Az Policy Advertizer

Canada_Federal_PBMM_3-1-2020_AC_17

AC_17

Canada Federal PBMM 3-1-2020 AC 17

Remote Access

Shared

1. The organization establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed. 2. The organization authorizes remote access to the information system prior to allowing such connections. (AA). The organization ensures that all employees working off site safeguard information as per the organization's minimum security requirements (NOTE: Item (AA) is not applicable to CSPs).

To ensure the security of the organization's information system, especially when accessed remotely.

Canada_Federal_PBMM_3-1-2020_AC_17(1)

AC_17(1)

Canada Federal PBMM 3-1-2020 AC 17(1)

Remote Access

Remote Access | Automated Monitoring / Control

Shared

The information system monitors and controls remote access methods.

To ensure that remote access methods to the information system are monitored and controlled effectively

Canada_Federal_PBMM_3-1-2020_AC_17(2)

AC_17(2)

Canada Federal PBMM 3-1-2020 AC 17(2)

Remote Access

Remote Access | Protection of Confidentiality / Integrity using Encryption

Shared

1. The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions. 2. The cryptography must be compliant with the requirements of SC-13.

To enhance security by encrypting data transmitted during remote access sessions.

Canada_Federal_PBMM_3-1-2020_AC_17(3)

AC_17(3)

Canada Federal PBMM 3-1-2020 AC 17(3)

Remote Access

Remote Access | Managed Access Control Points

Shared

The information system routes all remote accesses through approved managed network access control points.

To mitigate the risk of unauthorized access or malicious activities.

Canada_Federal_PBMM_3-1-2020_AC_17(4)

AC_17(4)

Canada Federal PBMM 3-1-2020 AC 17(4)

Remote Access

Remote Access | Privileged Commands / Access

Shared

1. The organization authorizes the execution of privileged commands and access to security-relevant information via remote access only for approved operational requirements; and 2. The organization documents the rationale for such access in the security plan for the information system.

To ensure transparency and accountability in the management of remote access privileges and security-related activities.

Canada_Federal_PBMM_3-1-2020_AC_17(9)

AC_17(9)

Canada Federal PBMM 3-1-2020 AC 17(9)

Remote Access

Remote Access | Disconnect / Disable Access

Shared

The organization provides the capability to expeditiously disconnect or disable remote access to the information system within a period no greater than 15 minutes.

To mitigate the risk of security breaches.

Canada_Federal_PBMM_3-1-2020_AC_20

AC_20

Canada Federal PBMM 3-1-2020 AC 20

Use of External Information Systems

Shared

1. The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from external information systems. 2. The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external information systems.

To ensure secure and compliant interactions between internal and external information systems while maintaining trust and security standards.

Canada_Federal_PBMM_3-1-2020_AC_20(1)

AC_20(1)

Canada Federal PBMM 3-1-2020 AC 20(1)

Use of External Information Systems

Use of External Information Systems | Limits of Authorized Use

Shared

The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization: 1. Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or 2. Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

To ensure appropriate security measures are in place to safeguard organization-controlled information when accessed or processed externally.

Canada_Federal_PBMM_3-1-2020_CA_7

CA_7

Canada Federal PBMM 3-1-2020 CA 7

Continuous Monitoring

Shared

1. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes establishment of organization-defined metrics to be monitored. 2. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes establishment of at least monthly monitoring and assessments of at least operating system scans, database, and web application scan. 3. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes ongoing security control assessments in accordance with the organizational continuous monitoring strategy. 4. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy. 5. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes correlation and analysis of security-related information generated by assessments and monitoring. 6. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes response actions to address results of the analysis of security-related information. 7. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes reporting the security status of organization and the information system to organization-defined personnel or roles at organization-defined frequency.

To ensure the ongoing effectiveness of security controls and maintain the security posture in alignment with organizational objectives and requirements.

120

Canada_Federal_PBMM_3-1-2020_CM_3(6)

CM_3(6)

Canada Federal PBMM 3-1-2020 CM 3(6)

Configuration Change Control

Configuration Change Control | Cryptography Management

Shared

The organization ensures that cryptographic mechanisms used to provide any cryptographic-based safeguards are under configuration management.

To uphold security and integrity measures.

Canada_Federal_PBMM_3-1-2020_SC_12

SC_12

Canada Federal PBMM 3-1-2020 SC 12

Cryptographic Key Establishment and Management

Shared

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with CSE-approved cryptography.

To enhance overall security posture and compliance with industry best practices.

Canada_Federal_PBMM_3-1-2020_SC_12(1)

SC_12(1)

Canada Federal PBMM 3-1-2020 SC 12(1)

Cryptographic Key Establishment and Management

Cryptographic Key Establishment and Management | Availability

Shared

The organization maintains availability of information in the event of the loss of cryptographic keys by users.

To implement backup and recovery mechanisms.

Canada_Federal_PBMM_3-1-2020_SI_4

SI_4

Canada Federal PBMM 3-1-2020 SI 4

Information System Monitoring

Shared

1. The organization monitors the information system to detect: a. Attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives; and b. Unauthorized local, network, and remote connections; 2. The organization identifies unauthorized use of the information system through organization-defined techniques and methods. 3. The organization deploys monitoring devices: (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization. 4. The organization protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion. 5. The organization heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or Canada based on law enforcement information, intelligence information, or other credible sources of information. 6. The organization obtains legal opinion with regard to information system monitoring activities in accordance with organizational policies, directives and standards. 7. The organization provides organization-defined information system monitoring information to organization-defined personnel or roles at an organization-defined frequency.

To enhance overall security posture.

Canada_Federal_PBMM_3-1-2020_SI_4(1)

SI_4(1)

Canada Federal PBMM 3-1-2020 SI 4(1)

Information System Monitoring

Information System Monitoring | System-Wide Intrusion Detection System

Shared

The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.

To enhance overall security posture.

Canada_Federal_PBMM_3-1-2020_SI_4(2)

SI_4(2)

Canada Federal PBMM 3-1-2020 SI 4(2)

Information System Monitoring

Information System Monitoring | Automated Tools for Real-Time Analysis

Shared

The organization employs automated tools to support near real-time analysis of events.

To enhance overall security posture.

Canada_Federal_PBMM_3-1-2020_SI_8(1)

SI_8(1)

Canada Federal PBMM 3-1-2020 SI 8(1)

Spam Protection

Spam Protection | Central Management of Protection Mechanisms

Shared

The organization centrally manages spam protection mechanisms.

To enhance overall security posture.

CIS_Controls_v8.1

16.14

CIS_Controls_v8.1_16.14

CIS Controls v8.1 16.14

Application Software Security

Conduct threat modeling

Shared

1. Conduct threat modeling. 2. Threat modeling is the process of identifying and addressing application security design flaws within a design, before code is created. 3. It is conducted through specially trained individuals who evaluate the application design and gauge security risks for each entry point and access level. 4. The goal is to map out the application, architecture, and infrastructure in a structured way to understand its weaknesses.

To mitigate security risks at entry points and access levels.

CMMC_2.0_L2

IA.L2-3.5.10

CMMC_2.0_L2_IA.L2-3.5.10

404 not found

n/a

CMMC_2.0_L2

IA.L2-3.5.4

CMMC_2.0_L2_IA.L2-3.5.4

404 not found

n/a

CMMC_L2_v1.9.0

PE.L2_3.10.6

CMMC_L2_v1.9.0_PE.L2_3.10.6

Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 PE.L2 3.10.6

Physical Protection

Alternative Work Sites

Shared

Enforce safeguarding measures for CUI at alternate work sites.

To ensure that sensitive information is protected even when employees are working remotely or at off site locations.

CMMC_L2_v1.9.0

SC.L2_3.13.11

CMMC_L2_v1.9.0_SC.L2_3.13.11

Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SC.L2 3.13.11

System and Communications Protection

CUI Encryption

Shared

Employ FIPS validated cryptography when used to protect the confidentiality of CUI.

To ensure the integrity and effectiveness of cryptographic protections applied to sensitive data.

AC.1.001

CMMC_L3_AC.1.001

CMMC L3 AC.1.001

Access Control

Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Access control policies (e.g., identity- or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses non-privileged) are addressed in requirement AC.1.002.

AC.2.013

CMMC_L3_AC.2.013

CMMC L3 AC.2.013

Access Control

Monitor and control remote access sessions.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Remote access is access to organizational systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the Internet). Remote access methods include dial-up, broadband, and wireless. Organizations often employ encrypted virtual private networks (VPNs) to enhance confidentiality over remote connections. The use of encrypted VPNs does not make the access non-remote; however, the use of VPNs, when adequately provisioned with appropriate control (e.g., employing encryption techniques for confidentiality protection), may provide sufficient assurance to the organization that it can effectively treat such connections as internal networks. VPNs with encrypted tunnels can affect the capability to adequately monitor network communications traffic for malicious code. Automated monitoring and control of remote access sessions allows organizations to detect cyberattacks and help to ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

CM.2.064

CMMC_L3_CM.2.064

CMMC L3 CM.2.064

Configuration Management

Establish and enforce security configuration settings for information technology products employed in organizational systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture or functionality of the system. Information technology products for which security-related configuration settings can be defined include mainframe computers, servers, workstations, input and output devices (e.g., scanners, copiers, and printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications. Security parameters are those parameters impacting the security state of systems including the parameters required to satisfy other security requirements. Security parameters include: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, and remote connections. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the systems configuration baseline. Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations including information technology product developers, manufacturers, vendors, consortia, academia, industry, federal agencies, and other organizations in the public and private sectors.

IA.1.077

CMMC_L3_IA.1.077

CMMC L3 IA.1.077

Identification and Authentication

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Individual authenticators include the following: passwords, key cards, cryptographic devices, and one-time password devices. Initial authenticator content is the actual content of the authenticator, for example, the initial password. In contrast, the requirements about authenticator content include the minimum password length. Developers ship system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant security risk. Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics including minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication. Authenticator management includes issuing and revoking, when no longer needed, authenticators for temporary access such as that required for remote maintenance. Device authenticators include certificates and passwords.

IA.2.078

CMMC_L3_IA.2.078

CMMC L3 IA.2.078

Identification and Authentication

Enforce a minimum password complexity and change of characters when new passwords are created.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

This requirement applies to single-factor authentication of individuals using passwords as individual or group authenticators, and in a similar manner, when passwords are used as part of multifactor authenticators. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. To mitigate certain brute force attacks against passwords, organizations may also consider salting passwords.

IA.2.079

CMMC_L3_IA.2.079

CMMC L3 IA.2.079

Identification and Authentication

Prohibit password reuse for a specified number of generations.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Password lifetime restrictions do not apply to temporary passwords.

IA.2.081

CMMC_L3_IA.2.081

CMMC L3 IA.2.081

Identification and Authentication

Store and transmit only cryptographically-protected passwords.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Cryptographically-protected passwords use salted one-way cryptographic hashes of passwords.

SC.1.175

CMMC_L3_SC.1.175

CMMC L3 SC.1.175

System and Communications Protection

Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Communications can be monitored, controlled, and protected at boundary components and by restricting or prohibiting interfaces in organizational systems. Boundary components include gateways, routers, firewalls, guards, network-based malicious code analysis and virtualization systems, or encrypted tunnels implemented within a system security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Restricting or prohibiting interfaces in organizational systems includes restricting external web communications traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses. Organizations consider the shared nature of commercial telecommunications services in the implementation of security requirements associated with the use of such services. Commercial telecommunications services are commonly based on network components and consolidated management systems shared by all attached commercial customers and may also include third party-provided access lines and other service elements. Such transmission services may represent sources of increased risk despite contract security provisions.

SC.3.183

CMMC_L3_SC.3.183

CMMC L3 SC.3.183

System and Communications Protection

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, permit-by-exception network communications traffic policy ensures that only those connections which are essential and approved are allowed.

CEK_02

CSA_v4.0.12_CEK_02

CSA Cloud Controls Matrix v4.0.12 CEK 02

Cryptography, Encryption & Key Management

CEK Roles and Responsibilities

Shared

n/a

Define and implement cryptographic, encryption and key management roles and responsibilities.

CEK_10

CSA_v4.0.12_CEK_10

CSA Cloud Controls Matrix v4.0.12 CEK 10

Cryptography, Encryption & Key Management

Key Generation

Shared

n/a

Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.

CEK_11

CSA_v4.0.12_CEK_11

CSA Cloud Controls Matrix v4.0.12 CEK 11

Cryptography, Encryption & Key Management

Key Purpose

Shared

n/a

Manage cryptographic secret and private keys that are provisioned for a unique purpose.

CEK_12

CSA_v4.0.12_CEK_12

CSA Cloud Controls Matrix v4.0.12 CEK 12

Cryptography, Encryption & Key Management

Key Rotation

Shared

n/a

Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.

CEK_15

CSA_v4.0.12_CEK_15

CSA Cloud Controls Matrix v4.0.12 CEK 15

Cryptography, Encryption & Key Management

Key Activation

Shared

n/a

Define, implement and evaluate processes, procedures and technical measures to create keys in a pre-activated state when they have been generated but not authorized for use, which include provisions for legal and regulatory requirements.

FBI_Criminal_Justice_Information_Services_v5.9.5_5

CEK_16

CSA_v4.0.12_CEK_16

CSA Cloud Controls Matrix v4.0.12 CEK 16

Cryptography, Encryption & Key Management

Key Suspension

Shared

n/a

Define, implement and evaluate processes, procedures and technical measures to monitor, review and approve key transitions from any state to/from suspension, which include provisions for legal and regulatory requirements.

Cyber_Essentials_v3.1

Cyber_Essentials_v3.1_1

Cyber Essentials v3.1 1

Cyber Essentials

Firewalls

Shared

n/a

Aim: to make sure that only secure and necessary network services can be accessed from the internet.

Cyber_Essentials_v3.1

Cyber_Essentials_v3.1_4

Cyber Essentials v3.1 4

Cyber Essentials

User Access Control

Shared

n/a

Aim: ensure that user accounts (1) are assigned to authorised individuals only, and (2) provide access to only those applications, computers and networks the user needs to carry out their role.

EU_2555_(NIS2)_2022

EU_2555_(NIS2)_2022_21

EU 2022/2555 (NIS2) 2022 21

Cybersecurity risk-management measures

Shared

n/a

Requires essential and important entities to take appropriate measures to manage cybersecurity risks.

189

FBI_Criminal_Justice_Information_Services_v5.9.5_5.1

FBI Criminal Justice Information Services (CJIS) v5.9.5 5.1

Policy and Implementation - Systems And Communications Protection

Systems And Communications Protection

Shared

In addition, applications, services, or information systems must have the capability to ensure system integrity through the detection and protection against unauthorized changes to software and information.

Examples of systems and communications safeguards range from boundary and transmission protection to securing an agency's virtualized environment.

110

FBI_Criminal_Justice_Information_Services_v5.9.5_5

FBI_Criminal_Justice_Information_Services_v5.9.5_5.5

FBI Criminal Justice Information Services (CJIS) v5.9.5 5.5

Policy and Implementation - Access Control

Access Control

Shared

Refer to Section 5.13.6 for additional access control requirements related to mobile devices used to access CJI.

Access control provides the planning and implementation of mechanisms to restrict reading, writing, processing, and transmission of CJIS information and the modification of information systems, applications, services and communication configurations allowing access to CJIS information.

FBI_Criminal_Justice_Information_Services_v5.9.5_5

FBI_Criminal_Justice_Information_Services_v5.9.5_5.7

404 not found

n/a

FFIEC_CAT_2017

3.1.2

FFIEC_CAT_2017_3.1.2

FFIEC CAT 2017 3.1.2

Cybersecurity Controls

Access and Data Management

Shared

n/a

Employee access is granted to systems and confidential data based on job responsibilities and the principles of least privilege.'FFIEC_Cybersecurity Control'!F8 - Employee access to systems and confidential data provides for separation of duties. - Elevated privileges (e.g., administrator privileges) are limited and tightly controlled (e.g., assigned to individuals, not shared, and require stronger 'FFIEC_Cybersecurity Control'!F7password controls). - User access reviews are performed periodically for all systems and applications based on the risk to the application or system. - Changes to physical and logical user access, including those that result from voluntary and involuntary terminations, are submitted to and approved by appropriate personnel. - Identification and authentication are required and managed for access to systems, applications, and hardware. - Access controls include password complexity and limits to password attempts and reuse. - All default passwords and unnecessary default accounts are changed before system implementation. - Customer access to Internet-based products or services requires authentication controls (e.g., layered controls, multifactor) that are commensurate with the risk. - Production and non-production environments are segregated to prevent unauthorized access or changes to information assets. (*N/A if no production environment exists at the institution or the institution’s third party.) - Physical security controls are used to prevent unauthorized access to information systems and telecommunication systems. - All passwords are encrypted in storage and in transit. - Confidential data are encrypted when transmitted across public or untrusted networks (e.g., Internet). - Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store confidential data. (*N/A if mobile devices are not used.) - Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication. - Administrative, physical, or technical controls are in place to prevent users without administrative responsibilities from installing unauthorized software. - Customer service (e.g., the call center) utilizes formal procedures to authenticate customers commensurate with the risk of the transaction or request. - Data is disposed of or destroyed according to documented requirements and within expected time frames.

01.i

HITRUST_CSF_v11.3_01.i

HITRUST CSF v11.3 01.i

Network Access Control

Implement role based access to internal and external network services.

Shared

1. It is to be determined who is allowed access to which network and what networked services. 2. The networks and network services to which users have authorized access is to be specified.

Users shall only be provided with access to internal and external network services that they have been specifically authorized to use. Authentication and authorization mechanisms shall be applied for users and equipment.

01.j

HITRUST_CSF_v11.3_01.j

HITRUST CSF v11.3 01.j

Network Access Control

Prevent unauthorized access to networked services.

Shared

1.External access to systems to be strictly regulated and tightly controlled. 2. External access to sensitive systems to be automatically deactivated immediately after use. 3. Authentication of remote users to be done by using cryptography, biometrics, hardware tokens, software token, a challenge/response protocol, or, certificate agents. 4. Dial-up connections to be encrypted.

Appropriate authentication methods shall be used to control access by remote users.

01.m

HITRUST_CSF_v11.3_01.m

HITRUST CSF v11.3 01.m

Network Access Control

Ensure segregation in networks.

Shared

Security gateways, internal network perimeters, wireless network segregation, firewalls, and logical network domains with controlled data flows to be implemented to enhance network security.

Groups of information services, users, and information systems should be segregated on networks.

ISO_IEC_27017_2015_10.1.1

09.ab

HITRUST_CSF_v11.3_09.ab

HITRUST CSF v11.3 09.ab

Monitoring

Establish procedures for monitoring use of information processing systems and facilities to check for use and effectiveness of implemented controls.

Shared

1. It is to be specified how often audit logs are reviewed, how the reviews are documented, and the specific roles and responsibilities of the personnel conducting the reviews, including the professional certifications or other qualifications required. 2. All relevant legal requirements applicable to its monitoring of authorized access and unauthorized access attempts is to be complied with.

Procedures for monitoring use of information processing systems and facilities shall be established to check for use and effectiveness of implemented controls. The results of the monitoring activities shall be reviewed regularly.

109

ISO_IEC_27002_2022

6.7

ISO_IEC_27002_2022_6.7

ISO IEC 27002 2022 6.7

Protection, Preventive, Control

Remote working

Shared

Security measures should be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organization’s premises.

To ensure the security of information when personnel are working remotely.

ISO_IEC_27002_2022

8.9

ISO_IEC_27002_2022_8.9

ISO IEC 27002 2022 8.9

Protection, Preventive Control

Configuration management

Shared

Configurations, including security configurations, of hardware, software, services and networks should be established, documented, implemented, monitored and reviewed.

To ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorized or incorrect changes.

ISO_IEC_27017_2015

10.1.1

ISO IEC 27017 2015 10.1.1

Cryptography

Policy on the use of cryptographic controls

Shared

For Cloud Service Customer: The cloud service customer should implement cryptographic controls for its use of cloud services if justified by the risk analysis. The controls should be of sufficient strength to mitigate the identified risks, whether those controls are supplied by the cloud service customer or by the cloud service provider. When the cloud service provider offers cryptography, the cloud service customer should review any information supplied by the cloud service provider to confirm whether the cryptographic capabilities: (i) meet the cloud service customer's policy requirements; (ii) are compatible with any other cryptographic protection used by the cloud service customer; (iii) apply to data at rest and in transit to, from and within the cloud service. For Cloud Service Provider: The cloud service provider should provide information to the cloud service customer regarding the circumstances in which it uses cryptography to protect the information it processes. The cloud service provider should also provide information to the cloud service customer about any capabilities it provides that can assist the cloud service customer in applying its own cryptographic protection.

To ensure proper and effective use of cryptography to protect the confidentiality, authenticity or integrity of information according to business and information security requirements, and taking into consideration legal, statutory, regulatory and contractual requirements related to cryptography.

ISO_IEC_27017_2015

18.1.5

ISO_IEC_27017_2015_18.1.5

ISO IEC 27017 2015 18.1.5

Compliance

Regulation of Cryptographic Controls

Shared

For Cloud Service Customer: The cloud service customer should verify that the set of cryptographic controls that apply to the use of a cloud service comply with relevant agreements, legislation and regulations. For Cloud Service Provider: The cloud service provider should provide descriptions of the cryptographic controls implemented by the cloud service provider to the cloud service customer for reviewing compliance with applicable agreements, legislation and regulations.

To ensure compliance with legal, statutory, regulatory and contractual requirements related to information security.

K_ISMS_P_2018

2.10.1

K_ISMS_P_2018_2.10.1

K ISMS P 2018 2.10.1

2.10

Establish Procedures for Managing the Security of System Operations

Shared

n/a

Establish and implement operating procedures for managing the security of system operations such as designating system administrators, updating policies, changing rulesets, monitoring events, managing policy implementations or exceptions.

408

K_ISMS_P_2018

2.6.1

K_ISMS_P_2018_2.6.1

K ISMS P 2018 2.6.1

2.6

Establish Network Management Procedures

Shared

n/a

Establish and implement network management procedures such as IP management, terminal authentication, and network segregation according to business purpose and criticality.

NIST_SP_800-171_R2_3

.5.10

NIST_SP_800-171_R2_3.5.10

NIST SP 800-171 R2 3.5.10

Identification and Authentication

Store and transmit only cryptographically-protected passwords.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Cryptographically-protected passwords use salted one-way cryptographic hashes of passwords. See [NIST CRYPTO].

NIST_SP_800-171_R2_3

.5.4

NIST_SP_800-171_R2_3.5.4

NIST SP 800-171 R2 3.5.4

Identification and Authentication

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Authentication processes resist replay attacks if it is impractical to successfully authenticate by recording or replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or challenge-response one-time authenticators. [SP 800-63-3] provides guidance on digital identities.

NIST_SP_800-171_R3_3.1.12

NIST_SP_800-171_R3_3

.1.12

NIST 800-171 R3 3.1.12

Access Control

Remote Access

Shared

Remote access to the system represents a significant potential vulnerability that can be exploited by adversaries. Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. This occurs by auditing the connection activities of remote users on the systems. Routing remote access through manaccess control points enhances explicit control over such connections and reduces susceptibility to unauthorized access to the system, which could result in the unauthorized disclosure of CUI. Restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and its susceptibility to threats by adversaries. A privileged command is a human-initiated command executed on a system that involves the control, monitoring, or administration of the system, including security functions and security-relevant information. Security-relevant information is information that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data. Privileged commands give individuals the ability to execute sensitive, security-critical, or security-relevant system functions. Controlling access from remote locations helps to ensure that unauthorized individuals are unable to execute such commands with the potential to do serious or catastrophic damage to the system.

a. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access. b. Authorize each type of remote system access prior to establishing such connections. c. Route remote access to the system through authorized and managed access control points. d. Authorize remote execution of privileged commands and remote access to security-relevant information.

NIST_SP_800-171_R3_3

.1.16

NIST_SP_800-171_R3_3.1.16

NIST 800-171 R3 3.1.16

Access Control

Wireless Access

Shared

Establishing usage restrictions, configuration requirements, and connection requirements for wireless access to the system provides criteria to support access authorization decisions. These restrictions and requirements reduce susceptibility to unauthorized system access through wireless technologies. Wireless networks use authentication protocols that provide credential protection and mutual authentication. Organizations authenticate individuals and devices to protect wireless access to the system. Special attention is given to the variety of devices with potential wireless access to the system, including small form factor mobile devices (e.g., smart phones, smart watches). Wireless networking capabilities that are embedded within system components represent a significant potential vulnerability that can be exploited by adversaries. Disabling wireless capabilities when not needed for essential missions or business functions can help reduce susceptibility to threats by adversaries involving wireless technologies.

a. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system. b. Authorize each type of wireless access to the system prior to establishing such connections. c. Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment.

NIST_SP_800-171_R3_3

.13.11

NIST_SP_800-171_R3_3.13.11

NIST 800-171 R3 3.13.11

System and Communications Protection Control

Cryptographic Protection

Shared

Cryptography is implemented in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.

Implement the following types of cryptography when used to protect the confidentiality of CUI: [Assignment: organization-defined types of cryptography].

NIST_SP_800-53_R5.1.1_AC.17

AC.17

NIST SP 800-53 R5.1.1 AC.17

Access Control

Remote Access

Shared

a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connections.

Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of CA-3. Enforcing access restrictions for remote access is addressed via AC-3.

NIST_SP_800-53_R5.1.1_AC.18

AC.18

NIST SP 800-53 R5.1.1 AC.18

Access Control

Wireless Access

Shared

a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b. Authorize each type of wireless access to the system prior to allowing such connections.

Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.

NIST_SP_800-53_R5.1.1_SC.13

SC.13

NIST SP 800-53 R5.1.1 SC.13

System and Communications Protection

Cryptographic Protection

Shared

a. Determine the [Assignment: organization-defined cryptographic uses]; and b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-defined types of cryptography for each specified cryptographic use].

Cryptography can be employed to support a variety of security solutions, including the protection of classified information and controlled unclassified information, the provision and implementation of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances but lack the necessary formal access approvals. Cryptography can also be used to support random number and hash generation. Generally applicable cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography. For example, organizations that need to protect classified information may specify the use of NSA-approved cryptography. Organizations that need to provision and implement digital signatures may specify the use of FIPS-validated cryptography. Cryptography is implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

NIST_SP_800-53_R5.1.1_SC.31

SC.31

NIST SP 800-53 R5.1.1 SC.31

System and Communications Protection

Covert Channel Analysis

Shared

a. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection (one or more): storage; timing] channels; and b. Estimate the maximum bandwidth of those channels.

Developers are in the best position to identify potential areas within systems that might lead to covert channels. Covert channel analysis is a meaningful activity when there is the potential for unauthorized information flows across security domains, such as in the case of systems that contain export-controlled information and have connections to external networks (i.e., networks that are not controlled by organizations). Covert channel analysis is also useful for multilevel secure systems, multiple security level systems, and cross-domain systems.

NIST_SP_800-53_R5.1.1_SC.32

SC.32

NIST SP 800-53 R5.1.1 SC.32

System and Communications Protection

System Partitioning

Shared

Partition the system into [Assignment: organization-defined system components] residing in separate [Selection: physical; logical] domains or environments based on [Assignment: organization-defined circumstances for physical or logical separation of components].

System partitioning is part of a defense-in-depth protection strategy. Organizations determine the degree of physical separation of system components. Physical separation options include physically distinct components in separate racks in the same room, critical components in separate rooms, and geographical separation of critical components. Security categorization can guide the selection of candidates for domain partitioning. Managed interfaces restrict or prohibit network access and information flow among partitioned system components.

16.5.10.C.01.

NZISM_v3.7_16.5.10.C.01.

NZISM v3.7 16.5.10.C.01.

Remote Access

16.5.10.C.01. - enhance security and reduce the risk of unauthorized access or misuse.

Shared

n/a

Agencies MUST authenticate each remote connection and user prior to permitting access to an agency system.

16.5.10.C.02.

NZISM_v3.7_16.5.10.C.02.

NZISM v3.7 16.5.10.C.02.

Remote Access

16.5.10.C.02. - enhance security and reduce the risk of unauthorized access or misuse.

Shared

n/a

Agencies SHOULD authenticate both the remote system user and device during the authentication process.

16.5.11.C.01.

NZISM_v3.7_16.5.11.C.01.

NZISM v3.7 16.5.11.C.01.

Remote Access

16.5.11.C.01. - enhance security and reduce the risk of unauthorized access or misuse.

Shared

n/a

Agencies MUST NOT allow the use of remote privileged access from an untrusted domain, including logging in as an unprivileged system user and then escalating privileges.

16.5.11.C.02.

NZISM_v3.7_16.5.11.C.02.

NZISM v3.7 16.5.11.C.02.

Remote Access

16.5.11.C.02. - enhance security and reduce the risk of unauthorized access or misuse.

Shared

n/a

Agencies SHOULD NOT allow the use of remote privileged access from an untrusted domain, including logging in as an unprivileged system user and then escalating privileges.

16.5.12.C.01.

NZISM_v3.7_16.5.12.C.01.

NZISM v3.7 16.5.12.C.01.

Remote Access

16.5.12.C.01. - enhance security and reduce the risk of unauthorized access or misuse.

Shared

n/a

Agencies SHOULD establish VPN connections for all remote access connections.

17.1.51.C.01.

NZISM_v3.7_17.1.51.C.01.

NZISM v3.7 17.1.51.C.01.

Cryptographic Fundamentals

17.1.51.C.01. - enhace overall security posture.

Shared

n/a

Agencies using cryptographic functionality within a product to protect the confidentiality, authentication, non-repudiation or integrity of information, MUST ensure that the product has completed a cryptographic evaluation recognised by the GCSB.

17.1.52.C.01.

NZISM_v3.7_17.1.52.C.01.

NZISM v3.7 17.1.52.C.01.

Cryptographic Fundamentals

17.1.52.C.01. - enhace overall security posture.

Shared

n/a

Cryptographic products MUST provide a means of data recovery to allow for recovery of data in circumstances where the encryption key is unavailable due to loss, damage or failure.

17.1.52.C.02.

NZISM_v3.7_17.1.52.C.02.

NZISM v3.7 17.1.52.C.02.

Cryptographic Fundamentals

17.1.52.C.02. - enhance data accessibility and integrity.

Shared

n/a

Cryptographic products SHOULD provide a means of data recovery to allow for recovery of data in circumstances where the encryption key is unavailable due to loss, damage or failure.

17.1.53.C.03.

NZISM_v3.7_17.1.53.C.03.

NZISM v3.7 17.1.53.C.03.

Cryptographic Fundamentals

17.1.53.C.03. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

If an agency wishes to use encryption to reduce the storage, handling or physical transfer requirements for IT equipment or media that contains classified information, they MUST use: 1. full disk encryption; or 2. partial disk encryption where the access control will allow writing ONLY to the encrypted partition holding the classified information.

17.1.53.C.04.

NZISM_v3.7_17.1.53.C.04.

NZISM v3.7 17.1.53.C.04.

Cryptographic Fundamentals

17.1.53.C.04. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

If an agency wishes to use encryption to reduce the storage or physical transfer requirements for IT equipment or media that contains classified information, they SHOULD use: 1. full disk encryption; or 2. partial disk encryption where the access control will allow writing ONLY to the encrypted partition holding the classified information.

17.1.54.C.01.

NZISM_v3.7_17.1.54.C.01.

NZISM v3.7 17.1.54.C.01.

Cryptographic Fundamentals

17.1.54.C.01. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies MUST use an Approved Cryptographic Algorithm to protect NZEO information when at rest on a system.

17.1.55.C.01.

NZISM_v3.7_17.1.55.C.01.

NZISM v3.7 17.1.55.C.01.

Cryptographic Fundamentals

17.1.55.C.01. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies MUST use HACE if they wish to communicate or pass information over UNCLASSIFIED, insecure or unprotected networks.

17.1.55.C.02.

NZISM_v3.7_17.1.55.C.02.

NZISM v3.7 17.1.55.C.02.

Cryptographic Fundamentals

17.1.55.C.02. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Information or systems classified RESTRICTED or SENSITIVE MUST be encrypted with an Approved Cryptographic Algorithm and Protocol if information is transmitted or systems are communicating over insecure or unprotected networks, such as the Internet, public networks or non-agency controlled networks.

17.1.55.C.03.

NZISM_v3.7_17.1.55.C.03.

NZISM v3.7 17.1.55.C.03.

Cryptographic Fundamentals

17.1.55.C.03. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies MUST encrypt aggregated agency data using an approved algorithm and protocol over insecure or unprotected networks such as the Internet, public infrastructure or non-agency controlled networks when the compromise of the aggregated data would present a significant impact to the agency.

17.1.55.C.04.

NZISM_v3.7_17.1.55.C.04.

NZISM v3.7 17.1.55.C.04.

Cryptographic Fundamentals

17.1.55.C.04. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies SHOULD encrypt agency data using an approved algorithm and protocol if they wish to communicate over insecure or unprotected networks such as the Internet, public networks or non-agency controlled networks.

17.1.56.C.02.

NZISM_v3.7_17.1.56.C.02.

NZISM v3.7 17.1.56.C.02.

Cryptographic Fundamentals

17.1.56.C.02. - ensure compliance with security protocols and best practices.

Shared

n/a

Agencies MUST consult the GCSB for further advice on the powered off status and treatment of specific software, systems and IT equipment.

1.2.1

PCI_DSS_v4.0.1_1.2.1

PCI DSS v4.0.1 1.2.1

Install and Maintain Network Security Controls

Configuration standards for NSC rulesets are defined, implemented, and maintained

Shared

n/a

Examine the configuration standards for NSC rulesets to verify the standards are in accordance with all elements specified in this requirement. Examine configuration settings for NSC rulesets to verify that rulesets are implemented according to the configuration standards

1.2.7

PCI_DSS_v4.0.1_1.2.7

PCI DSS v4.0.1 1.2.7

Install and Maintain Network Security Controls

Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective

Shared

n/a

Examine documentation to verify procedures are defined for reviewing configurations of NSCs at least once every six months. Examine documentation of reviews of configurations for NSCs and interview responsible personnel to verify that reviews occur at least once every six months. Examine configurations for NSCs to verify that configurations identified as no longer being supported by a business justification are removed or updated

3.5.1.1

PCI_DSS_v4.0.1_3.5.1.1

PCI DSS v4.0.1 3.5.1.1

Protect Stored Account Data

Hashes used to render PAN unreadable (per the first bullet of Requirement 3.5.1) are keyed cryptographic hashes of the entire PAN, with associated key-management processes and procedures in accordance with Requirements 3.6 and 3.7

Shared

n/a

Examine documentation about the hashing method used to render PAN unreadable, including the vendor, type of system/process, and the encryption algorithms (as applicable) to verify that the hashing method results in keyed cryptographic hashes of the entire PAN, with associated key management processes and procedures. Examine documentation about the key management procedures and processes associated with the keyed cryptographic hashes to verify keys are managed in accordance with Requirements 3.6 and 3.7. Examine data repositories to verify the PAN is rendered unreadable. Examine audit logs, including payment application logs, to verify the PAN is rendered unreadable

Sarbanes_Oxley_Act_(1)_2022_1

4.2.1

PCI_DSS_v4.0.1_4.2.1

PCI DSS v4.0.1 4.2.1

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks: Only trusted keys and certificates are accepted. Certificates used to safeguard PAN during transmission over open, public networks are confirmed as valid and are not expired or revoked. The protocol in use supports only secure versions or configurations and does not support fallback to, or use of insecure versions, algorithms, key sizes, or implementations. The encryption strength is appropriate for the encryption methodology in use

Shared

n/a

Examine documented policies and procedures and interview personnel to verify processes are defined to include all elements specified in this requirement. Examine system configurations to verify that strong cryptography and security protocols are implemented in accordance with all elements specified in this requirement. Examine cardholder data transmissions to verify that all PAN is encrypted with strong cryptography when it is transmitted over open, public networks. Examine system configurations to verify that keys and/or certificates that cannot be verified as trusted are rejected

Sarbanes Oxley Act 2022 1

PUBLIC LAW

Sarbanes Oxley Act 2022 (SOX)

Shared

n/a

A1.1

SOC_2023_A1.1

SOC 2023 A1.1

Additional Criteria for Availability

Effectively manage capacity demand and facilitate the implementation of additional capacity as needed.

Shared

n/a

The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.

107

C1.1

SOC_2023_C1.1

SOC 2023 C1.1

Additional Criteria for Confidentiality

Preserve trust, compliance, and competitive advantage.

Shared

n/a

The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality.

CC1.3

SOC_2023_CC1.3

SOC 2023 CC1.3

Control Environment

Enable effective execution of authorities, information flow, and setup of appropriate responsibilities to achieve organizational objectives.

Shared

n/a

1. Ensure the management establishes, with board oversight, structures including operating units, legal entities, geographic distribution and outsourced service providers. 2. Design and evaluate reporting lines for each entity to enable execution of authorities, execution and flow of information and setup appropriate authorities and responsibilities in the pursuit of objectives.

CC2.2

SOC_2023_CC2.2

SOC 2023 CC2.2

Information and Communication

Facilitate effective internal communication, including objectives and responsibilities for internal control.

Shared

n/a

Entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control by setting up a process to communicate required information to enable personnel to understand and carry out responsibilities, ensure communication exists between management and board of directors, provides for separate communication channels which serve as fail-safe mechanism to enable anonymous or confidential communication and setting up relevant methods of communication by considering the timing, audience and nature information

CC2.3

SOC_2023_CC2.3

SOC 2023 CC2.3

Information and Communication

Facilitate effective internal communication.

Shared

n/a

Entity to communicate with external parties regarding matters affecting the functioning of internal control.

214

CC5.2

SOC_2023_CC5.2

SOC 2023 CC5.2

Control Activities

Mitigate technology-related risks and ensure that technology effectively supports the organization in achieving its objectives, enhancing efficiency, reliability, and security in its operations.

Shared

n/a

Entity also selects and develops general control activities over technology to support the achievement of objectives by determining Dependency Between the Use of Technology in Business Processes and Technology General Controls, establishing Relevant Technology Infrastructure Control Activities, establishing Relevant Security Management Process Controls Activities, establishing Relevant Technology Acquisition and Development, and Maintenance of Process Control Activities.

CC5.3

SOC_2023_CC5.3

SOC 2023 CC5.3

Control Activities

Maintain alignment with organizational objectives and regulatory requirements.

Shared

n/a

Entity deploys control activities through policies that establish what is expected and in procedures that put policies into action by establishing Policies and Procedures to Support Deployment of Management’s Directives, Responsibility and Accountability for Executing Policies and Procedures, perform tasks in a timely manner, taking corrective actions, perform using competent personnel and reassess policies and procedures.

225

CC6.1

SOC_2023_CC6.1

SOC 2023 CC6.1

Logical and Physical Access Controls

Mitigate security events and ensuring the confidentiality, integrity, and availability of critical information assets.

Shared

n/a

Entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives by identifying and managing the inventory of information assets, restricting logical access, identification and authentication of users, consider network segmentation, manage points of access, restricting access of information assets, managing identification and authentication, managing credentials for infrastructure and software, using encryption to protect data and protect using encryption keys.

127

CC7.1

SOC_2023_CC7.1

SOC 2023 CC7.1

Systems Operations

Maintain a proactive approach to cybersecurity and mitigate risks effectively.

Shared

n/a

meet its objectives, the entity uses detection and monitoring procedures to identify changes to configurations that result in the introduction of new vulnerabilities, and susceptibilities to newly discovered vulnerabilities.

CC7.2

SOC_2023_CC7.2

SOC 2023 CC7.2

Systems Operations

Maintain robust security measures and ensure operational resilience.

Shared

n/a

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events.

163

CC7.4

SOC_2023_CC7.4

SOC 2023 CC7.4

Systems Operations

Effectively manage security incidents, minimize their impact, and protect assets, operations, and reputation.

Shared

n/a

The entity responds to identified security incidents by: a. Executing a defined incident-response program to understand, contain, remediate, and communicate security incidents by assigning roles and responsibilities; b. Establishing procedures to contain security incidents; c. Mitigating ongoing security incidents, End Threats Posed by Security Incidents; d. Restoring operations; e. Developing and Implementing Communication Protocols for Security Incidents; f. Obtains Understanding of Nature of Incident and Determines Containment Strategy; g. Remediation Identified Vulnerabilities; h. Communicating Remediation Activities; and, i. Evaluating the Effectiveness of Incident Response and periodic incident evaluations.

209

CC7.5

SOC_2023_CC7.5

SOC 2023 CC7.5

Systems Operations

Ensure prompt restoration of normal operations, mitigation of residual risks, and enhancement of incident response capabilities to minimize the impact of future incidents.

Shared

n/a

The entity identifies, develops, and implements activities to recover from identified security incidents.

CC8.1

SOC_2023_CC8.1

SOC 2023 CC8.1

Change Management

Minimise risks, ensure quality, optimise efficiency, and enhance resilience in the face of change.

Shared

n/a

The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives by Managing Changes Throughout the System Life Cycle, authorizing changes, designing and developing changes, documenting all changes, tracking system changes, configuring software's, testing system changes, approving system changes, deploying system changes, identifying and evaluating system changes, creating baseline configurations for IT technologies and providing necessary changes in emergency situations.

143

CC9.2

SOC_2023_CC9.2

SOC 2023 CC9.2

Risk Mitigation

Ensure effective risk management throughout the supply chain and business ecosystem.

Shared

n/a

Entity assesses and manages risks associated with vendors and business partners.