Az Policy Advertizer

Canada_Federal_PBMM_3-1-2020

AC_2(4)

Canada_Federal_PBMM_3-1-2020_AC_2(4)

Canada Federal PBMM 3-1-2020 AC 2(4)

Account Management

Account Management | Automated Audit Actions

Shared

1. The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies responsible managers. 2. Related controls: AU-2, AU-12.

To ensure accountability and transparency within the information system.

CIS_Azure_1.1.0

5.1.3

CIS_Azure_1.1.0_5.1.3

CIS Microsoft Azure Foundations Benchmark recommendation 5.1.3

5 Logging and Monitoring

Ensure audit profile captures all the activities

Shared

The customer is responsible for implementing this recommendation.

The log profile should be configured to export all activities from the control/management plane.

CMMC_L2_v1.9.0_CM.L2_3.4.1

CMMC_L2_v1.9.0

CM.L2_3.4.1

Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 CM.L2 3.4.1

Configuration Management

System Baselining

Shared

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

To ensure consistency, security, and compliance with organizational standards and requirements.

CMMC_L3

AU.2.041

CMMC_L3_AU.2.041

CMMC L3 AU.2.041

Audit and Accountability

Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

This requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible. Organizations consider logging for traceability including results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, communications at system boundaries, configuration settings, physical access, nonlocal maintenance, use of maintenance tools, temperature and humidity, equipment delivery and removal, system component inventory, use of mobile code, and use of Voice over Internet Protocol (VoIP).

CMMC_L3

SI.2.217

CMMC_L3_SI.2.217

CMMC L3 SI.2.217

System and Information Integrity

Identify unauthorized use of organizational systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

System monitoring includes external and internal monitoring. System monitoring can detect unauthorized use of organizational systems. System monitoring is an integral part of continuous monitoring and incident response programs. Monitoring is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Output from system monitoring serves as input to continuous monitoring and incident response programs. Unusual/unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements.

CCC_06

CSA_v4.0.12_CCC_06

CSA Cloud Controls Matrix v4.0.12 CCC 06

Change Control and Configuration Management

Change Management Baseline

Shared

n/a

Establish change management baselines for all relevant authorized changes on organization assets.

CEK_03

CSA_v4.0.12_CEK_03

CSA Cloud Controls Matrix v4.0.12 CEK 03

Cryptography, Encryption & Key Management

Data Encryption

Shared

n/a

Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.

CEK_05

CSA_v4.0.12_CEK_05

CSA Cloud Controls Matrix v4.0.12 CEK 05

Cryptography, Encryption & Key Management

Encryption Change Management

Shared

n/a

Establish a standard change management procedure, to accommodate changes from internal and external sources, for review, approval, implementation and communication of cryptographic, encryption and key management technology changes.

CEK_06

CSA_v4.0.12_CEK_06

CSA Cloud Controls Matrix v4.0.12 CEK 06

Cryptography, Encryption & Key Management

Encryption Change Cost Benefit Analysis

Shared

n/a

Manage and adopt changes to cryptography-, encryption-, and key management-related systems (including policies and procedures) that fully account for downstream effects of proposed changes, including residual risk, cost, and benefits analysis.

CEK_07

CSA_v4.0.12_CEK_07

CSA Cloud Controls Matrix v4.0.12 CEK 07

Cryptography, Encryption & Key Management

Encryption Risk Management

Shared

n/a

Establish and maintain an encryption and key management risk program that includes provisions for risk assessment, risk treatment, risk context, monitoring, and feedback.

CEK_20

CSA_v4.0.12_CEK_20

CSA Cloud Controls Matrix v4.0.12 CEK 20

Cryptography, Encryption & Key Management

Key Recovery

Shared

n/a

Define, implement and evaluate processes, procedures and technical measures to assess the risk to operational continuity versus the risk of the keying material and the information it protects being exposed if control of the keying material is lost, which include provisions for legal and regulatory requirements.

DCS_05

CSA_v4.0.12_DCS_05

CSA Cloud Controls Matrix v4.0.12 DCS 05

Datacenter Security

Assets Classification

Shared

n/a

Classify and document the physical, and logical assets (e.g., applications) based on the organizational business risk.

DCS_06

CSA_v4.0.12_DCS_06

CSA Cloud Controls Matrix v4.0.12 DCS 06

Datacenter Security

Assets Cataloguing and Tracking

Shared

n/a

Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.

IVS_07

CSA_v4.0.12_IVS_07

CSA Cloud Controls Matrix v4.0.12 IVS 07

Infrastructure & Virtualization Security

Migration to Cloud Environments

Shared

n/a

Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.

TVM_07

CSA_v4.0.12_TVM_07

CSA Cloud Controls Matrix v4.0.12 TVM 07

Threat & Vulnerability Management

Vulnerability Identification

Shared

n/a

Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.

UEM_04

CSA_v4.0.12_UEM_04

CSA Cloud Controls Matrix v4.0.12 UEM 04

Universal Endpoint Management

Endpoint Inventory

Shared

n/a

Maintain an inventory of all endpoints used to store and access company data.

UEM_07

CSA_v4.0.12_UEM_07

CSA Cloud Controls Matrix v4.0.12 UEM 07

Universal Endpoint Management

Operating Systems

Shared

n/a

Manage changes to endpoint operating systems, patch levels, and/or applications through the company's change management processes.

UEM_12

CSA_v4.0.12_UEM_12

CSA Cloud Controls Matrix v4.0.12 UEM 12

Universal Endpoint Management

Remote Locate

Shared

n/a

Enable remote geo-location capabilities for all managed mobile endpoints.

EU_2555_(NIS2)_2022_11

EU 2022/2555 (NIS2) 2022 11

Requirements, technical capabilities and tasks of CSIRTs

Shared

n/a

Outlines the requirements, technical capabilities, and tasks of CSIRTs.

EU_2555_(NIS2)_2022_12

EU 2022/2555 (NIS2) 2022 12

Coordinated vulnerability disclosure and a European vulnerability database

Shared

n/a

Establishes a coordinated vulnerability disclosure process and a European vulnerability database.

EU_2555_(NIS2)_2022_21

EU 2022/2555 (NIS2) 2022 21

Cybersecurity risk-management measures

Shared

n/a

Requires essential and important entities to take appropriate measures to manage cybersecurity risks.

193

EU_2555_(NIS2)_2022_29

EU 2022/2555 (NIS2) 2022 29

Cybersecurity information-sharing arrangements

Shared

n/a

Allows entities to exchange relevant cybersecurity information on a voluntary basis.

EU_GDPR_2016_679_Art._24

EU General Data Protection Regulation (GDPR) 2016/679 Art. 24

Chapter 4 - Controller and processor

Responsibility of the controller

Shared

n/a

310

EU_GDPR_2016_679_Art._25

EU General Data Protection Regulation (GDPR) 2016/679 Art. 25

Chapter 4 - Controller and processor

Data protection by design and by default

Shared

n/a

310

EU_GDPR_2016_679_Art._28

EU General Data Protection Regulation (GDPR) 2016/679 Art. 28

Chapter 4 - Controller and processor

Processor

Shared

n/a

310

FBI_Criminal_Justice_Information_Services_v5.9.5_5

EU_GDPR_2016_679_Art._32

EU General Data Protection Regulation (GDPR) 2016/679 Art. 32

Chapter 4 - Controller and processor

Security of processing

Shared

n/a

310

.11

FBI_Criminal_Justice_Information_Services_v5.9.5_5.11

FBI Criminal Justice Information Services (CJIS) v5.9.5 5.11

Policy and Implementation - Formal Audits

Policy Area 11: Formal Audits

Shared

Internal compliance checklists should be regularly kept updated with respect to applicable statutes, regulations, policies and on the basis of findings in audit.

Formal audits are conducted to ensure compliance with applicable statutes, regulations and policies.

FBI_Criminal_Justice_Information_Services_v5.9.5_5

FBI_Criminal_Justice_Information_Services_v5.9.5_5.7

404 not found

n/a

hipaa

1212.09ab1System.1-09.ab

hipaa-1212.09ab1System.1-09.ab

1212.09ab1System.1-09.ab

12 Audit Logging & Monitoring

1212.09ab1System.1-09.ab 09.10 Monitoring

Shared

n/a

All applicable legal requirements related to monitoring authorized access and unauthorized access attempts are met.

hipaa

1219.09ab3System.10-09.ab

hipaa-1219.09ab3System.10-09.ab

1219.09ab3System.10-09.ab

12 Audit Logging & Monitoring

1219.09ab3System.10-09.ab 09.10 Monitoring

Shared

n/a

The information system is able to automatically process audit records for events of interest based on selectable criteria.

HITRUST_CSF_v11.3

06.h

HITRUST_CSF_v11.3_06.h

HITRUST CSF v11.3 06.h

Compliance with Security Policies and Standards

Ensure compliance with security implementation standards by regular checking of information systems.

Shared

1. Annual checks on the technical security configuration of systems is to be performed either manually by an individual with experience with the systems and/or with the assistance of automated software tools. 2. Technical compliance checking is to be implemented to show compliance in support of technical interoperability.

Information systems shall be regularly checked for compliance with security implementation standards.

HITRUST_CSF_v11.3

10.c

HITRUST_CSF_v11.3_10.c

HITRUST CSF v11.3 10.c

Correct Processing in Applications

Incorporate validation checks into applications to detect any corruption of information through processing errors or deliberate acts.

Shared

Data integrity controls which manage changes, prevent sequencing errors, ensure recovery from failures, and protect against buffer overrun attacks are to be implemented.

Validation checks shall be incorporated into applications to detect any corruption of information through processing errors or deliberate acts.

ISO_IEC_27002_2022

5.9

ISO_IEC_27002_2022_5.9

ISO IEC 27002 2022 5.9

Preventive, Identifying Control

Inventory of information and other associated assets

Shared

An inventory of information and other associated assets, including owners, should be developed and maintained.

To identify the organization’s information and other associated assets in order to preserve their information security and assign appropriate ownership.

ISO_IEC_27017_2015

8.1.1

ISO_IEC_27017_2015_8.1.1

ISO IEC 27017 2015 8.1.1

Asset Management

Inventory of Assets

Shared

For Cloud Service Customer: The cloud service customer's inventory of assets should account for information and associated assets stored in the cloud computing environment. The records of the inventory should indicate where the assets are maintained, e.g., identification of the cloud service. For Cloud Service Provider: The inventory of assets of the cloud service provider should explicitly identify: (i) cloud service customer data; (ii) cloud service derived data.

To identify the organization’s information and other associated assets in order to preserve their information security and assign appropriate ownership.

NIST_SP_800-171_R3_3

.4.10

NIST_SP_800-171_R3_3.4.10

NIST 800-171 R3 3.4.10

Configuration Management Control

System Component Inventory

Shared

System components are discrete, identifiable assets (i.e., hardware, software, and firmware elements) that compose a system. Organizations may implement centralized system component inventories that include components from all systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information — and for networked components — the machine names and network addresses for all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include component type, physical location, date of receipt, manufacturer, cost, model, serial number, and supplier information.

a. Develop and document an inventory of system components. b. Review and update the system component inventory periodically. c. Update the system component inventory as part of installations, removals, and system updates.

NIST_SP_800-53_R5.1.1

CM.8

NIST_SP_800-53_R5.1.1_CM.8

NIST SP 800-53 R5.1.1 CM.8

Configuration Management Control

System Component Inventory

Shared

a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability]; and b. Review and update the system component inventory [Assignment: organization-defined frequency].

System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location. Preventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of CM-8(7) can help to eliminate duplicate accounting of components.

NIST_SP_800-53_R5.1.1

SI.7

NIST_SP_800-53_R5.1.1_SI.7

NIST SP 800-53 R5.1.1 SI.7

System and Information Integrity Control

Software, Firmware, and Information Integrity

Shared

a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.

14.1.9.C.01.

NZISM_v3.7_14.1.9.C.01.

NZISM v3.7 14.1.9.C.01.

Standard Operating Environments

14.1.9.C.01. - maintain system reliability, protect sensitive information, and fulfill security requirements.

Shared

n/a

Agencies MUST ensure that for all servers and workstations: 1. a technical specification is agreed for each platform with specified controls; 2. a standard configuration created and updated for each operating system type and version; 3. system users do not have the ability to install or disable software without approval; and 4. installed software and operating system patching is up to date.

17.1.58.C.02.

NZISM_v3.7_17.1.58.C.02.

NZISM v3.7 17.1.58.C.02.

Cryptographic Fundamentals

17.1.58.C.02. - enhance overall cybersecurity posture.

Shared

n/a

Agencies SHOULD use risk assessment techniques and guidance to establish cryptoperiods.

17.5.7.C.02.

NZISM_v3.7_17.5.7.C.02.

NZISM v3.7 17.5.7.C.02.

Secure Shell

17.5.7.C.02. - enhance overall cybersecurity posture.

Shared

n/a

Agencies that allow password authentication SHOULD use techniques to block brute force attacks against the password.

22.1.24.C.02.

NZISM_v3.7_22.1.24.C.02.

NZISM v3.7 22.1.24.C.02.

Cloud Computing

22.1.24.C.02. - enhance security posture.

Shared

n/a

Agencies intending to adopt cloud technologies or services SHOULD apply separation and access controls to protect data and systems where support is provided by offshore technical staff.

22.1.26.C.01.

NZISM_v3.7_22.1.26.C.01.

NZISM v3.7 22.1.26.C.01.

Cloud Computing

22.1.26.C.01. - ensure safety of data.

Shared

n/a

Agencies MUST develop and implement a backup, recovery and archiving plan and supporting procedures.

23.1.56.C.01.

NZISM_v3.7_23.1.56.C.01.

NZISM v3.7 23.1.56.C.01.

Public Cloud Security Concepts

23.1.56.C.01. - reduce manual errors and ensure adherence to security standards.

Shared

n/a

Agencies SHOULD deploy and manage their cloud infrastructure using automation, version control, and infrastructure as code techniques where these are available.

23.2.20.C.01.

NZISM_v3.7_23.2.20.C.01.

NZISM v3.7 23.2.20.C.01.

Governance, Risk Assessment & Assurance

23.2.20.C.01. - enhance confidence in the security and reliability of cloud services and mitigate risks associated with potential vulnerabilities or non-compliance with security standards.

Shared

n/a

Agencies MUST obtain assurance that technical protections exist to adequately isolate tenants.

6.4.6.C.01.

NZISM_v3.7_6.4.6.C.01.

NZISM v3.7 6.4.6.C.01.

Business Continuity and Disaster Recovery

6.4.6.C.01. - enhance operational resilience.

Shared

n/a

Agencies SHOULD: 1.Identify vital records; 2. backup all vital records; 3. store copies of critical information, with associated documented recovery procedures, offsite and secured in accordance with the requirements for the highest 4. 4. classification of the information; and 5. test backup and restoration processes regularly to confirm their effectiveness.

10.3.4

PCI_DSS_v4.0.1_10.3.4

PCI DSS v4.0.1 10.3.4

Log and Monitor All Access to System Components and Cardholder Data

Log Integrity Monitoring

Shared

n/a

File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts.

11.5.2

PCI_DSS_v4.0.1_11.5.2

PCI DSS v4.0.1 11.5.2

Test Security of Systems and Networks Regularly

Change-Detection Mechanism Deployment

Shared

n/a

A change-detection mechanism (for example, file integrity monitoring tools) is deployed as follows: • To alert personnel to unauthorized modification (including changes, additions, and deletions) of critical files. • To perform critical file comparisons at least once weekly.

9.5.1

PCI_DSS_v4.0.1_9.5.1

PCI DSS v4.0.1 9.5.1

Restrict Physical Access to Cardholder Data

Protection Measures for POI Devices Against Tampering and Unauthorized Substitution

Shared

n/a

POI devices that capture payment card data via direct physical interaction with the payment card form factor are protected from tampering and unauthorized substitution, including the following: • Maintaining a list of POI devices. • Periodically inspecting POI devices to look for tampering or unauthorized substitution. • Training personnel to be aware of suspicious behavior and to report tampering or unauthorized substitution of devices.

9.5.1.1

PCI_DSS_v4.0.1_9.5.1.1

PCI DSS v4.0.1 9.5.1.1

Restrict Physical Access to Cardholder Data

Maintenance of an Up-to-Date List of POI Devices

Shared

n/a

An up-to-date list of POI devices is maintained, including: • Make and model of the device. • Location of device. • Device serial number or other methods of unique identification.

RBI_CSF_Banks_v2016

16.2

RBI_CSF_Banks_v2016_16.2

Maintenance, Monitoring, And Analysis Of Audit Logs

Maintenance, Monitoring, And Analysis Of Audit Logs-16.2

n/a

Manage and analyse audit logs in a systematic manner so as to detect, understand or recover from an attack.

RBI_ITF_NBFC_v2017

3.1.g

RBI_ITF_NBFC_v2017_3.1.g

RBI IT Framework 3.1.g

Information and Cyber Security

Trails-3.1

n/a

The IS Policy must provide for a IS framework with the following basic tenets: Trails- NBFCs shall ensure that audit trails exist for IT assets satisfying its business requirements including regulatory and legal requirements, facilitating audit, serving as forensic evidence when required and assisting in dispute resolution. If an employee, for instance, attempts to access an unauthorized section, this improper activity should be recorded in the audit trail.

RMiT_v1.0

10.66

RMiT_v1.0_10.66

RMiT 10.66

Security of Digital Services

Security of Digital Services - 10.66

Shared

n/a

A financial institution must implement robust technology security controls in providing digital services which assure the following: (a) confidentiality and integrity of customer and counterparty information and transactions; (b) reliability of services delivered via channels and devices with minimum disruption to services; (c) proper authentication of users or devices and authorisation of transactions; (d) sufficient audit trail and monitoring of anomalous transactions; (e) ability to identify and revert to the recovery point prior to incident or service disruption; and (f) strong physical control and logical control measures

CC1.4

SOC_2023_CC1.4

SOC 2023 CC1.4

Control Environment

Ensure organizational resilience, innovation, and competitiveness in the long run.

Shared

n/a

Entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives by establishing policies and procedures, evaluating the competence required and address its shortcomings, attracts, develops and retains individuals through mentoring and training and plan and prepare for succession by developing contingency plans for assignments of responsibilities important for internal control.

CC2.3

SOC_2023_CC2.3

SOC 2023 CC2.3

Information and Communication

Facilitate effective internal communication.

Shared

n/a

Entity to communicate with external parties regarding matters affecting the functioning of internal control.

218

CC5.3

SOC_2023_CC5.3

SOC 2023 CC5.3

Control Activities

Maintain alignment with organizational objectives and regulatory requirements.

Shared

n/a

Entity deploys control activities through policies that establish what is expected and in procedures that put policies into action by establishing Policies and Procedures to Support Deployment of Management’s Directives, Responsibility and Accountability for Executing Policies and Procedures, perform tasks in a timely manner, taking corrective actions, perform using competent personnel and reassess policies and procedures.

229

CC6.1

SOC_2023_CC6.1

SOC 2023 CC6.1

Logical and Physical Access Controls

Mitigate security events and ensuring the confidentiality, integrity, and availability of critical information assets.

Shared

n/a

Entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives by identifying and managing the inventory of information assets, restricting logical access, identification and authentication of users, consider network segmentation, manage points of access, restricting access of information assets, managing identification and authentication, managing credentials for infrastructure and software, using encryption to protect data and protect using encryption keys.

128

CC7.4

SOC_2023_CC7.4

SOC 2023 CC7.4

Systems Operations

Effectively manage security incidents, minimize their impact, and protect assets, operations, and reputation.

Shared

n/a

The entity responds to identified security incidents by: a. Executing a defined incident-response program to understand, contain, remediate, and communicate security incidents by assigning roles and responsibilities; b. Establishing procedures to contain security incidents; c. Mitigating ongoing security incidents, End Threats Posed by Security Incidents; d. Restoring operations; e. Developing and Implementing Communication Protocols for Security Incidents; f. Obtains Understanding of Nature of Incident and Determines Containment Strategy; g. Remediation Identified Vulnerabilities; h. Communicating Remediation Activities; and, i. Evaluating the Effectiveness of Incident Response and periodic incident evaluations.

213

CM_8b

SOC_2023_CM_8b

404 not found

n/a

SWIFT_CSCF_2024

2.1

SWIFT_CSCF_2024_2.1

SWIFT Customer Security Controls Framework 2024 2.1

Risk Management

Internal Data Flow Security

Shared

The protection of internal data flows safeguards against unintended disclosure, modification, and access of the data while in transit.

To ensure the confidentiality, integrity, and authenticity of application data flows between ’user’s Swift-related components.

SWIFT_CSCF_2024

6.2

SWIFT_CSCF_2024_6.2

SWIFT Customer Security Controls Framework 2024 6.2

Risk Management

Software Integrity

Shared

Software integrity checks provide a detective control against unexpected modification to operational software.

To ensure the software integrity of the Swift-related components and act upon results.

SWIFT_CSCF_2024

6.3

SWIFT_CSCF_2024_6.3

SWIFT Customer Security Controls Framework 2024 6.3

Risk Management

Database Integrity

Shared

Database integrity checks allow unexpected modification to records stored within the database to be detected.

To ensure the integrity of the database records for the Swift messaging interface or the customer connector and act upon results.

SWIFT_CSCF_v2021

6.4

SWIFT_CSCF_v2021_6.4

SWIFT CSCF v2021 6.4

Detect Anomalous Activity to Systems or Transaction Records

Logging and Monitoring

n/a

Record security events and detect anomalous actions and operations within the local SWIFT environment.

SWIFT_CSCF_v2022

6.4

SWIFT_CSCF_v2022_6.4

SWIFT CSCF v2022 6.4

6. Detect Anomalous Activity to Systems or Transaction Records

Record security events and detect anomalous actions and operations within the local SWIFT environment.

Shared

n/a

Capabilities to detect anomalous activity are implemented, and a process or tool is in place to keep and review logs.