compliance controls are associated with this Policy definition '[Preview]: Secure Boot should be enabled on supported Windows virtual machines' (97566dd7-78ae-4997-8b36-1c7bfe0d8121)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| Azure_Security_Benchmark_v3.0 |
PV-4 |
Azure_Security_Benchmark_v3.0_PV-4 |
Microsoft cloud security benchmark PV-4 |
Posture and Vulnerability Management |
Audit and enforce secure configurations for compute resources |
Shared |
**Security Principle:**
Continuously monitor and alert when there is a deviation from the defined configuration baseline in your compute resources. Enforce the desired configuration according to the baseline configuration by denying the non-compliant configuration or deploy a configuration in compute resources.
**Azure Guidance:**
Use Microsoft Defender for Cloud and Azure Policy guest configuration agent to regularly assess and remediate configuration deviations on your Azure compute resources, including VMs, containers, and others. In addition, you can use Azure Resource Manager templates, custom operating system images, or Azure Automation State Configuration to maintain the security configuration of the operating system. Microsoft VM templates in conjunction with Azure Automation State Configuration can assist in meeting and maintaining security requirements.
Note: Azure Marketplace VM images published by Microsoft are managed and maintained by Microsoft.
**Implementation and additional context:**
How to implement Microsoft Defender for Cloud vulnerability assessment recommendations:
https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations
How to create an Azure virtual machine from an ARM template:
https://docs.microsoft.com/azure/virtual-machines/windows/ps-template
Azure Automation State Configuration overview:
https://docs.microsoft.com/azure/automation/automation-dsc-overview
Create a Windows virtual machine in the Azure portal:
https://docs.microsoft.com/azure/virtual-machines/windows/quick-create-portal
Container security in Microsoft Defender for Cloud:
https://docs.microsoft.com/azure/security-center/container-security |
n/a |
link |
13 |
| Canada_Federal_PBMM_3-1-2020 |
AC_2(4) |
Canada_Federal_PBMM_3-1-2020_AC_2(4) |
Canada Federal PBMM 3-1-2020 AC 2(4) |
Account Management |
Account Management | Automated Audit Actions |
Shared |
1. The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies responsible managers.
2. Related controls: AU-2, AU-12. |
To ensure accountability and transparency within the information system. |
|
52 |
| CIS_Azure_Foundations_v2.1.0 |
7.9 |
CIS_Azure_Foundations_v2.1.0_7.9 |
CIS Azure Foundations v2.1.0 7.9 |
Virtual Machines |
Ensure Trusted Launch is enabled on Virtual Machines |
Shared |
n/a |
Ensure Trusted Launch is enabled on Virtual Machines. |
|
2 |
| CIS_Controls_v8.1 |
4.1 |
CIS_Controls_v8.1_4.1 |
CIS Controls v8.1 4.1 |
Secure Configuration of Enterprise Assets and Software |
Establish and maintain a secure configuration process. |
Shared |
1. Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile; non-computing/IoT devices; and servers) and software (operating systems and applications).
2. Review and update documentation annually, or when significant enterprise changes occur that could impact this safeguard. |
To ensure data integrity and safety of enterprise assets. |
|
44 |
| CSA_v4.0.12 |
CEK_03 |
CSA_v4.0.12_CEK_03 |
CSA Cloud Controls Matrix v4.0.12 CEK 03 |
Cryptography, Encryption & Key Management |
Data Encryption |
Shared |
n/a |
Provide cryptographic protection to data at-rest and in-transit,
using cryptographic libraries certified to approved standards. |
|
58 |
| CSA_v4.0.12 |
IVS_07 |
CSA_v4.0.12_IVS_07 |
CSA Cloud Controls Matrix v4.0.12 IVS 07 |
Infrastructure & Virtualization Security |
Migration to Cloud Environments |
Shared |
n/a |
Use secure and encrypted communication channels when migrating servers,
services, applications, or data to cloud environments. Such channels must include
only up-to-date and approved protocols. |
|
8 |
| CSA_v4.0.12 |
TVM_07 |
CSA_v4.0.12_TVM_07 |
CSA Cloud Controls Matrix v4.0.12 TVM 07 |
Threat & Vulnerability Management |
Vulnerability Identification |
Shared |
n/a |
Define, implement and evaluate processes, procedures and technical
measures for the detection of vulnerabilities on organizationally managed assets
at least monthly. |
|
8 |
| Cyber_Essentials_v3.1 |
2 |
Cyber_Essentials_v3.1_2 |
Cyber Essentials v3.1 2 |
Cyber Essentials |
Secure Configuration |
Shared |
n/a |
Aim: ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfill their role. |
|
61 |
| Cyber_Essentials_v3.1 |
5 |
Cyber_Essentials_v3.1_5 |
Cyber Essentials v3.1 5 |
Cyber Essentials |
Malware protection |
Shared |
n/a |
Aim: to restrict execution of known malware and untrusted software, from causing damage or accessing data. |
|
60 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_11 |
EU_2555_(NIS2)_2022_11 |
EU 2022/2555 (NIS2) 2022 11 |
|
Requirements, technical capabilities and tasks of CSIRTs |
Shared |
n/a |
Outlines the requirements, technical capabilities, and tasks of CSIRTs. |
|
68 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_12 |
EU_2555_(NIS2)_2022_12 |
EU 2022/2555 (NIS2) 2022 12 |
|
Coordinated vulnerability disclosure and a European vulnerability database |
Shared |
n/a |
Establishes a coordinated vulnerability disclosure process and a European vulnerability database. |
|
66 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_21 |
EU_2555_(NIS2)_2022_21 |
EU 2022/2555 (NIS2) 2022 21 |
|
Cybersecurity risk-management measures |
Shared |
n/a |
Requires essential and important entities to take appropriate measures to manage cybersecurity risks. |
|
193 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_29 |
EU_2555_(NIS2)_2022_29 |
EU 2022/2555 (NIS2) 2022 29 |
|
Cybersecurity information-sharing arrangements |
Shared |
n/a |
Allows entities to exchange relevant cybersecurity information on a voluntary basis. |
|
66 |
| EU_GDPR_2016_679_Art. |
24 |
EU_GDPR_2016_679_Art._24 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 24 |
Chapter 4 - Controller and processor |
Responsibility of the controller |
Shared |
n/a |
n/a |
|
310 |
| EU_GDPR_2016_679_Art. |
25 |
EU_GDPR_2016_679_Art._25 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 25 |
Chapter 4 - Controller and processor |
Data protection by design and by default |
Shared |
n/a |
n/a |
|
310 |
| EU_GDPR_2016_679_Art. |
28 |
EU_GDPR_2016_679_Art._28 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 28 |
Chapter 4 - Controller and processor |
Processor |
Shared |
n/a |
n/a |
|
310 |
| EU_GDPR_2016_679_Art. |
32 |
EU_GDPR_2016_679_Art._32 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 32 |
Chapter 4 - Controller and processor |
Security of processing |
Shared |
n/a |
n/a |
|
310 |
| FBI_Criminal_Justice_Information_Services_v5.9.5_5 |
.11 |
FBI_Criminal_Justice_Information_Services_v5.9.5_5.11 |
FBI Criminal Justice Information Services (CJIS) v5.9.5 5.11 |
Policy and Implementation - Formal Audits |
Policy Area 11: Formal Audits |
Shared |
Internal compliance checklists should be regularly kept updated with respect to applicable statutes, regulations, policies and on the basis of findings in audit. |
Formal audits are conducted to ensure compliance with applicable statutes, regulations and policies. |
|
64 |
| FBI_Criminal_Justice_Information_Services_v5.9.5_5 |
.7 |
FBI_Criminal_Justice_Information_Services_v5.9.5_5.7 |
404 not found |
|
|
|
n/a |
n/a |
|
95 |
| HITRUST_CSF_v11.3 |
01.c |
HITRUST_CSF_v11.3_01.c |
HITRUST CSF v11.3 01.c |
Authorized Access to Information Systems |
Control privileged access to information systems and services. |
Shared |
1. Privileged role assignments to be automatically tracked and monitored.
2. Role-based access controls to be implemented and should be capable of mapping each user to one or more roles, and each role to one or more system functions.
3. Critical security functions to be executable only after granting of explicit authorization. |
The allocation and use of privileges to information systems and services shall be restricted and controlled. Special attention shall be given to the allocation of privileged access rights, which allow users to override system controls. |
|
44 |
| HITRUST_CSF_v11.3 |
09.aa |
HITRUST_CSF_v11.3_09.aa |
HITRUST CSF v11.3 09.aa |
Monitoring |
Ensure information security events are monitored and recorded to detect unauthorized information processing activities in compliance with all relevant legal requirements. |
Shared |
1. Retention policies for audit logs are to be specified and the audit logs are to be retained accordingly.
2. A secure audit record is to be created each time a user accesses, creates, updates, or deletes covered and/or confidential information via the system.
3. Audit logs are to be maintained for account management activities, security policy changes, configuration changes, modification to sensitive information, read access to sensitive information, and printing of sensitive information. |
Audit logs recording user activities, exceptions, and information security events shall be produced and kept for an agreed period to assist in future investigations and access control monitoring. |
|
39 |
| HITRUST_CSF_v11.3 |
10.c |
HITRUST_CSF_v11.3_10.c |
HITRUST CSF v11.3 10.c |
Correct Processing in Applications |
Incorporate validation checks into applications to detect any corruption of information through processing errors or deliberate acts. |
Shared |
Data integrity controls which manage changes, prevent sequencing errors, ensure recovery from failures, and protect against buffer overrun attacks are to be implemented. |
Validation checks shall be incorporated into applications to detect any corruption of information through processing errors or deliberate acts. |
|
35 |
| NIS2 |
PV._Posture_and_Vulnerability_Management_5 |
NIS2_PV._Posture_and_Vulnerability_Management_5 |
NIS2_PV._Posture_and_Vulnerability_Management_5 |
PV. Posture and Vulnerability Management |
Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure |
|
n/a |
missing value |
|
47 |
| NIST_CSF_v2.0 |
PR.DS |
NIST_CSF_v2.0_PR.DS |
404 not found |
|
|
|
n/a |
n/a |
|
1 |
| NIST_SP_800-53_R5.1.1 |
SI.7 |
NIST_SP_800-53_R5.1.1_SI.7 |
NIST SP 800-53 R5.1.1 SI.7 |
System and Information Integrity Control |
Software, Firmware, and Information Integrity |
Shared |
a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and
b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions]. |
Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications. |
|
7 |
| NIST_SP_800-53_R5.1.1 |
SI.7.9 |
NIST_SP_800-53_R5.1.1_SI.7.9 |
NIST SP 800-53 R5.1.1 SI.7.9 |
System and Information Integrity Control |
Software, Firmware, and Information Integrity | Verify Boot Process |
Shared |
Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components]. |
Ensuring the integrity of boot processes is critical to starting system components in known, trustworthy states. Integrity verification mechanisms provide a level of assurance that only trusted code is executed during boot processes. |
|
1 |
| NZISM_v3.7 |
16.3.6.C.01. |
NZISM_v3.7_16.3.6.C.01. |
NZISM v3.7 16.3.6.C.01. |
Privileged User Access |
16.3.6.C.01. - safeguard sensitive national data. |
Shared |
n/a |
Agencies MUST NOT allow foreign nationals, including seconded foreign nationals, to have privileged access to systems that process, store or communicate NZEO information. |
|
2 |
| NZISM_v3.7 |
16.4.32.C.02. |
NZISM_v3.7_16.4.32.C.02. |
NZISM v3.7 16.4.32.C.02. |
Privileged Access Management |
16.4.32.C.02. - enhance security and reduce the risk of unauthorized access or misuse. |
Shared |
n/a |
Privileged Access credentials MUST NOT be issued until approval has been formally granted. |
|
20 |
| NZISM_v3.7 |
16.6.10.C.01. |
NZISM_v3.7_16.6.10.C.01. |
NZISM v3.7 16.6.10.C.01. |
Event Logging and Auditing |
16.6.10.C.01. - enhance system security and accountability. |
Shared |
n/a |
Agencies SHOULD log the events listed in the table below for specific software components.
1. Database -
a. System user access to the database.
b. Attempted access that is denied
c. Changes to system user roles or database rights.
d. Addition of new system users, especially privileged users
e. Modifications to the data.
f. Modifications to the format or structure of the database
2. Network/operating system
a. Successful and failed attempts to logon and logoff.
b. Changes to system administrator and system user accounts.
c. Failed attempts to access data and system resources.
d. Attempts to use special privileges.
e. Use of special privileges.
f. System user or group management.
g. Changes to the security policy.
h. Service failures and restarts.
i.System startup and shutdown.
j. Changes to system configuration data.
k. Access to sensitive data and processes.
l. Data import/export operations.
3. Web application
a. System user access to the Web application.
b. Attempted access that is denied.
c. System user access to the Web documents.
d. Search engine queries initiated by system users. |
|
33 |
| NZISM_v3.7 |
16.6.10.C.02. |
NZISM_v3.7_16.6.10.C.02. |
NZISM v3.7 16.6.10.C.02. |
Event Logging and Auditing |
16.6.10.C.02. - enhance system security and accountability. |
Shared |
n/a |
Agencies SHOULD log, at minimum, the following events for all software components:
1. user login;
2. all privileged operations;
3. failed attempts to elevate privileges;
4. security related system alerts and failures;
5. system user and group additions, deletions and modification to permissions; and
6. unauthorised or failed access attempts to systems and files identified as critical to the agency. |
|
50 |
| NZISM_v3.7 |
16.6.11.C.01. |
NZISM_v3.7_16.6.11.C.01. |
NZISM v3.7 16.6.11.C.01. |
Event Logging and Auditing |
16.6.11.C.01. - enhance system security and accountability. |
Shared |
n/a |
For each event identified as needing to be logged, agencies MUST ensure that the log facility records at least the following details, where applicable:
1. date and time of the event;
2. relevant system user(s) or processes;
3. event description;
4. success or failure of the event;
5. event source (e.g. application name); and
6. IT equipment location/identification. |
|
50 |
| NZISM_v3.7 |
16.6.12.C.01. |
NZISM_v3.7_16.6.12.C.01. |
NZISM v3.7 16.6.12.C.01. |
Event Logging and Auditing |
16.6.12.C.01. - maintain integrity of the data. |
Shared |
n/a |
Event logs MUST be protected from:
1. modification and unauthorised access; and
2. whole or partial loss within the defined retention period. |
|
50 |
| NZISM_v3.7 |
16.6.6.C.01. |
NZISM_v3.7_16.6.6.C.01. |
NZISM v3.7 16.6.6.C.01. |
Event Logging and Auditing |
16.6.6.C.01. - enhance security and reduce the risk of unauthorized access or misuse. |
Shared |
n/a |
Agencies MUST maintain system management logs for the life of a system. |
|
50 |
| NZISM_v3.7 |
16.6.7.C.01. |
NZISM_v3.7_16.6.7.C.01. |
NZISM v3.7 16.6.7.C.01. |
Event Logging and Auditing |
16.6.7.C.01. - facilitate effective monitoring, troubleshooting, and auditability of system operations. |
Shared |
n/a |
A system management log SHOULD record the following minimum information:
1. all system start-up and shutdown;
2. service, application, component or system failures;
3. maintenance activities;
4. backup and archival activities;
5. system recovery activities; and
6. special or out of hours activities. |
|
50 |
| NZISM_v3.7 |
16.6.9.C.01. |
NZISM_v3.7_16.6.9.C.01. |
NZISM v3.7 16.6.9.C.01. |
Event Logging and Auditing |
16.6.9.C.01. - enhance system security and accountability. |
Shared |
n/a |
Agencies MUST log, at minimum, the following events for all software components:
1. logons;
2. failed logon attempts;
3. logoffs;
4 .date and time;
5. all privileged operations;
6. failed attempts to elevate privileges;
7. security related system alerts and failures;
8. system user and group additions, deletions and modification to permissions; and
9. unauthorised or failed access attempts to systems and files identified as critical to the agency. |
|
48 |
| NZISM_v3.7 |
2.3.26.C.01. |
NZISM_v3.7_2.3.26.C.01. |
NZISM v3.7 2.3.26.C.01. |
Using Cloud Services |
2.3.26.C.01. - enhance security measures and minimise trust assumptions in cloud environments. |
Shared |
n/a |
Agencies intending to adopt public cloud technologies or services SHOULD incorporate Zero Trust philosophies and concepts. |
|
4 |
| PCI_DSS_v4.0.1 |
10.3.4 |
PCI_DSS_v4.0.1_10.3.4 |
PCI DSS v4.0.1 10.3.4 |
Log and Monitor All Access to System Components and Cardholder Data |
Log Integrity Monitoring |
Shared |
n/a |
File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts. |
|
28 |
| PCI_DSS_v4.0.1 |
11.5.2 |
PCI_DSS_v4.0.1_11.5.2 |
PCI DSS v4.0.1 11.5.2 |
Test Security of Systems and Networks Regularly |
Change-Detection Mechanism Deployment |
Shared |
n/a |
A change-detection mechanism (for example, file integrity monitoring tools) is deployed as follows:
• To alert personnel to unauthorized modification (including changes, additions, and deletions) of critical files.
• To perform critical file comparisons at least once weekly. |
|
31 |
| RBI_CSF_Banks_v2016 |
13.1 |
RBI_CSF_Banks_v2016_13.1 |
|
Advanced Real-Timethreat Defenceand Management |
Advanced Real-Timethreat Defenceand Management-13.1 |
|
n/a |
Build a robust defence against the installation, spread, and execution of malicious code at multiple points in the enterprise. |
|
21 |
| RBI_ITF_NBFC_v2017 |
3.1.b |
RBI_ITF_NBFC_v2017_3.1.b |
RBI IT Framework 3.1.b |
Information and Cyber Security |
Segregation of Functions-3.1 |
|
n/a |
The IS Policy must provide for a IS framework with the following basic tenets:
Segregation of functions: There should be segregation of the duties of the Security Officer/Group (both physical security as well as cyber security) dealing exclusively with information systems security and the Information Technology division which actually implements the computer systems. The information security function should be adequately resourced in terms of the number of staff, level of skill and tools or techniques like risk assessment, security architecture, vulnerability assessment, forensic assessment, etc. Further, there should be a clear segregation of responsibilities relating to system administration, database administration and transaction processing. |
link |
6 |
| SOC_2 |
CC6.8 |
SOC_2_CC6.8 |
SOC 2 Type 2 CC6.8 |
Logical and Physical Access Controls |
Prevent or detect against unauthorized or malicious software |
Shared |
The customer is responsible for implementing this recommendation. |
Restricts Application and Software Installation — The ability to install applications
and software is restricted to authorized individuals.
• Detects Unauthorized Changes to Software and Configuration Parameters — Processes are in place to detect changes to software and configuration parameters that
may be indicative of unauthorized or malicious software.
• Uses a Defined Change Control Process — A management-defined change control
process is used for the implementation of software.
• Uses Antivirus and Anti-Malware Software — Antivirus and anti-malware software
is implemented and maintained to provide for the interception or detection and remediation of malware.
• Scans Information Assets from Outside the Entity for Malware and Other Unauthorized Software — Procedures are in place to scan information assets that have been
transferred or returned to the entity’s custody for malware and other unauthorized
software and to remove any items detected prior to its implementation on the network. |
|
47 |
| SOC_2 |
CC8.1 |
SOC_2_CC8.1 |
SOC 2 Type 2 CC8.1 |
Change Management |
Changes to infrastructure, data, and software |
Shared |
The customer is responsible for implementing this recommendation. |
Manages Changes Throughout the System Life Cycle — A process for managing
system changes throughout the life cycle of the system and its components (infrastructure, data, software, and procedures) is used to support system availability and
processing integrity.
• Authorizes Changes — A process is in place to authorize system changes prior to
development.
• Designs and Develops Changes — A process is in place to design and develop system changes.
• Documents Changes — A process is in place to document system changes to support ongoing maintenance of the system and to support system users in performing
their responsibilities.
• Tracks System Changes — A process is in place to track system changes prior to
implementation.
• Configures Software — A process is in place to select and implement the configuration parameters used to control the functionality of software.
• Tests System Changes — A process is in place to test system changes prior to implementation.
• Approves System Changes — A process is in place to approve system changes prior
to implementation.
• Deploys System Changes — A process is in place to implement system changes.
• Identifies and Evaluates System Changes — Objectives affected by system changes
are identified and the ability of the modified system to meet the objectives is evaluated throughout the system development life cycle.
• Identifies Changes in Infrastructure, Data, Software, and Procedures Required to
Remediate Incidents — Changes in infrastructure, data, software, and procedures
required to remediate incidents to continue to meet objectives are identified and the
change process is initiated upon identification.
• Creates Baseline Configuration of IT Technology — A baseline configuration of IT
and control systems is created and maintained.
• Provides for Changes Necessary in Emergency Situations — A process is in place
for authorizing, designing, testing, approving, and implementing changes necessary
in emergency situations (that is, changes that need to be implemented in an urgent
time frame).
Additional points of focus that apply only in an engagement using the trust services criteria for
confidentiality:
• Protects Confidential Information — The entity protects confidential information
during system design, development, testing, implementation, and change processes
to meet the entity’s objectives related to confidentiality.
Additional points of focus that apply only in an engagement using the trust services criteria for
privacy:
• Protects Personal Information — The entity protects personal information during
system design, development, testing, implementation, and change processes to meet
the entity’s objectives related to privacy. |
|
52 |
| SOC_2023 |
CC.5.3 |
SOC_2023_CC.5.3 |
404 not found |
|
|
|
n/a |
n/a |
|
37 |
| SOC_2023 |
CC4.1 |
SOC_2023_CC4.1 |
SOC 2023 CC4.1 |
Monitoring Activities |
Enhance the ability to manage risks and achieve objectives. |
Shared |
n/a |
The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
|
38 |
| SOC_2023 |
CC4.2 |
SOC_2023_CC4.2 |
SOC 2023 CC4.2 |
Monitoring Activities |
Facilitate timely corrective actions and strengthen the ability to maintain effective control over its operations and achieve its objectives. |
Shared |
n/a |
The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors. |
|
37 |
| SOC_2023 |
CC7.2 |
SOC_2023_CC7.2 |
SOC 2023 CC7.2 |
Systems Operations |
Maintain robust security measures and ensure operational resilience. |
Shared |
n/a |
The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events. |
|
167 |
| SWIFT_CSCF_2024 |
2.1 |
SWIFT_CSCF_2024_2.1 |
SWIFT Customer Security Controls Framework 2024 2.1 |
Risk Management |
Internal Data Flow Security |
Shared |
The protection of internal data flows safeguards against unintended disclosure, modification, and access of the data while in transit. |
To ensure the confidentiality, integrity, and authenticity of application data flows between ’user’s Swift-related components. |
|
48 |
| SWIFT_CSCF_2024 |
6.2 |
SWIFT_CSCF_2024_6.2 |
SWIFT Customer Security Controls Framework 2024 6.2 |
Risk Management |
Software Integrity |
Shared |
Software integrity checks provide a detective control against unexpected modification to operational software. |
To ensure the software integrity of the Swift-related components and act upon results. |
|
16 |
| SWIFT_CSCF_2024 |
6.3 |
SWIFT_CSCF_2024_6.3 |
SWIFT Customer Security Controls Framework 2024 6.3 |
Risk Management |
Database Integrity |
Shared |
Database integrity checks allow unexpected modification to records stored within the database to be detected. |
To ensure the integrity of the database records for the Swift messaging interface or the customer connector and act upon results. |
|
16 |
|
U.05.2 - Cryptographic measures |
U.05.2 - Cryptographic measures |
404 not found |
|
|
|
n/a |
n/a |
|
53 |
|
U.11.3 - Encrypted |
U.11.3 - Encrypted |
404 not found |
|
|
|
n/a |
n/a |
|
52 |