NIST Cybersecurity Framework 2.0

Perbandingan

Persyaratan

ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.

NIST Cybersecurity Framework 2.0 persyaratan

ID	Persyaratan	Topik	Dipetakan dalam
Detect (DE) · 11
DE.AE-02	Potentially adverse events are analyzed to better understand associated activities	Deteksi Intrusi, Deteksi Anomali	10 dari 13
DE.AE-03	Information is correlated from multiple sources	Pencatatan & Audit, SIEM / SOC	10 dari 13
DE.AE-04	The estimated impact and scope of adverse events are understood	Deteksi Anomali	9 dari 13
DE.AE-06	Information on adverse events is provided to authorized staff and tools	SIEM / SOC	10 dari 13
DE.AE-07	Cyber threat intelligence and other contextual information are integrated into the analysis	Intelijen Ancaman	6 dari 13
DE.AE-08	Incidents are declared when adverse events meet the defined incident criteria	SIEM / SOC	10 dari 13
DE.CM-01	Networks and network services are monitored to find potentially adverse events	Keamanan DNS, WAF, Pemantauan Berkelanjutan, Deteksi Intrusi	11 dari 13
DE.CM-02	The physical environment is monitored to find potentially adverse events	Keamanan Fisik	8 dari 13
DE.CM-03	Personnel activity and technology usage are monitored to find potentially adverse events	Pemantauan Berkelanjutan, Ancaman Orang Dalam	11 dari 13
DE.CM-06	External service provider activities and services are monitored to find potentially adverse events	Manajemen Risiko Vendor	10 dari 13
DE.CM-09	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events	Perlindungan Endpoint, Keamanan Email, Pemantauan Berkelanjutan, Deteksi Anomali	11 dari 13
Govern (GV) · 31
GV.OC-01	The organizational mission is understood and informs cybersecurity risk management	Lingkungan Bisnis	5 dari 13
GV.OC-02	Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered	—	0
GV.OC-03	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed	Kepatuhan	10 dari 13
GV.OC-04	Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated	Lingkungan Bisnis, Kelangsungan Usaha	8 dari 13
GV.OC-05	Outcomes, capabilities, and services that the organization depends on are understood and communicated	Lingkungan Bisnis	5 dari 13
GV.OV-01	Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction	—	0
GV.OV-02	The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks	—	0
GV.OV-03	Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed	Kepatuhan	10 dari 13
GV.PO-01	Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced	Kebijakan Tata Kelola	9 dari 13
GV.PO-02	Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission	Kebijakan Tata Kelola	9 dari 13
GV.RM-01	Risk management objectives are established and agreed to by organizational stakeholders	Manajemen Risiko	10 dari 13
GV.RM-02	Risk appetite and risk tolerance statements are established, communicated, and maintained	Manajemen Risiko	10 dari 13
GV.RM-03	Cybersecurity risk management activities and outcomes are included in enterprise risk management processes	Manajemen Risiko	10 dari 13
GV.RM-04	Strategic direction that describes appropriate risk response options is established and communicated	—	0
GV.RM-05	Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties	—	0
GV.RM-06	A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated	Manajemen Risiko	10 dari 13
GV.RM-07	Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions	—	0
GV.RR-01	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving	Peran & Tanggung Jawab	9 dari 13
GV.RR-02	Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced	Peran & Tanggung Jawab	9 dari 13
GV.RR-03	Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies	Peran & Tanggung Jawab	9 dari 13
GV.RR-04	Cybersecurity is included in human resources practices	Ancaman Orang Dalam	8 dari 13
GV.SC-01	A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders	Risiko Rantai Pasok	9 dari 13
GV.SC-02	Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally	—	0
GV.SC-03	Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes	Risiko Rantai Pasok	9 dari 13
GV.SC-04	Suppliers are known and prioritized by criticality	Manajemen Risiko Vendor	10 dari 13
GV.SC-05	Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties	Risiko Rantai Pasok	9 dari 13
GV.SC-06	Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships	Manajemen Risiko Vendor	10 dari 13
GV.SC-07	The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship	Manajemen Risiko Vendor	10 dari 13
GV.SC-08	Relevant suppliers and other third parties are included in incident planning, response, and recovery activities	—	0
GV.SC-09	Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle	Risiko Rantai Pasok	9 dari 13
GV.SC-10	Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement	—	0
Identify (ID) · 21
ID.AM-01	Inventories of hardware managed by the organization are maintained	Manajemen Aset	13 dari 13
ID.AM-02	Inventories of software, services, and systems managed by the organization are maintained	Manajemen Aset	13 dari 13
ID.AM-03	Representations of the organization's authorized network communication and internal and external network data flows are maintained	Firewall / Segmentasi Jaringan	9 dari 13
ID.AM-04	Inventories of services provided by suppliers are maintained	Manajemen Aset, Keamanan Cloud	13 dari 13
ID.AM-05	Assets are prioritized based on classification, criticality, resources, and impact on the mission	Klasifikasi Data	9 dari 13
ID.AM-07	Inventories of data and corresponding metadata for designated data types are maintained	Klasifikasi Data	9 dari 13
ID.AM-08	Systems, hardware, software, services, and data are managed throughout their life cycles	Manajemen Aset	13 dari 13
ID.IM-01	Improvements are identified from evaluations	—	0
ID.IM-02	Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties	—	0
ID.IM-03	Improvements are identified from execution of operational processes, procedures, and activities	Pelajaran yang Dipetik	9 dari 13
ID.IM-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved	Respons Insiden, Perencanaan Pemulihan	12 dari 13
ID.RA-01	Vulnerabilities in assets are identified, validated, and recorded	Manajemen Kerentanan	13 dari 13
ID.RA-02	Cyber threat intelligence is received from information sharing forums and sources	Intelijen Ancaman	6 dari 13
ID.RA-03	Internal and external threats to the organization are identified and recorded	Penilaian Risiko, Intelijen Ancaman	10 dari 13
ID.RA-04	Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded	Penilaian Risiko	10 dari 13
ID.RA-05	Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization	Penilaian Risiko	10 dari 13
ID.RA-06	Risk responses are chosen, prioritized, planned, tracked, and communicated	Penilaian Risiko	10 dari 13
ID.RA-07	Changes and exceptions are managed, assessed for risk impact, recorded, and tracked	—	0
ID.RA-08	Processes for receiving, analyzing, and responding to vulnerability disclosures are established	Manajemen Kerentanan	13 dari 13
ID.RA-09	The authenticity and integrity of hardware and software are assessed prior to acquisition and use	Risiko Rantai Pasok	9 dari 13
ID.RA-10	Critical suppliers are assessed prior to acquisition	Manajemen Risiko Vendor	10 dari 13
Protect (PR) · 22
PR.AA-01	Identities and credentials for authorized users, services, and hardware are managed by the organization	Kontrol Akses	11 dari 13
PR.AA-02	Identities are proofed and bound to credentials based on the context of interactions	—	0
PR.AA-03	Users, services, and hardware are authenticated	Autentikasi Multi-Faktor, Zero Trust, Keamanan API	10 dari 13
PR.AA-04	Identity assertions are protected, conveyed, and verified	Zero Trust	7 dari 13
PR.AA-05	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Kontrol Akses, Akses Istimewa, Zero Trust, Keamanan Seluler	12 dari 13
PR.AA-06	Physical access to assets is managed, monitored, and enforced commensurate with risk	Keamanan Fisik	8 dari 13
PR.AT-01	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind	Kesadaran & Pelatihan	10 dari 13
PR.AT-02	Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	Kesadaran & Pelatihan	10 dari 13
PR.DS-01	The confidentiality, integrity, and availability of data-at-rest are protected	Enkripsi, Perlindungan Data, DLP	11 dari 13
PR.DS-02	The confidentiality, integrity, and availability of data-in-transit are protected	Enkripsi, Perlindungan Data, Keamanan Email, DLP	12 dari 13
PR.DS-10	The confidentiality, integrity, and availability of data-in-use are protected	Perlindungan Data, DLP	11 dari 13
PR.DS-11	Backups of data are created, protected, maintained, and tested	Cadangan & Pemulihan	11 dari 13
PR.IR-01	Networks and environments are protected from unauthorized logical access and usage	Firewall / Segmentasi Jaringan, Keamanan Web, Zero Trust, Keamanan Cloud, Keamanan DNS, WAF, Keamanan API	11 dari 13
PR.IR-02	The organization's technology assets are protected from environmental threats	Keamanan Fisik	8 dari 13
PR.IR-03	Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	Kelangsungan Usaha, Pemulihan Bencana	10 dari 13
PR.IR-04	Adequate resource capacity to ensure availability is maintained	—	0
PR.PS-01	Configuration management practices are established and applied	Konfigurasi Aman, Keamanan Seluler, Keamanan Cloud	12 dari 13
PR.PS-02	Software is maintained, replaced, and removed commensurate with risk	Manajemen Patch	10 dari 13
PR.PS-03	Hardware is maintained, replaced, and removed commensurate with risk	—	0
PR.PS-04	Log records are generated and made available for continuous monitoring	Pencatatan & Audit	10 dari 13
PR.PS-05	Installation and execution of unauthorized software are prevented	Perlindungan Endpoint	10 dari 13
PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	Pengembangan Aman, Keamanan Web, Keamanan API	8 dari 13
Recover (RC) · 8
RC.CO-03	Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders	Komunikasi & Pemulihan	8 dari 13
RC.CO-04	Public updates on incident recovery are shared using approved methods and messaging	Komunikasi & Pemulihan	8 dari 13
RC.RP-01	The recovery portion of the incident response plan is executed once initiated from the incident response process	Perencanaan Pemulihan	9 dari 13
RC.RP-02	Recovery actions are selected, scoped, prioritized, and performed	Perencanaan Pemulihan, Pemulihan Bencana	10 dari 13
RC.RP-03	The integrity of backups and other restoration assets is verified before using them for restoration	Cadangan & Pemulihan	11 dari 13
RC.RP-04	Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms	Kelangsungan Usaha	8 dari 13
RC.RP-05	The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed	Komunikasi & Pemulihan, Pemulihan Bencana	11 dari 13
RC.RP-06	The end of incident recovery is declared based on criteria, and incident-related documentation is completed	Pelajaran yang Dipetik	9 dari 13
Respond (RS) · 13
RS.AN-03	Analysis is performed to establish what has taken place during an incident and the root cause of the incident	Forensik	7 dari 13
RS.AN-06	Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved	Forensik	7 dari 13
RS.AN-07	Incident data and metadata are collected, and their integrity and provenance are preserved	Forensik	7 dari 13
RS.AN-08	An incident's magnitude is estimated and validated	—	0
RS.CO-02	Internal and external stakeholders are notified of incidents	Pelaporan	12 dari 13
RS.CO-03	Information is shared with designated internal and external stakeholders	Komunikasi	8 dari 13
RS.MA-01	The incident response plan is executed in coordination with relevant third parties once an incident is declared	Respons Insiden	12 dari 13
RS.MA-02	Incident reports are triaged and validated	Respons Insiden	12 dari 13
RS.MA-03	Incidents are categorized and prioritized	Respons Insiden	12 dari 13
RS.MA-04	Incidents are escalated or elevated as needed	Respons Insiden	12 dari 13
RS.MA-05	The criteria for initiating incident recovery are applied	—	0
RS.MI-01	Incidents are contained	Mitigasi	8 dari 13
RS.MI-02	Incidents are eradicated	Mitigasi	8 dari 13

Cakupan topik

Topik dengan persyaratan NIST CSF 2.0 yang dipetakan (50):