.01 → SP 800-53"]]},{"fw":"cmmc","id":"AU.L2-3.3.1","title":"System Auditing","text":"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.","csf":[["PR.PS-04","c","800-171r3 03.03.01 → AU-2"]],"topics":["Lg"],"edTopics":[],"direct":[["nist80053","AU-2","NIST SP 800-171r3 03.03.01 → SP 800-53"],["nist80053","AU-3","NIST SP 800-171r2 Appendix D"],["nist80053","AU-6","NIST SP 800-171r2 Appendix D"],["nist80053","AU-11","NIST SP 800-171r2 Appendix D"],["nist80053","AU-12","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AU.L2-3.3.2","title":"User Accountability","text":"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"],["PR.PS-04","c","800-171r3 03.03.02"]],"topics":["Lg","It"],"edTopics":["It"],"direct":[["nist80053","AU-3","NIST SP 800-171r3 03.03.02 → SP 800-53"],["nist80053","AU-2","NIST SP 800-171r2 Appendix D"],["nist80053","AU-6","NIST SP 800-171r2 Appendix D"],["nist80053","AU-11","NIST SP 800-171r2 Appendix D"],["nist80053","AU-12","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AU.L2-3.3.3","title":"Event Review","text":"Review and update logged events.","csf":[["DE.CM-01","c","800-171r3 03.03.03"],["DE.CM-03","c","800-171r3 03.03.03"],["DE.CM-09","c","800-171r3 03.03.03"],["PR.PS-04","c","800-171r3 03.03.03"]],"topics":[],"edTopics":[],"direct":[["nist80053","AU-11","NIST SP 800-171r3 03.03.03 → SP 800-53"],["nist80053","AU-12","NIST SP 800-171r3 03.03.03 → SP 800-53"],["nist80053","AU-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AU.L2-3.3.4","title":"Audit Failure Alerting","text":"Alert in the event of an audit logging process failure.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","AU-5","NIST SP 800-171r3 03.03.04 → SP 800-53"]]},{"fw":"cmmc","id":"AU.L2-3.3.5","title":"Audit Correlation","text":"Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.","csf":[["DE.AE-02","c","800-171r3 03.03.05"],["DE.AE-03","c","800-171r3 03.03.05"],["PR.PS-04","c","800-171r3 03.03.05"]],"topics":["Sg"],"edTopics":[],"direct":[["nist80053","AU-6","NIST SP 800-171r3 03.03.05 → SP 800-53"],["nist80053","AU-6(3)","NIST SP 800-171r3 03.03.05 → SP 800-53"]]},{"fw":"cmmc","id":"AU.L2-3.3.6","title":"Reduction & Reporting","text":"Provide audit record reduction and report generation to support on-demand analysis and reporting.","csf":[["PR.PS-04","c","800-171r3 03.03.06"],["RS.AN-03","c","800-171r3 03.03.06"],["RS.AN-06","c","800-171r3 03.03.06"],["RS.AN-07","c","800-171r3 03.03.06"]],"topics":["Fn"],"edTopics":[],"direct":[["nist80053","AU-7","NIST SP 800-171r3 03.03.06 → SP 800-53"]]},{"fw":"cmmc","id":"AU.L2-3.3.7","title":"Authoritative Time Source","text":"Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[["nist80053","AU-8","NIST SP 800-171r3 03.03.07 → SP 800-53"],["nist80053","SC-45","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"AU.L2-3.3.8","title":"Audit Protection","text":"Protect audit information and audit logging tools from unauthorized access, modification, and deletion.","csf":[["PR.DS-10","c","800-171r3 03.03.08"]],"topics":[],"edTopics":[],"direct":[["nist80053","AU-9","NIST SP 800-171r3 03.03.08 → SP 800-53"]]},{"fw":"cmmc","id":"AU.L2-3.3.9","title":"Audit Management","text":"Limit management of audit logging functionality to a subset of privileged users.","csf":[["PR.DS-10","c","800-171r3 03.03.08"]],"topics":[],"edTopics":[],"direct":[["nist80053","AU-9","NIST SP 800-171r3 03.03.08 → SP 800-53"]]},{"fw":"cmmc","id":"CA.L2-3.12.1","title":"Security Control Assessment","text":"Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"],["ID.IM-01","c","800-171r3 03.12.01"],["ID.IM-02","c","800-171r3 03.12.01"],["ID.IM-03","c","800-171r3 03.12.01"],["ID.RA-01","c","800-171r3 03.12.01"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[["nist80053","CA-2","NIST SP 800-171r3 03.12.01 → SP 800-53"],["nist80053","CA-5","NIST SP 800-171r2 Appendix D"],["nist80053","CA-7","NIST SP 800-171r2 Appendix D"],["nist80053","PL-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CA.L2-3.12.2","title":"Plan of Action","text":"Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.","csf":[["ID.IM-01","c","800-171r3 03.12.02"],["ID.IM-02","c","800-171r3 03.12.02"],["ID.IM-03","c","800-171r3 03.12.02"]],"topics":[],"edTopics":[],"direct":[["nist80053","CA-5","NIST SP 800-171r3 03.12.02 → SP 800-53"],["nist80053","CA-2","NIST SP 800-171r2 Appendix D"],["nist80053","CA-7","NIST SP 800-171r2 Appendix D"],["nist80053","PL-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CA.L2-3.12.3","title":"Security Control Monitoring","text":"Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.","csf":[["DE.AE-02","c","800-171r3 03.12.03"],["DE.AE-03","c","800-171r3 03.12.03"],["DE.CM-01","c","800-171r3 03.12.03"],["DE.CM-02","c","800-171r3 03.12.03"],["DE.CM-03","c","800-171r3 03.12.03"],["DE.CM-06","c","800-171r3 03.12.03"],["DE.CM-09","c","800-171r3 03.12.03"],["ID.IM-01","c","800-171r3 03.12.03"],["ID.IM-02","c","800-171r3 03.12.03"],["ID.IM-03","c","800-171r3 03.12.03"],["ID.RA-01","c","800-171r3 03.12.03"]],"topics":[],"edTopics":[],"direct":[["nist80053","CA-7","NIST SP 800-171r3 03.12.03 → SP 800-53"],["nist80053","CA-2","NIST SP 800-171r2 Appendix D"],["nist80053","CA-5","NIST SP 800-171r2 Appendix D"],["nist80053","PL-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CA.L2-3.12.4","title":"System Security Plan","text":"Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.","csf":[["ID.AM-03","c","800-171r3 03.15.02"],["ID.AM-08","c","800-171r3 03.15.02"],["ID.IM-01","c","800-171r3 03.15.02"],["ID.IM-02","c","800-171r3 03.15.02"],["ID.IM-03","c","800-171r3 03.15.02"],["ID.IM-04","c","800-171r3 03.15.02"]],"topics":[],"edTopics":[],"direct":[["nist80053","PL-2","NIST SP 800-171r3 03.15.02 → SP 800-53"],["nist80053","CA-2","NIST SP 800-171r2 Appendix D"],["nist80053","CA-5","NIST SP 800-171r2 Appendix D"],["nist80053","CA-7","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CM.L2-3.4.1","title":"System Baselining","text":"Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.","csf":[["PR.PS-01","c","800-171r3 03.04.01"]],"topics":["Am","Cf"],"edTopics":[],"direct":[["nist80053","CM-2","NIST SP 800-171r3 03.04.01 → SP 800-53"],["nist80053","CM-6","NIST SP 800-171r2 Appendix D"],["nist80053","CM-8","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CM.L2-3.4.2","title":"Security Configuration Enforcement","text":"Establish and enforce security configuration settings for information technology products employed in organizational systems.","csf":[["DE.CM-09","c","800-171r3 03.04.02"],["PR.PS-01","c","800-171r3 03.04.02"]],"topics":["Cf"],"edTopics":[],"direct":[["nist80053","CM-6","NIST SP 800-171r3 03.04.02 → SP 800-53"],["nist80053","CM-2","NIST SP 800-171r2 Appendix D"],["nist80053","CM-8","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CM.L2-3.4.3","title":"System Change Management","text":"Track, review, approve or disapprove, and log changes to organizational systems.","csf":[["DE.CM-01","c","800-171r3 03.04.03"],["DE.CM-09","c","800-171r3 03.04.03"],["ID.RA-07","c","800-171r3 03.04.03"],["PR.PS-01","c","800-171r3 03.04.03"]],"topics":[],"edTopics":[],"direct":[["nist80053","CM-3","NIST SP 800-171r3 03.04.03 → SP 800-53"]]},{"fw":"cmmc","id":"CM.L2-3.4.4","title":"Security Impact Analysis","text":"Analyze the security impact of changes prior to implementation.","csf":[["ID.RA-07","c","800-171r3 03.04.04"],["PR.PS-01","c","800-171r3 03.04.04"]],"topics":[],"edTopics":[],"direct":[["nist80053","CM-4","NIST SP 800-171r3 03.04.04 → SP 800-53"]]},{"fw":"cmmc","id":"CM.L2-3.4.5","title":"Access Restrictions for Change","text":"Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.","csf":[["PR.PS-01","c","800-171r3 03.04.05"]],"topics":[],"edTopics":[],"direct":[["nist80053","CM-5","NIST SP 800-171r3 03.04.05 → SP 800-53"],["nist80053","CM-7(5)","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CM.L2-3.4.6","title":"Least Functionality","text":"Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.","csf":[["PR.PS-01","c","800-171r3 03.04.06"]],"topics":["Cf"],"edTopics":[],"direct":[["nist80053","CM-7","NIST SP 800-171r3 03.04.06 → SP 800-53"]]},{"fw":"cmmc","id":"CM.L2-3.4.7","title":"Nonessential Functionality","text":"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.","csf":[["PR.PS-01","c","800-171r3 03.04.08"]],"topics":["Cf"],"edTopics":[],"direct":[["nist80053","CM-7(5)","NIST SP 800-171r3 03.04.08 → SP 800-53"],["nist80053","CM-7","NIST SP 800-171r3 03.04.06 → SP 800-53"]]},{"fw":"cmmc","id":"CM.L2-3.4.8","title":"Application Execution Policy","text":"Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.","csf":[["PR.PS-01","c","800-171r3 03.04.08"]],"topics":[],"edTopics":[],"direct":[["nist80053","CM-7(5)","NIST SP 800-171r3 03.04.08 → SP 800-53"],["nist80053","CM-7","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"CM.L2-3.4.9","title":"User-Installed Software","text":"Control and monitor user-installed software.","csf":[["DE.AE-02","c","800-171r3 03.12.03"],["DE.AE-03","c","800-171r3 03.12.03"],["DE.CM-01","c","800-171r3 03.12.03"],["DE.CM-02","c","800-171r3 03.12.03"],["DE.CM-03","c","800-171r3 03.12.03"],["DE.CM-06","c","800-171r3 03.12.03"],["DE.CM-09","c","800-171r3 03.12.03"],["ID.IM-01","c","800-171r3 03.12.03"],["ID.IM-02","c","800-171r3 03.12.03"],["ID.IM-03","c","800-171r3 03.12.03"],["ID.RA-01","c","800-171r3 03.12.03"],["PR.AA-05","c","800-171r3 03.01.05"],["PR.PS-01","c","800-171r3 03.04.08"]],"topics":[],"edTopics":[],"direct":[["nist80053","CM-7(5)","NIST SP 800-171r3 03.04.08 → SP 800-53"],["nist80053","CA-7","NIST SP 800-171r3 03.12.03 → SP 800-53"],["nist80053","AC-6","NIST SP 800-171r3 03.01.05 → SP 800-53"],["nist80053","AU-9","NIST SP 800-171r3 03.01.05 → SP 800-53"],["nist80053","AC-6(5)","NIST SP 800-171r3 03.01.06 → SP 800-53"],["nist80053","CM-11","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IA.L2-3.5.1","title":"Identification","text":"Identify system users, processes acting on behalf of users, and devices.","csf":[["PR.AA-01","c","800-171r3 03.05.01"],["PR.AA-03","c","800-171r3 03.05.01"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-2","NIST SP 800-171r3 03.05.01 → SP 800-53"],["nist80053","IA-11","NIST SP 800-171r3 03.05.01 → SP 800-53"],["nist80053","IA-3","NIST SP 800-171r2 Appendix D"],["nist80053","IA-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IA.L2-3.5.2","title":"Authentication","text":"Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.","csf":[["PR.AA-01","c","800-171r3 03.05.02"],["PR.AA-03","c","800-171r3 03.05.02"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-3","NIST SP 800-171r3 03.05.02 → SP 800-53"],["nist80053","IA-2","NIST SP 800-171r2 Appendix D"],["nist80053","IA-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IA.L2-3.5.3","title":"Multifactor Authentication","text":"Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.","csf":[["PR.AA-01","c","800-171r3 03.05.03"],["PR.AA-03","c","800-171r3 03.05.03"]],"topics":["Mf"],"edTopics":[],"direct":[["nist80053","IA-2(1)","NIST SP 800-171r3 03.05.03 → SP 800-53"],["nist80053","IA-2(2)","NIST SP 800-171r3 03.05.03 → SP 800-53"]]},{"fw":"cmmc","id":"IA.L2-3.5.4","title":"Replay-Resistant Authentication","text":"Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.","csf":[["PR.AA-01","c","800-171r3 03.05.04"],["PR.AA-03","c","800-171r3 03.05.04"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-2","NIST SP 800-171r3 03.05.04 → SP 800-53"]]},{"fw":"cmmc","id":"IA.L2-3.5.5","title":"Identifier Reuse","text":"Prevent reuse of identifiers for a defined period.","csf":[["PR.AA-01","c","800-171r3 03.05.05"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-4","NIST SP 800-171r3 03.05.05 → SP 800-53"]]},{"fw":"cmmc","id":"IA.L2-3.5.6","title":"Identifier Handling","text":"Disable identifiers after a defined period of inactivity.","csf":[["PR.AA-01","c","800-171r2 App. D → IA-4"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-4","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IA.L2-3.5.7","title":"Password Complexity","text":"Enforce a minimum password complexity and change of characters when new passwords are created.","csf":[["PR.AA-01","c","800-171r3 03.05.07"],["PR.AA-03","c","800-171r3 03.05.07"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-5","NIST SP 800-171r3 03.05.07 → SP 800-53"]]},{"fw":"cmmc","id":"IA.L2-3.5.8","title":"Password Reuse","text":"Prohibit password reuse for a specified number of generations.","csf":[["PR.AA-01","c","800-171r2 App. D → IA-5"],["PR.AA-03","c","800-171r2 App. D → IA-5"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IA.L2-3.5.9","title":"Temporary Passwords","text":"Allow temporary password use for system logons with an immediate change to a permanent password.","csf":[["PR.AA-01","c","800-171r2 App. D → IA-5"],["PR.AA-03","c","800-171r2 App. D → IA-5"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IA.L2-3.5.10","title":"Cryptographically-Protected Passwords","text":"Store and transmit only cryptographically-protected passwords.","csf":[["PR.AA-01","c","800-171r3 03.05.07"],["PR.AA-03","c","800-171r3 03.05.07"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-5","NIST SP 800-171r3 03.05.07 → SP 800-53"]]},{"fw":"cmmc","id":"IA.L2-3.5.11","title":"Obscure Feedback","text":"Obscure feedback of authentication information.","csf":[["PR.AA-01","c","800-171r3 03.05.11"]],"topics":[],"edTopics":[],"direct":[["nist80053","IA-6","NIST SP 800-171r3 03.05.11 → SP 800-53"]]},{"fw":"cmmc","id":"IR.L2-3.6.1","title":"Incident Handling","text":"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.","csf":[["DE.AE-02","c","800-171r3 03.06.01"],["DE.AE-03","c","800-171r3 03.06.01"],["DE.AE-06","c","800-171r3 03.06.01"],["GV.SC-08","c","800-171r3 03.06.01"],["ID.IM-01","c","800-171r3 03.06.01"],["ID.IM-02","c","800-171r3 03.06.01"],["ID.IM-03","c","800-171r3 03.06.01"],["RC.CO-03","c","800-171r3 03.06.01"],["RC.CO-04","c","800-171r3 03.06.01"],["RC.RP-01","c","800-171r3 03.06.01"],["RC.RP-02","c","800-171r3 03.06.01"],["RC.RP-06","c","800-171r3 03.06.01"],["RS.AN-03","c","800-171r3 03.06.01"],["RS.AN-06","c","800-171r3 03.06.01"],["RS.AN-07","c","800-171r3 03.06.01"],["RS.AN-08","c","800-171r3 03.06.01"],["RS.CO-02","c","800-171r3 03.06.01"],["RS.CO-03","c","800-171r3 03.06.01"],["RS.MA-02","c","800-171r3 03.06.01"],["RS.MA-03","c","800-171r3 03.06.01"],["RS.MA-04","c","800-171r3 03.06.01"],["RS.MA-05","c","800-171r3 03.06.01"],["RS.MI-01","c","800-171r3 03.06.01"],["RS.MI-02","c","800-171r3 03.06.01"]],"topics":["Ir","Mt","Ll"],"edTopics":[],"direct":[["nist80053","IR-4","NIST SP 800-171r3 03.06.01 → SP 800-53"],["nist80053","IR-2","NIST SP 800-171r2 Appendix D"],["nist80053","IR-5","NIST SP 800-171r2 Appendix D"],["nist80053","IR-6","NIST SP 800-171r2 Appendix D"],["nist80053","IR-7","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IR.L2-3.6.2","title":"Incident Reporting","text":"Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.","csf":[["DE.AE-03","c","800-171r3 03.06.02"],["GV.SC-08","c","800-171r3 03.06.02"],["RC.CO-03","c","800-171r3 03.06.02"],["RS.AN-06","c","800-171r3 03.06.02"],["RS.AN-07","c","800-171r3 03.06.02"],["RS.CO-02","c","800-171r3 03.06.02"],["RS.CO-03","c","800-171r3 03.06.02"],["RS.MA-01","c","800-171r3 03.06.02"],["RS.MA-02","c","800-171r3 03.06.02"],["RS.MA-03","c","800-171r3 03.06.02"],["RS.MA-04","c","800-171r3 03.06.02"]],"topics":["Co","Rp","Cr"],"edTopics":[],"direct":[["nist80053","IR-5","NIST SP 800-171r3 03.06.02 → SP 800-53"],["nist80053","IR-6","NIST SP 800-171r3 03.06.02 → SP 800-53"],["nist80053","IR-7","NIST SP 800-171r3 03.06.02 → SP 800-53"],["nist80053","IR-2","NIST SP 800-171r2 Appendix D"],["nist80053","IR-4","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"IR.L2-3.6.3","title":"Incident Response Testing","text":"Test the organizational incident response capability.","csf":[["ID.IM-02","c","800-171r3 03.06.03"],["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[["nist80053","IR-3","NIST SP 800-171r3 03.06.03 → SP 800-53"]]},{"fw":"cmmc","id":"MA.L2-3.7.1","title":"Perform Maintenance","text":"Perform maintenance on organizational systems.","csf":[["ID.AM-08","c","800-171r2 App. D → MA-2"],["PR.PS-02","c","800-171r2 App. D → MA-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","MA-2","NIST SP 800-171r2 Appendix D"],["nist80053","MA-3","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"MA.L2-3.7.2","title":"System Maintenance Control","text":"Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.","csf":[["PR.PS-02","c","800-171r3 03.07.04 → MA-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","MA-3","NIST SP 800-171r3 03.07.04 → SP 800-53"],["nist80053","MA-5","NIST SP 800-171r3 03.07.06 → SP 800-53"],["nist80053","MA-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"MA.L2-3.7.3","title":"Equipment Sanitization","text":"Ensure equipment removed for off-site maintenance is sanitized of any CUI.","csf":[["ID.AM-08","c","800-171r2 App. D → MA-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","MP-6","NIST SP 800-171r3 03.08.03 → SP 800-53"],["nist80053","MA-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"MA.L2-3.7.4","title":"Media Inspection","text":"Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.","csf":[["PR.PS-02","c","800-171r3 03.07.04 → MA-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","MA-3","NIST SP 800-171r3 03.07.04 → SP 800-53"]]},{"fw":"cmmc","id":"MA.L2-3.7.5","title":"Nonlocal Maintenance","text":"Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","MA-4","NIST SP 800-171r3 03.07.05 → SP 800-53"]]},{"fw":"cmmc","id":"MA.L2-3.7.6","title":"Maintenance Personnel","text":"Supervise the maintenance activities of maintenance personnel without required access authorization.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","MA-5","NIST SP 800-171r3 03.07.06 → SP 800-53"]]},{"fw":"cmmc","id":"MP.L2-3.8.1","title":"Media Protection","text":"Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","MP-4","NIST SP 800-171r3 03.08.01 → SP 800-53"],["nist80053","MP-2","NIST SP 800-171r2 Appendix D"],["nist80053","MP-6","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"MP.L2-3.8.2","title":"Media Access","text":"Limit access to CUI on system media to authorized users.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","MP-2","NIST SP 800-171r3 03.08.02 → SP 800-53"],["nist80053","MP-4","NIST SP 800-171r2 Appendix D"],["nist80053","MP-6","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"MP.L2-3.8.3","title":"Media Disposal","text":"Sanitize or destroy system media containing CUI before disposal or release for reuse.","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[["nist80053","MP-6","NIST SP 800-171r3 03.08.03 → SP 800-53"],["nist80053","MP-2","NIST SP 800-171r2 Appendix D"],["nist80053","MP-4","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"MP.L2-3.8.4","title":"Media Markings","text":"Mark media with necessary CUI markings and distribution limitations.","csf":[["ID.AM-05","e","topic: Data Classification"],["ID.AM-07","e","topic: Data Classification"]],"topics":["Da"],"edTopics":["Da"],"direct":[["nist80053","MP-3","NIST SP 800-171r3 03.08.04 → SP 800-53"]]},{"fw":"cmmc","id":"MP.L2-3.8.5","title":"Media Accountability","text":"Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.","csf":[["PR.DS-01","c","800-171r3 03.08.05 → SC-28"]],"topics":[],"edTopics":[],"direct":[["nist80053","MP-5","NIST SP 800-171r3 03.08.05 → SP 800-53"],["nist80053","SC-28","NIST SP 800-171r3 03.08.05 → SP 800-53"]]},{"fw":"cmmc","id":"MP.L2-3.8.6","title":"Portable Storage Encryption","text":"Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.","csf":[["PR.AA-05","c","800-171r3 03.13.08"],["PR.DS-01","c","800-171r3 03.13.08"],["PR.DS-02","c","800-171r3 03.13.08"]],"topics":["En"],"edTopics":[],"direct":[["nist80053","SC-8","NIST SP 800-171r3 03.13.08 → SP 800-53"],["nist80053","SC-28","NIST SP 800-171r3 03.13.08 → SP 800-53"]]},{"fw":"cmmc","id":"MP.L2-3.8.7","title":"Removable Media","text":"Control the use of removable media on system components.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","MP-7","NIST SP 800-171r3 03.08.07 → SP 800-53"]]},{"fw":"cmmc","id":"MP.L2-3.8.8","title":"Shared Media","text":"Prohibit the use of portable storage devices when such devices have no identifiable owner.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","MP-7","NIST SP 800-171r3 03.08.07 → SP 800-53"]]},{"fw":"cmmc","id":"MP.L2-3.8.9","title":"Protect Backups","text":"Protect the confidentiality of backup CUI at storage locations.","csf":[["PR.DS-01","c","800-171r3 03.08.09"],["PR.DS-10","c","800-171r3 03.08.09"],["PR.DS-11","c","800-171r3 03.08.09"],["RC.RP-03","c","800-171r3 03.08.09"]],"topics":["Bk"],"edTopics":[],"direct":[["nist80053","CP-9","NIST SP 800-171r3 03.08.09 → SP 800-53"]]},{"fw":"cmmc","id":"PE.L2-3.10.1","title":"Limit Physical Access","text":"Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.","csf":[["PR.AA-06","c","800-171r3 03.10.01"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-2","NIST SP 800-171r3 03.10.01 → SP 800-53"],["nist80053","PE-4","NIST SP 800-171r2 Appendix D"],["nist80053","PE-5","NIST SP 800-171r2 Appendix D"],["nist80053","PE-6","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"PE.L2-3.10.2","title":"Monitor Facility","text":"Protect and monitor the physical facility and support infrastructure for organizational systems.","csf":[["DE.CM-02","c","800-171r3 03.10.02"],["PR.AA-06","c","800-171r3 03.10.02"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-6","NIST SP 800-171r3 03.10.02 → SP 800-53"],["nist80053","PE-2","NIST SP 800-171r2 Appendix D"],["nist80053","PE-4","NIST SP 800-171r2 Appendix D"],["nist80053","PE-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"PE.L2-3.10.3","title":"Escort Visitors","text":"Escort visitors and monitor visitor activity.","csf":[["DE.CM-02","c","800-171r3 03.10.07"],["PR.AA-06","c","800-171r3 03.10.07"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-3","NIST SP 800-171r3 03.10.07 → SP 800-53"],["nist80053","PE-5","NIST SP 800-171r3 03.10.07 → SP 800-53"]]},{"fw":"cmmc","id":"PE.L2-3.10.4","title":"Physical Access Logs","text":"Maintain audit logs of physical access.","csf":[["DE.CM-02","c","800-171r3 03.10.07"],["PR.AA-06","c","800-171r3 03.10.07"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-3","NIST SP 800-171r3 03.10.07 → SP 800-53"],["nist80053","PE-5","NIST SP 800-171r3 03.10.07 → SP 800-53"]]},{"fw":"cmmc","id":"PE.L2-3.10.5","title":"Manage Physical Access","text":"Control and manage physical access devices.","csf":[["DE.CM-02","c","800-171r3 03.10.07"],["PR.AA-06","c","800-171r3 03.10.07"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-3","NIST SP 800-171r3 03.10.07 → SP 800-53"],["nist80053","PE-5","NIST SP 800-171r3 03.10.07 → SP 800-53"]]},{"fw":"cmmc","id":"PE.L2-3.10.6","title":"Alternative Work Sites","text":"Enforce safeguarding measures for CUI at alternate work sites.","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[["nist80053","PE-17","NIST SP 800-171r3 03.10.06 → SP 800-53"]]},{"fw":"cmmc","id":"PS.L2-3.9.1","title":"Screen Individuals","text":"Screen individuals prior to authorizing access to organizational systems containing CUI.","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"]],"topics":["It"],"edTopics":["It"],"direct":[["nist80053","PS-3","NIST SP 800-171r3 03.09.01 → SP 800-53"],["nist80053","PS-4","NIST SP 800-171r2 Appendix D"],["nist80053","PS-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"PS.L2-3.9.2","title":"Personnel Actions","text":"Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","PS-4","NIST SP 800-171r3 03.09.02 → SP 800-53"],["nist80053","PS-5","NIST SP 800-171r3 03.09.02 → SP 800-53"],["nist80053","PS-3","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"RA.L2-3.11.1","title":"Risk Assessments","text":"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.","csf":[["DE.AE-07","c","800-171r3 03.11.01"],["GV.OC-02","c","800-171r3 03.11.01"],["GV.OV-01","c","800-171r3 03.11.01"],["GV.OV-02","c","800-171r3 03.11.01"],["GV.OV-03","c","800-171r3 03.11.01"],["GV.RM-06","c","800-171r3 03.11.01"],["GV.RM-07","c","800-171r3 03.11.01"],["GV.SC-03","c","800-171r3 03.11.01"],["GV.SC-04","c","800-171r3 03.11.01"],["GV.SC-05","c","800-171r3 03.11.01"],["GV.SC-06","c","800-171r3 03.11.01"],["GV.SC-07","c","800-171r3 03.11.01"],["GV.SC-09","c","800-171r3 03.11.01"],["GV.SC-10","c","800-171r3 03.11.01"],["ID.IM-01","c","800-171r3 03.11.01"],["ID.IM-02","c","800-171r3 03.11.01"],["ID.IM-03","c","800-171r3 03.11.01"],["ID.RA-01","c","800-171r3 03.11.01"],["ID.RA-02","c","800-171r3 03.11.01"],["ID.RA-03","c","800-171r3 03.11.01"],["ID.RA-04","c","800-171r3 03.11.01"],["ID.RA-05","c","800-171r3 03.11.01"],["ID.RA-09","c","800-171r3 03.11.01"],["ID.RA-10","c","800-171r3 03.11.01"],["RS.AN-08","c","800-171r3 03.11.01"]],"topics":["Rm","Ra"],"edTopics":[],"direct":[["nist80053","RA-3","NIST SP 800-171r3 03.11.01 → SP 800-53"],["nist80053","SR-6","NIST SP 800-171r3 03.11.01 → SP 800-53"]]},{"fw":"cmmc","id":"RA.L2-3.11.2","title":"Vulnerability Scan","text":"Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.","csf":[["GV.SC-10","c","800-171r3 03.11.02"],["ID.IM-01","c","800-171r3 03.11.02"],["ID.IM-02","c","800-171r3 03.11.02"],["ID.IM-03","c","800-171r3 03.11.02"],["ID.RA-01","c","800-171r3 03.11.02"],["ID.RA-08","c","800-171r3 03.11.02"]],"topics":["Vn"],"edTopics":[],"direct":[["nist80053","RA-5","NIST SP 800-171r3 03.11.02 → SP 800-53"]]},{"fw":"cmmc","id":"RA.L2-3.11.3","title":"Vulnerability Remediation","text":"Remediate vulnerabilities in accordance with risk assessments.","csf":[["GV.SC-10","c","800-171r3 03.11.02"],["ID.IM-01","c","800-171r3 03.11.02"],["ID.IM-02","c","800-171r3 03.11.02"],["ID.IM-03","c","800-171r3 03.11.02"],["ID.RA-01","c","800-171r3 03.11.02"],["ID.RA-08","c","800-171r3 03.11.02"]],"topics":["Vn"],"edTopics":[],"direct":[["nist80053","RA-5","NIST SP 800-171r3 03.11.02 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.1","title":"Boundary Protection","text":"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.","csf":[["DE.CM-01","c","800-171r3 03.13.01"],["PR.DS-01","c","800-171r3 03.13.01"],["PR.DS-02","c","800-171r3 03.13.01"],["PR.DS-10","c","800-171r3 03.13.01"],["PR.IR-01","c","800-171r3 03.13.01"]],"topics":["Fw","Ws","Zt"],"edTopics":[],"direct":[["nist80053","SC-7","NIST SP 800-171r3 03.13.01 → SP 800-53"],["nist80053","SA-8","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"SC.L2-3.13.2","title":"Security Engineering","text":"Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.","csf":[["DE.CM-01","c","800-171r2 App. D → SC-7"],["ID.AM-08","c","800-171r2 App. D → SA-8"],["ID.IM-01","c","800-171r2 App. D → SA-8"],["ID.IM-02","c","800-171r2 App. D → SA-8"],["ID.IM-03","c","800-171r2 App. D → SA-8"],["PR.DS-01","c","800-171r2 App. D → SC-7"],["PR.DS-02","c","800-171r2 App. D → SC-7"],["PR.DS-10","c","800-171r2 App. D → SC-7"],["PR.IR-01","c","800-171r2 App. D → SC-7"],["PR.IR-03","c","800-171r2 App. D → SA-8"],["PR.PS-06","c","800-171r2 App. D → SA-8"]],"topics":["Sd"],"edTopics":[],"direct":[["nist80053","SC-7","NIST SP 800-171r2 Appendix D"],["nist80053","SA-8","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"SC.L2-3.13.3","title":"Role Separation","text":"Separate user functionality from system management functionality.","csf":[["DE.CM-01","c","800-171r3 03.01.01"],["DE.CM-03","c","800-171r3 03.01.01"],["DE.CM-09","c","800-171r3 03.01.03"],["PR.AA-01","c","800-171r3 03.01.01"],["PR.AA-05","c","800-171r3 03.01.01"],["PR.DS-10","c","800-171r3 03.01.01"],["PR.IR-01","c","800-171r3 03.01.02"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-2","NIST SP 800-171r3 03.01.01 → SP 800-53"],["nist80053","AC-3","NIST SP 800-171r3 03.01.02 → SP 800-53"],["nist80053","AC-4","NIST SP 800-171r3 03.01.03 → SP 800-53"],["nist80053","AC-5","NIST SP 800-171r3 03.01.04 → SP 800-53"],["nist80053","AC-6","NIST SP 800-171r3 03.01.05 → SP 800-53"],["nist80053","AU-9","NIST SP 800-171r3 03.01.05 → SP 800-53"],["nist80053","AC-6(5)","NIST SP 800-171r3 03.01.06 → SP 800-53"],["nist80053","SC-2","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"SC.L2-3.13.4","title":"Shared Resource Control","text":"Prevent unauthorized and unintended information transfer via shared system resources.","csf":[["PR.DS-01","c","800-171r3 03.13.04"],["PR.DS-02","c","800-171r3 03.13.04"],["PR.DS-10","c","800-171r3 03.13.04"],["PR.IR-01","c","800-171r3 03.13.04"]],"topics":[],"edTopics":[],"direct":[["nist80053","SC-4","NIST SP 800-171r3 03.13.04 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.5","title":"Public-Access System Separation","text":"Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.","csf":[["DE.CM-01","c","800-171r3 03.13.01"],["PR.DS-01","c","800-171r3 03.13.01"],["PR.DS-02","c","800-171r3 03.13.01"],["PR.DS-10","c","800-171r3 03.13.01"],["PR.IR-01","c","800-171r3 03.13.01"]],"topics":["Fw"],"edTopics":[],"direct":[["nist80053","SC-7","NIST SP 800-171r3 03.13.01 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.6","title":"Network Communication by Exception","text":"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).","csf":[["DE.CM-01","c","800-171r3 03.13.06"],["PR.DS-01","c","800-171r3 03.13.06"],["PR.DS-02","c","800-171r3 03.13.06"],["PR.DS-10","c","800-171r3 03.13.06"],["PR.IR-01","c","800-171r3 03.13.06"]],"topics":["Fw","Zt"],"edTopics":[],"direct":[["nist80053","SC-7","NIST SP 800-171r3 03.13.06 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.7","title":"Split Tunneling","text":"Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).","csf":[["DE.CM-09","c","800-171r3 03.04.02"],["PR.AA-05","c","800-171r3 03.01.12"],["PR.PS-01","c","800-171r3 03.04.02"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-17","NIST SP 800-171r3 03.01.12 → SP 800-53"],["nist80053","CM-6","NIST SP 800-171r3 03.04.02 → SP 800-53"],["nist80053","CM-7","NIST SP 800-171r3 03.04.06 → SP 800-53"],["nist80053","SC-7","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"SC.L2-3.13.8","title":"Data in Transit","text":"Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.","csf":[["PR.AA-05","c","800-171r3 03.13.08"],["PR.DS-01","c","800-171r3 03.13.08"],["PR.DS-02","c","800-171r3 03.13.08"]],"topics":["En"],"edTopics":[],"direct":[["nist80053","SC-8","NIST SP 800-171r3 03.13.08 → SP 800-53"],["nist80053","SC-28","NIST SP 800-171r3 03.13.08 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.9","title":"Connections Termination","text":"Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","SC-10","NIST SP 800-171r3 03.13.09 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.10","title":"Key Management","text":"Establish and manage cryptographic keys for cryptography employed in organizational systems.","csf":[["PR.DS-01","c","800-171r3 03.13.10"],["PR.DS-02","c","800-171r3 03.13.10"]],"topics":["En"],"edTopics":[],"direct":[["nist80053","SC-12","NIST SP 800-171r3 03.13.10 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.11","title":"CUI Encryption","text":"Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.","csf":[["PR.DS-01","c","800-171r3 03.13.11"],["PR.DS-02","c","800-171r3 03.13.11"],["PR.DS-10","c","800-171r3 03.13.11"]],"topics":["En"],"edTopics":[],"direct":[["nist80053","SC-13","NIST SP 800-171r3 03.13.11 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.12","title":"Collaborative Device Control","text":"Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","SC-15","NIST SP 800-171r3 03.13.12 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.13","title":"Mobile Code","text":"Control and monitor the use of mobile code.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","SC-18","NIST SP 800-171r3 03.13.13 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.15","title":"Communications Authenticity","text":"Protect the authenticity of communications sessions.","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","SC-23","NIST SP 800-171r3 03.13.15 → SP 800-53"]]},{"fw":"cmmc","id":"SC.L2-3.13.16","title":"Data at Rest","text":"Protect the confidentiality of CUI at rest.","csf":[["PR.AA-05","c","800-171r3 03.13.08"],["PR.DS-01","c","800-171r3 03.13.08"],["PR.DS-02","c","800-171r3 03.13.08"]],"topics":["En","Dp"],"edTopics":[],"direct":[["nist80053","SC-8","NIST SP 800-171r3 03.13.08 → SP 800-53"],["nist80053","SC-28","NIST SP 800-171r3 03.13.08 → SP 800-53"]]},{"fw":"cmmc","id":"SI.L2-3.14.1","title":"Flaw Remediation","text":"Identify, report, and correct system flaws in a timely manner.","csf":[["ID.IM-01","c","800-171r3 03.14.01"],["ID.IM-02","c","800-171r3 03.14.01"],["ID.IM-03","c","800-171r3 03.14.01"],["PR.PS-02","c","800-171r3 03.14.01"]],"topics":["Pm"],"edTopics":[],"direct":[["nist80053","SI-2","NIST SP 800-171r3 03.14.01 → SP 800-53"],["nist80053","SI-3","NIST SP 800-171r2 Appendix D"],["nist80053","SI-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"SI.L2-3.14.2","title":"Malicious Code Protection","text":"Provide protection from malicious code at designated locations within organizational systems.","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.DS-01","c","800-171r3 03.14.02"],["PR.DS-02","c","800-171r3 03.14.02"],["PR.DS-10","c","800-171r3 03.14.02"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep","Ml"],"edTopics":["Ep"],"direct":[["nist80053","SI-3","NIST SP 800-171r3 03.14.02 → SP 800-53"],["nist80053","SI-2","NIST SP 800-171r2 Appendix D"],["nist80053","SI-5","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"SI.L2-3.14.3","title":"Security Alerts & Advisories","text":"Monitor system security alerts and advisories and take action in response.","csf":[["ID.RA-01","c","800-171r3 03.14.03"],["ID.RA-03","c","800-171r3 03.14.03"]],"topics":["Ti"],"edTopics":[],"direct":[["nist80053","SI-5","NIST SP 800-171r3 03.14.03 → SP 800-53"],["nist80053","SI-2","NIST SP 800-171r2 Appendix D"],["nist80053","SI-3","NIST SP 800-171r2 Appendix D"]]},{"fw":"cmmc","id":"SI.L2-3.14.4","title":"Update Malicious Code Protection","text":"Update malicious code protection mechanisms when new releases are available.","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.DS-01","c","800-171r3 03.14.02"],["PR.DS-02","c","800-171r3 03.14.02"],["PR.DS-10","c","800-171r3 03.14.02"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[["nist80053","SI-3","NIST SP 800-171r3 03.14.02 → SP 800-53"]]},{"fw":"cmmc","id":"SI.L2-3.14.5","title":"System & File Scanning","text":"Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.","csf":[["PR.DS-01","c","800-171r3 03.14.02"],["PR.DS-02","c","800-171r3 03.14.02"],["PR.DS-10","c","800-171r3 03.14.02"]],"topics":[],"edTopics":[],"direct":[["nist80053","SI-3","NIST SP 800-171r3 03.14.02 → SP 800-53"]]},{"fw":"cmmc","id":"SI.L2-3.14.6","title":"Monitor Communications for Attacks","text":"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.","csf":[["DE.AE-02","c","800-171r3 03.14.06"],["DE.AE-03","c","800-171r3 03.14.06"],["DE.CM-01","c","800-171r3 03.14.06"],["DE.CM-06","c","800-171r3 03.14.06"],["DE.CM-09","c","800-171r3 03.14.06"],["ID.IM-01","c","800-171r3 03.14.06"],["ID.IM-02","c","800-171r3 03.14.06"],["ID.IM-03","c","800-171r3 03.14.06"],["ID.RA-01","c","800-171r3 03.14.06"],["PR.DS-01","c","800-171r3 03.14.06"],["PR.DS-02","c","800-171r3 03.14.06"],["PR.DS-10","c","800-171r3 03.14.06"]],"topics":["Sm","Id"],"edTopics":[],"direct":[["nist80053","SI-4","NIST SP 800-171r3 03.14.06 → SP 800-53"]]},{"fw":"cmmc","id":"SI.L2-3.14.7","title":"Identify Unauthorized Use","text":"Identify unauthorized use of organizational systems.","csf":[["DE.AE-02","c","800-171r3 03.14.06"],["DE.AE-03","c","800-171r3 03.14.06"],["DE.CM-01","c","800-171r3 03.14.06"],["DE.CM-06","c","800-171r3 03.14.06"],["DE.CM-09","c","800-171r3 03.14.06"],["ID.IM-01","c","800-171r3 03.14.06"],["ID.IM-02","c","800-171r3 03.14.06"],["ID.IM-03","c","800-171r3 03.14.06"],["ID.RA-01","c","800-171r3 03.14.06"],["PR.DS-01","c","800-171r3 03.14.06"],["PR.DS-02","c","800-171r3 03.14.06"],["PR.DS-10","c","800-171r3 03.14.06"]],"topics":["Sm","An"],"edTopics":[],"direct":[["nist80053","SI-4","NIST SP 800-171r3 03.14.06 → SP 800-53"]]},{"fw":"hipaa","id":"§164.308(a)(1)","title":"Security Management Process","text":"Implement policies and procedures to prevent, detect, contain, and correct security violations.","csf":[["GV.OC-03","c","800-53 RA-1"],["GV.OV-01","c","800-53 RA-1"],["GV.PO-01","c","800-53 RA-1"],["GV.PO-02","c","800-53 RA-1"],["GV.SC-03","c","800-53 RA-1"],["ID.IM-01","c","800-53 RA-1"],["ID.IM-02","c","800-53 RA-1"],["ID.IM-03","c","800-53 RA-1"]],"topics":[],"edTopics":[],"direct":[["nist80053","RA-1","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(1)(ii)(A)","title":"Risk Analysis","text":"Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the covered entity or business associate.","status":"Required","csf":[["DE.AE-07","c","800-53 RA-3"],["GV.RM-06","c","800-53 RA-3"],["GV.RM-07","c","800-53 RA-3"],["GV.SC-03","c","800-53 RA-3"],["GV.SC-09","c","800-53 RA-3"],["GV.SC-10","c","800-53 RA-3"],["ID.AM-05","c","800-53 RA-2"],["ID.IM-01","c","800-53 RA-3"],["ID.IM-02","c","800-53 RA-3"],["ID.IM-03","c","800-53 RA-3"],["ID.RA-01","c","800-53 RA-3"],["ID.RA-03","c","800-53 RA-3"],["ID.RA-04","c","800-53 RA-2"],["ID.RA-05","c","800-53 RA-2"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["RS.AN-08","c","800-53 RA-3"]],"topics":["Ra","Vn"],"edTopics":["Vn"],"direct":[["nist80053","RA-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-3","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 6.1.2","HIPAA's risk analysis is the ISO 27001 risk assessment (6.1.2, 8.2); both NIST crosswalks route it through SP 800-53 RA-3.","e"],["iso","Clause 8.2","HIPAA's risk analysis is the ISO 27001 risk assessment (6.1.2, 8.2); both NIST crosswalks route it through SP 800-53 RA-3.","e"]]},{"fw":"hipaa","id":"§164.308(a)(1)(ii)(B)","title":"Risk Management","text":"Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with §164.306(a)","status":"Required","csf":[["DE.AE-07","c","800-53 RA-3"],["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","c","800-53 RA-3"],["GV.RM-07","c","800-53 RA-3"],["GV.SC-03","c","800-53 RA-3"],["GV.SC-09","c","800-53 RA-3"],["GV.SC-10","c","800-53 RA-3"],["ID.AM-03","c","800-53 PL-2"],["ID.AM-05","c","800-53 RA-2"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 PL-2"],["ID.IM-02","c","800-53 PL-2"],["ID.IM-03","c","800-53 PL-2"],["ID.IM-04","c","800-53 PL-2"],["ID.RA-01","c","800-53 RA-3"],["ID.RA-03","c","800-53 RA-3"],["ID.RA-04","c","800-53 RA-2"],["ID.RA-05","c","800-53 RA-2"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["RS.AN-08","c","800-53 RA-3"]],"topics":["Rm","Vn"],"edTopics":["Rm","Vn"],"direct":[["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-3","NIST HIPAA → SP 800-53 crosswalk"],["iso","Clause 6.1.3","HIPAA's risk management (reduce risk to a reasonable level) is ISO 27001 risk treatment (6.1.3, 8.3).","e"],["iso","Clause 8.3","HIPAA's risk management (reduce risk to a reasonable level) is ISO 27001 risk treatment (6.1.3, 8.3).","e"]]},{"fw":"hipaa","id":"§164.308(a)(1)(ii)(C)","title":"Sanction Policy","text":"Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate","status":"Required","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"]],"topics":["It"],"edTopics":["It"],"direct":[["nist80053","PS-8","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(1)(ii)(D)","title":"Information System Activity Review","text":"Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.","status":"Required","csf":[["DE.AE-02","c","800-53 AU-6"],["DE.AE-03","c","800-53 AU-6"],["DE.CM-01","c","800-53 CA-7"],["DE.CM-02","c","800-53 CA-7"],["DE.CM-03","c","800-53 CA-7"],["DE.CM-06","c","800-53 CA-7"],["DE.CM-09","c","800-53 CA-7"],["ID.IM-01","c","800-53 CA-7"],["ID.IM-02","c","800-53 CA-7"],["ID.IM-03","c","800-53 CA-7"],["ID.RA-01","c","800-53 CA-7"],["ID.RA-07","c","800-53 CA-7"],["PR.DS-01","c","800-53 SI-4"],["PR.DS-02","c","800-53 SI-4"],["PR.DS-10","c","800-53 SI-4"],["PR.PS-04","c","800-53 AU-6"],["RC.CO-03","c","800-53 IR-6"],["RS.AN-03","c","800-53 AU-7"],["RS.AN-06","c","800-53 AU-7"],["RS.AN-07","c","800-53 AU-7"],["RS.CO-02","c","800-53 IR-6"],["RS.CO-03","c","800-53 IR-6"],["RS.MA-01","c","800-53 IR-6"],["RS.MA-02","c","800-53 IR-5"],["RS.MA-03","c","800-53 IR-5"],["RS.MA-04","c","800-53 IR-5"]],"topics":["Sm","Sg"],"edTopics":[],"direct":[["nist80053","AU-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SI-4","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(2)","title":"Assigned Security Responsibility","text":"Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate.","csf":[["GV.RR-01","c","800-53 PM-2"],["GV.RR-02","c","800-53 PM-2"]],"topics":["Rr"],"edTopics":[],"direct":[["nist80053","CA-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PM-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(3)","title":"Workforce Security","text":"Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.SC-03","c","800-53 AC-1"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.DS-10","c","800-53 AC-2"],["PR.IR-01","c","800-53 AC-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(3)(ii)(A)","title":"Authorization and/or Supervision","text":"Implement procedures for the authorization and/or supervision of workforce members who work with ePHI or in locations where it might be accessed.","status":"Addressable","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["DE.CM-06","c","800-53 PS-7"],["DE.CM-09","c","800-53 AC-4"],["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.RR-04","c","800-53 PS-1"],["GV.SC-03","c","800-53 AC-1"],["ID.AM-03","c","800-53 AC-4"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.DS-10","c","800-53 AC-2"],["PR.IR-01","c","800-53 AC-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MA-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(3)(ii)(B)","title":"Workforce Clearance Procedure","text":"Implement procedures to determine that the access of a workforce member to ePHI is appropriate.","status":"Addressable","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["DE.CM-06","c","800-53 PS-7"],["GV.OC-03","c","800-53 PS-1"],["GV.OV-01","c","800-53 PS-1"],["GV.PO-01","c","800-53 PS-1"],["GV.PO-02","c","800-53 PS-1"],["GV.RR-04","c","800-53 PS-1"],["GV.SC-03","c","800-53 PS-1"],["ID.IM-01","c","800-53 PS-1"],["ID.IM-02","c","800-53 PS-1"],["ID.IM-03","c","800-53 PS-1"],["PR.AA-01","c","800-53 AC-2"],["PR.AA-05","c","800-53 AC-2"],["PR.DS-10","c","800-53 AC-2"]],"topics":["It"],"edTopics":[],"direct":[["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(3)(ii)(C)","title":"Termination Procedures","text":"Implement procedures for terminating access to ePHI when the employment of or other arrangement with a workforce member ends or as required by determinations made as specified in §164.308(a)(3)(ii)(B).","status":"Addressable","csf":[["GV.OC-03","c","800-53 PS-1"],["GV.OV-01","c","800-53 PS-1"],["GV.PO-01","c","800-53 PS-1"],["GV.PO-02","c","800-53 PS-1"],["GV.RR-04","c","800-53 PS-1"],["GV.SC-03","c","800-53 PS-1"],["ID.IM-01","c","800-53 PS-1"],["ID.IM-02","c","800-53 PS-1"],["ID.IM-03","c","800-53 PS-1"]],"topics":[],"edTopics":[],"direct":[["nist80053","PS-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-5","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(4)","title":"Information Access Management","text":"Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.SC-03","c","800-53 AC-1"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.DS-10","c","800-53 AC-2"]],"topics":["Ac"],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(4)(ii)(A)","title":"Isolating Health care Clearinghouse Function","text":"If a healthcare clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the ePHI of the clearinghouse from unauthorized access by the larger organization.","status":"Required","csf":[["ID.AM-03","c","800-53 CA-3"],["PR.AA-05","c","800-53 AC-5"],["PR.DS-01","c","800-53 CA-3"],["PR.DS-02","c","800-53 CA-3"],["PR.DS-10","c","800-53 CA-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-3","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(4)(ii)(B)","title":"Access Authorization","text":"Implement policies and procedures for granting access to ePHI, such as through access to a workstation, transaction, program, process, or other mechanism.","status":"Addressable","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["DE.CM-06","c","800-53 PS-7"],["DE.CM-09","c","800-53 AC-4"],["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.RR-04","c","800-53 PS-7"],["GV.SC-03","c","800-53 AC-1"],["ID.AM-03","c","800-53 AC-4"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.DS-10","c","800-53 AC-2"],["PR.IR-01","c","800-53 AC-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(4)(ii)(C)","title":"Access Establishment and Modification","text":"Implement policies and procedures that – based on the covered entity or business associate’s access authorization policies – establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process.","status":"Addressable","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.SC-03","c","800-53 AC-1"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.DS-10","c","800-53 AC-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(5)","title":"Security Awareness and Training","text":"Implement a security awareness and training program for all members of its workforce (including management).","csf":[["GV.OC-03","c","800-53 AT-1"],["GV.OV-01","c","800-53 AT-1"],["GV.PO-01","c","800-53 AT-1"],["GV.PO-02","c","800-53 AT-1"],["GV.SC-03","c","800-53 AT-1"],["ID.IM-01","c","800-53 AT-1"],["ID.IM-02","c","800-53 AT-1"],["ID.IM-03","c","800-53 AT-1"],["PR.AT-01","c","800-53 AT-2"],["PR.AT-02","c","800-53 AT-3"]],"topics":["Aw"],"edTopics":[],"direct":[["nist80053","AT-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-4","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(5)(ii)(A)","title":"Security Reminders","text":"Implement periodic security updates.","status":"Addressable","csf":[["PR.AT-01","c","800-53 AT-2"],["PR.AT-02","c","800-53 AT-3"]],"topics":["Aw"],"edTopics":[],"direct":[["nist80053","AT-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-3","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(5)(ii)(B)","title":"Protection from Malicious Software","text":"Guarding against, detecting, and reporting malicious software;","status":"Addressable","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.AT-01","c","800-53 AT-2"],["PR.AT-02","c","800-53 AT-3"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[["nist80053","AT-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-3","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(5)(ii)(C)","title":"Log-in Monitoring","text":"Monitoring login attempts and reporting discrepancies; and","status":"Addressable","csf":[["DE.AE-02","c","800-53 AU-6"],["DE.AE-03","c","800-53 AU-6"],["PR.AT-01","c","800-53 AT-3"],["PR.AT-02","c","800-53 AT-3"],["PR.PS-04","c","800-53 AU-6"]],"topics":[],"edTopics":[],"direct":[["nist80053","AT-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(5)(ii)(D)","title":"Password Management","text":"Creating, changing, and safeguarding passwords.","status":"Addressable","csf":[["PR.AT-01","c","800-53 AT-2"],["PR.AT-02","c","800-53 AT-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","AT-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-3","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(6)","title":"Security Incident Procedures","text":"Implement policies and procedures to address security incidents.","csf":[["DE.AE-02","c","800-53 IR-4"],["DE.AE-03","c","800-53 IR-4"],["DE.AE-06","c","800-53 IR-4"],["DE.AE-08","c","800-53 IR-4"],["GV.OC-03","c","800-53 IR-1"],["GV.OV-01","c","800-53 IR-1"],["GV.PO-01","c","800-53 IR-1"],["GV.PO-02","c","800-53 IR-1"],["GV.SC-03","c","800-53 IR-1"],["GV.SC-08","c","800-53 IR-1"],["ID.IM-01","c","800-53 IR-1"],["ID.IM-02","c","800-53 IR-1"],["ID.IM-03","c","800-53 IR-1"],["RC.CO-03","c","800-53 IR-4"],["RC.CO-04","c","800-53 IR-4"],["RC.RP-01","c","800-53 IR-4"],["RC.RP-02","c","800-53 IR-4"],["RC.RP-04","c","800-53 IR-1"],["RC.RP-06","c","800-53 IR-4"],["RS.AN-03","c","800-53 IR-4"],["RS.AN-06","c","800-53 IR-4"],["RS.AN-07","c","800-53 IR-4"],["RS.AN-08","c","800-53 IR-4"],["RS.CO-02","c","800-53 IR-4"],["RS.CO-03","c","800-53 IR-4"],["RS.MA-02","c","800-53 IR-4"],["RS.MA-03","c","800-53 IR-4"],["RS.MA-04","c","800-53 IR-4"],["RS.MA-05","c","800-53 IR-4"],["RS.MI-01","c","800-53 IR-4"],["RS.MI-02","c","800-53 IR-4"]],"topics":["Ir"],"edTopics":[],"direct":[["nist80053","IR-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-4","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(6)(ii)","title":"Response and Reporting","text":"Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.","status":"Required","csf":[["DE.AE-02","c","800-53 IR-4"],["DE.AE-03","c","800-53 IR-4"],["DE.AE-06","c","800-53 IR-4"],["DE.AE-08","c","800-53 IR-4"],["ID.IM-01","c","800-53 IR-4"],["ID.IM-02","c","800-53 IR-4"],["ID.IM-03","c","800-53 IR-4"],["ID.IM-04","c","800-53 IR-8"],["RC.CO-03","c","800-53 IR-4"],["RC.CO-04","c","800-53 IR-4"],["RC.RP-01","c","800-53 IR-4"],["RC.RP-02","c","800-53 IR-4"],["RC.RP-04","c","800-53 IR-8"],["RC.RP-06","c","800-53 IR-4"],["RS.AN-03","c","800-53 IR-4"],["RS.AN-06","c","800-53 IR-4"],["RS.AN-07","c","800-53 IR-4"],["RS.AN-08","c","800-53 IR-4"],["RS.CO-02","c","800-53 IR-4"],["RS.CO-03","c","800-53 IR-4"],["RS.MA-01","c","800-53 IR-6"],["RS.MA-02","c","800-53 IR-4"],["RS.MA-03","c","800-53 IR-4"],["RS.MA-04","c","800-53 IR-4"],["RS.MA-05","c","800-53 IR-4"],["RS.MI-01","c","800-53 IR-4"],["RS.MI-02","c","800-53 IR-4"]],"topics":["Ir","Mt","Rp"],"edTopics":[],"direct":[["nist80053","IR-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(7)","title":"Contingency Plan","text":"Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information","csf":[["GV.OC-03","c","800-53 CP-1"],["GV.OC-04","c","800-53 CP-2"],["GV.OV-01","c","800-53 CP-1"],["GV.PO-01","c","800-53 CP-1"],["GV.PO-02","c","800-53 CP-1"],["GV.SC-03","c","800-53 CP-1"],["GV.SC-08","c","800-53 CP-1"],["ID.IM-01","c","800-53 CP-1"],["ID.IM-02","c","800-53 CP-1"],["ID.IM-03","c","800-53 CP-1"],["ID.IM-04","c","800-53 CP-2"],["PR.IR-02","c","800-53 CP-2"],["RC.CO-04","c","800-53 CP-2"],["RC.RP-03","c","800-53 CP-2"]],"topics":["Rc"],"edTopics":[],"direct":[["nist80053","CP-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(7)(ii)(A)","title":"Data Backup Plan","text":"Establish and implement procedures to create and maintain retrievable exact copies of ePHI.","status":"Required","csf":[["PR.DS-01","c","800-53 CP-9"],["PR.DS-10","c","800-53 CP-9"],["PR.DS-11","c","800-53 CP-6"],["PR.IR-04","c","800-53 CP-6"],["RC.RP-03","c","800-53 CP-9"]],"topics":["Bk"],"edTopics":[],"direct":[["nist80053","CP-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(7)(ii)(B)","title":"Disaster Recovery Plan","text":"Establish (and implement as needed) procedures to restore any loss of data.","status":"Required","csf":[["GV.OC-04","c","800-53 CP-2"],["ID.IM-01","c","800-53 CP-2"],["ID.IM-02","c","800-53 CP-2"],["ID.IM-03","c","800-53 CP-2"],["ID.IM-04","c","800-53 CP-2"],["PR.DS-01","c","800-53 CP-9"],["PR.DS-10","c","800-53 CP-9"],["PR.DS-11","c","800-53 CP-6"],["PR.IR-02","c","800-53 CP-2"],["PR.IR-04","c","800-53 CP-6"],["RC.CO-04","c","800-53 CP-2"],["RC.RP-01","c","800-53 CP-10"],["RC.RP-02","c","800-53 CP-10"],["RC.RP-03","c","800-53 CP-2"],["RC.RP-05","c","800-53 CP-10"]],"topics":["Rc","Dr"],"edTopics":[],"direct":[["nist80053","CP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-9","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-10","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(7)(ii)(C)","title":"Emergency Mode Operation Plan","text":"Establish (and implement as needed) procedures to enable the continuation of critical business processes to protect the security of ePHI while operating in emergency mode.","status":"Required","csf":[["GV.OC-04","c","800-53 CP-2"],["ID.IM-01","c","800-53 CP-2"],["ID.IM-02","c","800-53 CP-2"],["ID.IM-03","c","800-53 CP-2"],["ID.IM-04","c","800-53 CP-2"],["PR.IR-02","c","800-53 CP-2"],["RC.CO-04","c","800-53 CP-2"],["RC.RP-01","c","800-53 CP-10"],["RC.RP-02","c","800-53 CP-10"],["RC.RP-03","c","800-53 CP-2"],["RC.RP-05","c","800-53 CP-10"]],"topics":["Bc"],"edTopics":[],"direct":[["nist80053","CP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-10","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(7)(ii)(D)","title":"Testing and Revision Procedure","text":"Implement procedures for the periodic testing and revision of contingency plans.","status":"Addressable","csf":[["GV.OC-04","c","800-53 CP-2"],["ID.IM-01","c","800-53 CP-2"],["ID.IM-02","c","800-53 CP-2"],["ID.IM-03","c","800-53 CP-2"],["ID.IM-04","c","800-53 CP-2"],["PR.IR-02","c","800-53 CP-2"],["PR.IR-03","e","topic: Disaster Recovery"],["RC.CO-04","c","800-53 CP-2"],["RC.RP-02","e","topic: Disaster Recovery"],["RC.RP-03","c","800-53 CP-2"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Dr"],"edTopics":["Dr"],"direct":[["nist80053","CP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-4","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(7)(ii)(E)","title":"Applications and Data Criticality Analysis","text":"Assess the relative criticality of specific applications and data in support of other Contingency Plan components.","status":"Addressable","csf":[["GV.OC-04","c","800-53 CP-2"],["ID.AM-05","c","800-53 RA-2"],["ID.IM-01","c","800-53 CP-2"],["ID.IM-02","c","800-53 CP-2"],["ID.IM-03","c","800-53 CP-2"],["ID.IM-04","c","800-53 CP-2"],["ID.RA-04","c","800-53 RA-2"],["ID.RA-05","c","800-53 RA-2"],["PR.IR-02","c","800-53 CP-2"],["RC.CO-04","c","800-53 CP-2"],["RC.RP-03","c","800-53 CP-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","CP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-2(8)","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(a)(8)","title":"Evaluation","text":"Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity’s or business associate’s security policies and procedures meet the requirements of this subpart.","csf":[["DE.AE-02","c","800-53 CA-7"],["DE.AE-03","c","800-53 CA-7"],["DE.CM-01","c","800-53 CA-7"],["DE.CM-02","c","800-53 CA-7"],["DE.CM-03","c","800-53 CA-7"],["DE.CM-06","c","800-53 CA-7"],["DE.CM-09","c","800-53 CA-7"],["GV.OC-03","c","800-53 CA-1"],["GV.OV-01","c","800-53 CA-1"],["GV.OV-03","e","topic: Compliance"],["GV.PO-01","c","800-53 CA-1"],["GV.PO-02","c","800-53 CA-1"],["GV.SC-03","c","800-53 CA-1"],["ID.IM-01","c","800-53 CA-1"],["ID.IM-02","c","800-53 CA-1"],["ID.IM-03","c","800-53 CA-1"],["ID.RA-01","c","800-53 CA-2"],["ID.RA-07","c","800-53 CA-7"]],"topics":["Cm","Vn"],"edTopics":["Cm"],"direct":[["nist80053","CA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-8","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(b)(1)","title":"Business Associate Contracts and Other Arrangements","text":"A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity’s behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.","csf":[["DE.CM-06","c","800-53 PS-7"],["GV.OC-05","c","800-53 SA-9"],["GV.RR-04","c","800-53 PS-7"],["GV.SC-04","c","800-53 SA-9"],["GV.SC-05","c","800-53 SA-9"],["GV.SC-06","c","800-53 SA-9"],["GV.SC-07","c","800-53 SA-9"],["GV.SC-08","c","800-53 SA-9"],["GV.SC-09","c","800-53 SA-9"],["GV.SC-10","c","800-53 SA-9"],["ID.AM-02","c","800-53 SA-9"],["ID.AM-03","c","800-53 CA-3"],["ID.AM-04","c","800-53 SA-9"],["PR.DS-01","c","800-53 CA-3"],["PR.DS-02","c","800-53 CA-3"],["PR.DS-10","c","800-53 CA-3"]],"topics":["Cl","Vr"],"edTopics":[],"direct":[["nist80053","CA-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.308(b)(4)","title":"Written Contract or Other Arrangement","text":"Document the satisfactory assurances required by this standard through a written contract or other arrangement with the business associate that meets the applicable requirements of §164.314(a). Readers may find useful resources in Appendix F, including OCR BAA guidance and/or templates that include applicable language.","status":"Required","csf":[["DE.CM-06","c","800-53 SA-4"],["GV.OC-05","c","800-53 SA-9"],["GV.SC-04","c","800-53 SA-9"],["GV.SC-05","c","800-53 SA-4"],["GV.SC-06","c","800-53 SA-4"],["GV.SC-07","c","800-53 SA-4"],["GV.SC-08","c","800-53 SA-4"],["GV.SC-09","c","800-53 SA-4"],["GV.SC-10","c","800-53 SA-4"],["ID.AM-02","c","800-53 SA-9"],["ID.AM-03","c","800-53 CA-3"],["ID.AM-04","c","800-53 SA-9"],["ID.AM-08","c","800-53 SA-4"],["ID.IM-03","c","800-53 SA-4"],["ID.RA-09","c","800-53 SA-4"],["PR.DS-01","c","800-53 CA-3"],["PR.DS-02","c","800-53 CA-3"],["PR.DS-10","c","800-53 CA-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","CA-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(a)","title":"Facility Access Controls","text":"Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.","csf":[["DE.CM-02","c","800-53 PE-3"],["GV.OC-03","c","800-53 PE-1"],["GV.OV-01","c","800-53 PE-1"],["GV.PO-01","c","800-53 PE-1"],["GV.PO-02","c","800-53 PE-1"],["GV.SC-03","c","800-53 PE-1"],["ID.IM-01","c","800-53 PE-1"],["ID.IM-02","c","800-53 PE-1"],["ID.IM-03","c","800-53 PE-1"],["PR.AA-06","c","800-53 PE-2"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-5","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(a)(2)(i)","title":"Contingency Operations","text":"Establish (and implement as needed) procedures that allow facility access in support of the restoration of lost data under the Disaster Recovery Plan and Emergency Mode Operations Plan in the event of an emergency.","status":"Addressable","csf":[["DE.CM-02","c","800-53 PE-3"],["GV.OC-04","c","800-53 CP-2"],["ID.IM-01","c","800-53 CP-2"],["ID.IM-02","c","800-53 CP-2"],["ID.IM-03","c","800-53 CP-2"],["ID.IM-04","c","800-53 CP-2"],["PR.AA-06","c","800-53 PE-2"],["PR.DS-11","c","800-53 CP-6"],["PR.IR-02","c","800-53 CP-2"],["PR.IR-04","c","800-53 CP-6"],["RC.CO-04","c","800-53 CP-2"],["RC.RP-03","c","800-53 CP-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","CP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-17","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(a)(2)(ii)","title":"Facility Security Plan","text":"Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.","status":"Addressable","csf":[["DE.CM-02","e","topic: Physical Security"],["GV.OC-03","c","800-53 PE-1"],["GV.OV-01","c","800-53 PE-1"],["GV.PO-01","c","800-53 PE-1"],["GV.PO-02","c","800-53 PE-1"],["GV.SC-03","c","800-53 PE-1"],["ID.AM-03","c","800-53 PL-2"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 PE-1"],["ID.IM-02","c","800-53 PE-1"],["ID.IM-03","c","800-53 PE-1"],["ID.IM-04","c","800-53 PL-2"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[["nist80053","PE-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(a)(2)(iii)","title":"Access Control and Validation Procedures","text":"Implement procedures to control and validate a person's access to facilities based on their role or function, including visitor control and control of access to software programs for testing and revision.","status":"Addressable","csf":[["DE.CM-02","c","800-53 PE-3"],["GV.OC-03","c","800-53 PE-1"],["GV.OV-01","c","800-53 PE-1"],["GV.PO-01","c","800-53 PE-1"],["GV.PO-02","c","800-53 PE-1"],["GV.SC-03","c","800-53 PE-1"],["ID.IM-01","c","800-53 PE-1"],["ID.IM-02","c","800-53 PE-1"],["ID.IM-03","c","800-53 PE-1"],["PR.AA-06","c","800-53 PE-2"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","PE-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-8","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(a)(2)(iv)","title":"Maintenance Records","text":"Implement policies and procedures to document repairs and modifications to the physical components of a facility that are related to security (e.g., hardware, walls, doors, and locks).","status":"Addressable","csf":[["GV.OC-03","c","800-53 MA-1"],["GV.OV-01","c","800-53 MA-1"],["GV.PO-01","c","800-53 MA-1"],["GV.PO-02","c","800-53 MA-1"],["GV.SC-03","c","800-53 MA-1"],["ID.AM-08","c","800-53 MA-2"],["ID.IM-01","c","800-53 MA-1"],["ID.IM-02","c","800-53 MA-1"],["ID.IM-03","c","800-53 MA-1"]],"topics":[],"edTopics":[],"direct":[["nist80053","MA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MA-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MA-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(b)","title":"Workstation Use","text":"Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.","csf":[["DE.CM-02","c","800-53 PE-3"],["DE.CM-09","c","800-53 AC-4"],["ID.AM-03","c","800-53 AC-4"],["PR.AA-03","c","800-53 AC-12"],["PR.AA-05","c","800-53 AC-3"],["PR.AA-06","c","800-53 PE-3"],["PR.DS-10","c","800-53 AC-3"],["PR.IR-01","c","800-53 AC-3"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","AC-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-11","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-12","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-16","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-17","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-19","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PL-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(c)","title":"Workstation Security","text":"Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users.","csf":[["DE.CM-02","c","800-53 PE-3"],["PR.AA-06","c","800-53 PE-2"],["PR.IR-02","c","800-53 PE-18"]],"topics":["Ph"],"edTopics":[],"direct":[["nist80053","MP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-18","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(d)","title":"Device and Media Controls","text":"Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.","csf":[["DE.CM-02","c","800-53 PE-20"],["GV.OC-03","c","800-53 MP-1"],["GV.OV-01","c","800-53 MP-1"],["GV.PO-01","c","800-53 MP-1"],["GV.PO-02","c","800-53 MP-1"],["GV.SC-03","c","800-53 MP-1"],["ID.AM-01","c","800-53 CM-8"],["ID.AM-02","c","800-53 CM-8"],["ID.IM-01","c","800-53 MP-1"],["ID.IM-02","c","800-53 MP-1"],["ID.IM-03","c","800-53 MP-1"],["PR.AA-05","e","topic: Mobile Security"],["PR.AA-06","c","800-53 PE-20"],["PR.PS-01","c","800-53 CM-8"]],"topics":["Am","Mb"],"edTopics":["Mb"],"direct":[["nist80053","CM-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-16","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-20","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(d)(2)(i)","title":"Disposal","text":"Implement policies and procedures to address the final disposition of ePHI and/or the hardware or electronic media on which it is stored.","status":"Required","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[["nist80053","MP-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(d)(2)(ii)","title":"Media Re-use","text":"Implement procedures for the removal of ePHI from electronic media before the media become available for reuse.","status":"Required","csf":[],"topics":[],"edTopics":[],"direct":[["nist80053","MP-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(d)(2)(iii)","title":"Accountability","text":"Maintain a record of the movements of hardware and electronic media and any person responsible for them.","status":"Addressable","csf":[["DE.CM-02","c","800-53 PE-20"],["ID.AM-01","c","800-53 CM-8"],["ID.AM-02","c","800-53 CM-8"],["PR.AA-06","c","800-53 PE-20"],["PR.PS-01","c","800-53 CM-8"]],"topics":["Am"],"edTopics":[],"direct":[["nist80053","CM-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-16","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-20","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.310(d)(2)(iv)","title":"Data Backup and Storage","text":"Create a retrievable exact copy of ePHI, when needed, before movement of equipment.","status":"Addressable","csf":[["PR.DS-01","c","800-53 CP-9"],["PR.DS-10","c","800-53 CP-9"],["PR.DS-11","c","800-53 CP-9"],["RC.RP-03","c","800-53 CP-9"]],"topics":["Bk"],"edTopics":[],"direct":[["nist80053","CP-9","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-4","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(a)","title":"Access Control","text":"Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).","csf":[["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.SC-03","c","800-53 AC-1"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.DS-10","c","800-53 AC-3"],["PR.IR-01","c","800-53 AC-3"]],"topics":["Ac"],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(a)(2)(i)","title":"Unique User Identification","text":"Assign a unique name and/or number for identifying and tracking user identity.","status":"Required","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["PR.AA-01","c","800-53 AC-2"],["PR.AA-03","c","800-53 IA-2"],["PR.AA-05","c","800-53 AC-2"],["PR.DS-10","c","800-53 AC-2"],["PR.IR-01","c","800-53 AC-3"]],"topics":["Ac"],"edTopics":[],"direct":[["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-8","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(a)(2)(ii)","title":"Emergency Access Procedure","text":"Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.","status":"Required","csf":[["DE.CM-01","c","800-53 AC-2"],["DE.CM-03","c","800-53 AC-2"],["GV.OC-04","c","800-53 CP-2"],["ID.IM-01","c","800-53 CP-2"],["ID.IM-02","c","800-53 CP-2"],["ID.IM-03","c","800-53 CP-2"],["ID.IM-04","c","800-53 CP-2"],["PR.AA-01","c","800-53 AC-2"],["PR.AA-05","c","800-53 AC-2"],["PR.DS-10","c","800-53 AC-2"],["PR.IR-01","c","800-53 AC-3"],["PR.IR-02","c","800-53 CP-2"],["RC.CO-04","c","800-53 CP-2"],["RC.RP-03","c","800-53 CP-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AC-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(a)(2)(iii)","title":"Automatic Logoff","text":"Implement electronic procedures that terminate an electronic session after a predetermined period of inactivity.","status":"Addressable","csf":[["PR.AA-03","c","800-53 AC-12"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-12","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(a)(2)(iv)","title":"Encryption and Decryption","text":"Implement a mechanism to encrypt and decrypt ePHI.","status":"Addressable","csf":[["PR.DS-01","c","800-53 SC-13"],["PR.DS-02","c","800-53 SC-13"],["PR.DS-10","c","800-53 SC-13"]],"topics":["En"],"edTopics":[],"direct":[["nist80053","SC-13","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(b)","title":"Audit Controls","text":"Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.","csf":[["DE.AE-02","c","800-53 AU-6"],["DE.AE-03","c","800-53 AU-6"],["GV.OC-03","c","800-53 AU-1"],["GV.OV-01","c","800-53 AU-1"],["GV.PO-01","c","800-53 AU-1"],["GV.PO-02","c","800-53 AU-1"],["GV.SC-03","c","800-53 AU-1"],["ID.IM-01","c","800-53 AU-1"],["ID.IM-02","c","800-53 AU-1"],["ID.IM-03","c","800-53 AU-1"],["PR.PS-04","c","800-53 AU-2"],["RS.AN-03","c","800-53 AU-7"],["RS.AN-06","c","800-53 AU-7"],["RS.AN-07","c","800-53 AU-7"]],"topics":["Lg"],"edTopics":[],"direct":[["nist80053","AU-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-8","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(c)","title":"Integrity","text":"Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.","csf":[["DE.CM-09","c","800-53 SI-7"],["GV.OC-03","c","800-53 SI-1"],["GV.OV-01","c","800-53 SI-1"],["GV.PO-01","c","800-53 SI-1"],["GV.PO-02","c","800-53 SI-1"],["GV.SC-03","c","800-53 SI-1"],["ID.IM-01","c","800-53 SI-1"],["ID.IM-02","c","800-53 SI-1"],["ID.IM-03","c","800-53 SI-1"],["ID.RA-09","c","800-53 SI-7"],["PR.DS-01","c","800-53 CP-9"],["PR.DS-02","c","800-53 SC-8"],["PR.DS-10","c","800-53 CP-9"],["PR.DS-11","c","800-53 CP-9"],["PR.PS-02","c","800-53 SI-7"],["RC.RP-03","c","800-53 CP-9"]],"topics":["Dp"],"edTopics":[],"direct":[["nist80053","CP-9","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-5","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SC-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SI-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SI-7","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(c)(2)","title":"Mechanism to Authenticate Electronic Protected Health Information","text":"Implement electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.","status":"Addressable","csf":[["DE.CM-09","c","800-53 SI-7"],["ID.RA-09","c","800-53 SI-7"],["PR.DS-01","c","800-53 SI-7"],["PR.DS-02","c","800-53 SC-8"],["PR.DS-10","c","800-53 SI-7"],["PR.PS-02","c","800-53 SI-7"]],"topics":[],"edTopics":[],"direct":[["nist80053","SC-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SI-7","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(d)","title":"Person or Entity Authentication","text":"Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.","csf":[["PR.AA-01","c","800-53 IA-2"],["PR.AA-03","c","800-53 IA-2"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[["nist80053","IA-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(e)(1)","title":"Transmission Security","text":"Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.","csf":[["PR.DS-02","c","800-53 SC-8"]],"topics":[],"edTopics":[],"direct":[["nist80053","SC-8","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(e)(2)(i)","title":"Integrity Controls","text":"Implement security measures to ensure that electronically transmitted ePHI is not improperly modified without detection until disposed of.","status":"Addressable","csf":[["DE.CM-09","c","800-53 SI-7"],["ID.RA-09","c","800-53 SI-7"],["PR.DS-01","c","800-53 SI-7"],["PR.DS-02","c","800-53 SC-8"],["PR.DS-10","c","800-53 SI-7"],["PR.PS-02","c","800-53 SI-7"]],"topics":[],"edTopics":[],"direct":[["nist80053","SC-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SI-7","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.312(e)(2)(ii)","title":"Encryption","text":"Implement a mechanism to encrypt ePHI whenever appropriate.","status":"Addressable","csf":[["PR.DS-01","c","800-53 SC-12"],["PR.DS-02","c","800-53 SC-8"],["PR.DS-10","c","800-53 SC-13"]],"topics":["En"],"edTopics":[],"direct":[["nist80053","SC-8","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SC-12","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SC-13","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(a)","title":"Business Associate Contracts or Other Arrangements","text":"(i) The contract or other arrangement between the covered entity and its business associate required by § 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable. (ii) A covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3). (iii) The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by § 164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.","csf":[["DE.CM-06","c","800-53 PS-7"],["GV.OC-05","c","800-53 SA-9"],["GV.RR-04","c","800-53 PS-7"],["GV.SC-04","c","800-53 SA-9"],["GV.SC-05","c","800-53 SA-4"],["GV.SC-06","c","800-53 SA-4"],["GV.SC-07","c","800-53 SA-4"],["GV.SC-08","c","800-53 SA-4"],["GV.SC-09","c","800-53 SA-4"],["GV.SC-10","c","800-53 SA-4"],["ID.AM-02","c","800-53 SA-9"],["ID.AM-04","c","800-53 SA-9"],["ID.AM-08","c","800-53 SA-4"],["ID.IM-03","c","800-53 SA-4"],["ID.RA-09","c","800-53 SA-4"]],"topics":["Vr"],"edTopics":[],"direct":[["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(a)(2)(i)","title":"Business Associate Contracts","text":"Contracts between covered entities and business associates must provide that business associates will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that the business associate creates, receives, maintains, or transmits on behalf of the covered entity.","status":"Required","csf":[["DE.CM-06","c","800-53 PS-7"],["GV.OC-05","c","800-53 SA-9"],["GV.RR-04","c","800-53 PS-7"],["GV.SC-04","c","800-53 SA-9"],["GV.SC-05","c","800-53 SA-4"],["GV.SC-06","c","800-53 SA-4"],["GV.SC-07","c","800-53 SA-4"],["GV.SC-08","c","800-53 SA-4"],["GV.SC-09","c","800-53 SA-4"],["GV.SC-10","c","800-53 SA-4"],["ID.AM-02","c","800-53 SA-9"],["ID.AM-04","c","800-53 SA-9"],["ID.AM-08","c","800-53 SA-4"],["ID.IM-03","c","800-53 SA-4"],["ID.RA-09","c","800-53 SA-4"],["RC.CO-03","c","800-53 IR-6"],["RS.AN-06","c","800-53 IR-6"],["RS.AN-07","c","800-53 IR-6"],["RS.CO-02","c","800-53 IR-6"],["RS.CO-03","c","800-53 IR-6"],["RS.MA-01","c","800-53 IR-6"],["RS.MA-02","c","800-53 IR-6"],["RS.MA-03","c","800-53 IR-6"],["RS.MA-04","c","800-53 IR-6"]],"topics":[],"edTopics":[],"direct":[["nist80053","IR-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(a)(2)(ii)","title":"Other Arrangements","text":"The covered entity complies with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3).","status":"Required","csf":[["DE.CM-06","c","800-53 PS-7"],["GV.OC-05","c","800-53 SA-9"],["GV.RR-04","c","800-53 PS-7"],["GV.SC-04","c","800-53 SA-9"],["GV.SC-05","c","800-53 SA-9"],["GV.SC-06","c","800-53 SA-9"],["GV.SC-07","c","800-53 SA-9"],["GV.SC-08","c","800-53 SA-9"],["GV.SC-09","c","800-53 SA-9"],["GV.SC-10","c","800-53 SA-9"],["ID.AM-02","c","800-53 SA-9"],["ID.AM-03","c","800-53 CA-3"],["ID.AM-04","c","800-53 SA-9"],["PR.DS-01","c","800-53 CA-3"],["PR.DS-02","c","800-53 CA-3"],["PR.DS-10","c","800-53 CA-3"]],"topics":[],"edTopics":[],"direct":[["nist80053","CA-3","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(a)(2)(iii)","title":"Business associate contracts with subcontractors","text":"The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.","status":"Required","csf":[["DE.CM-06","c","800-53 PS-7"],["GV.OC-05","c","800-53 SA-9"],["GV.RR-04","c","800-53 PS-7"],["GV.SC-04","c","800-53 SA-9"],["GV.SC-05","c","800-53 SA-4"],["GV.SC-06","c","800-53 SA-4"],["GV.SC-07","c","800-53 SA-4"],["GV.SC-08","c","800-53 SA-4"],["GV.SC-09","c","800-53 SA-4"],["GV.SC-10","c","800-53 SA-4"],["ID.AM-02","c","800-53 SA-9"],["ID.AM-04","c","800-53 SA-9"],["ID.AM-08","c","800-53 SA-4"],["ID.IM-03","c","800-53 SA-4"],["ID.RA-09","c","800-53 SA-4"],["RC.CO-03","c","800-53 IR-6"],["RS.AN-06","c","800-53 IR-6"],["RS.AN-07","c","800-53 IR-6"],["RS.CO-02","c","800-53 IR-6"],["RS.CO-03","c","800-53 IR-6"],["RS.MA-01","c","800-53 IR-6"],["RS.MA-02","c","800-53 IR-6"],["RS.MA-03","c","800-53 IR-6"],["RS.MA-04","c","800-53 IR-6"]],"topics":[],"edTopics":[],"direct":[["nist80053","IR-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-6","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-7","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-4","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(b)","title":"Requirements for Group Health Plans","text":"Except when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to § 164.504(f)(1)(ii) or (iii), or as authorized under § 164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan.","csf":[["ID.AM-03","c","800-53 PL-2"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 PL-2"],["ID.IM-02","c","800-53 PL-2"],["ID.IM-03","c","800-53 PL-2"],["ID.IM-04","c","800-53 PL-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(b)(2)(i)","title":"Group Health Plan Implementation Specification","text":"Amend the plan documents to incorporate provisions to require the plan sponsor to implement administrative, technical, and physical safeguards that will reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of the group health plan.","status":"Required","csf":[["ID.AM-03","c","800-53 PL-2"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 PL-2"],["ID.IM-02","c","800-53 PL-2"],["ID.IM-03","c","800-53 PL-2"],["ID.IM-04","c","800-53 PL-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(b)(2)(ii)","title":"Group Health Plan Implementation Specification","text":"Amend the plan documents to incorporate provisions to require the plan sponsor to ensure that the adequate separation between the group health plan and plan sponsor required by §164.504(f)(2)(iii) is supported by reasonable and appropriate security measures.","status":"Required","csf":[["ID.AM-03","c","800-53 PL-2"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 PL-2"],["ID.IM-02","c","800-53 PL-2"],["ID.IM-03","c","800-53 PL-2"],["ID.IM-04","c","800-53 PL-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(b)(2)(iii)","title":"Group Health Plan Implementation Specification","text":"Amend plan documents to incorporate provisions to require the plan sponsor to ensure that any agent to whom it provides ePHI agrees to implement reasonable and appropriate security measures to protect the ePHI.","status":"Required","csf":[["DE.CM-06","c","800-53 SA-9"],["GV.OC-05","c","800-53 SA-9"],["GV.SC-04","c","800-53 SA-9"],["GV.SC-05","c","800-53 SA-9"],["GV.SC-06","c","800-53 SA-9"],["GV.SC-07","c","800-53 SA-9"],["GV.SC-08","c","800-53 SA-9"],["GV.SC-09","c","800-53 SA-9"],["GV.SC-10","c","800-53 SA-9"],["ID.AM-02","c","800-53 SA-9"],["ID.AM-04","c","800-53 SA-9"]],"topics":[],"edTopics":[],"direct":[["nist80053","SA-9","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.314(b)(2)(iv)","title":"Group Health Plan Implementation Specification","text":"Amend plan documents to incorporate provisions to require the plan sponsor to report any security incident of which it becomes aware to the group health plan.","status":"Required","csf":[["RC.CO-03","c","800-53 IR-6"],["RS.AN-06","c","800-53 IR-6"],["RS.AN-07","c","800-53 IR-6"],["RS.CO-02","c","800-53 IR-6"],["RS.CO-03","c","800-53 IR-6"],["RS.MA-01","c","800-53 IR-6"],["RS.MA-02","c","800-53 IR-6"],["RS.MA-03","c","800-53 IR-6"],["RS.MA-04","c","800-53 IR-6"]],"topics":[],"edTopics":[],"direct":[["nist80053","IR-6","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.316(a)","title":"Policies and Procedures","text":"Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.","csf":[["DE.AE-07","c","800-53 RA-3"],["GV.OC-03","c","800-53 PL-1"],["GV.OV-01","c","800-53 PL-1"],["GV.PO-01","c","800-53 PL-1"],["GV.PO-02","c","800-53 PL-1"],["GV.RM-06","c","800-53 RA-3"],["GV.RM-07","c","800-53 RA-3"],["GV.SC-03","c","800-53 PL-1"],["GV.SC-09","c","800-53 RA-3"],["GV.SC-10","c","800-53 RA-3"],["ID.AM-03","c","800-53 PL-2"],["ID.AM-05","c","800-53 RA-3"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 PL-1"],["ID.IM-02","c","800-53 PL-1"],["ID.IM-03","c","800-53 PL-1"],["ID.IM-04","c","800-53 PL-2"],["ID.RA-01","c","800-53 RA-3"],["ID.RA-03","c","800-53 RA-3"],["ID.RA-04","c","800-53 RA-3"],["ID.RA-05","c","800-53 RA-3"],["RS.AN-08","c","800-53 RA-3"]],"topics":["Gp"],"edTopics":[],"direct":[["nist80053","PL-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-3","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.316(b)","title":"Documentation","text":"(i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and (ii) if an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.","csf":[["ID.AM-03","c","800-53 PL-2"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 CA-2"],["ID.IM-02","c","800-53 CA-2"],["ID.IM-03","c","800-53 CA-2"],["ID.IM-04","c","800-53 PL-2"],["ID.RA-01","c","800-53 CA-2"]],"topics":[],"edTopics":[],"direct":[["nist80053","CA-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.316(b)(2)(i)","title":"Time Limit","text":"Retain documentation required by paragraph (b)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later.","status":"Required","csf":[["ID.AM-07","c","800-53 SI-12"],["ID.AM-08","c","800-53 SI-12"]],"topics":[],"edTopics":[],"direct":[["nist80053","SI-12","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.316(b)(2)(ii)","title":"Availability","text":"Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.","status":"Required","csf":[["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.RR-04","c","800-53 PS-1"],["GV.SC-03","c","800-53 AC-1"],["GV.SC-08","c","800-53 CP-1"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.PS-01","c","800-53 CM-1"],["RC.RP-04","c","800-53 IR-1"]],"topics":[],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CM-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PL-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PM-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PT-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SI-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SR-1","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"hipaa","id":"§164.316(b)(2)(iii)","title":"Updates","text":"Review documentation periodically and update as needed in response to environmental or operational changes that affect the security of the ePHI.","status":"Required","csf":[["GV.OC-03","c","800-53 AC-1"],["GV.OV-01","c","800-53 AC-1"],["GV.PO-01","c","800-53 AC-1"],["GV.PO-02","c","800-53 AC-1"],["GV.RR-04","c","800-53 PS-1"],["GV.SC-03","c","800-53 AC-1"],["GV.SC-08","c","800-53 CP-1"],["ID.AM-03","c","800-53 PL-2"],["ID.AM-08","c","800-53 PL-2"],["ID.IM-01","c","800-53 AC-1"],["ID.IM-02","c","800-53 AC-1"],["ID.IM-03","c","800-53 AC-1"],["ID.IM-04","c","800-53 PL-2"],["PR.AA-01","c","800-53 AC-1"],["PR.AA-05","c","800-53 AC-1"],["PR.PS-01","c","800-53 CM-1"],["RC.RP-04","c","800-53 IR-1"]],"topics":["Gp"],"edTopics":[],"direct":[["nist80053","AC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AT-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","AU-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CM-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","CP-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","IR-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","MP-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PE-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PL-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PL-2","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PM-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PS-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","PT-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","RA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SA-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SC-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SI-1","NIST HIPAA → SP 800-53 crosswalk"],["nist80053","SR-1","NIST HIPAA → SP 800-53 crosswalk"]]},{"fw":"gdpr","id":"Art.5(1)(e)","title":"Principles relating to processing of personal data","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"gdpr","id":"Art.5(1)(f)","title":"Principles relating to processing of personal data","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"gdpr","id":"Art.5(2)","title":"Principles relating to processing of personal data","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[]},{"fw":"gdpr","id":"Art.24(1)","title":"Responsibility of the controller","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"gdpr","id":"Art.24(2)","title":"Responsibility of the controller","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[]},{"fw":"gdpr","id":"Art.25(1)","title":"Data protection by design and by default","csf":[["PR.PS-06","e","topic: Secure Development"]],"topics":["Sd"],"edTopics":["Sd"],"direct":[]},{"fw":"gdpr","id":"Art.25(2)","title":"Data protection by design and by default","csf":[["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"]],"topics":["Ac"],"edTopics":["Ac"],"direct":[]},{"fw":"gdpr","id":"Art.28(1)","title":"Processor","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-01","e","topic: Supply Chain Risk"],["GV.SC-03","e","topic: Supply Chain Risk"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-05","e","topic: Supply Chain Risk"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["GV.SC-09","e","topic: Supply Chain Risk"],["ID.AM-04","e","topic: Cloud Security"],["ID.RA-09","e","topic: Supply Chain Risk"],["ID.RA-10","e","topic: Vendor Risk Mgmt"],["PR.IR-01","e","topic: Cloud Security"],["PR.PS-01","e","topic: Cloud Security"]],"topics":["Sc","Cl","Vr"],"edTopics":["Sc","Cl","Vr"],"direct":[]},{"fw":"gdpr","id":"Art.28(3)","title":"Processor","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"gdpr","id":"Art.29","title":"Processing under the authority of the controller or processor","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"]],"topics":["It"],"edTopics":["It"],"direct":[]},{"fw":"gdpr","id":"Art.30(1)","title":"Records of processing activities","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"gdpr","id":"Art.32(1)(a)","title":"Security of processing","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"gdpr","id":"Art.32(1)(b)","title":"Security of processing","csf":[["GV.OC-04","e","topic: Business Continuity"],["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"],["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"],["PR.IR-03","e","topic: Business Continuity"],["RC.RP-04","e","topic: Business Continuity"]],"topics":["Ac","Dp","Bc"],"edTopics":["Ac","Dp","Bc"],"direct":[]},{"fw":"gdpr","id":"Art.32(1)(c)","title":"Security of processing","csf":[["ID.IM-04","e","topic: Recovery Planning"],["PR.DS-11","e","topic: Backup & Recovery"],["PR.IR-03","e","topic: Disaster Recovery"],["RC.RP-01","e","topic: Recovery Planning"],["RC.RP-02","e","topic: Recovery Planning"],["RC.RP-03","e","topic: Backup & Recovery"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Bk","Rc","Dr"],"edTopics":["Bk","Rc","Dr"],"direct":[]},{"fw":"gdpr","id":"Art.32(1)(d)","title":"Security of processing","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"gdpr","id":"Art.32(2)","title":"Security of processing","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"gdpr","id":"Art.32(4)","title":"Security of processing","csf":[["DE.CM-03","e","topic: Insider Threat"],["GV.RR-04","e","topic: Insider Threat"]],"topics":["It"],"edTopics":["It"],"direct":[]},{"fw":"gdpr","id":"Art.33(1)","title":"Notification of a personal data breach to the supervisory authority","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.CO-02","e","topic: Reporting"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir","Rp"],"edTopics":["Ir","Rp"],"direct":[]},{"fw":"gdpr","id":"Art.33(5)","title":"Notification of a personal data breach to the supervisory authority","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"gdpr","id":"Art.34(1)","title":"Communication of a personal data breach to the data subject","csf":[["RC.CO-03","e","topic: Comms & Restore"],["RC.CO-04","e","topic: Comms & Restore"],["RC.RP-05","e","topic: Comms & Restore"],["RS.CO-02","e","topic: Reporting"]],"topics":["Rp","Cr"],"edTopics":["Rp","Cr"],"direct":[]},{"fw":"gdpr","id":"Art.34(3)(a)","title":"Communication of a personal data breach to the data subject","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"gdpr","id":"Art.35(1)","title":"Data protection impact assessment","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"]],"topics":["Ra"],"edTopics":["Ra"],"direct":[]},{"fw":"gdpr","id":"Art.35(7)","title":"Data protection impact assessment","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"]],"topics":["Ra"],"edTopics":["Ra"],"direct":[]},{"fw":"gdpr","id":"Art.37(1)","title":"Designation of the data protection officer","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[]},{"fw":"gdpr","id":"Art.39(1)","title":"Tasks of the data protection officer","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[]},{"fw":"gdpr","id":"Art.39(1)(b)","title":"Tasks of the data protection officer","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"nis2","id":"1.1","title":"Policy on the security of network and information systems","csf":[["GV.OC-02","c",""],["GV.OC-03","c",""],["GV.PO-01","c",""],["GV.PO-02","c",""],["GV.RM-03","c",""],["PR.AT-02","c",""]],"topics":["Gp"],"edTopics":[],"direct":[["iso","Clause 5.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.1","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.36","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.4","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 9.3","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"1.2","title":"Roles, responsibilities and authorities","csf":[["GV.RR-02","c",""],["GV.SC-02","c",""],["PR.AT-02","c",""]],"topics":["Rr"],"edTopics":[],"direct":[["iso","Clause 5.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.4","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"2.1","title":"Risk management framework","csf":[["GV.RM-01","c",""],["GV.RM-03","c",""],["GV.RM-06","c",""],["GV.RR-03","c",""],["ID.RA-01","c",""],["ID.RA-02","c",""],["ID.RA-03","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""],["ID.RA-06","c",""]],"topics":["Rm","Ra"],"edTopics":[],"direct":[["iso","Clause 6.1","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 6.1.2","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 6.1.3","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 6.2","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 8.2","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 8.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.7","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.19","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.20","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.21","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"2.2","title":"Compliance monitoring","csf":[["GV.OV-02","c",""]],"topics":["Cm"],"edTopics":[],"direct":[["iso","Clause 9.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.31","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.35","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.36","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"2.3","title":"Independent review of information and network security","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-02","c",""],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[["iso","Clause 9.2","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 10.1","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.35","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.34","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"3.1","title":"Incident handling policy","csf":[["GV.SC-08","c",""],["RS.MA-01","c",""],["RS.MA-05","c",""],["RS.MI-01","c",""],["RS.MI-02","c",""]],"topics":["Ir"],"edTopics":[],"direct":[["iso","A.5.24","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"3.2","title":"Monitoring and logging","csf":[["RS.AN-06","c",""],["RS.AN-07","c",""]],"topics":["Sm","Lg","Id","Sg"],"edTopics":[],"direct":[["iso","A.5.28","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.15","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.16","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.17","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"3.3","title":"Event reporting","csf":[["RS.CO-02","c",""],["RS.MI-01","c",""]],"topics":["Rp"],"edTopics":[],"direct":[["iso","A.6.8","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"3.4","title":"Event assessment and classification","csf":[["DE.AE-04","c",""],["RS.MA-02","c",""],["RS.MA-03","c",""],["RS.MA-04","c",""]],"topics":["An","Sg"],"edTopics":[],"direct":[["iso","A.5.25","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"3.5","title":"Incident response","csf":[["RC.CO-03","c",""],["RC.CO-04","c",""],["RS.AN-03","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""],["RS.MA-01","c",""],["RS.MA-02","c",""],["RS.MA-03","c",""],["RS.MA-04","c",""],["RS.MI-01","c",""],["RS.MI-02","c",""]],"topics":["Ir","Fn","Mt"],"edTopics":[],"direct":[["iso","A.5.26","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"3.6","title":"Post-incident reviews","csf":[["RS.AN-08","c",""]],"topics":["Ll"],"edTopics":[],"direct":[["iso","A.5.27","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"4.1","title":"Business continuity and disaster recovery plan","csf":[["GV.OC-04","c",""],["GV.SC-08","c",""],["RC.RP-01","c",""],["RC.RP-02","c",""]],"topics":["Rc","Bc","Dr"],"edTopics":[],"direct":[["iso","A.5.29","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.30","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"4.2","title":"Backup management","csf":[["PR.DS-11","c",""],["RC.RP-01","c",""],["RC.RP-02","c",""]],"topics":["Bk","Dr"],"edTopics":[],"direct":[["iso","A.8.13","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.14","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"4.3","title":"Crisis management","csf":[["DE.AE-02","c",""],["DE.AE-03","c",""],["DE.AE-04","c",""],["DE.AE-06","c",""],["DE.AE-07","c",""],["DE.AE-08","c",""],["DE.CM-01","c",""],["ID.AM-03","c",""],["PR.IR-03","c",""],["RS.CO-02","c",""],["RS.CO-03","c",""]],"topics":["Co","Bc","Cr"],"edTopics":[],"direct":[["iso","A.5.26","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.29","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.30","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"5.1","title":"Supply chain security policy","csf":[["GV.OC-03","c",""],["GV.OC-05","c",""],["GV.SC-01","c",""],["GV.SC-04","c",""],["GV.SC-05","c",""],["GV.SC-06","c",""],["GV.SC-07","c",""],["GV.SC-09","c",""],["GV.SC-10","c",""],["ID.RA-10","c",""]],"topics":["Sc","Vr"],"edTopics":[],"direct":[["iso","A.5.19","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.20","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.21","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.30","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"5.2","title":"Directory of suppliers and service providers","csf":[["GV.OC-05","c",""],["GV.SC-04","c",""]],"topics":["Vr"],"edTopics":[],"direct":[["iso","A.5.22","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.1","title":"Security in acquisition of ICT services, ICT systems or ICT products","csf":[["GV.PO-02","c",""],["GV.SC-06","c",""],["ID.RA-09","c",""],["ID.RA-10","c",""]],"topics":["Sc","Cl","Vr"],"edTopics":[],"direct":[["iso","A.5.21","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.23","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.2","title":"Secure development life cycle","csf":[["ID.AM-08","c",""],["PR.PS-06","c",""]],"topics":["Sd"],"edTopics":[],"direct":[["iso","A.8.25","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.31","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.3","title":"Configuration management","csf":[["PR.PS-01","c",""]],"topics":["Cf"],"edTopics":[],"direct":[["iso","A.8.9","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.4","title":"Change management, repairs and maintenance","csf":[["ID.RA-07","c",""]],"topics":[],"edTopics":[],"direct":[["iso","Clause 6.3","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 8.1","ENISA NIS2 → ISO 27001 mapping"],["iso","A.7.13","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.32","ENISA NIS2 → ISO 27001 mapping"],["soc2","CC8.1","Change management: SOC 2 requires changes to be authorised, tested and approved; NIS2 point 6.4 requires change management, repairs and maintenance procedures.","e"],["dora","Art.9(4)(e)","All three require documented, risk-based change management in which changes are recorded, tested, approved and verified.","e"]]},{"fw":"nis2","id":"6.5","title":"Security testing","csf":[["ID.RA-01","c",""]],"topics":["Vn"],"edTopics":[],"direct":[["iso","A.8.29","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.33","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.34","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.6","title":"Security patch management","csf":[["DE.CM-09","c",""],["PR.PS-02","c",""]],"topics":["Pm"],"edTopics":[],"direct":[["iso","A.8.31","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.32","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.7","title":"Network security","csf":[["DE.CM-01","c",""],["PR.IR-01","c",""],["PR.PS-05","c",""]],"topics":["Fw"],"edTopics":[],"direct":[["iso","A.8.16","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.20","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.8","title":"Network segmentation","csf":[["PR.IR-01","c",""]],"topics":["Fw","Zt"],"edTopics":[],"direct":[["iso","A.8.22","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.9","title":"Protection against malicious and unauthorised software","csf":[["DE.CM-01","c",""],["DE.CM-09","c",""],["PR.PS-05","c",""]],"topics":["Ep","Ml"],"edTopics":[],"direct":[["iso","A.5.32","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.7","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"6.10","title":"Vulnerability handling and disclosure","csf":[["ID.RA-01","c",""],["ID.RA-02","c",""],["ID.RA-04","c",""],["ID.RA-05","c",""],["ID.RA-06","c",""],["ID.RA-08","c",""],["PR.PS-02","c",""],["PR.PS-03","c",""]],"topics":["Vn"],"edTopics":[],"direct":[["iso","A.8.8","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"7.1","title":"Policies and procedures to assess the effectiveness of cybersecurity risk-management measures","csf":[["GV.RM-06","c",""]],"topics":["Rm"],"edTopics":[],"direct":[["iso","Clause 6.2","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 9.1","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 9.3","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"8.1","title":"Awareness raising and basic cyber hygiene practices","csf":[["PR.AT-01","c",""],["PR.AT-02","c",""]],"topics":["Aw"],"edTopics":[],"direct":[["iso","Clause 7.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.6.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.7","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"8.2","title":"Security training","csf":[["PR.AT-01","c",""]],"topics":["Aw"],"edTopics":[],"direct":[["iso","Clause 7.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.6.3","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"9.1","title":"Cryptography","csf":[["PR.DS-01","c",""],["PR.DS-02","c",""]],"topics":["En"],"edTopics":[],"direct":[["iso","A.5.31","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.24","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"10.1","title":"Human resources security","csf":[["GV.RR-04","c",""],["PR.AT-02","c",""]],"topics":[],"edTopics":[],"direct":[["iso","Clause 7.1","ENISA NIS2 → ISO 27001 mapping"],["iso","Clause 7.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.6.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.6.3","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"10.2","title":"Verification of Background","csf":[["GV.RR-04","c",""]],"topics":["It"],"edTopics":[],"direct":[["iso","A.6.1","ENISA NIS2 → ISO 27001 mapping"],["soc2","CC1.4","Background verification: SOC 2's commitment to competence includes screening; NIS2 point 10.2 requires background checks where appropriate.","e"]]},{"fw":"nis2","id":"10.3","title":"Termination or change of employment procedures","csf":[["GV.RR-04","c",""]],"topics":[],"edTopics":[],"direct":[["iso","A.6.5","ENISA NIS2 → ISO 27001 mapping"],["soc2","CC6.2","Leavers and movers: SOC 2 requires access to be removed when no longer needed; NIS2 point 10.3 covers termination or change of employment.","e"]]},{"fw":"nis2","id":"10.4","title":"Disciplinary process","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.IM-04","c",""]],"topics":["It"],"edTopics":[],"direct":[["iso","A.5.28","ENISA NIS2 → ISO 27001 mapping"],["iso","A.6.4","ENISA NIS2 → ISO 27001 mapping"],["soc2","CC1.5","Accountability: SOC 2 holds people accountable for their responsibilities; NIS2 point 10.4 requires a disciplinary process for violations.","e"]]},{"fw":"nis2","id":"11.1","title":"Access control policy","csf":[["PR.AA-05","c",""]],"topics":["Ac","Zt"],"edTopics":[],"direct":[["iso","A.5.15","ENISA NIS2 → ISO 27001 mapping"],["iso","A.7.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.21","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"11.2","title":"Management of access rights","csf":[["PR.AA-05","c",""]],"topics":["Ac"],"edTopics":[],"direct":[["iso","A.5.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.18","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"11.3","title":"Privileged accounts and system administration accounts","csf":[["ID.IM-01","c",""],["ID.IM-02","c",""],["ID.IM-03","c",""],["ID.IM-04","c",""]],"topics":["Pa"],"edTopics":[],"direct":[["iso","A.8.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.18","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"11.4","title":"Administration systems","csf":[["PR.AA-05","e","topic: Privileged Access"]],"topics":["Pa"],"edTopics":[],"direct":[["iso","A.8.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.18","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"11.5","title":"Identification","csf":[["PR.AA-01","c",""],["PR.AA-05","c",""],["PR.AA-06","c",""]],"topics":["Ac"],"edTopics":[],"direct":[["iso","A.5.16","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"11.6","title":"Authentication","csf":[["PR.AA-03","c",""],["PR.AA-05","c",""]],"topics":["Mf","Zt"],"edTopics":[],"direct":[["iso","A.5.17","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"11.7","title":"Multi-factor authentication","csf":[["PR.AA-03","c",""]],"topics":["Mf"],"edTopics":[],"direct":[["iso","A.8.5","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"12.1","title":"Asset classification","csf":[["ID.AM-05","c",""]],"topics":["Da"],"edTopics":[],"direct":[["iso","A.5.9","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.12","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.13","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"12.2","title":"Handling of assets","csf":[["ID.IM-01","c",""]],"topics":["Dp"],"edTopics":[],"direct":[["iso","A.5.9","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.10","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.14","ENISA NIS2 → ISO 27001 mapping"],["iso","A.7.10","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"12.3","title":"Removable media policy","csf":[["PR.DS-01","c",""]],"topics":["Dp","Dl"],"edTopics":[],"direct":[["iso","A.7.7","ENISA NIS2 → ISO 27001 mapping"],["iso","A.7.10","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"12.4","title":"Asset inventory","csf":[["ID.AM-01","c",""],["ID.AM-02","c",""],["ID.AM-03","c",""],["ID.AM-04","c",""],["ID.AM-07","c",""],["ID.AM-08","c",""]],"topics":["Am"],"edTopics":[],"direct":[["iso","A.5.9","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"12.5","title":"Deposit, return or deletion of assets upon termination of employment","csf":[],"topics":[],"edTopics":[],"direct":[["iso","A.5.11","ENISA NIS2 → ISO 27001 mapping"],["iso","A.5.18","ENISA NIS2 → ISO 27001 mapping"],["iso","A.8.24","ENISA NIS2 → ISO 27001 mapping"],["dora","Art.30(2)(d)","Access to, return and deletion of data and assets when a contract or relationship ends.","e"]]},{"fw":"nis2","id":"13.1","title":"Supporting utilities","csf":[["DE.CM-02","c",""],["DE.CM-06","c",""],["GV.OC-03","c",""],["GV.OC-05","c",""],["ID.RA-10","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["iso","A.7.11","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"13.2","title":"Protection against physical and environmental threats","csf":[["PR.IR-02","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["iso","A.7.3","ENISA NIS2 → ISO 27001 mapping"],["iso","A.7.5","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"nis2","id":"13.3","title":"Perimeter and physical access control","csf":[["DE.CM-02","c",""],["PR.AA-06","c",""]],"topics":["Ph"],"edTopics":[],"direct":[["iso","A.7.1","ENISA NIS2 → ISO 27001 mapping"],["iso","A.7.2","ENISA NIS2 → ISO 27001 mapping"],["iso","A.7.4","ENISA NIS2 → ISO 27001 mapping"]]},{"fw":"e8","id":"ISM-0109","title":"Event logs from workstations are analysed in a timely manner to detect cyber security…","text":"Event logs from workstations are analysed in a timely manner to detect cyber security events.","status":"ML3","group":"All strategies","csf":[["DE.AE-02","e","Essential Eight strategy (ControlMapping mapping)"],["DE.AE-03","e","Essential Eight strategy (ControlMapping mapping)"],["DE.CM-01","e","topic: Cont. Monitoring"],["DE.CM-03","e","topic: Cont. Monitoring"],["DE.CM-09","e","topic: Cont. Monitoring"]],"topics":["Sm"],"edTopics":["Sm"],"direct":[]},{"fw":"e8","id":"ISM-0123","title":"Cyber security incidents are reported to the chief information security officer, or one…","text":"Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.","status":"ML2, ML3","group":"All strategies","csf":[["RS.CO-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"e8","id":"ISM-0140","title":"Cyber security incidents are reported to ASD as soon as possible after they occur or…","text":"Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.","status":"ML2, ML3","group":"All strategies","csf":[["RS.CO-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"e8","id":"ISM-0304","title":"Applications other than office productivity suites, web browsers and their extensions…","text":"Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.","status":"ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-0445","title":"Privileged human users are assigned a dedicated privileged user account to be used…","text":"Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.","status":"ML1, ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-0843","title":"Application control is implemented on workstations","text":"Application control is implemented on workstations.","status":"ML1, ML2, ML3","group":"Application control","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"e8","id":"ISM-0974","title":"Multi-factor authentication is used to authenticate unprivileged human users of systems","text":"Multi-factor authentication is used to authenticate unprivileged human users of systems.","status":"ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"e8","id":"ISM-1173","title":"Multi-factor authentication is used to authenticate privileged human users of systems","text":"Multi-factor authentication is used to authenticate privileged human users of systems.","status":"ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"e8","id":"ISM-1175","title":"Privileged user accounts (excluding those explicitly authorised to access online…","text":"Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.","status":"ML1, ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-1228","title":"Cyber security events are analysed in a timely manner to identify cyber security incidents","text":"Cyber security events are analysed in a timely manner to identify cyber security incidents.","status":"ML2, ML3","group":"All strategies","csf":[["DE.AE-02","e","Essential Eight strategy (ControlMapping mapping)"],["DE.AE-03","e","Essential Eight strategy (ControlMapping mapping)"],["DE.AE-04","e","topic: Anomaly Detection"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"],["DE.CM-09","e","topic: Anomaly Detection"]],"topics":["An","Sg"],"edTopics":["An","Sg"],"direct":[]},{"fw":"e8","id":"ISM-1380","title":"Privileged human users use separate privileged and unprivileged operating environments","text":"Privileged human users use separate privileged and unprivileged operating environments.","status":"ML1, ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-1387","title":"Administrative activities are conducted through jump servers","text":"Administrative activities are conducted through jump servers.","status":"ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-1401","title":"Multi-factor authentication uses either: something people have and something people…","text":"Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are.","status":"ML1, ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"e8","id":"ISM-1407","title":"The latest release, or the previous release, of operating systems are used","text":"The latest release, or the previous release, of operating systems are used.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1412","title":"Web browsers are hardened using ASD and vendor hardening guidance, with the most…","text":"Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"e8","id":"ISM-1485","title":"Web browsers do not process web advertisements from the internet","text":"Web browsers do not process web advertisements from the internet.","status":"ML1, ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1486","title":"Web browsers do not process Java from the internet","text":"Web browsers do not process Java from the internet.","status":"ML1, ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1487","title":"Only privileged human users responsible for checking that Microsoft Office macros are…","text":"Only privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.","status":"ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1488","title":"Microsoft Office macros in files originating from the internet are blocked","text":"Microsoft Office macros in files originating from the internet are blocked.","status":"ML1, ML2, ML3","group":"Restrict Microsoft Office macros","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.DS-02","e","topic: Email Security"],["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Ep","Ml"],"edTopics":["Ep","Ml"],"direct":[]},{"fw":"e8","id":"ISM-1489","title":"Microsoft Office macro security settings cannot be changed by human users","text":"Microsoft Office macro security settings cannot be changed by human users.","status":"ML1, ML2, ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1490","title":"Application control is implemented on internet-facing servers","text":"Application control is implemented on internet-facing servers.","status":"ML2, ML3","group":"Application control","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"e8","id":"ISM-1501","title":"Operating systems that are no longer supported by vendors are replaced","text":"Operating systems that are no longer supported by vendors are replaced.","status":"ML1, ML2, ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"e8","id":"ISM-1504","title":"Multi-factor authentication is used to authenticate human users to their organisation’s online services that process…","text":"Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data.","status":"ML1, ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"e8","id":"ISM-1505","title":"Multi-factor authentication is used to authenticate human users of data repositories","text":"Multi-factor authentication is used to authenticate human users of data repositories.","status":"ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1507","title":"Requests for privileged access to systems and their resources are validated when first…","text":"Requests for privileged access to systems and their resources are validated when first requested.","status":"ML1, ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-1508","title":"Privileged access to systems and their resources is limited to only what is required…","text":"Privileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions.","status":"ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-1509","title":"Privileged access events are centrally logged","text":"Privileged access events are centrally logged.","status":"ML2, ML3","group":"Restrict administrative privileges","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"e8","id":"ISM-1511","title":"Backups of data, applications and settings are performed and retained in accordance…","text":"Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.","status":"ML1, ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"e8","id":"ISM-1515","title":"Restoration of data, applications and settings from backups to a common point in time…","text":"Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.","status":"ML1, ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["PR.IR-03","e","topic: Disaster Recovery"],["RC.RP-02","e","topic: Disaster Recovery"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Bk","Dr"],"edTopics":["Bk","Dr"],"direct":[]},{"fw":"e8","id":"ISM-1542","title":"Microsoft Office is configured to prevent activation of Object Linking and Embedding…","text":"Microsoft Office is configured to prevent activation of Object Linking and Embedding packages.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1544","title":"Microsoft’s recommended application blocklist is implemented","text":"Microsoft’s recommended application blocklist is implemented.","status":"ML2, ML3","group":"Application control","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"e8","id":"ISM-1582","title":"Application control rulesets are validated at least annually","text":"Application control rulesets are validated at least annually.","status":"ML2, ML3","group":"Application control","csf":[["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1585","title":"Web browser security settings cannot be changed by human users","text":"Web browser security settings cannot be changed by human users.","status":"ML1, ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"e8","id":"ISM-1621","title":"Windows PowerShell 2.0 is disabled or removed","text":"Windows PowerShell 2.0 is disabled or removed.","status":"ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"e8","id":"ISM-1622","title":"PowerShell is configured to use Constrained Language Mode","text":"PowerShell is configured to use Constrained Language Mode.","status":"ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1623","title":"PowerShell module logging, script block logging and transcription events are centrally…","text":"PowerShell module logging, script block logging and transcription events are centrally logged.","status":"ML2, ML3","group":"User application hardening","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"e8","id":"ISM-1647","title":"Privileged access to systems and their resources are disabled after 12 months unless…","text":"Privileged access to systems and their resources are disabled after 12 months unless revalidated.","status":"ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-1648","title":"Privileged access to systems and their resources are disabled after 45 days of inactivity","text":"Privileged access to systems and their resources are disabled after 45 days of inactivity.","status":"ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pa"],"edTopics":["Pa"],"direct":[]},{"fw":"e8","id":"ISM-1649","title":"Just-in-time administration is used for the administration of systems and their resources","text":"Just-in-time administration is used for the administration of systems and their resources.","status":"ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1650","title":"Privileged user account and security group management events are centrally logged","text":"Privileged user account and security group management events are centrally logged.","status":"ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1654","title":"Internet Explorer 11 is disabled or removed","text":"Internet Explorer 11 is disabled or removed.","status":"ML1, ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"e8","id":"ISM-1655","title":".NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed","text":".NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.","status":"ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1656","title":"Application control is implemented on non-internet-facing servers","text":"Application control is implemented on non-internet-facing servers.","status":"ML3","group":"Application control","csf":[["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1657","title":"Application control restricts the execution of executables, libraries, scripts…","text":"Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.","status":"ML1, ML2, ML3","group":"Application control","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"e8","id":"ISM-1658","title":"Application control restricts the execution of drivers to an organisation-approved set","text":"Application control restricts the execution of drivers to an organisation-approved set.","status":"ML3","group":"Application control","csf":[["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1659","title":"Microsoft’s vulnerable driver blocklist is implemented","text":"Microsoft’s vulnerable driver blocklist is implemented.","status":"ML3","group":"Application control","csf":[["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1660","title":"Allowed and blocked application control events are centrally logged","text":"Allowed and blocked application control events are centrally logged.","status":"ML2, ML3","group":"Application control","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","topic: Logging & Audit"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"e8","id":"ISM-1667","title":"Microsoft Office is blocked from creating child processes","text":"Microsoft Office is blocked from creating child processes.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1668","title":"Microsoft Office is blocked from creating executable content","text":"Microsoft Office is blocked from creating executable content.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1669","title":"Microsoft Office is blocked from injecting code into other processes","text":"Microsoft Office is blocked from injecting code into other processes.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1670","title":"PDF applications are blocked from creating child processes","text":"PDF applications are blocked from creating child processes.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1671","title":"Microsoft Office macros are disabled for human users that do not have a demonstrated…","text":"Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement.","status":"ML1, ML2, ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1672","title":"Microsoft Office macro antivirus scanning is enabled","text":"Microsoft Office macro antivirus scanning is enabled.","status":"ML1, ML2, ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1673","title":"Microsoft Office macros are blocked from making Win32 API calls","text":"Microsoft Office macros are blocked from making Win32 API calls.","status":"ML2, ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1674","title":"Only Microsoft Office macros running from within a sandboxed environment, a Trusted…","text":"Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.","status":"ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1675","title":"Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled…","text":"Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.","status":"ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1676","title":"Microsoft Office’s list of trusted publishers is validated at least annually","text":"Microsoft Office’s list of trusted publishers is validated at least annually.","status":"ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1679","title":"Multi-factor authentication is used to authenticate human users to third-party online services that process, store or…","text":"Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data.","status":"ML1, ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"e8","id":"ISM-1680","title":"Multi-factor authentication (where available) is used to authenticate human users to…","text":"Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data.","status":"ML1, ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1681","title":"Multi-factor authentication is used to authenticate customers to online customer…","text":"Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data.","status":"ML1, ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1682","title":"Multi-factor authentication used for authenticating human users of systems is…","text":"Multi-factor authentication used for authenticating human users of systems is phishing-resistant.","status":"ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1683","title":"Successful and unsuccessful multi-factor authentication events are centrally logged","text":"Successful and unsuccessful multi-factor authentication events are centrally logged.","status":"ML2, ML3","group":"Multi-factor authentication","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"e8","id":"ISM-1685","title":"Credentials for break glass accounts, local administrator accounts and service accounts…","text":"Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed.","status":"ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1686","title":"Credential Guard functionality is enabled","text":"Credential Guard functionality is enabled.","status":"ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1687","title":"Privileged operating environments are not virtualised within unprivileged operating…","text":"Privileged operating environments are not virtualised within unprivileged operating environments.","status":"ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1688","title":"Unprivileged user accounts cannot be used to log on to privileged operating environments","text":"Unprivileged user accounts cannot be used to log on to privileged operating environments.","status":"ML1, ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1689","title":"Privileged user accounts (excluding local administrator accounts) cannot be used to log…","text":"Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments.","status":"ML1, ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1690","title":"Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of…","text":"Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","status":"ML1, ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1691","title":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release","text":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release.","status":"ML1, ML2","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"e8","id":"ISM-1692","title":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48…","text":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","status":"ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1693","title":"Patches, updates or other vendor mitigations for vulnerabilities in applications other…","text":"Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within one month of release.","status":"ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"e8","id":"ISM-1694","title":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks…","text":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","status":"ML1, ML2, ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1695","title":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release","text":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.","status":"ML1, ML2","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"e8","id":"ISM-1696","title":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of…","text":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1697","title":"Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release…","text":"Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1698","title":"A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…","text":"A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.","status":"ML1, ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"e8","id":"ISM-1699","title":"A vulnerability scanner is used at least weekly to identify missing patches or updates…","text":"A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.","status":"ML1, ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"e8","id":"ISM-1700","title":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office…","text":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.","status":"ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1701","title":"A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in…","text":"A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.","status":"ML1, ML2, ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"e8","id":"ISM-1702","title":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of…","text":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.","status":"ML1, ML2, ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"e8","id":"ISM-1703","title":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers","text":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1704","title":"Office productivity suites, web browsers and their extensions, email clients, PDF…","text":"Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.","status":"ML1, ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"e8","id":"ISM-1705","title":"Privileged user accounts (excluding backup administrator accounts) cannot access…","text":"Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.","status":"ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1706","title":"Privileged user accounts (excluding backup administrator accounts) cannot access their…","text":"Privileged user accounts (excluding backup administrator accounts) cannot access their own backups.","status":"ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1707","title":"Privileged user accounts (excluding backup administrator accounts) are prevented from…","text":"Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.","status":"ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"e8","id":"ISM-1708","title":"Backup administrator accounts are prevented from modifying and deleting backups during…","text":"Backup administrator accounts are prevented from modifying and deleting backups during their retention period.","status":"ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1807","title":"An automated method of asset discovery is used at least fortnightly to support the…","text":"An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.","status":"ML1, ML2, ML3","group":"Patch applications & Patch operating systems","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"],["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Am","Vn"],"edTopics":["Am","Vn"],"direct":[]},{"fw":"e8","id":"ISM-1808","title":"A vulnerability scanner with an up-to-date vulnerability database is used for…","text":"A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.","status":"ML1, ML2, ML3","group":"Patch applications & Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"e8","id":"ISM-1810","title":"Backups of data, applications and settings are synchronised to enable restoration to a…","text":"Backups of data, applications and settings are synchronised to enable restoration to a common point in time.","status":"ML1, ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"e8","id":"ISM-1811","title":"Backups of data, applications and settings are retained in a secure and resilient manner","text":"Backups of data, applications and settings are retained in a secure and resilient manner.","status":"ML1, ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"e8","id":"ISM-1812","title":"Unprivileged user accounts cannot access backups belonging to other user accounts","text":"Unprivileged user accounts cannot access backups belonging to other user accounts.","status":"ML1, ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1813","title":"Unprivileged user accounts cannot access their own backups","text":"Unprivileged user accounts cannot access their own backups.","status":"ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1814","title":"Unprivileged user accounts are prevented from modifying and deleting backups","text":"Unprivileged user accounts are prevented from modifying and deleting backups.","status":"ML1, ML2, ML3","group":"Regular backups","csf":[["PR.DS-11","e","Essential Eight strategy (ControlMapping mapping)"],["RC.RP-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"e8","id":"ISM-1815","title":"Event logs are protected from unauthorised modification and deletion","text":"Event logs are protected from unauthorised modification and deletion.","status":"ML2, ML3","group":"All strategies","csf":[["DE.AE-03","e","topic: Logging & Audit"],["PR.PS-04","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Lg"],"edTopics":["Lg"],"direct":[]},{"fw":"e8","id":"ISM-1819","title":"Following the identification of a cyber security incident, the cyber security incident…","text":"Following the identification of a cyber security incident, the cyber security incident response plan is enacted.","status":"ML2, ML3","group":"All strategies","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","Essential Eight strategy (ControlMapping mapping)"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"e8","id":"ISM-1823","title":"Office productivity suite security settings cannot be changed by human users","text":"Office productivity suite security settings cannot be changed by human users.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1824","title":"PDF application security settings cannot be changed by human users","text":"PDF application security settings cannot be changed by human users.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1859","title":"Office productivity suites are hardened using ASD and vendor hardening guidance, with…","text":"Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"e8","id":"ISM-1860","title":"PDF applications are hardened using ASD and vendor hardening guidance, with the most…","text":"PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Cf"],"edTopics":["Cf"],"direct":[]},{"fw":"e8","id":"ISM-1861","title":"Local Security Authority protection functionality is enabled","text":"Local Security Authority protection functionality is enabled.","status":"ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1870","title":"Application control is applied to user profiles and temporary folders used by operating…","text":"Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.","status":"ML1, ML2, ML3","group":"Application control","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]},{"fw":"e8","id":"ISM-1871","title":"Application control is applied to all locations other than user profiles and temporary…","text":"Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.","status":"ML2, ML3","group":"Application control","csf":[["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1872","title":"Multi-factor authentication used for authenticating human users of online services is…","text":"Multi-factor authentication used for authenticating human users of online services is phishing-resistant.","status":"ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Mf"],"edTopics":["Mf"],"direct":[]},{"fw":"e8","id":"ISM-1873","title":"Multi-factor authentication used for authenticating customers of online customer services provides a…","text":"Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option.","status":"ML2","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1874","title":"Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant","text":"Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant.","status":"ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1876","title":"Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of…","text":"Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","status":"ML1, ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"e8","id":"ISM-1877","title":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours…","text":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","status":"ML1, ML2, ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"e8","id":"ISM-1879","title":"Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release…","text":"Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1883","title":"Privileged user accounts explicitly authorised to access online services are strictly…","text":"Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions.","status":"ML1, ML2, ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1889","title":"Command line process creation events are centrally logged","text":"Command line process creation events are centrally logged.","status":"ML2, ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1890","title":"Microsoft Office macros are checked to ensure they are free of malicious code before…","text":"Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations.","status":"ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1891","title":"Microsoft Office macros digitally signed by signatures other than V3 signatures cannot…","text":"Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View.","status":"ML3","group":"Restrict Microsoft Office macros","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1892","title":"Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that…","text":"Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data.","status":"ML1, ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1893","title":"Multi-factor authentication is used to authenticate human users to third-party online customer services that process…","text":"Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data.","status":"ML1, ML2, ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1894","title":"Multi-factor authentication used for authenticating human users of data repositories is…","text":"Multi-factor authentication used for authenticating human users of data repositories is phishing-resistant.","status":"ML3","group":"Multi-factor authentication","csf":[["PR.AA-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1896","title":"Memory integrity functionality is enabled","text":"Memory integrity functionality is enabled.","status":"ML3","group":"User application hardening","csf":[["PR.PS-01","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1897","title":"Remote Credential Guard functionality is enabled","text":"Remote Credential Guard functionality is enabled.","status":"ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1898","title":"Secure Admin Workstations are used in the performance of administrative activities","text":"Secure Admin Workstations are used in the performance of administrative activities.","status":"ML3","group":"Restrict administrative privileges","csf":[["PR.AA-05","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1900","title":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware","text":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1901","title":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when…","text":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","status":"ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1902","title":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of…","text":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1903","title":"Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release…","text":"Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1904","title":"Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release…","text":"Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","status":"ML3","group":"Patch operating systems","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-03","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1905","title":"Online services that are no longer supported by vendors are removed","text":"Online services that are no longer supported by vendors are removed.","status":"ML1, ML2, ML3","group":"Patch applications","csf":[["ID.RA-01","e","Essential Eight strategy (ControlMapping mapping)"],["PR.PS-02","e","Essential Eight strategy (ControlMapping mapping)"]],"topics":[],"edTopics":[],"direct":[]},{"fw":"e8","id":"ISM-1906","title":"Event logs from internet-facing servers are analysed in a timely manner to detect cyber…","text":"Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events.","status":"ML2, ML3","group":"All strategies","csf":[["DE.AE-02","e","Essential Eight strategy (ControlMapping mapping)"],["DE.AE-03","e","Essential Eight strategy (ControlMapping mapping)"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"],["DE.CM-01","e","topic: Cont. Monitoring"],["DE.CM-03","e","topic: Cont. Monitoring"],["DE.CM-09","e","topic: Cont. Monitoring"]],"topics":["Sm","Sg"],"edTopics":["Sm","Sg"],"direct":[]},{"fw":"e8","id":"ISM-1907","title":"Event logs from non-internet-facing servers are analysed in a timely manner to detect…","text":"Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events.","status":"ML3","group":"All strategies","csf":[["DE.AE-02","e","Essential Eight strategy (ControlMapping mapping)"],["DE.AE-03","e","Essential Eight strategy (ControlMapping mapping)"],["DE.CM-01","e","topic: Cont. Monitoring"],["DE.CM-03","e","topic: Cont. Monitoring"],["DE.CM-09","e","topic: Cont. Monitoring"]],"topics":["Sm"],"edTopics":["Sm"],"direct":[]},{"fw":"dora","id":"Art.5(2)(a)","title":"Governance and organisation","text":"bear the ultimate responsibility for managing the financial entity’s ICT risk;","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"dora","id":"Art.5(2)(b)","title":"Governance and organisation","text":"put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality, of data;","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[]},{"fw":"dora","id":"Art.5(2)(c)","title":"Governance and organisation","text":"set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions;","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[]},{"fw":"dora","id":"Art.5(2)(f)","title":"Governance and organisation","text":"approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them;","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[]},{"fw":"dora","id":"Art.5(3)","title":"Governance and organisation","text":"Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation.","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[]},{"fw":"dora","id":"Art.5(4)","title":"Governance and organisation","text":"Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"dora","id":"Art.6(1)","title":"ICT risk management framework","text":"Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"dora","id":"Art.6(2)","title":"ICT risk management framework","text":"The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks including damage and unauthorised access or usage.","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ph"],"edTopics":["Ph"],"direct":[]},{"fw":"dora","id":"Art.6(4)","title":"ICT risk management framework","text":"Financial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest. Financial entities shall ensure appropriate segregation and independence of ICT risk management functions, control functions, and internal audit functions, according to the three lines of defence model, or an internal risk management and control model.","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[]},{"fw":"dora","id":"Art.6(5)","title":"ICT risk management framework","text":"The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request.","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[]},{"fw":"dora","id":"Art.6(6)","title":"ICT risk management framework","text":"The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence. The frequency and focus of ICT audits shall be commensurate to the ICT risk of the financial entity.","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[]},{"fw":"dora","id":"Art.6(7)","title":"ICT risk management framework","text":"Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[]},{"fw":"dora","id":"Art.6(8)","title":"ICT risk management framework","text":"The ICT risk management framework shall include a digital operational resilience strategy setting out how the framework shall be implemented. To that end, the digital operational resilience strategy shall include methods to address ICT risk and attain specific ICT objectives, by:","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"dora","id":"Art.8(1)","title":"Identification","text":"As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.","csf":[["GV.OC-01","e","topic: Business Environment"],["GV.OC-04","e","topic: Business Environment"],["GV.OC-05","e","topic: Business Environment"],["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-05","e","topic: Data Classification"],["ID.AM-07","e","topic: Data Classification"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am","Be","Da"],"edTopics":["Am","Be","Da"],"direct":[]},{"fw":"dora","id":"Art.8(2)","title":"Identification","text":"Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them.","csf":[["DE.AE-07","e","topic: Threat Intelligence"],["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-02","e","topic: Threat Intelligence"],["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Ra","Vn","Ti"],"edTopics":["Ra","Vn","Ti"],"direct":[]},{"fw":"dora","id":"Art.8(3)","title":"Identification","text":"Financial entities, other than microenterprises, shall perform a risk assessment upon each major change in the network and information system infrastructure, in the processes or procedures affecting their ICT supported business functions, information assets or ICT assets.","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"]],"topics":["Ra"],"edTopics":["Ra"],"direct":[]},{"fw":"dora","id":"Art.8(4)","title":"Identification","text":"Financial entities shall identify all information assets and ICT assets, including those on remote sites, network resources and hardware equipment, and shall map those considered critical. They shall map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets.","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"dora","id":"Art.8(6)","title":"Identification","text":"For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am"],"edTopics":["Am"],"direct":[]},{"fw":"dora","id":"Art.8(7)","title":"Identification","text":"Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems and, in any case before and after connecting technologies, applications or systems.","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"]],"topics":["Ra"],"edTopics":["Ra"],"direct":[]},{"fw":"dora","id":"Art.9(1)","title":"Protection and prevention","text":"For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.","csf":[["DE.CM-01","e","topic: Cont. Monitoring"],["DE.CM-03","e","topic: Cont. Monitoring"],["DE.CM-09","e","topic: Cont. Monitoring"]],"topics":["Sm"],"edTopics":["Sm"],"direct":[]},{"fw":"dora","id":"Art.9(2)","title":"Protection and prevention","text":"Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"dora","id":"Art.9(3)(a)","title":"Protection and prevention","text":"ensure the security of the means of transfer of data;","csf":[["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["En"],"edTopics":["En"],"direct":[]},{"fw":"dora","id":"Art.9(3)(c)","title":"Protection and prevention","text":"prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data;","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"dora","id":"Art.9(3)(d)","title":"Protection and prevention","text":"ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error.","csf":[["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Dp"],"edTopics":["Dp"],"direct":[]},{"fw":"dora","id":"Art.9(4)(a)","title":"Protection and prevention","text":"develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[]},{"fw":"dora","id":"Art.9(4)(b)","title":"Protection and prevention","text":"following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"dora","id":"Art.9(4)(c)","title":"Protection and prevention","text":"implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof;","csf":[["DE.CM-02","e","topic: Physical Security"],["PR.AA-01","e","topic: Access Control"],["PR.AA-05","e","topic: Access Control"],["PR.AA-06","e","topic: Physical Security"],["PR.IR-02","e","topic: Physical Security"]],"topics":["Ac","Pa","Ph"],"edTopics":["Ac","Pa","Ph"],"direct":[]},{"fw":"dora","id":"Art.9(4)(d)","title":"Protection and prevention","text":"implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;","csf":[["PR.AA-03","e","topic: Multi-Factor Auth"],["PR.DS-01","e","topic: Encryption"],["PR.DS-02","e","topic: Encryption"]],"topics":["Mf","En"],"edTopics":["Mf","En"],"direct":[]},{"fw":"dora","id":"Art.9(4)(e)","title":"Protection and prevention","text":"implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner;","csf":[],"topics":[],"edTopics":[],"direct":[["nis2","6.4","All three require documented, risk-based change management in which changes are recorded, tested, approved and verified.","e"],["iso","A.8.32","All three require documented, risk-based change management in which changes are recorded, tested, approved and verified.","e"]]},{"fw":"dora","id":"Art.9(4)(f)","title":"Protection and prevention","text":"have appropriate and comprehensive documented policies for patches and updates.","csf":[["PR.PS-02","e","topic: Patch Management"]],"topics":["Pm"],"edTopics":["Pm"],"direct":[]},{"fw":"dora","id":"Art.10(1)","title":"Detection","text":"Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure. All detection mechanisms referred to in the first subparagraph shall be regularly tested in accordance with Article 25.","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.AE-04","e","topic: Anomaly Detection"],["DE.CM-01","e","topic: Intrusion Detection"],["DE.CM-09","e","topic: Anomaly Detection"]],"topics":["Id","An"],"edTopics":["Id","An"],"direct":[]},{"fw":"dora","id":"Art.10(2)","title":"Detection","text":"The detection mechanisms referred to in paragraph 1 shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate ICT-related incident response processes, including automatic alert mechanisms for relevant staff in charge of ICT-related incident response.","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.AE-03","e","topic: SIEM / SOC"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"],["DE.CM-01","e","topic: Intrusion Detection"]],"topics":["Id","Sg"],"edTopics":["Id","Sg"],"direct":[]},{"fw":"dora","id":"Art.10(3)","title":"Detection","text":"Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.","csf":[["DE.AE-03","e","topic: Logging & Audit"],["DE.AE-06","e","topic: SIEM / SOC"],["DE.AE-08","e","topic: SIEM / SOC"],["DE.CM-01","e","topic: Cont. Monitoring"],["DE.CM-03","e","topic: Cont. Monitoring"],["DE.CM-09","e","topic: Cont. Monitoring"],["GV.RR-04","e","topic: Insider Threat"],["PR.PS-04","e","topic: Logging & Audit"]],"topics":["Sm","Lg","Sg","It"],"edTopics":["Sm","Lg","Sg","It"],"direct":[]},{"fw":"dora","id":"Art.11(1)","title":"Response and recovery","text":"As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.","csf":[["GV.OC-04","e","topic: Business Continuity"],["PR.IR-03","e","topic: Business Continuity"],["RC.RP-04","e","topic: Business Continuity"]],"topics":["Bc"],"edTopics":["Bc"],"direct":[]},{"fw":"dora","id":"Art.11(2)(b)","title":"Response and recovery","text":"quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and recovery actions;","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"dora","id":"Art.11(2)(c)","title":"Response and recovery","text":"activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;","csf":[["RS.MI-01","e","topic: Mitigation"],["RS.MI-02","e","topic: Mitigation"]],"topics":["Mt"],"edTopics":["Mt"],"direct":[]},{"fw":"dora","id":"Art.11(2)(e)","title":"Response and recovery","text":"set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19.","csf":[["RC.CO-03","e","topic: Comms & Restore"],["RC.CO-04","e","topic: Comms & Restore"],["RC.RP-05","e","topic: Comms & Restore"]],"topics":["Cr"],"edTopics":["Cr"],"direct":[]},{"fw":"dora","id":"Art.11(3)","title":"Response and recovery","text":"As part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews.","csf":[["ID.IM-04","e","topic: Recovery Planning"],["RC.RP-01","e","topic: Recovery Planning"],["RC.RP-02","e","topic: Recovery Planning"]],"topics":["Rc"],"edTopics":["Rc"],"direct":[]},{"fw":"dora","id":"Art.11(4)","title":"Response and recovery","text":"Financial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.","csf":[["GV.OC-04","e","topic: Business Continuity"],["PR.IR-03","e","topic: Business Continuity"],["RC.RP-04","e","topic: Business Continuity"]],"topics":["Bc"],"edTopics":["Bc"],"direct":[]},{"fw":"dora","id":"Art.11(5)","title":"Response and recovery","text":"As part of the overall business continuity policy, financial entities shall conduct a business impact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, financial entities shall assess the potential impact of severe business disruptions by means of quantitative and qualitative criteria, using internal and external data and scenario analysis, as appropriate. The BIA shall consider the criticality of identified and mapped business functions, support processes, third-party dependencies and information assets, and their interdependencies. Financial entities shall ensure that ICT assets and ICT services are designed and used in full alignment with the BIA, in particular with regard to adequately ensuring the redundancy of all critical components.","csf":[["GV.OC-01","e","topic: Business Environment"],["GV.OC-04","e","topic: Business Environment"],["GV.OC-05","e","topic: Business Environment"]],"topics":["Be"],"edTopics":["Be"],"direct":[]},{"fw":"dora","id":"Art.11(6)","title":"Response and recovery","text":"As part of their comprehensive ICT risk management, financial entities shall: For the purposes of the first subparagraph, point (a), financial entities, other than microenterprises, shall include in the testing plans scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities necessary to meet the obligations set out in Article 12. Financial entities shall regularly review their ICT business continuity policy and ICT response and recovery plans, taking into account the results of tests carried out in accordance with the first subparagraph and recommendations stemming from audit checks or supervisory reviews.","csf":[["GV.OC-04","e","topic: Business Continuity"],["PR.IR-03","e","topic: Business Continuity"],["RC.RP-02","e","topic: Disaster Recovery"],["RC.RP-04","e","topic: Business Continuity"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Bc","Dr"],"edTopics":["Bc","Dr"],"direct":[]},{"fw":"dora","id":"Art.11(7)","title":"Response and recovery","text":"Financial entities, other than microenterprises, shall have a crisis management function, which, in the event of activation of their ICT business continuity plans or ICT response and recovery plans, shall, inter alia, set out clear procedures to manage internal and external crisis communications in accordance with Article 14.","csf":[["RC.CO-03","e","topic: Comms & Restore"],["RC.CO-04","e","topic: Comms & Restore"],["RC.RP-05","e","topic: Comms & Restore"]],"topics":["Cr"],"edTopics":["Cr"],"direct":[]},{"fw":"dora","id":"Art.12(1)","title":"Backup policies and procedures, restoration and recovery procedures and methods","text":"For the purpose of ensuring the restoration of ICT systems and data with minimum downtime, limited disruption and loss, as part of their ICT risk management framework, financial entities shall develop and document:","csf":[["PR.DS-11","e","topic: Backup & Recovery"],["RC.RP-03","e","topic: Backup & Recovery"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"dora","id":"Art.12(2)","title":"Backup policies and procedures, restoration and recovery procedures and methods","text":"Financial entities shall set up backup systems that can be activated in accordance with the backup policies and procedures, as well as restoration and recovery procedures and methods. The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.","csf":[["PR.DS-11","e","topic: Backup & Recovery"],["RC.RP-03","e","topic: Backup & Recovery"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"dora","id":"Art.12(3)","title":"Backup policies and procedures, restoration and recovery procedures and methods","text":"When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. The ICT systems shall be securely protected from any unauthorised access or ICT corruption and allow for the timely restoration of services making use of data and system backups as necessary. For central counterparties, the recovery plans shall enable the recovery of all transactions at the time of disruption to allow the central counterparty to continue to operate with certainty and to complete settlement on the scheduled date. Data reporting service providers shall additionally maintain adequate resources and have back-up and restoration facilities in place in order to offer and maintain their services at all times.","csf":[["PR.DS-11","e","topic: Backup & Recovery"],["RC.RP-03","e","topic: Backup & Recovery"]],"topics":["Bk"],"edTopics":["Bk"],"direct":[]},{"fw":"dora","id":"Art.12(4)","title":"Backup policies and procedures, restoration and recovery procedures and methods","text":"Financial entities, other than microenterprises, shall maintain redundant ICT capacities equipped with resources, capabilities and functions that are adequate to ensure business needs. Microenterprises shall assess the need to maintain such redundant ICT capacities based on their risk profile.","csf":[["PR.IR-03","e","topic: Disaster Recovery"],["RC.RP-02","e","topic: Disaster Recovery"],["RC.RP-05","e","topic: Disaster Recovery"]],"topics":["Dr"],"edTopics":["Dr"],"direct":[]},{"fw":"dora","id":"Art.12(6)","title":"Backup policies and procedures, restoration and recovery procedures and methods","text":"In determining the recovery time and recovery point objectives for each function, financial entities shall take into account whether it is a critical or important function and the potential overall impact on market efficiency. Such time objectives shall ensure that, in extreme scenarios, the agreed service levels are met.","csf":[["ID.IM-04","e","topic: Recovery Planning"],["RC.RP-01","e","topic: Recovery Planning"],["RC.RP-02","e","topic: Recovery Planning"]],"topics":["Rc"],"edTopics":["Rc"],"direct":[]},{"fw":"dora","id":"Art.13(1)","title":"Learning and evolving","text":"Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience.","csf":[["DE.AE-07","e","topic: Threat Intelligence"],["ID.RA-02","e","topic: Threat Intelligence"],["ID.RA-03","e","topic: Threat Intelligence"]],"topics":["Ti"],"edTopics":["Ti"],"direct":[]},{"fw":"dora","id":"Art.13(2)","title":"Learning and evolving","text":"Financial entities shall put in place post ICT-related incident reviews after a major ICT-related incident disrupts their core activities, analysing the causes of disruption and identifying required improvements to the ICT operations or within the ICT business continuity policy referred to in Article 11. Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph. The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following:","csf":[["ID.IM-03","e","topic: Lessons Learned"],["RC.RP-06","e","topic: Lessons Learned"],["RS.AN-03","e","topic: Forensics"],["RS.AN-06","e","topic: Forensics"],["RS.AN-07","e","topic: Forensics"]],"topics":["Fn","Ll"],"edTopics":["Fn","Ll"],"direct":[]},{"fw":"dora","id":"Art.13(3)","title":"Learning and evolving","text":"Lessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1).","csf":[["ID.IM-03","e","topic: Lessons Learned"],["RC.RP-06","e","topic: Lessons Learned"]],"topics":["Ll"],"edTopics":["Ll"],"direct":[]},{"fw":"dora","id":"Art.13(6)","title":"Learning and evolving","text":"Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).","csf":[["PR.AT-01","e","topic: Awareness & Training"],["PR.AT-02","e","topic: Awareness & Training"]],"topics":["Aw"],"edTopics":["Aw"],"direct":[]},{"fw":"dora","id":"Art.14(1)","title":"Communication","text":"As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.","csf":[["RS.CO-03","e","topic: Communication"]],"topics":["Co"],"edTopics":["Co"],"direct":[]},{"fw":"dora","id":"Art.14(2)","title":"Communication","text":"As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.","csf":[["RS.CO-03","e","topic: Communication"]],"topics":["Co"],"edTopics":["Co"],"direct":[]},{"fw":"dora","id":"Art.16(1)","title":"Simplified ICT risk management framework","text":"Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive 2009/110/EC; and small institutions for occupational retirement provision. Without prejudice to the first subparagraph, the entities listed in the first subparagraph shall:","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"dora","id":"Art.17(1)","title":"ICT-related incident management process","text":"Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"dora","id":"Art.17(2)","title":"ICT-related incident management process","text":"Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.","csf":[["RS.AN-03","e","topic: Forensics"],["RS.AN-06","e","topic: Forensics"],["RS.AN-07","e","topic: Forensics"]],"topics":["Fn"],"edTopics":["Fn"],"direct":[]},{"fw":"dora","id":"Art.17(3)","title":"ICT-related incident management process","text":"The ICT-related incident management process referred to in paragraph 1 shall:","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"dora","id":"Art.17(3)(d)","title":"ICT-related incident management process","text":"set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;","csf":[["RS.CO-03","e","topic: Communication"]],"topics":["Co"],"edTopics":["Co"],"direct":[]},{"fw":"dora","id":"Art.17(3)(f)","title":"ICT-related incident management process","text":"establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.","csf":[["RS.MI-01","e","topic: Mitigation"],["RS.MI-02","e","topic: Mitigation"]],"topics":["Mt"],"edTopics":["Mt"],"direct":[]},{"fw":"dora","id":"Art.18(1)","title":"Classification of ICT-related incidents and cyber threats","text":"Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria:","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.CO-02","e","topic: Reporting"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir","Rp"],"edTopics":["Ir","Rp"],"direct":[]},{"fw":"dora","id":"Art.19(1)","title":"Reporting of major ICT-related incidents and voluntary notification of significant cyber threats","text":"Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article. Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB. For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means. The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts. Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.","csf":[["RS.CO-02","e","topic: Reporting"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"dora","id":"Art.19(3)","title":"Reporting of major ICT-related incidents and voluntary notification of significant cyber threats","text":"Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident. In the case of a significant cyber threat, financial entities shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.","csf":[["RS.CO-02","e","topic: Reporting"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"dora","id":"Art.19(4)","title":"Reporting of major ICT-related incidents and voluntary notification of significant cyber threats","text":"Financial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit the following to the relevant competent authority:","csf":[["RS.CO-02","e","topic: Reporting"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"dora","id":"Art.24(1)","title":"General requirements for the performance of digital operational resilience testing","text":"For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"dora","id":"Art.25(1)","title":"Testing of ICT tools and systems","text":"The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"dora","id":"Art.26(1)","title":"Advanced testing of ICT tools, systems and processes based on TLPT","text":"Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"dora","id":"Art.27(1)","title":"Requirements for testers for the carrying out of TLPT","text":"Financial entities shall only use testers for the carrying out of TLPT, that:","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"dora","id":"Art.28(2)","title":"General principles","text":"As part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis. The management body shall, on the basis of an assessment of the overall risk profile of the financial entity and the scale and complexity of the business services, regularly review the risks identified in respect to contractual arrangements on the use of ICT services supporting critical or important functions.","csf":[["GV.SC-01","e","topic: Supply Chain Risk"],["GV.SC-03","e","topic: Supply Chain Risk"],["GV.SC-05","e","topic: Supply Chain Risk"],["GV.SC-09","e","topic: Supply Chain Risk"],["ID.RA-09","e","topic: Supply Chain Risk"]],"topics":["Sc"],"edTopics":["Sc"],"direct":[]},{"fw":"dora","id":"Art.28(3)","title":"General principles","text":"As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not. Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided. Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity. Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"dora","id":"Art.28(4)","title":"General principles","text":"Before entering into a contractual arrangement on the use of ICT services, financial entities shall:","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"dora","id":"Art.28(5)","title":"General principles","text":"Financial entities may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards. When those contractual arrangements concern critical or important functions, financial entities shall, prior to concluding the arrangements, take due consideration of the use, by ICT third-party service providers, of the most up-to-date and highest quality information security standards.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"dora","id":"Art.28(8)","title":"General principles","text":"For ICT services supporting critical or important functions, financial entities shall put in place exit strategies. The exit strategies shall take into account risks that may emerge at the level of ICT third-party service providers, in particular a possible failure on their part, a deterioration of the quality of the ICT services provided, any business disruption due to inappropriate or failed provision of ICT services or any material risk arising in relation to the appropriate and continuous deployment of the respective ICT service, or the termination of contractual arrangements with ICT third-party service providers under any of the circumstances listed in paragraph 7. Financial entities shall ensure that they are able to exit contractual arrangements without: Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically. Financial entities shall identify alternative solutions and develop transition plans enabling them to remove the contracted ICT services and the relevant data from the ICT third-party service provider and to securely and integrally transfer them to alternative providers or reincorporate them in-house. Financial entities shall have appropriate contingency measures in place to maintain business continuity in the event of the circumstances referred to in the first subparagraph.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.AM-04","e","topic: Cloud Security"],["ID.RA-10","e","topic: Vendor Risk Mgmt"],["PR.IR-01","e","topic: Cloud Security"],["PR.PS-01","e","topic: Cloud Security"]],"topics":["Cl","Vr"],"edTopics":["Cl","Vr"],"direct":[]},{"fw":"dora","id":"Art.29(1)","title":"Preliminary assessment of ICT concentration risk at entity level","text":"When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of a contractual arrangement in relation to ICT services supporting critical or important functions would lead to any of the following: Financial entities shall weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers, taking into account if and how envisaged solutions match the business needs and objectives set out in their digital resilience strategy.","csf":[["GV.SC-01","e","topic: Supply Chain Risk"],["GV.SC-03","e","topic: Supply Chain Risk"],["GV.SC-05","e","topic: Supply Chain Risk"],["GV.SC-09","e","topic: Supply Chain Risk"],["ID.RA-09","e","topic: Supply Chain Risk"]],"topics":["Sc"],"edTopics":["Sc"],"direct":[]},{"fw":"dora","id":"Art.29(2)","title":"Preliminary assessment of ICT concentration risk at entity level","text":"Where the contractual arrangements on the use of ICT services supporting critical or important functions include the possibility that an ICT third-party service provider further subcontracts ICT services supporting a critical or important function to other ICT third-party service providers, financial entities shall weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country. Where contractual arrangements concern ICT services supporting critical or important functions, financial entities shall duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider’s bankruptcy as well as any constraint that may arise in respect to the urgent recovery of the financial entity’s data. Where contractual arrangements on the use of ICT services supporting critical or important functions are concluded with an ICT third-party service provider established in a third country, financial entities shall, in addition to the considerations referred to in the second subparagraph, also consider the compliance with Union data protection rules and the effective enforcement of the law in that third country. Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively supervise the financial entity in that respect.","csf":[["GV.SC-01","e","topic: Supply Chain Risk"],["GV.SC-03","e","topic: Supply Chain Risk"],["GV.SC-05","e","topic: Supply Chain Risk"],["GV.SC-09","e","topic: Supply Chain Risk"],["ID.RA-09","e","topic: Supply Chain Risk"]],"topics":["Sc"],"edTopics":["Sc"],"direct":[]},{"fw":"dora","id":"Art.30(2)","title":"Key contractual provisions","text":"The contractual arrangements on the use of ICT services shall include at least the following elements:","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.AM-04","e","topic: Cloud Security"],["ID.RA-10","e","topic: Vendor Risk Mgmt"],["PR.IR-01","e","topic: Cloud Security"],["PR.PS-01","e","topic: Cloud Security"]],"topics":["Cl","Vr"],"edTopics":["Cl","Vr"],"direct":[]},{"fw":"dora","id":"Art.30(2)(d)","title":"Key contractual provisions","text":"provisions on ensuring access, recovery and return in an easily accessible format of personal and non-personal data processed by the financial entity in the event of the insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, or in the event of the termination of the contractual arrangements;","csf":[],"topics":[],"edTopics":[],"direct":[["nis2","12.5","Access to, return and deletion of data and assets when a contract or relationship ends.","e"],["iso","A.5.11","Access to, return and deletion of data and assets when a contract or relationship ends.","e"]]},{"fw":"dora","id":"Art.30(3)","title":"Key contractual provisions","text":"The contractual arrangements on the use of ICT services supporting critical or important functions shall include, in addition to the elements referred to in paragraph 2, at least the following: By way of derogation from point (e), the ICT third-party service provider and the financial entity that is a microenterprise may agree that the financial entity’s rights of access, inspection and audit can be delegated to an independent third party, appointed by the ICT third-party service provider, and that the financial entity is able to request information and assurance on the ICT third-party service provider’s performance from the third party at any time.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"dora","id":"Art.45(1)","title":"Information-sharing arrangements on cyber threat information and intelligence","text":"Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing:","csf":[["DE.AE-07","e","topic: Threat Intelligence"],["ID.RA-02","e","topic: Threat Intelligence"],["ID.RA-03","e","topic: Threat Intelligence"]],"topics":["Ti"],"edTopics":["Ti"],"direct":[]},{"fw":"cps234","id":"Para 13","title":"Board ultimately responsible for information security","text":"The Board of an APRA-regulated entity (Board) is ultimately responsible for the information security of the entity. The Board must ensure that the entity maintains information security in a manner commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity.","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"],["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rm","Rr"],"edTopics":["Rm","Rr"],"direct":[]},{"fw":"cps234","id":"Para 14","title":"Define information security roles and responsibilities","text":"An APRA-regulated entity must clearly define the information security-related roles and responsibilities of the Board, senior management, governing bodies and individuals with responsibility for decision-making, approval, oversight, operations and other information security functions.","csf":[["GV.RR-01","e","topic: Roles & Responsibilities"],["GV.RR-02","e","topic: Roles & Responsibilities"],["GV.RR-03","e","topic: Roles & Responsibilities"]],"topics":["Rr"],"edTopics":["Rr"],"direct":[]},{"fw":"cps234","id":"Para 15","title":"Maintain a capability commensurate with threats","text":"An APRA-regulated entity must maintain an information security capability commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity.","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"cps234","id":"Para 16","title":"Assess third parties' information security capability","text":"Where information assets are managed by a related party or third party, the APRA-regulated entity must assess the information security capability of that party, commensurate with the potential consequences of an information security incident affecting those assets.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-01","e","topic: Supply Chain Risk"],["GV.SC-03","e","topic: Supply Chain Risk"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-05","e","topic: Supply Chain Risk"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["GV.SC-09","e","topic: Supply Chain Risk"],["ID.RA-09","e","topic: Supply Chain Risk"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Sc","Vr"],"edTopics":["Sc","Vr"],"direct":[]},{"fw":"cps234","id":"Para 17","title":"Keep capability current as threats and vulnerabilities change","text":"An APRA-regulated entity must actively maintain its information security capability with respect to changes in vulnerabilities and threats, including those resulting from changes to information assets or its business environment.","csf":[["DE.AE-07","e","topic: Threat Intelligence"],["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-02","e","topic: Threat Intelligence"],["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Ra","Vn","Ti"],"edTopics":["Ra","Vn","Ti"],"direct":[]},{"fw":"cps234","id":"Para 18","title":"Maintain an information security policy framework","text":"An APRA-regulated entity must maintain an information security policy framework commensurate with its exposures to vulnerabilities and threats.","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[]},{"fw":"cps234","id":"Para 19","title":"Policies direct everyone with security obligations","text":"An APRA-regulated entity's information security policy framework must provide direction on the responsibilities of all parties who have an obligation to maintain information security.","csf":[["GV.PO-01","e","topic: Governance Policy"],["GV.PO-02","e","topic: Governance Policy"]],"topics":["Gp"],"edTopics":["Gp"],"direct":[]},{"fw":"cps234","id":"Para 20","title":"Classify information assets by criticality and sensitivity","text":"An APRA-regulated entity must classify its information assets, including those managed by related parties and third parties, by criticality and sensitivity. This classification must reflect the degree to which an information security incident affecting an information asset has the potential to affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers.","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-05","e","topic: Data Classification"],["ID.AM-07","e","topic: Data Classification"],["ID.AM-08","e","topic: Asset Management"]],"topics":["Am","Da"],"edTopics":["Am","Da"],"direct":[]},{"fw":"cps234","id":"Para 21","title":"Timely controls commensurate with risk and asset life-cycle","text":"An APRA-regulated entity must have information security controls to protect its information assets, including those managed by related parties and third parties, that are implemented in a timely manner and that are commensurate with:\n(a) vulnerabilities and threats to the information assets;\n(b) the criticality and sensitivity of the information assets;\n(c) the stage at which the information assets are within their life-cycle; and\n(d) the potential consequences of an information security incident.","csf":[["ID.RA-03","e","topic: Risk Assessment"],["ID.RA-04","e","topic: Risk Assessment"],["ID.RA-05","e","topic: Risk Assessment"],["ID.RA-06","e","topic: Risk Assessment"],["PR.DS-01","e","topic: Data Protection"],["PR.DS-02","e","topic: Data Protection"],["PR.DS-10","e","topic: Data Protection"]],"topics":["Ra","Dp"],"edTopics":["Ra","Dp"],"direct":[]},{"fw":"cps234","id":"Para 22","title":"Evaluate the design of third parties' controls","text":"Where an APRA-regulated entity's information assets are managed by a related party or third party, the APRA-regulated entity must evaluate the design of that party's information security controls that protects the information assets of the APRA-regulated entity.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-01","e","topic: Supply Chain Risk"],["GV.SC-03","e","topic: Supply Chain Risk"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-05","e","topic: Supply Chain Risk"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["GV.SC-09","e","topic: Supply Chain Risk"],["ID.RA-09","e","topic: Supply Chain Risk"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Sc","Vr"],"edTopics":["Sc","Vr"],"direct":[]},{"fw":"cps234","id":"Para 23","title":"Detect and respond to incidents in a timely manner","text":"An APRA-regulated entity must have robust mechanisms in place to detect and respond to information security incidents in a timely manner.","csf":[["DE.AE-02","e","topic: Intrusion Detection"],["DE.CM-01","e","topic: Intrusion Detection"],["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Id","Ir"],"edTopics":["Id","Ir"],"direct":[]},{"fw":"cps234","id":"Para 24","title":"Maintain information security response plans","text":"An APRA-regulated entity must maintain plans to respond to information security incidents that the entity considers could plausibly occur (information security response plans).","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"cps234","id":"Para 25","title":"Response plans cover all stages and escalation","text":"An APRA-regulated entity's information security response plans must include the mechanisms in place for:\n(a) managing all relevant stages of an incident, from detection to post-incident review; and\n(b) escalation and reporting of information security incidents to the Board, other governing bodies and individuals responsible for information security incident management and oversight, as appropriate.","csf":[["ID.IM-03","e","topic: Lessons Learned"],["ID.IM-04","e","topic: Incident Response"],["RC.RP-06","e","topic: Lessons Learned"],["RS.CO-03","e","topic: Communication"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir","Co","Ll"],"edTopics":["Ir","Co","Ll"],"direct":[]},{"fw":"cps234","id":"Para 26","title":"Review and test response plans annually","text":"An APRA-regulated entity must annually review and test its information security response plans to ensure they remain effective and fit-for-purpose.","csf":[["ID.IM-04","e","topic: Incident Response"],["RS.MA-01","e","topic: Incident Response"],["RS.MA-02","e","topic: Incident Response"],["RS.MA-03","e","topic: Incident Response"],["RS.MA-04","e","topic: Incident Response"]],"topics":["Ir"],"edTopics":["Ir"],"direct":[]},{"fw":"cps234","id":"Para 27","title":"Systematic testing programme for control effectiveness","text":"An APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program. The nature and frequency of the systematic testing must be commensurate with:\n(a) the rate at which the vulnerabilities and threats change;\n(b) the criticality and sensitivity of the information asset;\n(c) the consequences of an information security incident;\n(d) the risks associated with exposure to environments where the APRA-regulated entity is unable to enforce its information security policies; and\n(e) the materiality and frequency of change to information assets.","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"],["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Rm","Vn"],"edTopics":["Rm","Vn"],"direct":[]},{"fw":"cps234","id":"Para 28","title":"Check third parties' control testing is adequate","text":"Where an APRA-regulated entity's information assets are managed by a related party or a third party, and the APRA-regulated entity is reliant on that party's information security control testing, the APRA-regulated entity must assess whether the nature and frequency of testing of controls in respect of those information assets is commensurate with paragraphs 27(a) to 27(e) of this Prudential Standard.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Vr"],"edTopics":["Vr"],"direct":[]},{"fw":"cps234","id":"Para 30","title":"Testing by skilled, functionally independent specialists","text":"An APRA-regulated entity must ensure that testing is conducted by appropriately skilled and functionally independent specialists.","csf":[["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"]],"topics":["Vn"],"edTopics":["Vn"],"direct":[]},{"fw":"cps234","id":"Para 31","title":"Review the testing programme at least annually","text":"An APRA-regulated entity must review the sufficiency of the testing program at least annually or when there is a material change to information assets or the business environment.","csf":[["GV.RM-01","e","topic: Risk Management"],["GV.RM-02","e","topic: Risk Management"],["GV.RM-03","e","topic: Risk Management"],["GV.RM-06","e","topic: Risk Management"]],"topics":["Rm"],"edTopics":["Rm"],"direct":[]},{"fw":"cps234","id":"Para 32","title":"Internal audit reviews control design and effectiveness","text":"An APRA-regulated entity's internal audit activities must include a review of the design and operating effectiveness of information security controls, including those maintained by related parties and third parties (information security control assurance).","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[]},{"fw":"cps234","id":"Para 33","title":"Assurance provided by appropriately skilled personnel","text":"An APRA-regulated entity must ensure that the information security control assurance is provided by personnel appropriately skilled in providing such assurance.","csf":[["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"]],"topics":["Cm"],"edTopics":["Cm"],"direct":[]},{"fw":"cps234","id":"Para 34","title":"Internal audit assesses third-party assurance relied on","text":"An APRA-regulated entity's internal audit function must assess the information security control assurance provided by a related party or third party where:\n(a) an information security incident affecting the information assets has the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; and\n(b) internal audit intends to rely on the information security control assurance provided by the related party or third party.","csf":[["DE.CM-06","e","topic: Vendor Risk Mgmt"],["GV.OC-03","e","topic: Compliance"],["GV.OV-03","e","topic: Compliance"],["GV.SC-04","e","topic: Vendor Risk Mgmt"],["GV.SC-06","e","topic: Vendor Risk Mgmt"],["GV.SC-07","e","topic: Vendor Risk Mgmt"],["ID.RA-10","e","topic: Vendor Risk Mgmt"]],"topics":["Cm","Vr"],"edTopics":["Cm","Vr"],"direct":[]},{"fw":"cps234","id":"Para 35","title":"Notify APRA of material incidents within 72 hours","text":"An APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that:\n(a) materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; or\n(b) has been notified to other regulators, either in Australia or other jurisdictions.","csf":[["RS.CO-02","e","topic: Reporting"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"cps234","id":"Para 36","title":"Notify APRA of material control weaknesses within 10 business days","text":"An APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 10 business days, after it becomes aware of a material information security control weakness which the entity expects it will not be able to remediate in a timely manner.","csf":[["RS.CO-02","e","topic: Reporting"]],"topics":["Rp"],"edTopics":["Rp"],"direct":[]},{"fw":"ce","id":"CE 1","title":"Firewalls","csf":[["ID.AM-03","e","topic: Firewall / Net Seg"],["PR.IR-01","e","topic: Firewall / Net Seg"]],"topics":["Fw"],"edTopics":["Fw"],"direct":[]},{"fw":"ce","id":"CE 2","title":"Secure Configuration","csf":[["PR.AA-05","e","topic: Mobile Security"],["PR.PS-01","e","topic: Secure Config"]],"topics":["Cf","Mb"],"edTopics":["Cf","Mb"],"direct":[]},{"fw":"ce","id":"CE 3","title":"Security Update Management","csf":[["ID.AM-01","e","topic: Asset Management"],["ID.AM-02","e","topic: Asset Management"],["ID.AM-04","e","topic: Asset Management"],["ID.AM-08","e","topic: Asset Management"],["ID.RA-01","e","topic: Vulnerability Mgmt"],["ID.RA-08","e","topic: Vulnerability Mgmt"],["PR.PS-02","e","topic: Patch Management"]],"topics":["Am","Vn","Pm"],"edTopics":["Am","Vn","Pm"],"direct":[]},{"fw":"ce","id":"CE 4","title":"User Access Control","csf":[["ID.AM-04","e","topic: Cloud Security"],["PR.AA-01","e","topic: Access Control"],["PR.AA-03","e","topic: Multi-Factor Auth"],["PR.AA-05","e","topic: Access Control"],["PR.IR-01","e","topic: Cloud Security"],["PR.PS-01","e","topic: Cloud Security"]],"topics":["Ac","Mf","Pa","Cl"],"edTopics":["Ac","Mf","Pa","Cl"],"direct":[]},{"fw":"ce","id":"CE 5","title":"Malware protection","csf":[["DE.CM-09","e","topic: Endpoint Protection"],["PR.PS-05","e","topic: Endpoint Protection"]],"topics":["Ep"],"edTopics":["Ep"],"direct":[]}]}