Az Policy Advertizer

1144

AU_ISM_1144

AU ISM 1144

Guidelines for System Management - System patching

When to patch security vulnerabilities - 1144

n/a

Security vulnerabilities in applications and drivers assessed as extreme risk are patched, updated or mitigated within 48 hours of the security vulnerabilities being identified by vendors, independent third parties, system managers or users.

1472

AU_ISM_1472

AU ISM 1472

Guidelines for System Management - System patching

When to patch security vulnerabilities - 1472

n/a

Security vulnerabilities in applications and drivers assessed as moderate or low risk are patched, updated or mitigated within one month of the security vulnerability being identified by vendors, independent third parties, system managers or users.

1494

AU_ISM_1494

AU ISM 1494

Guidelines for System Management - System patching

When to patch security vulnerabilities - 1494

n/a

Security vulnerabilities in operating systems and firmware assessed as extreme risk are patched, updated or mitigated within 48 hours of the security vulnerabilities being identified by vendors, independent third parties, system managers or users.

1495

AU_ISM_1495

AU ISM 1495

Guidelines for System Management - System patching

When to patch security vulnerabilities - 1495

n/a

Security vulnerabilities in operating systems and firmware assessed as high risk are patched, updated or mitigated within two weeks of the security vulnerability being identified by vendors, independent third parties, system managers or users.

1496

AU_ISM_1496

AU ISM 1496

Guidelines for System Management - System patching

When to patch security vulnerabilities - 1496

n/a

Security vulnerabilities in operating systems and firmware assessed as moderate or low risk are patched, updated or mitigated within one month of the security vulnerability being identified by vendors, independent third parties, system managers or users.

940

AU_ISM_940

AU ISM 940

Guidelines for System Management - System patching

When to patch security vulnerabilities - 940

n/a

Security vulnerabilities in applications and drivers assessed as high risk are patched, updated or mitigated within two weeks of the security vulnerability being identified by vendors, independent third parties, system managers or users.

Azure_Security_Benchmark_v1.0

5.1

Azure_Security_Benchmark_v1.0_5.1

Azure Security Benchmark 5.1

Vulnerability Management

Run automated vulnerability scanning tools

Customer

Follow recommendations from Azure Security Center on performing vulnerability assessments on your Azure virtual machines, container images, and SQL servers. Use a third-party solution for performing vulnerability assessments on network devices and web applications. When conducting remote scans, do not use a single, perpetual, administrative account. Consider implementing JIT provisioning methodology for the scan account. Credentials for the scan account should be protected, monitored, and used only for vulnerability scanning. How to implement Azure Security Center vulnerability assessment recommendations: https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations

n/a

Azure_Security_Benchmark_v2.0

PV-6

Azure_Security_Benchmark_v2.0_PV-6

Azure Security Benchmark PV-6

Posture and Vulnerability Management

Perform software vulnerability assessments

Customer

Follow recommendations from Azure Security Center for performing vulnerability assessments on your Azure virtual machines, container images, and SQL servers. Azure Security Center has a built-in vulnerability scanner for virtual machine scan. Use a third-party solution for performing vulnerability assessments on network devices and web applications. When conducting remote scans, do not use a single, perpetual, administrative account. Consider implementing JIT (Just In Time) provisioning methodology for the scan account. Credentials for the scan account should be protected, monitored, and used only for vulnerability scanning. Export scan results at consistent intervals and compare the results with previous scans to verify that vulnerabilities have been remediated. When using vulnerability management recommendations suggested by Azure Security Center, you can pivot into the selected scan solution's portal to view historical scan data. How to implement Azure Security Center vulnerability assessment recommendations: https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations Integrated vulnerability scanner for virtual machines: https://docs.microsoft.com/azure/security-center/built-in-vulnerability-assessment SQL vulnerability assessment: https://docs.microsoft.com/azure/azure-sql/database/sql-vulnerability-assessment Exporting Azure Security Center vulnerability scan results: https://docs.microsoft.com/azure/security-center/built-in-vulnerability-assessment#exporting-results

n/a

Azure_Security_Benchmark_v3.0

PV-5

Azure_Security_Benchmark_v3.0_PV-5

Microsoft cloud security benchmark PV-5

Posture and Vulnerability Management

Perform vulnerability assessments

Shared

**Security Principle:** Perform vulnerabilities assessment for your cloud resources at all tiers in a fixed schedule or on-demand. Track and compare the scan results to verify the vulnerabilities are remediated. The assessment should include all type of vulnerabilities, such as vulnerabilities in Azure services, network, web, operating systems, misconfigurations, and so on. Be aware of the potential risks associated with the privileged access used by the vulnerability scanners. Follow the privileged access security best practice to secure any administrative accounts used for the scanning. **Azure Guidance:** Follow recommendations from Microsoft Defender for Cloud for performing vulnerability assessments on your Azure virtual machines, container images, and SQL servers. Microsoft Defender for Cloud has a built-in vulnerability scanner for virtual machine scan. Use a third-party solution for performing vulnerability assessments on network devices and applications (e.g., web applications) Export scan results at consistent intervals and compare the results with previous scans to verify that vulnerabilities have been remediated. When using vulnerability management recommendations suggested by Microsoft Defender for Cloud, you can pivot into the selected scan solution's portal to view historical scan data. When conducting remote scans, do not use a single, perpetual, administrative account. Consider implementing JIT (Just In Time) provisioning methodology for the scan account. Credentials for the scan account should be protected, monitored, and used only for vulnerability scanning. Note: Azure Defender services (including Defender for server, container registry, App Service, SQL, and DNS) embed certain vulnerability assessment capabilities. The alerts generated from Azure Defender services should be monitored and reviewed together with the result from Microsoft Defender for Cloud vulnerability scanning tool. Note: Ensure your setup email notifications in Microsoft Defender for Cloud. **Implementation and additional context:** How to implement Microsoft Defender for Cloud vulnerability assessment recommendations: https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations Integrated vulnerability scanner for virtual machines: https://docs.microsoft.com/azure/security-center/built-in-vulnerability-assessment SQL vulnerability assessment: https://docs.microsoft.com/azure/azure-sql/database/sql-vulnerability-assessment Exporting Microsoft Defender for Cloud vulnerability scan results: https://docs.microsoft.com/azure/security-center/built-in-vulnerability-assessment#exporting-results

n/a

CIS_Azure_1.3.0

4.2.2

CIS_Azure_1.3.0_4.2.2

CIS Microsoft Azure Foundations Benchmark recommendation 4.2.2

4 Database Services

Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account

Shared

The customer is responsible for implementing this recommendation.

Enable Vulnerability Assessment (VA) service scans for critical SQL servers and corresponding SQL databases.

CIS_Azure_1.4.0

4.2.2

CIS_Azure_1.4.0_4.2.2

CIS Microsoft Azure Foundations Benchmark recommendation 4.2.2

4 Database Services

Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account

Shared

The customer is responsible for implementing this recommendation.

Enable Vulnerability Assessment (VA) service scans for critical SQL servers and corresponding SQL databases.

CMMC_2.0_L2

RA.L2-3.11.2

CMMC_2.0_L2_RA.L2-3.11.2

404 not found

n/a

CMMC_2.0_L2

RA.L2-3.11.3

CMMC_2.0_L2_RA.L2-3.11.3

404 not found

n/a

CA.2.158

CMMC_L3_CA.2.158

CMMC L3 CA.2.158

Security Assessment

Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Organizations assess security controls in organizational systems and the environments in which those systems operate as part of the system development life cycle. Security controls are the safeguards or countermeasures organizations implement to satisfy security requirements. By assessing the implemented security controls, organizations determine if the security safeguards or countermeasures are in place and operating as intended. Security control assessments ensure that information security is built into organizational systems; identify weaknesses and deficiencies early in the development process; provide essential information needed to make risk-based decisions; and ensure compliance to vulnerability mitigation procedures. Assessments are conducted on the implemented security controls as documented in system security plans. Security assessment reports document assessment results in sufficient detail as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security requirements. Security assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. Organizations ensure that security assessment results are current, relevant to the determination of security control effectiveness, and obtained with the appropriate level of assessor independence. Organizations can choose to use other types of assessment activities such as vulnerability scanning and system monitoring to maintain the security posture of systems during the system life cycle.

CA.3.161

CMMC_L3_CA.3.161

CMMC L3 CA.3.161

Security Assessment

Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Continuous monitoring programs facilitate ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions. The terms continuous and ongoing imply that organizations assess and analyze security controls and information security-related risks at a frequency sufficient to support risk-based decisions. The results of continuous monitoring programs generate appropriate risk response actions by organizations. Providing access to security information on a continuing basis through reports or dashboards gives organizational officials the capability to make effective and timely risk management decisions. Automation supports more frequent updates to hardware, software, firmware inventories, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Monitoring requirements, including the need for specific monitoring, may also be referenced in other requirements.

RM.2.141

CMMC_L3_RM.2.141

CMMC L3 RM.2.141

Risk Assessment

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Clearly defined system boundaries are a prerequisite for effective risk assessments. Such risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations, organizational assets, and individuals based on the operation and use of organizational systems. Risk assessments also consider risk from external parties (e.g., service providers, contractors operating systems on behalf of the organization, individuals accessing organizational systems, outsourcing entities). Risk assessments, either formal or informal, can be conducted at the organization level, the mission or business process level, or the system level, and at any phase in the system development life cycle.

RM.2.142

CMMC_L3_RM.2.142

CMMC L3 RM.2.142

Risk Assessment

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Organizations determine the required vulnerability scanning for all system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. The vulnerabilities to be scanned are readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This process ensures that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in source code reviews and in a variety of tools (e.g., static analysis tools, web-based application scanners, binary analyzers) and in source code reviews. Vulnerability scanning includes: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms. To facilitate interoperability, organizations consider using products that are Security Content Automated Protocol (SCAP)-validated, scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention, and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of system vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Security assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). In certain situations, the nature of the vulnerability scanning may be more intrusive or the system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates thorough vulnerability scanning and protects the sensitive nature of such scanning.

RM.2.143

CMMC_L3_RM.2.143

CMMC L3 RM.2.143

Risk Assessment

Remediate vulnerabilities in accordance with risk assessments.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Vulnerabilities discovered, for example, via the scanning conducted in response to RM.2.142, are remediated with consideration of the related assessment of risk. The consideration of risk influences the prioritization of remediation efforts and the level of effort to be expended in the remediation for specific vulnerabilities.

FedRAMP_High_R4

RA-5

FedRAMP_High_R4_RA-5

FedRAMP High RA-5

Risk Assessment

Vulnerability Scanning

Shared

n/a

The organization: a. Scans for vulnerabilities in the information system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1. Enumerating platforms, software flaws, and improper configurations; 2. Formatting checklists and test procedures; and 3. Measuring vulnerability impact; c. Analyzes vulnerability scan reports and results from security control assessments; d. Remediates legitimate vulnerabilities [Assignment: organization-defined response times], in accordance with an organizational assessment of risk; and e. Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies). Supplemental Guidance: Security categorization of information systems guides the frequency and comprehensiveness of vulnerability scans. Organizations determine the required vulnerability scanning for all information system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in a variety of tools (e.g., web-based application scanners, static analysis tools, binary analyzers) and in source code reviews. Vulnerability scanning includes, for example: (i) scanning for patch levels; (ii) scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and (iii) scanning for improperly configured or incorrectly operating information flow control mechanisms. Organizations consider using tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine/test for the presence of vulnerabilities. Suggested sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). In addition, security control assessments such as red team exercises provide other sources of potential vulnerabilities for which to scan. Organizations also consider using tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). Related controls: CA-2, CA-7, CM-4, CM-6, RA-2, RA-3, SA-11, SI-2. References: NIST Special Publications 800-40, 800-70, 800-115; Web: http://cwe.mitre.org, http://nvd.nist.gov.

FedRAMP_Moderate_R4

RA-5

FedRAMP_Moderate_R4_RA-5

FedRAMP Moderate RA-5

Risk Assessment

Vulnerability Scanning

Shared

n/a

hipaa-0709.10m1Organizational.1-10.m

hipaa

0709.10m1Organizational.1-10.m

0709.10m1Organizational.1-10.m

07 Vulnerability Management

0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management

Shared

n/a

Technical vulnerabilities are identified, evaluated for risk, and corrected in a timely manner.

hipaa

0710.10m2Organizational.1-10.m

hipaa-0710.10m2Organizational.1-10.m

0710.10m2Organizational.1-10.m

07 Vulnerability Management

0710.10m2Organizational.1-10.m 10.06 Technical Vulnerability Management

Shared

n/a

A hardened configuration standard exists for all system and network components.

hipaa

0719.10m3Organizational.5-10.m

hipaa-0719.10m3Organizational.5-10.m

0719.10m3Organizational.5-10.m

07 Vulnerability Management

0719.10m3Organizational.5-10.m 10.06 Technical Vulnerability Management

Shared

n/a

The organization updates the list of information system vulnerabilities scanned within every 30 days or when new vulnerabilities are identified and reported.

NIST_SP_800-171_R2_3

.11.2

NIST_SP_800-171_R2_3.11.2

NIST SP 800-171 R2 3.11.2

Risk Assessment

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

NIST_SP_800-171_R2_3.11.3

NIST_SP_800-171_R2_3

.11.3

NIST SP 800-171 R2 3.11.3

Risk Assessment

Remediate vulnerabilities in accordance with risk assessments.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Vulnerabilities discovered, for example, via the scanning conducted in response to 3.11.2, are remediated with consideration of the related assessment of risk. The consideration of risk influences the prioritization of remediation efforts and the level of effort to be expended in the remediation for specific vulnerabilities.

NIST_SP_800-53_R4

RA-5

NIST_SP_800-53_R4_RA-5

NIST SP 800-53 Rev. 4 RA-5

Risk Assessment

Vulnerability Scanning

Shared

n/a

NIST_SP_800-53_R5

RA-5

NIST_SP_800-53_R5_RA-5

NIST SP 800-53 Rev. 5 RA-5

Risk Assessment

Vulnerability Monitoring and Scanning

Shared

n/a

a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1. Enumerating platforms, software flaws, and improper configurations; 2. Formatting checklists and test procedures; and 3. Measuring vulnerability impact; c. Analyze vulnerability scan reports and results from vulnerability monitoring; d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk; e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.

NZ_ISM_v3.5

ISM-3

NZ_ISM_v3.5_ISM-3

NZISM Security Benchmark ISM-3

Information security monitoring

6.2.5 Conducting vulnerability assessments

Customer

n/a

A baseline or known point of origin is the basis of any comparison and allows measurement of changes and improvements when further information security monitoring activities are conducted.

NZISM_Security_Benchmark_v1.1

ISM-3

NZISM_Security_Benchmark_v1.1_ISM-3

NZISM Security Benchmark ISM-3

Information security monitoring

6.2.5 Conducting vulnerability assessments

Customer

Agencies should conduct vulnerability assessments on systems: - before the system is deployed, including conducting assessments during the system design and development stages - after a significant change to the system - after significant changes to the threats or risks faced by a system; for example, a software vendor announces a critical vulnerability in a product used by the agency at least annually, or as specified by an ITSM or the system owner.

A baseline or known point of origin is the basis of any comparison and allows measurement of changes and improvements when further information security monitoring activities are conducted.

13.2

RBI_CSF_Banks_v2016_13.2

Advanced Real-Timethreat Defenceand Management

Advanced Real-Timethreat Defenceand Management-13.2

n/a

Implement Anti-malware, Antivirus protection including behavioural detection systems for all categories of devices ???(Endpoints such as PCs/laptops/ mobile devices etc.), servers (operating systems, databases, applications, etc.), Web/Internet gateways, email-gateways, Wireless networks, SMS servers etc. including tools and processes for centralised management and monitoring.

13.4

RBI_CSF_Banks_v2016_13.4

Advanced Real-Timethreat Defenceand Management

Advanced Real-Timethreat Defenceand Management-13.4

n/a

Consider implementingsecure web gateways with capability to deep scan network packets including secure (HTTPS, etc.) traffic passing through the web/internet gateway

18.1

RBI_CSF_Banks_v2016_18.1

Vulnerability Assessment And Penetration Test And Red Team Exercises

Vulnerability Assessment And Penetration Test And Red Team Exercises-18.1

n/a

Periodically conduct vulnerability assessment and penetration testing exercises for all the critical systems, particularly those facing the internet.

18.2

RBI_CSF_Banks_v2016_18.2

Vulnerability Assessment And Penetration Test And Red Team Exercises

Vulnerability Assessment And Penetration Test And Red Team Exercises-18.2

n/a

The vulnerabilities detected are to be remedied promptly in terms of the bank???s risk management/treatment framework so asto avoid exploitation of such vulnerabilities.

20.1

RBI_CSF_Banks_v2016_20.1

Risk Based Transaction Monitoring

Risk Based Transaction Monitoring-20.1

n/a

Risk based transaction monitoring or surveillance process shall be implemented as part of fraud risk management system across all -delivery channels.

7.1

RBI_CSF_Banks_v2016_7.1

Patch/Vulnerability & Change Management

Patch/Vulnerability & Change Management-7.1

n/a

Follow a documented risk-based strategy for inventorying IT components that need to be patched, identification of patches and applying patches so as to minimize the number of vulnerable systems and the time window of vulnerability/exposure.

7.2

RBI_CSF_Banks_v2016_7.2

Patch/Vulnerability & Change Management

Patch/Vulnerability & Change Management-7.2

n/a

Put in place systems and processes to identify, track, manage and monitor the status of patches to operating system and application software running at end-user devices directly connected to the internet and in respect of Server operating Systems/Databases/Applications/ Middleware, etc.

RBI_ITF_NBFC_v2017

RBI_ITF_NBFC_v2017_1

RBI IT Framework 1

IT Governance

IT Governance-1

n/a

IT Governance is an integral part of corporate governance. It involves leadership support, organizational structure and processes to ensure that the NBFC???s IT sustains and extends business strategies and objectives. Effective IT Governance is the responsibility of the Board of Directors and Executive Management. Well-defined roles and responsibilities of Board and Senior Management are critical, while implementing IT Governance. Clearly-defined roles enable effective project control. People, when they are aware of others' expectations from them, are able to complete work on time, within budget and to the expected level of quality. IT Governance Stakeholders include: Board of Directors, IT Strategy Committees, CEOs, Business Executives, Chief Information Officers (CIOs), Chief Technology Officers (CTOs), IT Steering Committees (operating at an executive level and focusing on priority setting, resource allocation and project tracking), Chief Risk Officer and Risk Committees. The basic principles of value delivery, IT Risk Management, IT resource management and performance management must form the basis of governance framework. IT Governance has a continuous life-cycle. It's a process in which IT strategy drives the processes, using resources necessary to execute responsibilities. Given the criticality of the IT, NBFCs may follow relevant aspects of such prudential governance standards that have found acceptability in the finance industry.

RBI_ITF_NBFC_v2017

3.3

RBI_ITF_NBFC_v2017_3.3

RBI IT Framework 3.3

Information and Cyber Security

Vulnerability Management-3.3

n/a

A vulnerability can be defined as an inherent configuration flaw in an organization???s information technology base, whether hardware or software, which can be exploited by a third party to gather sensitive information regarding the organization. Vulnerability management is an ongoing process to determine the process of eliminating or mitigating vulnerabilities based upon the risk and cost associated with the vulnerabilities. NBFCs may devise a strategy for managing and eliminating vulnerabilities and such strategy may clearly be communicated in the Cyber Security policy

RMiT_v1.0

11.8

RMiT_v1.0_11.8

RMiT 11.8

Cybersecurity Operations

Cybersecurity Operations - 11.8

Shared

n/a

A financial institution must ensure that its cybersecurity operations continuously prevent and detect any potential compromise of its security controls or weakening of its security posture. For large financial institutions, this must include performing a quarterly vulnerability assessment of external and internal network components that support all critical systems.

SOC_2

CC3.2

SOC_2_CC3.2

SOC 2 Type 2 CC3.2

Risk Assessment

COSO Principle 7

Shared

The customer is responsible for implementing this recommendation.

Points of focus specified in the COSO framework: • Includes Entity, Subsidiary, Division, Operating Unit, and Functional Levels — The entity identifies and assesses risk at the entity, subsidiary, division, operating unit, and functional levels relevant to the achievement of objectives. • Analyzes Internal and External Factors — Risk identification considers both internal and external factors and their impact on the achievement of objectives. • Involves Appropriate Levels of Management — The entity puts into place effective risk assessment mechanisms that involve appropriate levels of management. • Estimates Significance of Risks Identified — Identified risks are analyzed through a process that includes estimating the potential significance of the risk. • Determines How to Respond to Risks — Risk assessment includes considering how the risk should be managed and whether to accept, avoid, reduce, or share the risk. Additional points of focus specifically related to all engagements using the trust services criteria: • Identifies and Assesses Criticality of Information Assets and Identifies Threats and Vulnerabilities — The entity's risk identification and assessment process includes (1) identifying information assets, including physical devices and systems, virtual devices, software, data and data flows, external information systems, and organizational roles; (2) assessing the criticality of those information assets; (3) identifying the threats to the assets from intentional (including malicious) and unintentional acts and environmental events; and (4) identifying the vulnerabilities of the identified assets. • Analyzes Threats and Vulnerabilities From Vendors, Business Partners, and Other Parties — The entity's risk assessment process includes the analysis of potential threats and vulnerabilities arising from vendors providing goods and services, as well as threats and vulnerabilities arising from business partners, customers, and others with access to the entity's information systems. • Considers the Significance of the Risk — The entity’s consideration of the potential significance of the identified risks includes (1) determining the criticality of identified assets in meeting objectives; (2) assessing the impact of identified threats and vulnerabilities in meeting objectives; (3) assessing the likelihood of identified threats; and (4) determining the risk associated with assets based on asset criticality, threat impact, and likelihood.

SOC_2

CC7.1

SOC_2_CC7.1

SOC 2 Type 2 CC7.1

System Operations

Detection and monitoring of new vulnerabilities

Shared

The customer is responsible for implementing this recommendation.

• Uses Defined Configuration Standards — Management has defined configuration standards. • Monitors Infrastructure and Software — The entity monitors infrastructure and software for noncompliance with the standards, which could threaten the achievement of the entity's objectives. • Implements Change-Detection Mechanisms — The IT system includes a changedetection mechanism (for example, file integrity monitoring tools) to alert personnel to unauthorized modifications of critical system files, configuration files, or content files. • Detects Unknown or Unauthorized Components — Procedures are in place to detect the introduction of unknown or unauthorized components. • Conducts Vulnerability Scans — The entity conducts vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after any significant change in the environment and takes action to remediate identified deficiencies on a timely basis

SWIFT_CSCF_v2021

2.7

SWIFT_CSCF_v2021_2.7

SWIFT CSCF v2021 2.7

Reduce Attack Surface and Vulnerabilities

Vulnerability Scanning

n/a

Identify known vulnerabilities within the local SWIFT environment by implementing a regular vulnerability scanning process and act upon results.

UK_NCSC_CSP

5.2

UK_NCSC_CSP_5.2

UK NCSC CSP 5.2

Operational security

Vulnerability management

Shared

n/a

Service providers should have a management processes in place to identify, triage and mitigate vulnerabilities. Services which don’t, will quickly become vulnerable to attack using publicly known methods and tools.