Perbandingan
NIS2 vs NIST CSF 2.0: persyaratan hukum UE dilihat dari kacamata NIST
NIST Cybersecurity Framework 2.0 · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27
Bagi organisasi yang menjalankan program keamanannya berdasarkan NIST CSF 2.0, yang sering kali merupakan perusahaan berkantor pusat di AS dengan operasi di UE, pertanyaannya adalah seberapa jauh CSF dapat membantu mereka menuju NIS2. Panduan implementasi teknis ENISA memetakan setiap persyaratan dalam Implementing Regulation (EU) 2024/2690 ke subkategori CSF 2.0 serta ke ISO 27001.
Jawabannya: sebagian besar sudah tercakup untuk langkah-langkah teknis. Hampir setiap poin NIS2 tercakup oleh hasil CSF, dengan beberapa poin hanya terkait secara longgar. Satu poin yang tidak terpetakan berkaitan dengan pengembalian atau penghapusan aset ketika hubungan kerja berakhir, yang oleh ENISA dipetakan ke ISO tetapi tidak ke CSF.
Dari NIS2 ke CSF, hasil CSF yang tidak terpetakan sebagian besar merupakan item tata kelola strategis yang tidak secara eksplisit diuraikan oleh NIS2, yaitu peninjauan misi dan strategi organisasi, arahan selera risiko, jalur komunikasi untuk risiko, dan verifikasi identitas.
Sama seperti ISO, pemetaan bukan kepatuhan. Kewajiban hukum NIS2 (akuntabilitas dan pelatihan badan manajemen, tenggat waktu pelaporan insiden Pasal 23, registrasi, transposisi nasional) berada di luar kerangka kerja kontrol mana pun.
Poin utama
- Target Profile CSF yang mencakup subkategori yang dipetakan ke NIS2 merupakan rencana implementasi NIS2 yang baik.
- Tambahkan secara eksplisit kewajiban khusus UE: tenggat waktu pelaporan CSIRT, pelatihan manajemen, dan registrasi nasional.
- Jika Anda juga memerlukan sertifikasi, ISO 27001 adalah jalurnya; CSF tidak dapat disertifikasi.
Miliki NIST CSF 2.0 → butuhkan NIS2
49 persyaratan 45 terpetakan · · 1 tanpa pemetaan Buka di tampilan kesenjangan →Dari 49 persyaratan NIS2 Implementing Regulation (EU) 2024/2690, 45 dipetakan ke sesuatu dalam NIST CSF 2.0, 3 hanya terkait secara longgar, dan 1 tidak memiliki pemetaan dalam data kami.
NIS2 di sini mengacu pada ketentuan teknis Implementing Regulation (EU) 2024/2690, yang berlaku langsung bagi penyedia infrastruktur digital dan layanan ICT; entitas NIS2 lainnya mengikuti transposisi Pasal 21 di negara masing-masing. Batas waktu pelaporan insiden (Pasal 23) tidak termasuk dalam cakupan. Pemetaan ENISA bersifat tidak mengikat.
Kemungkinan pekerjaan baru: persyaratan NIS2 tanpa pemetaan ke NIST CSF 2.0 (1)
| NIS2 | Persyaratan | Kecocokan | NIST CSF 2.0 | Bukti |
|---|---|---|---|---|
| 12. Asset management · 1 | ||||
| 12.5 | Deposit, return or deletion of assets upon termination of employment | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIST CSF 2.0 dalam data kami. |
Periksa ini: hanya terkait secara longgar (hasil CSF yang sama, bukan pemetaan) (3)
| NIS2 | Persyaratan | Kecocokan | NIST CSF 2.0 | Bukti |
|---|---|---|---|---|
| 6. Security in acquisition, development and maintenance · 1 | ||||
| 6.4 | Change management, repairs and maintenance | ID.RA-07 | Hanya berbagi CSF ID.RA-07: terkait, bukan pemetaan | |
| 10. Human resources security · 2 | ||||
| 10.1 | Human resources security | GV.RR-04PR.AT-02 | Hanya berbagi CSF GV.RR-04, PR.AT-02: terkait, bukan pemetaan | |
| 10.3 | Termination or change of employment procedures | GV.RR-04 | Hanya berbagi CSF GV.RR-04: terkait, bukan pemetaan | |
Dipetakan (45)
| NIS2 | Persyaratan | Kecocokan | NIST CSF 2.0 | Bukti |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | Crosswalk | GV.PO-01GV.PO-02 | Topik sama: Kebijakan Tata Kelola |
| 1.2 | Roles, responsibilities and authorities | Crosswalk | GV.RR-01GV.RR-02GV.RR-03 | Topik sama: Peran & Tanggung Jawab |
| 2. Risk management policy · 3 | ||||
| 2.1 | Risk management framework | Crosswalk | GV.RM-01GV.RM-02GV.RM-03+5 | Topik sama: Manajemen Risiko |
| 2.2 | Compliance monitoring | Crosswalk | GV.OC-03GV.OV-03 | Topik sama: Kepatuhan |
| 2.3 | Independent review of information and network security | Editorial | GV.OC-03GV.OV-03 | Topik sama: Kepatuhan (pilihan editor) |
| 3. Incident handling · 6 | ||||
| 3.1 | Incident handling policy | Crosswalk | ID.IM-04RS.MA-01RS.MA-02+2 | Topik sama: Respons Insiden |
| 3.2 | Monitoring and logging | Crosswalk | DE.AE-02DE.AE-03DE.AE-06+5 | Topik sama: Deteksi Intrusi, Pencatatan & Audit, SIEM / SOC |
| 3.3 | Event reporting | Crosswalk | RS.CO-02 | Topik sama: Pelaporan |
| 3.4 | Event assessment and classification | Crosswalk | DE.AE-02DE.AE-03DE.AE-04+3 | Topik sama: Deteksi Anomali, SIEM / SOC |
| 3.5 | Incident response | Crosswalk | ID.IM-04RS.AN-03RS.AN-06+7 | Topik sama: Respons Insiden, Forensik |
| 3.6 | Post-incident reviews | Crosswalk | ID.IM-03RC.RP-06 | Topik sama: Pelajaran yang Dipetik |
| 4. Business continuity and crisis management · 3 | ||||
| 4.1 | Business continuity and disaster recovery plan | Crosswalk | GV.OC-04ID.IM-04PR.IR-03+4 | Topik sama: Kelangsungan Usaha, Perencanaan Pemulihan, Pemulihan Bencana |
| 4.2 | Backup management | Crosswalk | PR.DS-11PR.IR-03RC.RP-02+2 | Topik sama: Cadangan & Pemulihan, Pemulihan Bencana |
| 4.3 | Crisis management | Crosswalk | GV.OC-04PR.IR-03RC.CO-03+4 | Topik sama: Kelangsungan Usaha, Komunikasi & Pemulihan |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | Crosswalk | DE.CM-06GV.SC-01GV.SC-03+7 | Topik sama: Manajemen Risiko Vendor, Risiko Rantai Pasok |
| 5.2 | Directory of suppliers and service providers | Crosswalk | DE.CM-06GV.SC-04GV.SC-06+2 | Topik sama: Manajemen Risiko Vendor |
| 6. Security in acquisition, development and maintenance · 9 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | DE.CM-06GV.SC-01GV.SC-03+10 | Topik sama: Manajemen Risiko Vendor, Risiko Rantai Pasok |
| 6.2 | Secure development life cycle | Crosswalk | PR.PS-06 | Topik sama: Pengembangan Aman |
| 6.3 | Configuration management | Crosswalk | PR.PS-01 | Topik sama: Konfigurasi Aman |
| 6.5 | Security testing | Crosswalk | ID.RA-01ID.RA-08 | Topik sama: Manajemen Kerentanan |
| 6.6 | Security patch management | Crosswalk | PR.PS-02 | Topik sama: Manajemen Patch |
| 6.7 | Network security | Crosswalk | ID.AM-03PR.IR-01 | Topik sama: Firewall / Segmentasi Jaringan |
| 6.8 | Network segmentation | Crosswalk | ID.AM-03PR.AA-03PR.AA-04+2 | Topik sama: Firewall / Segmentasi Jaringan, Zero Trust |
| 6.9 | Protection against malicious and unauthorised software | Crosswalk | DE.CM-09PR.DS-02PR.PS-05 | Topik sama: Perlindungan Endpoint, Keamanan Email |
| 6.10 | Vulnerability handling and disclosure | Crosswalk | ID.RA-01ID.RA-08 | Topik sama: Manajemen Kerentanan |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | GV.RM-01GV.RM-02GV.RM-03+1 | Topik sama: Manajemen Risiko |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Crosswalk | PR.AT-01PR.AT-02 | Topik sama: Kesadaran & Pelatihan |
| 8.2 | Security training | Crosswalk | PR.AT-01PR.AT-02 | Topik sama: Kesadaran & Pelatihan |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Crosswalk | PR.DS-01PR.DS-02 | Topik sama: Enkripsi |
| 10. Human resources security · 2 | ||||
| 10.2 | Verification of Background | Crosswalk | DE.CM-03GV.RR-04 | Topik sama: Ancaman Orang Dalam |
| 10.4 | Disciplinary process | Crosswalk | DE.CM-03GV.RR-04 | Topik sama: Ancaman Orang Dalam |
| 11. Access control · 7 | ||||
| 11.1 | Access control policy | Crosswalk | PR.AA-01PR.AA-03PR.AA-04+2 | Topik sama: Kontrol Akses, Zero Trust |
| 11.2 | Management of access rights | Crosswalk | PR.AA-01PR.AA-05 | Topik sama: Kontrol Akses |
| 11.3 | Privileged accounts and system administration accounts | Crosswalk | PR.AA-05 | Topik sama: Akses Istimewa |
| 11.4 | Administration systems | Crosswalk | PR.AA-05 | Topik sama: Akses Istimewa |
| 11.5 | Identification | Crosswalk | PR.AA-01PR.AA-05 | Topik sama: Kontrol Akses |
| 11.6 | Authentication | Crosswalk | PR.AA-03PR.AA-04PR.AA-05+1 | Topik sama: Autentikasi Multi-Faktor, Zero Trust |
| 11.7 | Multi-factor authentication | Crosswalk | PR.AA-03 | Topik sama: Autentikasi Multi-Faktor |
| 12. Asset management · 4 | ||||
| 12.1 | Asset classification | Crosswalk | ID.AM-05ID.AM-07 | Topik sama: Klasifikasi Data |
| 12.2 | Handling of assets | Crosswalk | PR.DS-01PR.DS-02PR.DS-10 | Topik sama: Perlindungan Data |
| 12.3 | Removable media policy | Crosswalk | PR.DS-01PR.DS-02PR.DS-10 | Topik sama: Perlindungan Data, DLP |
| 12.4 | Asset inventory | Crosswalk | ID.AM-01ID.AM-02ID.AM-04+1 | Topik sama: Manajemen Aset |
| 13. Environmental and physical security · 3 | ||||
| 13.1 | Supporting utilities | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik |
| 13.2 | Protection against physical and environmental threats | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik |
| 13.3 | Perimeter and physical access control | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik |
Miliki NIS2 → butuhkan NIST CSF 2.0
106 persyaratan 85 terpetakan · · 9 tanpa pemetaan Buka di tampilan kesenjangan →Dari 106 persyaratan NIST Cybersecurity Framework 2.0, 85 dipetakan ke sesuatu dalam NIS2, 12 hanya terkait secara longgar, dan 9 tidak memiliki pemetaan dalam data kami.
Kemungkinan pekerjaan baru: persyaratan NIST CSF 2.0 tanpa pemetaan ke NIS2 (9)
| NIST CSF 2.0 | Persyaratan | Kecocokan | NIS2 | Bukti |
|---|---|---|---|---|
| Govern (GV) · 5 | ||||
| GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| Identify (ID) · 2 | ||||
| ID.IM-01 | Improvements are identified from evaluations | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| Protect (PR) · 2 | ||||
| PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
| PR.IR-04 | Adequate resource capacity to ensure availability is maintained | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIS2 dalam data kami. |
Periksa ini: hanya terkait secara longgar (hasil CSF yang sama, bukan pemetaan) (12)
| NIST CSF 2.0 | Persyaratan | Kecocokan | NIS2 | Bukti |
|---|---|---|---|---|
| Detect (DE) · 1 | ||||
| DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | 4.3 | Hanya berbagi CSF DE.AE-07: terkait, bukan pemetaan | |
| Govern (GV) · 6 | ||||
| GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | 1.1 | Hanya berbagi CSF GV.OC-02: terkait, bukan pemetaan | |
| GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | 5.15.213.1 | Hanya berbagi CSF GV.OC-05: terkait, bukan pemetaan | |
| GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | 2.22.3 | Hanya berbagi CSF GV.OV-02: terkait, bukan pemetaan | |
| GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | 1.2 | Hanya berbagi CSF GV.SC-02: terkait, bukan pemetaan | |
| GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | 3.14.1 | Hanya berbagi CSF GV.SC-08: terkait, bukan pemetaan | |
| GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | 5.1 | Hanya berbagi CSF GV.SC-10: terkait, bukan pemetaan | |
| Identify (ID) · 2 | ||||
| ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | 2.16.10 | Hanya berbagi CSF ID.RA-02: terkait, bukan pemetaan | |
| ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | 6.4 | Hanya berbagi CSF ID.RA-07: terkait, bukan pemetaan | |
| Protect (PR) · 1 | ||||
| PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | 6.10 | Hanya berbagi CSF PR.PS-03: terkait, bukan pemetaan | |
| Respond (RS) · 2 | ||||
| RS.AN-08 | An incident's magnitude is estimated and validated | 3.6 | Hanya berbagi CSF RS.AN-08: terkait, bukan pemetaan | |
| RS.MA-05 | The criteria for initiating incident recovery are applied | 3.1 | Hanya berbagi CSF RS.MA-05: terkait, bukan pemetaan | |
Dipetakan (85)
| NIST CSF 2.0 | Persyaratan | Kecocokan | NIS2 | Bukti |
|---|---|---|---|---|
| Detect (DE) · 10 | ||||
| DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | Crosswalk | 3.23.4 | Topik sama: Deteksi Intrusi, Deteksi Anomali |
| DE.AE-03 | Information is correlated from multiple sources | Crosswalk | 3.23.4 | Topik sama: Pencatatan & Audit, SIEM / SOC |
| DE.AE-04 | The estimated impact and scope of adverse events are understood | Crosswalk | 3.4 | Topik sama: Deteksi Anomali |
| DE.AE-06 | Information on adverse events is provided to authorized staff and tools | Crosswalk | 3.23.4 | Topik sama: SIEM / SOC |
| DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | Crosswalk | 3.23.4 | Topik sama: SIEM / SOC |
| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Crosswalk | 3.2 | Topik sama: Pemantauan Berkelanjutan, Deteksi Intrusi |
| DE.CM-02 | The physical environment is monitored to find potentially adverse events | Crosswalk | 13.113.213.3 | Topik sama: Keamanan Fisik |
| DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | Crosswalk | 3.210.210.4 | Topik sama: Pemantauan Berkelanjutan, Ancaman Orang Dalam |
| DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | Crosswalk | 5.15.26.1 | Topik sama: Manajemen Risiko Vendor |
| DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | Crosswalk | 3.23.46.9 | Topik sama: Pemantauan Berkelanjutan, Deteksi Anomali, Perlindungan Endpoint, Keamanan Email |
| Govern (GV) · 20 | ||||
| GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | Crosswalk | 2.22.3 | Topik sama: Kepatuhan |
| GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | Crosswalk | 4.14.3 | Topik sama: Kelangsungan Usaha |
| GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Crosswalk | 2.22.3 | Topik sama: Kepatuhan |
| GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | Crosswalk | 1.1 | Topik sama: Kebijakan Tata Kelola |
| GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Crosswalk | 1.1 | Topik sama: Kebijakan Tata Kelola |
| GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | Crosswalk | 2.17.1 | Topik sama: Manajemen Risiko |
| GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | Crosswalk | 2.17.1 | Topik sama: Manajemen Risiko |
| GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | Crosswalk | 2.17.1 | Topik sama: Manajemen Risiko |
| GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | Crosswalk | 2.17.1 | Topik sama: Manajemen Risiko |
| GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | Crosswalk | 1.2 | Topik sama: Peran & Tanggung Jawab |
| GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | Crosswalk | 1.2 | Topik sama: Peran & Tanggung Jawab |
| GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | Crosswalk | 1.2 | Topik sama: Peran & Tanggung Jawab |
| GV.RR-04 | Cybersecurity is included in human resources practices | Crosswalk | 10.210.4 | Topik sama: Ancaman Orang Dalam |
| GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | Crosswalk | 5.16.1 | Topik sama: Risiko Rantai Pasok |
| GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | Crosswalk | 5.16.1 | Topik sama: Risiko Rantai Pasok |
| GV.SC-04 | Suppliers are known and prioritized by criticality | Crosswalk | 5.15.26.1 | Topik sama: Manajemen Risiko Vendor |
| GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | Crosswalk | 5.16.1 | Topik sama: Risiko Rantai Pasok |
| GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | Crosswalk | 5.15.26.1 | Topik sama: Manajemen Risiko Vendor |
| GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | Crosswalk | 5.15.26.1 | Topik sama: Manajemen Risiko Vendor |
| GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | Crosswalk | 5.16.1 | Topik sama: Risiko Rantai Pasok |
| Identify (ID) · 17 | ||||
| ID.AM-01 | Inventories of hardware managed by the organization are maintained | Crosswalk | 12.4 | Topik sama: Manajemen Aset |
| ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | Crosswalk | 12.4 | Topik sama: Manajemen Aset |
| ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | Crosswalk | 6.76.8 | Topik sama: Firewall / Segmentasi Jaringan |
| ID.AM-04 | Inventories of services provided by suppliers are maintained | Crosswalk | 6.112.4 | Topik sama: Keamanan Cloud, Manajemen Aset |
| ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | Crosswalk | 12.1 | Topik sama: Klasifikasi Data |
| ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | Crosswalk | 12.1 | Topik sama: Klasifikasi Data |
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | Crosswalk | 12.4 | Topik sama: Manajemen Aset |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | Crosswalk | 3.6 | Topik sama: Pelajaran yang Dipetik |
| ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Crosswalk | 3.13.54.1 | Topik sama: Respons Insiden, Perencanaan Pemulihan |
| ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Crosswalk | 6.56.10 | Topik sama: Manajemen Kerentanan |
| ID.RA-03 | Internal and external threats to the organization are identified and recorded | Crosswalk | 2.1 | Topik sama: Penilaian Risiko |
| ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | Crosswalk | 2.1 | Topik sama: Penilaian Risiko |
| ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | Crosswalk | 2.1 | Topik sama: Penilaian Risiko |
| ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | Crosswalk | 2.1 | Topik sama: Penilaian Risiko |
| ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Crosswalk | 6.56.10 | Topik sama: Manajemen Kerentanan |
| ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Crosswalk | 5.16.1 | Topik sama: Risiko Rantai Pasok |
| ID.RA-10 | Critical suppliers are assessed prior to acquisition | Crosswalk | 5.15.26.1 | Topik sama: Manajemen Risiko Vendor |
| Protect (PR) · 19 | ||||
| PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | Crosswalk | 11.111.211.5 | Topik sama: Kontrol Akses |
| PR.AA-03 | Users, services, and hardware are authenticated | Crosswalk | 6.811.111.6+1 | Topik sama: Zero Trust, Autentikasi Multi-Faktor |
| PR.AA-04 | Identity assertions are protected, conveyed, and verified | Crosswalk | 6.811.111.6 | Topik sama: Zero Trust |
| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Crosswalk | 6.811.111.2+4 | Topik sama: Zero Trust, Kontrol Akses |
| PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | Crosswalk | 13.113.213.3 | Topik sama: Keamanan Fisik |
| PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | Crosswalk | 8.18.2 | Topik sama: Kesadaran & Pelatihan |
| PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | Crosswalk | 8.18.2 | Topik sama: Kesadaran & Pelatihan |
| PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | Crosswalk | 9.112.212.3 | Topik sama: Enkripsi, Perlindungan Data, DLP |
| PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | Crosswalk | 6.99.112.2+1 | Topik sama: Keamanan Email, Enkripsi, Perlindungan Data |
| PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | Crosswalk | 12.212.3 | Topik sama: Perlindungan Data, DLP |
| PR.DS-11 | Backups of data are created, protected, maintained, and tested | Crosswalk | 4.2 | Topik sama: Cadangan & Pemulihan |
| PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | Crosswalk | 6.16.76.8+2 | Topik sama: Keamanan Cloud, Firewall / Segmentasi Jaringan, Zero Trust |
| PR.IR-02 | The organization's technology assets are protected from environmental threats | Crosswalk | 13.113.213.3 | Topik sama: Keamanan Fisik |
| PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | Crosswalk | 4.14.24.3 | Topik sama: Kelangsungan Usaha, Pemulihan Bencana |
| PR.PS-01 | Configuration management practices are established and applied | Crosswalk | 6.16.3 | Topik sama: Keamanan Cloud, Konfigurasi Aman |
| PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Crosswalk | 6.6 | Topik sama: Manajemen Patch |
| PR.PS-04 | Log records are generated and made available for continuous monitoring | Crosswalk | 3.2 | Topik sama: Pencatatan & Audit |
| PR.PS-05 | Installation and execution of unauthorized software are prevented | Crosswalk | 6.9 | Topik sama: Perlindungan Endpoint |
| PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | Crosswalk | 6.2 | Topik sama: Pengembangan Aman |
| Recover (RC) · 8 | ||||
| RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | Crosswalk | 4.3 | Topik sama: Komunikasi & Pemulihan |
| RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | Crosswalk | 4.3 | Topik sama: Komunikasi & Pemulihan |
| RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | Crosswalk | 4.1 | Topik sama: Perencanaan Pemulihan |
| RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | Crosswalk | 4.14.2 | Topik sama: Perencanaan Pemulihan, Pemulihan Bencana |
| RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | Crosswalk | 4.2 | Topik sama: Cadangan & Pemulihan |
| RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | Crosswalk | 4.14.3 | Topik sama: Kelangsungan Usaha |
| RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | Crosswalk | 4.14.24.3 | Topik sama: Pemulihan Bencana, Komunikasi & Pemulihan |
| RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | Crosswalk | 3.6 | Topik sama: Pelajaran yang Dipetik |
| Respond (RS) · 11 | ||||
| RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | Crosswalk | 3.5 | Topik sama: Forensik |
| RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | Crosswalk | 3.5 | Topik sama: Forensik |
| RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | Crosswalk | 3.5 | Topik sama: Forensik |
| RS.CO-02 | Internal and external stakeholders are notified of incidents | Crosswalk | 3.3 | Topik sama: Pelaporan |
| RS.CO-03 | Information is shared with designated internal and external stakeholders | Crosswalk | 4.3 | Topik sama: Komunikasi |
| RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | Crosswalk | 3.13.5 | Topik sama: Respons Insiden |
| RS.MA-02 | Incident reports are triaged and validated | Crosswalk | 3.13.5 | Topik sama: Respons Insiden |
| RS.MA-03 | Incidents are categorized and prioritized | Crosswalk | 3.13.5 | Topik sama: Respons Insiden |
| RS.MA-04 | Incidents are escalated or elevated as needed | Crosswalk | 3.13.5 | Topik sama: Respons Insiden |
| RS.MI-01 | Incidents are contained | Crosswalk | 3.5 | Topik sama: Mitigasi |
| RS.MI-02 | Incidents are eradicated | Crosswalk | 3.5 | Topik sama: Mitigasi |
Menurut topik
Keduanya mencakup (43):
Kebijakan Tata KelolaKesadaran & PelatihanManajemen RisikoRisiko Rantai PasokPeran & Tanggung JawabKepatuhanManajemen AsetPenilaian RisikoKlasifikasi DataManajemen KerentananKontrol AksesAutentikasi Multi-FaktorEnkripsiPerlindungan DataCadangan & PemulihanAkses IstimewaFirewall / Segmentasi JaringanPerlindungan EndpointManajemen PatchKonfigurasi AmanPengembangan AmanKeamanan EmailZero TrustKeamanan CloudDLPPemantauan BerkelanjutanPencatatan & AuditDeteksi IntrusiDeteksi AnomaliSIEM / SOCRespons InsidenForensikKomunikasiMitigasiPelaporanPerencanaan PemulihanKelangsungan UsahaPelajaran yang DipetikKomunikasi & PemulihanPemulihan BencanaAncaman Orang DalamManajemen Risiko VendorKeamanan Fisik
Hanya NIST CSF 2.0 (7):
ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.
Crosswalk crosswalk yang dipublikasikan (NIST, ENISA, CIS, PCI SSC) menetapkan tautannya · Editorial Penilaian ControlMapping jika tidak ada crosswalk; alasannya ditampilkan · hanya berbagi hasil CSF 2.0: layak diperiksa, bukan pemetaan · Tidak ada pemetaan dalam data kami belum ada yang dipetakan dalam data kami; sering kali pekerjaan baru, tetapi periksa catatan cakupannya. Dipetakan = dikurasi bersama dalam topik ControlMapping, atau ditautkan langsung. Crosswalk tidak membuktikan kepatuhan. Metodologi · Unduh data · Laporkan kesalahan.