compliance controls are associated with this Policy definition 'Azure Defender for SQL should be enabled for unprotected Azure SQL servers' (abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| AU_ISM |
1537 |
AU_ISM_1537 |
AU ISM 1537 |
Guidelines for System Monitoring - Event logging and auditing |
Events to be logged - 1537 |
|
n/a |
The following events are logged for databases:
• access to particularly important data
• addition of new users, especially privileged users
• any query containing comments
• any query containing multiple embedded queries
• any query or database alerts or failures
• attempts to elevate privileges
• attempted access that is successful or unsuccessful
• changes to the database structure
• changes to user roles or database permissions
• database administrator actions
• database logons and logoffs
• modifications to data
• use of executable commands. |
link |
3 |
| Azure_Security_Benchmark_v1.0 |
2.7 |
Azure_Security_Benchmark_v1.0_2.7 |
Azure Security Benchmark 2.7 |
Logging and Monitoring |
Enable alerts for anomalous activity |
Customer |
Use Azure Security Center with Log Analytics Workspace for monitoring and alerting on anomalous activity found in security logs and events.
Alternatively, you may enable and on-board data to Azure Sentinel.
How to onboard Azure Sentinel:
https://docs.microsoft.com/azure/sentinel/quickstart-onboard
How to manage alerts in Azure Security Center:
https://docs.microsoft.com/azure/security-center/security-center-managing-and-responding-alerts
How to alert on log analytics log data:
https://docs.microsoft.com/azure/azure-monitor/learn/tutorial-response |
n/a |
link |
2 |
| Azure_Security_Benchmark_v1.0 |
4.5 |
Azure_Security_Benchmark_v1.0_4.5 |
Azure Security Benchmark 4.5 |
Data Protection |
Use an active discovery tool to identify sensitive data |
Customer |
When no feature is available for your specific service in Azure, use a third-party active discovery tool to identify all sensitive information stored, processed, or transmitted by the organization's technology systems, including those located on-site, or at a remote service provider, and update the organization's sensitive information inventory.
Use Azure Information Protection for identifying sensitive information within Office 365 documents.
Use Azure SQL Information Protection to assist in the classification and labeling of information stored in Azure SQL Databases.
How to implement Azure SQL Data Discovery:
https://docs.microsoft.com/azure/sql-database/sql-database-data-discovery-and-classification
How to implement Azure Information Protection:
https://docs.microsoft.com/azure/information-protection/deployment-roadmap |
n/a |
link |
2 |
| Azure_Security_Benchmark_v3.0 |
IR-3 |
Azure_Security_Benchmark_v3.0_IR-3 |
Microsoft cloud security benchmark IR-3 |
Incident Response |
Detection and analysis - create incidents based on high-quality alerts |
Shared |
**Security Principle:**
Ensure you have a process to create high-quality alerts and measure the quality of alerts. This allows you to learn lessons from past incidents and prioritize alerts for analysts, so they don't waste time on false positives.
High-quality alerts can be built based on experience from past incidents, validated community sources, and tools designed to generate and clean up alerts by fusing and correlating diverse signal sources.
**Azure Guidance:**
Microsoft Defender for Cloud provides high-quality alerts across many Azure assets. You can use the Microsoft Defender for Cloud data connector to stream the alerts to Azure Sentinel. Azure Sentinel lets you create advanced alert rules to generate incidents automatically for an investigation.
Export your Microsoft Defender for Cloud alerts and recommendations using the export feature to help identify risks to Azure resources. Export alerts and recommendations either manually or in an ongoing, continuous fashion.
**Implementation and additional context:**
How to configure export:
https://docs.microsoft.com/azure/security-center/continuous-export
How to stream alerts into Azure Sentinel:
https://docs.microsoft.com/azure/sentinel/connect-azure-security-center |
n/a |
link |
18 |
| Azure_Security_Benchmark_v3.0 |
IR-5 |
Azure_Security_Benchmark_v3.0_IR-5 |
AMicrosoft cloud security benchmark IR-5 |
Incident Response |
Detection and analysis - prioritize incidents |
Shared |
**Security Principle:**
Provide context to security operations teams to help them determine which incidents ought to first be focused on, based on alert severity and asset sensitivity defined in your organization’s incident response plan.
**Azure Guidance:**
Microsoft Defender for Cloud assigns a severity to each alert to help you prioritize which alerts should be investigated first. The severity is based on how confident Microsoft Defender for Cloud is in the finding or the analytics used to issue the alert, as well as the confidence level that there was malicious intent behind the activity that led to the alert.
Additionally, mark resources using tags and create a naming system to identify and categorize Azure resources, especially those processing sensitive data. It is your responsibility to prioritize the remediation of alerts based on the criticality of the Azure resources and environment where the incident occurred.
**Implementation and additional context:**
Security alerts in Microsoft Defender for Cloud:
https://docs.microsoft.com/azure/security-center/security-center-alerts-overview
Use tags to organize your Azure resources:
https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags |
n/a |
link |
18 |
| Azure_Security_Benchmark_v3.0 |
LT-1 |
Azure_Security_Benchmark_v3.0_LT-1 |
Microsoft cloud security benchmark LT-1 |
Logging and Threat Detection |
Enable threat detection capabilities |
Shared |
**Security Principle:**
To support threat detection scenarios, monitor all known resource types for known and expected threats and anomalies. Configure your alert filtering and analytics rules to extract high-quality alerts from log data, agents, or other data sources to reduce false positives.
**Azure Guidance:**
Use the threat detection capability of Azure Defender services in Microsoft Defender for Cloud for the respective Azure services.
For threat detection not included in Azure Defender services, refer to the Azure Security Benchmark service baselines for the respective services to enable the threat detection or security alert capabilities within the service. Extract the alerts to your Azure Monitor or Azure Sentinel to build analytics rules, which hunt threats that match specific criteria across your environment.
For Operational Technology (OT) environments that include computers that control or monitor Industrial Control System (ICS) or Supervisory Control and Data Acquisition (SCADA) resources, use Defender for IoT to inventory assets and detect threats and vulnerabilities.
For services that do not have a native threat detection capability, consider collecting the data plane logs and analyze the threats through Azure Sentinel.
**Implementation and additional context:**
Introduction to Azure Defender:
https://docs.microsoft.com/azure/security-center/azure-defender
Microsoft Defender for Cloud security alerts reference guide:
https://docs.microsoft.com/azure/security-center/alerts-reference
Create custom analytics rules to detect threats:
https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom
Cyber threat intelligence with Azure Sentinel:
https://docs.microsoft.com/azure/architecture/example-scenario/data/sentinel-threat-intelligence |
n/a |
link |
21 |
| Azure_Security_Benchmark_v3.0 |
LT-2 |
Azure_Security_Benchmark_v3.0_LT-2 |
Microsoft cloud security benchmark LT-2 |
Logging and Threat Detection |
Enable threat detection for identity and access management |
Shared |
**Security Principle:**
Detect threats for identities and access management by monitoring the user and application sign-in and access anomalies. Behavioral patterns such as excessive number of failed login attempts, and deprecated accounts in the subscription, should be alerted.
**Azure Guidance:**
Microsoft Entra ID provides the following logs that can be viewed in Microsoft Entra reporting or integrated with Azure Monitor, Azure Sentinel or other SIEM/monitoring tools for more sophisticated monitoring and analytics use cases:
- Sign-ins: The sign-ins report provides information about the usage of managed applications and user sign-in activities.
- Audit logs: Provides traceability through logs for all changes done by various features within Microsoft Entra ID. Examples of audit logs include changes made to any resources within Microsoft Entra ID like adding or removing users, apps, groups, roles and policies.
- Risky sign-ins: A risky sign-in is an indicator for a sign-in attempt that might have been performed by someone who is not the legitimate owner of a user account.
- Users flagged for risk: A risky user is an indicator for a user account that might have been compromised.
Microsoft Entra ID also provides an Identity Protection module to detect, and remediate risks related to user accounts and sign-in behaviors. Examples risks include leaked credentials, sign-in from anonymous or malware linked IP addresses, password spray. The policies in the Microsoft Entra Identity Protection allow you to enforce risk-based MFA authentication in conjunction with Azure Conditional Access on user accounts.
In addition, Microsoft Defender for Cloud can be configured to alert on deprecated accounts in the subscription and suspicious activities such as an excessive number of failed authentication attempts. In addition to the basic security hygiene monitoring, Microsoft Defender for Cloud's Threat Protection module can also collect more in-depth security alerts from individual Azure compute resources (such as virtual machines, containers, app service), data resources (such as SQL DB and storage), and Azure service layers. This capability allows you to see account anomalies inside the individual resources.
Note: If you are connecting your on-premises Active Directory for synchronization, use the Microsoft Defender for Identity solution to consume your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.
**Implementation and additional context:**
Audit activity reports in Microsoft Entra ID:
https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs
Enable Azure Identity Protection:
https://docs.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection
Threat protection in Microsoft Defender for Cloud:
https://docs.microsoft.com/azure/security-center/threat-protection |
n/a |
link |
20 |
| Canada_Federal_PBMM_3-1-2020 |
AC_2 |
Canada_Federal_PBMM_3-1-2020_AC_2 |
Canada Federal PBMM 3-1-2020 AC 2 |
Account Management |
Account Management |
Shared |
1. The organization identifies and selects which types of information system accounts support organizational missions/business functions.
2. The organization assigns account managers for information system accounts.
3. The organization establishes conditions for group and role membership.
4. The organization specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account.
5. The organization requires approvals by responsible managers for requests to create information system accounts.
6. The organization creates, enables, modifies, disables, and removes information system accounts in accordance with information system account management procedures.
7. The organization monitors the use of information system accounts.
8. The organization notifies account managers:
a. When accounts are no longer required;
b. When users are terminated or transferred; and
c. When individual information system usage or need-to-know changes.
9. The organization authorizes access to the information system based on:
a. A valid access authorization;
b. Intended system usage; and
c. Other attributes as required by the organization or associated missions/business functions.
10. The organization reviews accounts for compliance with account management requirements at least annually.
11. The organization establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. |
To ensure the security, integrity, and efficiency of the information systems.
|
|
23 |
| Canada_Federal_PBMM_3-1-2020 |
AC_2(1) |
Canada_Federal_PBMM_3-1-2020_AC_2(1) |
Canada Federal PBMM 3-1-2020 AC 2(1) |
Account Management |
Account Management | Automated System Account Management |
Shared |
The organization employs automated mechanisms to support the management of information system accounts. |
To streamline and enhance information system account management processes. |
|
23 |
| Canada_Federal_PBMM_3-1-2020 |
CA_2 |
Canada_Federal_PBMM_3-1-2020_CA_2 |
Canada Federal PBMM 3-1-2020 CA 2 |
Security Assessments |
Security Assessments |
Shared |
1. The organization develops a security assessment plan that describes the scope of the assessment including:
a. Security controls and control enhancements under assessment;
b. Assessment procedures to be used to determine security control effectiveness; and
c. Assessment environment, assessment team, and assessment roles and responsibilities.
2. The organization assesses the security controls in the information system and its environment of operation at least annually to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements.
3. The organization produces a security assessment report that documents the results of the assessment.
4. The organization provides the results of the security control assessment to organization-defined individuals or roles. |
To enhance the overall security posture of the organization. |
|
23 |
| Canada_Federal_PBMM_3-1-2020 |
CA_3 |
Canada_Federal_PBMM_3-1-2020_CA_3 |
Canada Federal PBMM 3-1-2020 CA 3 |
Information System Connections |
System Interconnections |
Shared |
1. The organization authorizes connection from information system to other information system through the use of Interconnection Security Agreements.
2. The organization documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated.
3. The organization reviews and updates Interconnection Security Agreements annually. |
To establish and maintain secure connections between information systems. |
|
76 |
| Canada_Federal_PBMM_3-1-2020 |
CA_3(3) |
Canada_Federal_PBMM_3-1-2020_CA_3(3) |
Canada Federal PBMM 3-1-2020 CA 3(3) |
Information System Connections |
System Interconnections | Classified Non-National Security System Connections |
Shared |
The organization prohibits the direct connection of any internal network or system to an external network without the use of security controls approved by the information owner. |
To ensure the integrity and security of internal systems against external threats. |
|
76 |
| Canada_Federal_PBMM_3-1-2020 |
CA_3(5) |
Canada_Federal_PBMM_3-1-2020_CA_3(5) |
Canada Federal PBMM 3-1-2020 CA 3(5) |
Information System Connections |
System Interconnections | Restrictions on External Network Connections |
Shared |
The organization employs allow-all, deny-by-exception; deny-all policy for allowing any systems to connect to external information systems. |
To enhance security posture against unauthorized access. |
|
76 |
| Canada_Federal_PBMM_3-1-2020 |
CA_7 |
Canada_Federal_PBMM_3-1-2020_CA_7 |
Canada Federal PBMM 3-1-2020 CA 7 |
Continuous Monitoring |
Continuous Monitoring |
Shared |
1. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes establishment of organization-defined metrics to be monitored.
2. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes establishment of at least monthly monitoring and assessments of at least operating system scans, database, and web application scan.
3. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes ongoing security control assessments in accordance with the organizational continuous monitoring strategy.
4. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy.
5. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes correlation and analysis of security-related information generated by assessments and monitoring.
6. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes response actions to address results of the analysis of security-related information.
7. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes reporting the security status of organization and the information system to organization-defined personnel or roles at organization-defined frequency. |
To ensure the ongoing effectiveness of security controls and maintain the security posture in alignment with organizational objectives and requirements. |
|
120 |
| Canada_Federal_PBMM_3-1-2020 |
CM_2 |
Canada_Federal_PBMM_3-1-2020_CM_2 |
Canada Federal PBMM 3-1-2020 CM 2 |
Baseline Configuration |
Baseline Configuration |
Shared |
The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system. |
To support effective management and security practices. |
|
23 |
| Canada_Federal_PBMM_3-1-2020 |
CM_2(1) |
Canada_Federal_PBMM_3-1-2020_CM_2(1) |
Canada Federal PBMM 3-1-2020 CM 2(1) |
Baseline Configuration |
Baseline Configuration | Reviews and Updates |
Shared |
The organization reviews and updates the baseline configuration of the information system:
1. at least annually; or
2. When required due to significant changes as defined in NIST SP 800-37 rev1; and
3. As an integral part of information system component installations and upgrades.
|
To ensure alignment with current security standards and operational requirements. |
|
23 |
| Canada_Federal_PBMM_3-1-2020 |
CM_2(2) |
Canada_Federal_PBMM_3-1-2020_CM_2(2) |
Canada Federal PBMM 3-1-2020 CM 2(2) |
Baseline Configuration |
Baseline Configuration | Automation Support for Accuracy / Currency |
Shared |
The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system. |
To ensure the information system maintains an up-to-date, complete, accurate, and readily available baseline configuration |
|
22 |
| Canada_Federal_PBMM_3-1-2020 |
CM_8(3) |
Canada_Federal_PBMM_3-1-2020_CM_8(3) |
Canada Federal PBMM 3-1-2020 CM 8(3) |
Information System Component Inventory |
Information System Component Inventory | Automated Unauthorized Component Detection |
Shared |
1. The organization employs automated mechanisms continuously, using automated mechanisms with a maximum five-minute delay in detection to detect the presence of unauthorized hardware, software, and firmware components within the information system; and
2. The organization takes the organization-defined actions when unauthorized components are detected such as disables network access by such components; isolates the components; notifies organization-defined personnel or roles. |
To employ automated mechanisms for timely detection of unauthorized hardware, software, and firmware components in the information system. |
|
17 |
| Canada_Federal_PBMM_3-1-2020 |
CM_8(5) |
Canada_Federal_PBMM_3-1-2020_CM_8(5) |
Canada Federal PBMM 3-1-2020 CM 8(5) |
Information System Component Inventory |
Information System Component Inventory | No Duplicate Accounting of Components |
Shared |
The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories. |
To ensure that all components within the authorization boundary of the information system are uniquely identified and not duplicated in other information system component inventories. |
|
17 |
| Canada_Federal_PBMM_3-1-2020 |
IA_5 |
Canada_Federal_PBMM_3-1-2020_IA_5 |
Canada Federal PBMM 3-1-2020 IA 5 |
Authenticator Management |
Authenticator Management |
Shared |
1. The organization manages information system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator.
2. The organization manages information system authenticators by establishing initial authenticator content for authenticators defined by the organization.
3. The organization manages information system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.
4. The organization manages information system authenticators by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators.
5. The organization manages information system authenticators by changing the default content of authenticators prior to information system installation.
6. The organization manages information system authenticators by establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators.
7. The organization manages information system authenticators by changing/refreshing authenticators in accordance with CCCS’s ITSP.30.031.
8. The organization manages information system authenticators by protecting authenticator content from unauthorized disclosure and modification.
9. The organization manages information system authenticators by requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators.
10. The organization manages information system authenticators by changing authenticators for group/role accounts when membership to those accounts changes. |
To effectively manage information system authenticators through verification of recipient identity. |
|
21 |
| Canada_Federal_PBMM_3-1-2020 |
IA_5(11) |
Canada_Federal_PBMM_3-1-2020_IA_5(11) |
Canada Federal PBMM 3-1-2020 IA 5(11) |
Authenticator Management |
Authenticator Management | Hardware Token-Based Authentication |
Shared |
The information system, for hardware token-based authentication, employs mechanisms that satisfy CCCS's ITSP.30.031 token quality requirements. |
To enhance overall security and compliance with CCCS guidelines. |
|
20 |
| Canada_Federal_PBMM_3-1-2020 |
RA_5(1) |
Canada_Federal_PBMM_3-1-2020_RA_5(1) |
Canada Federal PBMM 3-1-2020 RA 5(1) |
Vulnerability Scanning |
Vulnerability Scanning | Update Tool Capability |
Shared |
The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned. |
To employ vulnerability scanning tools. |
|
20 |
| Canada_Federal_PBMM_3-1-2020 |
SI_8(1) |
Canada_Federal_PBMM_3-1-2020_SI_8(1) |
Canada Federal PBMM 3-1-2020 SI 8(1) |
Spam Protection |
Spam Protection | Central Management of Protection Mechanisms |
Shared |
The organization centrally manages spam protection mechanisms. |
To enhance overall security posture. |
|
87 |
| CCCS |
AU-12 |
CCCS_AU-12 |
CCCS AU-12 |
Audit and Accountability |
Audit Generation |
|
n/a |
(A) The information system provides audit record generation capability for the auditable events defined in AU-2 a. of all information system and network components where audit capability is deployed/available.
(B) The information system allows organization-defined personnel or roles to select which auditable events are to be audited by specific components of the information system.
(C) The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3. |
link |
4 |
| CCCS |
AU-5 |
CCCS_AU-5 |
CCCS AU-5 |
Audit and Accountability |
Response to Audit Processing Failures |
|
n/a |
(A) The information system alerts organization-defined personnel or roles in the event of an audit processing failure; and
(B) The information system overwrites the oldest audit records. |
link |
4 |
| CCCS |
RA-5 |
CCCS_RA-5 |
CCCS RA-5 |
Risk Assessment |
Vulnerability Scanning |
|
n/a |
(A) The organization scans for vulnerabilities in the information system and hosted applications monthly for operating systems/infrastructure, web applications, and database management systems and when new vulnerabilities potentially affecting the system/applications are identified and reported.
(B) The organization employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
(a) Enumerating platforms, software flaws, and improper configurations;
(b) Formatting checklists and test procedures; and
(c) Measuring vulnerability impact.
(C) The organization analyzes vulnerability scan reports and results from security control assessments.
(D) The organization remediates legitimate vulnerabilities within 30 days for high-risk vulnerabilities and 90 days for moderate-risk vulnerabilities from the date of discovery in accordance with an organizational assessment of risk.
(E) The organization shares information obtained from the vulnerability scanning process and security control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies). |
link |
4 |
| CCCS |
SC-28 |
CCCS_SC-28 |
CCCS SC-28 |
System and Communications Protection |
Protection of Information at Rest |
|
n/a |
(A) The information system protects the confidentiality and integrity ofall information not cleared for public release and all data with a higher than low integrity requirement. |
link |
3 |
| CCCS |
SI-4 |
CCCS_SI-4 |
CCCS SI-4 |
System and Information Integrity |
Information System Monitoring |
|
n/a |
(A) The organization monitors the information system to detect:
(a) Attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives; and
(b) Unauthorized local, network, and remote connections;
(B) The organization identifies unauthorized use of the information system through organization-defined techniques and methods.
(C) The organization deploys monitoring devices: (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization.
(D) The organization protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion.
(E) The organization heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or Canada based on law enforcement information, intelligence information, or other credible sources of information.
(F) The organization obtains legal opinion with regard to information system monitoring activities in accordance with orgnanizational policies, directives and standards.
(G) The organization provides organization-defined information system monitoring information to organization-defined personnel or roles at an organization-defined frequency. |
link |
2 |
| CIS_Azure_1.1.0 |
4.4 |
CIS_Azure_1.1.0_4.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.4 |
4 Database Services |
Ensure that 'Advanced Data Security' on a SQL server is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable "Advanced Data Security" on critical SQL Servers. |
link |
3 |
| CIS_Azure_1.3.0 |
4.2.1 |
CIS_Azure_1.3.0_4.2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.2.1 |
4 Database Services |
Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable "Azure Defender for SQL" on critical SQL Servers. |
link |
3 |
| CIS_Azure_1.4.0 |
4.2.1 |
CIS_Azure_1.4.0_4.2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.2.1 |
4 Database Services |
Ensure that Advanced Threat Protection (ATP) on a SQL Server is Set to 'Enabled' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable "Azure Defender for SQL" on critical SQL Servers. |
link |
3 |
| CIS_Azure_2.0.0 |
4.2.1 |
CIS_Azure_2.0.0_4.2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.2.1 |
4.2 |
Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers |
Shared |
Microsoft Defender for SQL is a paid feature and will incur additional cost for each SQL server. |
Enable "Microsoft Defender for SQL" on critical SQL Servers.
Microsoft Defender for SQL is a unified package for advanced SQL security capabilities. Microsoft Defender is available for Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics. It includes functionality for discovering and classifying sensitive data, surfacing and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your database. It provides a single go-to location for enabling and managing these capabilities. |
link |
3 |
| CIS_Controls_v8.1 |
10.1 |
CIS_Controls_v8.1_10.1 |
CIS Controls v8.1 10.1 |
Malware Defenses |
Deploy and maintain anti-malware software |
Shared |
Deploy and maintain anti-malware software on all enterprise assets. |
To ensure safety of all data on enterprise assets and prevent unauthorized access or exposure of data. |
|
8 |
| CIS_Controls_v8.1 |
10.2 |
CIS_Controls_v8.1_10.2 |
CIS Controls v8.1 10.2 |
Malware Defenses |
Configure automatic anti-malware signature updates |
Shared |
Configure automatic updates for anti-malware signature files on all enterprise assets. |
To ensure anti-malware is up to date. |
|
8 |
| CIS_Controls_v8.1 |
10.3 |
CIS_Controls_v8.1_10.3 |
CIS Controls v8.1 10.3 |
Malware Defenses |
Disable autorun and autoplay for removable media |
Shared |
Disable autorun and autoplay auto-execute functionality for removable media. |
To prevent removable media from auto-executing. |
|
8 |
| CIS_Controls_v8.1 |
10.4 |
CIS_Controls_v8.1_10.4 |
CIS Controls v8.1 10.4 |
Malware Defenses |
Configure automatic anti-malware scanning of
removable media |
Shared |
Configure anti-malware software to automatically scan removable media. |
To prevent contamination of systems through removable media. |
|
8 |
| CIS_Controls_v8.1 |
10.5 |
CIS_Controls_v8.1_10.5 |
CIS Controls v8.1 10.5 |
Malware Defenses |
Enable auto-exploitation features |
Shared |
Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft Data Execution Prevention (DEP), Windows Defender Exploit Guard (WDEG), or Apple System Integrity Protection (SIP) and Gatekeeper. |
To provide protection against exploits. |
|
8 |
| CIS_Controls_v8.1 |
10.6 |
CIS_Controls_v8.1_10.6 |
CIS Controls v8.1 10.6 |
Malware Defenses |
Centrally manage anti-malware software |
Shared |
Centrally manage anti-malware software. |
To ensure all systems are equipped with anti-malware and further ensure they are up to date. |
|
8 |
| CIS_Controls_v8.1 |
10.7 |
CIS_Controls_v8.1_10.7 |
CIS Controls v8.1 10.7 |
Malware Defenses |
Use behaviour based anti-malware software |
Shared |
Use behaviour based anti-malware software |
To ensure that a generic anti-malware software is not used. |
|
95 |
| CIS_Controls_v8.1 |
12.1 |
CIS_Controls_v8.1_12.1 |
CIS Controls v8.1 12.1 |
Network Infrastructure Management |
Ensure network infrastructure is up to date |
Shared |
1. Ensure network infrastructure is kept up-to-date.
2. Example implementations include running the latest stable release of software and/or using currently supported network-as-a-service (NaaS) offerings.
3. Review software versions monthly, or more frequently, to verify software support. |
To prevent any unauthorized or malicious activity on network systems. |
|
22 |
| CIS_Controls_v8.1 |
12.3 |
CIS_Controls_v8.1_12.3 |
CIS Controls v8.1 12.3 |
Network Infrastructure Management |
Securely manage network infrastructure |
Shared |
1. Securely manage network infrastructure.
2. Example implementations include version-controlled-infrastructure-ascode, and the use of secure network protocols, such as SSH and HTTPS. |
To ensure proper management of network infrastructure. |
|
38 |
| CIS_Controls_v8.1 |
13.1 |
CIS_Controls_v8.1_13.1 |
CIS Controls v8.1 13.1 |
Network Monitoring and Defense |
Centralize security event alerting |
Shared |
1. Centralize security event alerting across enterprise assets for log correlation and analysis.
2. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts.
3.A log analytics platform configured with security-relevant correlation alerts also satisfies this safeguard. |
To ensure that any security event is immediately alerted enterprise-wide. |
|
97 |
| CIS_Controls_v8.1 |
13.3 |
CIS_Controls_v8.1_13.3 |
CIS Controls v8.1 13.3 |
Network Monitoring and Defense |
Deploy a network intrusion detection solution |
Shared |
1. Deploy a network intrusion detection solution on enterprise assets, where appropriate.
2. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service. |
To enhance the organization's cybersecurity. |
|
95 |
| CIS_Controls_v8.1 |
13.7 |
CIS_Controls_v8.1_13.7 |
CIS Controls v8.1 13.7 |
Network Monitoring and Defense |
Deploy a host-based intrusion prevention solution |
Shared |
1. Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported.
2. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent. |
To implement a host-based intrusion prevention solution on enterprise assets. |
|
8 |
| CIS_Controls_v8.1 |
16.12 |
CIS_Controls_v8.1_16.12 |
CIS Controls v8.1 16.12 |
Application Software Security |
Implement code-level security checks |
Shared |
Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are being followed. |
To help identify and address potential security issues early in the development process, enhancing the overall security posture of the application.
|
|
22 |
| CIS_Controls_v8.1 |
16.13 |
CIS_Controls_v8.1_16.13 |
CIS Controls v8.1 16.13 |
Application Software Security |
Conduct application penetration testing |
Shared |
1. Conduct application penetration testing.
2. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing.
3. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user. |
To identify potential security weaknesses and assess the overall security posture of the application. |
|
22 |
| CIS_Controls_v8.1 |
16.2 |
CIS_Controls_v8.1_16.2 |
CIS Controls v8.1 16.2 |
Application Software Security |
Establish and maintain a process to accept and address software vulnerabilities |
Shared |
1. Establish and maintain a process to accept and address reports of software vulnerabilities, including providing a means for external entities to report.
2. The process is to include such items as: a vulnerability handling policy that identifies reporting process, responsible party for handling vulnerability reports, and a process for intake, assignment, remediation, and remediation testing.
3. As part of the process, use a vulnerability tracking system that includes severity ratings, and metrics for measuring timing for identification, analysis, and remediation of vulnerabilities.
4. Review and update documentation annually, or when significant enterprise changes occur that could impact this safeguard.
5. Third-party application developers need to consider this an externally-facing policy that helps to set expectations for outside stakeholders. |
To serve as an externally-facing document that establishes expectations for external stakeholders regarding vulnerability reporting and remediation procedures. |
|
22 |
| CIS_Controls_v8.1 |
9.7 |
CIS_Controls_v8.1_9.7 |
CIS Controls v8.1 9.7 |
Email and Web Browser Protections |
Deploy and maintain email server anti-malware protections |
Shared |
Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing. |
To add a security layer to network systems. |
|
8 |
| CMMC_2.0_L2 |
AU.L2-3.3.1 |
CMMC_2.0_L2_AU.L2-3.3.1 |
404 not found |
|
|
|
n/a |
n/a |
|
32 |
| CMMC_2.0_L2 |
AU.L2-3.3.2 |
CMMC_2.0_L2_AU.L2-3.3.2 |
404 not found |
|
|
|
n/a |
n/a |
|
32 |
| CMMC_2.0_L2 |
AU.L2-3.3.4 |
CMMC_2.0_L2_AU.L2-3.3.4 |
404 not found |
|
|
|
n/a |
n/a |
|
10 |
| CMMC_2.0_L2 |
AU.L2-3.3.5 |
CMMC_2.0_L2_AU.L2-3.3.5 |
404 not found |
|
|
|
n/a |
n/a |
|
10 |
| CMMC_2.0_L2 |
RA.L2-3.11.2 |
CMMC_2.0_L2_RA.L2-3.11.2 |
404 not found |
|
|
|
n/a |
n/a |
|
16 |
| CMMC_2.0_L2 |
RA.L2-3.11.3 |
CMMC_2.0_L2_RA.L2-3.11.3 |
404 not found |
|
|
|
n/a |
n/a |
|
16 |
| CMMC_2.0_L2 |
SI.L2-3.14.6 |
CMMC_2.0_L2_SI.L2-3.14.6 |
404 not found |
|
|
|
n/a |
n/a |
|
25 |
| CMMC_2.0_L2 |
SI.L2-3.14.7 |
CMMC_2.0_L2_SI.L2-3.14.7 |
404 not found |
|
|
|
n/a |
n/a |
|
19 |
| CMMC_L2_v1.9.0 |
AU.L2_3.3.1 |
CMMC_L2_v1.9.0_AU.L2_3.3.1 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 AU.L2 3.3.1 |
Audit and Accountability |
System Auditing |
Shared |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. |
To enhance security and accountability measures. |
|
40 |
| CMMC_L2_v1.9.0 |
CA.L2_3.12.2 |
CMMC_L2_v1.9.0_CA.L2_3.12.2 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 CA.L2 3.12.2 |
Security Assessment |
Plan of Action |
Shared |
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. |
To enhance the resilience to cyber threats and protect systems and data from potential exploitation or compromise. |
|
17 |
| CMMC_L2_v1.9.0 |
CM.L2_3.4.3 |
CMMC_L2_v1.9.0_CM.L2_3.4.3 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 CM.L2 3.4.3 |
Configuration Management |
System Change Management |
Shared |
Track, review, approve or disapprove, and log changes to organizational systems. |
To ensure accountability, transparency, and compliance with established procedures and security requirements. |
|
15 |
| CMMC_L2_v1.9.0 |
RA.L2_3.11.2 |
CMMC_L2_v1.9.0_RA.L2_3.11.2 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 RA.L2 3.11.2 |
Risk Assessment |
Vulnerability Scan |
Shared |
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. |
To enhance the overall security posture of the organization. |
|
14 |
| CMMC_L2_v1.9.0 |
RA.L2_3.11.3 |
CMMC_L2_v1.9.0_RA.L2_3.11.3 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 RA.L2 3.11.3 |
Risk Assessment |
Vulnerability Remediation |
Shared |
Remediate vulnerabilities in accordance with risk assessments. |
To reduce the likelihood of security breaches and minimize potential impacts on operations and assets. |
|
14 |
| CMMC_L2_v1.9.0 |
SI.L1_3.14.1 |
CMMC_L2_v1.9.0_SI.L1_3.14.1 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SI.L1 3.14.1 |
System and Information Integrity |
Flaw Remediation |
Shared |
Identify, report, and correct information and information system flaws in a timely manner. |
To safeguard assets and maintain operational continuity. |
|
23 |
| CMMC_L2_v1.9.0 |
SI.L1_3.14.2 |
CMMC_L2_v1.9.0_SI.L1_3.14.2 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SI.L1 3.14.2 |
System and Information Integrity |
Malicious Code Protection |
Shared |
Provide protection from malicious code at appropriate locations within organizational information systems. |
To the integrity, confidentiality, and availability of information assets. |
|
19 |
| CMMC_L2_v1.9.0 |
SI.L1_3.14.4 |
CMMC_L2_v1.9.0_SI.L1_3.14.4 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SI.L1 3.14.4 |
System and Information Integrity |
Update Malicious Code Protection |
Shared |
Update malicious code protection mechanisms when new releases are available. |
To effectively defend against new and evolving malware threats, minimize the risk of infections, and maintain the security of their information systems and data. |
|
19 |
| CMMC_L2_v1.9.0 |
SI.L1_3.14.5 |
CMMC_L2_v1.9.0_SI.L1_3.14.5 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SI.L1 3.14.5 |
System and Information Integrity |
System & File Scanning |
Shared |
Perform periodic scans of the information system and real time scans of files from external sources as files are downloaded, opened, or executed. |
To identify and mitigate security risks, prevent malware infections and minimise the impact of security breaches. |
|
19 |
| CMMC_L2_v1.9.0 |
SI.L2_3.14.3 |
CMMC_L2_v1.9.0_SI.L2_3.14.3 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SI.L2 3.14.3 |
System and Information Integrity |
Security Alerts & Advisories |
Shared |
Monitor system security alerts and advisories and take action in response. |
To proactively defend against emerging threats and minimize the risk of security incidents or breaches. |
|
15 |
| CMMC_L2_v1.9.0 |
SI.L2_3.14.6 |
CMMC_L2_v1.9.0_SI.L2_3.14.6 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SI.L2 3.14.6 |
System and Information Integrity |
Monitor Communications for Attacks |
Shared |
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
To protect systems and data from unauthorized access or compromise. |
|
15 |
| CMMC_L2_v1.9.0 |
SI.L2_3.14.7 |
CMMC_L2_v1.9.0_SI.L2_3.14.7 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SI.L2 3.14.7 |
System and Information Integrity |
Identify Unauthorized Use |
Shared |
Identify unauthorized use of organizational systems. |
To enable the organization to take appropriate action, such as revoking access privileges, investigating security incidents, and implementing additional security controls to prevent future unauthorized access. |
|
14 |
| CMMC_L3 |
AU.2.041 |
CMMC_L3_AU.2.041 |
CMMC L3 AU.2.041 |
Audit and Accountability |
Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
This requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible. Organizations consider logging for traceability including results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, communications at system boundaries, configuration settings, physical access, nonlocal maintenance, use of maintenance tools, temperature and humidity, equipment delivery and removal, system component inventory, use of mobile code, and use of Voice over Internet Protocol (VoIP). |
link |
11 |
| CMMC_L3 |
AU.2.042 |
CMMC_L3_AU.2.042 |
CMMC L3 AU.2.042 |
Audit and Accountability |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance.
Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloudbased architectures.
Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred).
Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. |
link |
11 |
| CMMC_L3 |
AU.3.046 |
CMMC_L3_AU.3.046 |
CMMC L3 AU.3.046 |
Audit and Accountability |
Alert in the event of an audit logging process failure. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Audit logging process failures include software and hardware errors, failures in the audit record capturing mechanisms, and audit record storage capacity being reached or exceeded. This requirement applies to each audit record data storage repository (i.e., distinct system component where audit records are stored), the total audit record storage capacity of organizations (i.e., all audit record data storage repositories combined), or both. |
link |
4 |
| CMMC_L3 |
CM.2.064 |
CMMC_L3_CM.2.064 |
CMMC L3 CM.2.064 |
Configuration Management |
Establish and enforce security configuration settings for information technology products employed in organizational systems. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture or functionality of the system. Information technology products for which security-related configuration settings can be defined include mainframe computers, servers, workstations, input and output devices (e.g., scanners, copiers, and printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications.
Security parameters are those parameters impacting the security state of systems including the parameters required to satisfy other security requirements. Security parameters include: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, and remote connections. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the systems configuration baseline.
Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations including information technology product developers, manufacturers, vendors, consortia, academia, industry, federal agencies, and other organizations in the public and private sectors. |
link |
10 |
| CMMC_L3 |
RM.2.141 |
CMMC_L3_RM.2.141 |
CMMC L3 RM.2.141 |
Risk Assessment |
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Clearly defined system boundaries are a prerequisite for effective risk assessments. Such risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations, organizational assets, and individuals based on the operation and use of organizational systems. Risk assessments also consider risk from external parties (e.g., service providers, contractors operating systems on behalf of the organization, individuals accessing organizational systems, outsourcing entities). Risk assessments, either formal or informal, can be conducted at the organization level, the mission or business process level, or the system level, and at any phase in the system development life cycle. |
link |
13 |
| CMMC_L3 |
RM.2.142 |
CMMC_L3_RM.2.142 |
CMMC L3 RM.2.142 |
Risk Assessment |
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Organizations determine the required vulnerability scanning for all system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. The vulnerabilities to be scanned are readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This process ensures that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in source code reviews and in a variety of tools (e.g., static analysis tools, web-based application scanners, binary analyzers) and in source code reviews. Vulnerability scanning includes: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms.
To facilitate interoperability, organizations consider using products that are Security Content Automated Protocol (SCAP)-validated, scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention, and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of system vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD).
Security assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). In certain situations, the nature of the vulnerability scanning may be more intrusive or the system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates thorough vulnerability scanning and protects the sensitive nature of such scanning. |
link |
13 |
| CMMC_L3 |
RM.2.143 |
CMMC_L3_RM.2.143 |
CMMC L3 RM.2.143 |
Risk Assessment |
Remediate vulnerabilities in accordance with risk assessments. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Vulnerabilities discovered, for example, via the scanning conducted in response to RM.2.142, are remediated with consideration of the related assessment of risk. The consideration of risk influences the prioritization of remediation efforts and the level of effort to be expended in the remediation for specific vulnerabilities. |
link |
15 |
| CMMC_L3 |
SC.3.191 |
CMMC_L3_SC.3.191 |
CMMC L3 SC.3.191 |
System and Communications Protection |
Protect the confidentiality of CUI at rest. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Information at rest refers to the state of information when it is not in process or in transit and is located on storage devices as specific components of systems. The focus of protection at rest is not on the type of storage device or the frequency of access but rather the state of the information. Organizations can use different mechanisms to achieve confidentiality protections, including the use of cryptographic mechanisms and file share scanning. Organizations may also use other controls including secure off-line storage in lieu of online storage when adequate protection of information at rest cannot otherwise be achieved or continuous monitoring to identify malicious code at rest. |
link |
13 |
| CMMC_L3 |
SI.2.216 |
CMMC_L3_SI.2.216 |
CMMC L3 SI.2.216 |
System and Information Integrity |
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the system. Organizations can monitor systems, for example, by observing audit record activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. System monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms supporting critical applications, with such devices being employed at managed system interfaces. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of systems to support such objectives.
System monitoring is an integral part of continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless.
Unusual or unauthorized activities or conditions related to inbound/outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. |
link |
23 |
| CMMC_L3 |
SI.2.217 |
CMMC_L3_SI.2.217 |
CMMC L3 SI.2.217 |
System and Information Integrity |
Identify unauthorized use of organizational systems. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. System monitoring can detect unauthorized use of organizational systems. System monitoring is an integral part of continuous monitoring and incident response programs. Monitoring is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Output from system monitoring serves as input to continuous monitoring and incident response programs.
Unusual/unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. |
link |
11 |
| CPS_234_(APRA)_2019 |
CPS_234_(APRA)_2019_27 |
CPS_234_(APRA)_2019_27 |
APRA CPS 234 2019 27 |
Testing control effectiveness |
Ensure that an APRA-regulated entity systematically tests the effectiveness of its information security controls. |
Shared |
n/a |
An APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program. The nature and frequency of the systematic testing must be commensurate with:
1. the rate at which the vulnerabilities and threats change;
2. the criticality and sensitivity of the information asset;
3. the consequences of an information security incident;
4. the risks associated with exposure to environments where the APRA-regulated entity is unable to enforce its information security policies;
5. the materiality and frequency of change to information assets. |
|
17 |
| CSA_v4.0.12 |
AIS_07 |
CSA_v4.0.12_AIS_07 |
CSA Cloud Controls Matrix v4.0.12 AIS 07 |
Application & Interface Security |
Application Vulnerability Remediation |
Shared |
n/a |
Define and implement a process to remediate application security
vulnerabilities, automating remediation when possible. |
|
22 |
| CSA_v4.0.12 |
CCC_07 |
CSA_v4.0.12_CCC_07 |
CSA Cloud Controls Matrix v4.0.12 CCC 07 |
Change Control and Configuration Management |
Detection of Baseline Deviation |
Shared |
n/a |
Implement detection measures with proactive notification in case
of changes deviating from the established baseline. |
|
22 |
| CSA_v4.0.12 |
CEK_03 |
CSA_v4.0.12_CEK_03 |
CSA Cloud Controls Matrix v4.0.12 CEK 03 |
Cryptography, Encryption & Key Management |
Data Encryption |
Shared |
n/a |
Provide cryptographic protection to data at-rest and in-transit,
using cryptographic libraries certified to approved standards. |
|
54 |
| CSA_v4.0.12 |
HRS_06 |
CSA_v4.0.12_HRS_06 |
CSA Cloud Controls Matrix v4.0.12 HRS 06 |
Human Resources |
Employment Termination |
Shared |
n/a |
Establish, document, and communicate to all personnel the procedures
outlining the roles and responsibilities concerning changes in employment. |
|
13 |
| CSA_v4.0.12 |
IAM_12 |
CSA_v4.0.12_IAM_12 |
CSA Cloud Controls Matrix v4.0.12 IAM 12 |
Identity & Access Management |
Safeguard Logs Integrity |
Shared |
n/a |
Define, implement and evaluate processes, procedures and technical
measures to ensure the logging infrastructure is read-only for all with write
access, including privileged access roles, and that the ability to disable it
is controlled through a procedure that ensures the segregation of duties and
break glass procedures. |
|
38 |
| CSA_v4.0.12 |
TVM_04 |
CSA_v4.0.12_TVM_04 |
CSA Cloud Controls Matrix v4.0.12 TVM 04 |
Threat & Vulnerability Management |
Detection Updates |
Shared |
n/a |
Define, implement and evaluate processes, procedures and technical
measures to update detection tools, threat signatures, and indicators of compromise
on a weekly, or more frequent basis. |
|
46 |
| CSA_v4.0.12 |
TVM_08 |
CSA_v4.0.12_TVM_08 |
CSA Cloud Controls Matrix v4.0.12 TVM 08 |
Threat & Vulnerability Management |
Vulnerability Prioritization |
Shared |
n/a |
Use a risk-based model for effective prioritization of vulnerability
remediation using an industry recognized framework. |
|
22 |
| Cyber_Essentials_v3.1 |
3 |
Cyber_Essentials_v3.1_3 |
Cyber Essentials v3.1 3 |
Cyber Essentials |
Security Update Management |
Shared |
n/a |
Aim: ensure that devices and software are not vulnerable to known security issues for which fixes are available. |
|
38 |
| Cyber_Essentials_v3.1 |
5 |
Cyber_Essentials_v3.1_5 |
Cyber Essentials v3.1 5 |
Cyber Essentials |
Malware protection |
Shared |
n/a |
Aim: to restrict execution of known malware and untrusted software, from causing damage or accessing data. |
|
60 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_11 |
EU_2555_(NIS2)_2022_11 |
EU 2022/2555 (NIS2) 2022 11 |
|
Requirements, technical capabilities and tasks of CSIRTs |
Shared |
n/a |
Outlines the requirements, technical capabilities, and tasks of CSIRTs. |
|
64 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_12 |
EU_2555_(NIS2)_2022_12 |
EU 2022/2555 (NIS2) 2022 12 |
|
Coordinated vulnerability disclosure and a European vulnerability database |
Shared |
n/a |
Establishes a coordinated vulnerability disclosure process and a European vulnerability database. |
|
62 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_21 |
EU_2555_(NIS2)_2022_21 |
EU 2022/2555 (NIS2) 2022 21 |
|
Cybersecurity risk-management measures |
Shared |
n/a |
Requires essential and important entities to take appropriate measures to manage cybersecurity risks. |
|
189 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_29 |
EU_2555_(NIS2)_2022_29 |
EU 2022/2555 (NIS2) 2022 29 |
|
Cybersecurity information-sharing arrangements |
Shared |
n/a |
Allows entities to exchange relevant cybersecurity information on a voluntary basis. |
|
62 |
| EU_2555_(NIS2)_2022 |
EU_2555_(NIS2)_2022_7 |
EU_2555_(NIS2)_2022_7 |
EU 2022/2555 (NIS2) 2022 7 |
|
National cybersecurity strategy |
Shared |
n/a |
Requires Member States to adopt a national cybersecurity strategy. |
|
16 |
| EU_GDPR_2016_679_Art. |
24 |
EU_GDPR_2016_679_Art._24 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 24 |
Chapter 4 - Controller and processor |
Responsibility of the controller |
Shared |
n/a |
n/a |
|
306 |
| EU_GDPR_2016_679_Art. |
25 |
EU_GDPR_2016_679_Art._25 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 25 |
Chapter 4 - Controller and processor |
Data protection by design and by default |
Shared |
n/a |
n/a |
|
306 |
| EU_GDPR_2016_679_Art. |
28 |
EU_GDPR_2016_679_Art._28 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 28 |
Chapter 4 - Controller and processor |
Processor |
Shared |
n/a |
n/a |
|
306 |
| EU_GDPR_2016_679_Art. |
32 |
EU_GDPR_2016_679_Art._32 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 32 |
Chapter 4 - Controller and processor |
Security of processing |
Shared |
n/a |
n/a |
|
306 |
| FBI_Criminal_Justice_Information_Services_v5.9.5_5 |
.1 |
FBI_Criminal_Justice_Information_Services_v5.9.5_5.1 |
FBI Criminal Justice Information Services (CJIS) v5.9.5 5.1 |
Policy and Implementation - Systems And Communications Protection |
Systems And Communications Protection |
Shared |
In addition, applications, services, or information systems must have the capability to ensure system integrity through the detection and protection against unauthorized changes to software and information. |
Examples of systems and communications safeguards range from boundary and transmission protection to securing an agency's virtualized environment. |
|
110 |
| FBI_Criminal_Justice_Information_Services_v5.9.5_5 |
.11 |
FBI_Criminal_Justice_Information_Services_v5.9.5_5.11 |
FBI Criminal Justice Information Services (CJIS) v5.9.5 5.11 |
Policy and Implementation - Formal Audits |
Policy Area 11: Formal Audits |
Shared |
Internal compliance checklists should be regularly kept updated with respect to applicable statutes, regulations, policies and on the basis of findings in audit. |
Formal audits are conducted to ensure compliance with applicable statutes, regulations and policies. |
|
60 |
| FBI_Criminal_Justice_Information_Services_v5.9.5_5 |
.7 |
FBI_Criminal_Justice_Information_Services_v5.9.5_5.7 |
404 not found |
|
|
|
n/a |
n/a |
|
94 |
| FedRAMP_High_R4 |
AU-12 |
FedRAMP_High_R4_AU-12 |
FedRAMP High AU-12 |
Audit And Accountability |
Audit Generation |
Shared |
n/a |
The information system:
a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];
b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and
c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Supplemental Guidance: Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. Related controls: AC-3, AU-2, AU-3, AU-6, AU-7.
References: None. |
link |
34 |
| FedRAMP_High_R4 |
AU-12(1) |
FedRAMP_High_R4_AU-12(1) |
FedRAMP High AU-12 (1) |
Audit And Accountability |
System-Wide / Time-Correlated Audit Trail |
Shared |
n/a |
The information system compiles audit records from [Assignment: organization-defined information system components] into a system-wide (logical or physical) audit trail that is time- correlated to within [Assignment: organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail].
Supplemental Guidance: Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances. Related controls: AU-8, AU-12. |
link |
31 |
| FedRAMP_High_R4 |
AU-6 |
FedRAMP_High_R4_AU-6 |
FedRAMP High AU-6 |
Audit And Accountability |
Audit Review, Analysis, And Reporting |
Shared |
n/a |
The organization:
a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and
b. Reports findings to [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP. Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority. Related controls: AC-2, AC-3, AC-6, AC-17, AT-3, AU-7, AU-16, CA-7, CM-5, CM-10, CM-11, IA-3, IA-5, IR-5, IR-6, MA-4, MP-4, PE-3, PE-6, PE-14, PE-16, RA-5, SC-7, SC-18, SC-19, SI-3, SI-4, SI-7.
References: None. |
link |
25 |
| FedRAMP_High_R4 |
AU-6(4) |
FedRAMP_High_R4_AU-6(4) |
FedRAMP High AU-6 (4) |
Audit And Accountability |
Central Review And Analysis |
Shared |
n/a |
The information system provides the capability to centrally review and analyze audit records from multiple components within the system.
Supplemental Guidance: Automated mechanisms for centralized reviews and analyses include, for example, Security Information Management products. Related controls: AU-2, AU-12. |
link |
30 |
| FedRAMP_High_R4 |
AU-6(5) |
FedRAMP_High_R4_AU-6(5) |
FedRAMP High AU-6 (5) |
Audit And Accountability |
Integration / Scanning And Monitoring Capabilities |
Shared |
n/a |
The organization integrates analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; information system monitoring information; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.
Supplemental Guidance: This control enhancement does not require vulnerability scanning, the generation of performance data, or information system monitoring. Rather, the enhancement requires that the analysis of information being otherwise produced in these areas is integrated with the analysis of audit information. Security Event and Information Management System tools can facilitate audit record aggregation/consolidation from multiple information system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches for analyzing audit record information collected. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans and correlating attack detection events with scanning results. Correlation with performance data can help uncover denial of service attacks or cyber attacks resulting in unauthorized use of resources. Correlation with system monitoring information can assist in uncovering attacks and in better relating audit information to operational situations. Related controls: AU-12, IR-4, RA-5. |
link |
31 |
| FedRAMP_High_R4 |
IR-4 |
FedRAMP_High_R4_IR-4 |
FedRAMP High IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
The organization:
a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinates incident handling activities with contingency planning activities; and
c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.
Supplemental Guidance: Organizations recognize that incident response capability is dependent on the capabilities of organizational information systems and the mission/business processes being supported by those systems. Therefore, organizations consider incident response as part of the definition, design, and development of mission/business processes and information systems. Incident-related information can be obtained from a variety of sources including, for example, audit monitoring, network monitoring, physical access monitoring, user/administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including, for example, mission/business owners, information system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive (function). Related controls: AU-6, CM-6, CP-2, CP-4, IR-2, IR-3, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: Executive Order 13587; NIST Special Publication 800-61. |
link |
24 |
| FedRAMP_High_R4 |
IR-5 |
FedRAMP_High_R4_IR-5 |
FedRAMP High IR-5 |
Incident Response |
Incident Monitoring |
Shared |
n/a |
The organization tracks and documents information system security incidents.
Supplemental Guidance: Documenting information system security incidents includes, for example, maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including, for example, incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. Related controls: AU-6, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: NIST Special Publication 800-61. |
link |
13 |
| FedRAMP_High_R4 |
RA-5 |
FedRAMP_High_R4_RA-5 |
FedRAMP High RA-5 |
Risk Assessment |
Vulnerability Scanning |
Shared |
n/a |
The organization:
a. Scans for vulnerabilities in the information system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;
b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyzes vulnerability scan reports and results from security control assessments;
d. Remediates legitimate vulnerabilities [Assignment: organization-defined response times], in accordance with an organizational assessment of risk; and
e. Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
Supplemental Guidance: Security categorization of information systems guides the frequency and comprehensiveness of vulnerability scans. Organizations determine the required vulnerability scanning for all information system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in a variety of tools (e.g., web-based application scanners, static analysis tools, binary analyzers) and in source code reviews. Vulnerability scanning includes, for example: (i) scanning for patch levels; (ii) scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and (iii) scanning for improperly configured or incorrectly operating information flow control mechanisms. Organizations consider using tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine/test for the presence of vulnerabilities. Suggested sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). In addition, security control assessments such as red team exercises provide other sources of potential vulnerabilities for which to scan. Organizations also consider using tools that express vulnerability impact by the
Common Vulnerability Scoring System (CVSS). Related controls: CA-2, CA-7, CM-4, CM-6, RA-2, RA-3, SA-11, SI-2.
References: NIST Special Publications 800-40, 800-70, 800-115; Web: http://cwe.mitre.org, http://nvd.nist.gov. |
link |
18 |
| FedRAMP_High_R4 |
SI-4 |
FedRAMP_High_R4_SI-4 |
FedRAMP High SI-4 |
System And Information Integrity |
Information System Monitoring |
Shared |
n/a |
The organization:
a. Monitors the information system to detect:
1. Attacks and indicators of potential attacks in accordance with [Assignment: organization- defined monitoring objectives]; and
2. Unauthorized local, network, and remote connections;
b. Identifies unauthorized use of the information system through [Assignment: organization- defined techniques and methods];
c. Deploys monitoring devices: (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization;
d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;
e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;
f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and
g. Provides [Assignment: or ganization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].
Supplemental Guidance: Information system monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the information system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the information system. Organizations can monitor information systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include, for example, selected perimeter locations and near server farms supporting critical applications, with such devices typically being employed at the managed interfaces associated with controls SC-7 and AC-17. Einstein network monitoring devices from the Department of Homeland Security can also be included as monitoring devices. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of information systems to support such objectives. Specific types of transactions of interest include, for example, Hyper Text Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. Information system monitoring is an integral part of organizational continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless. Related controls: AC-3, AC-4, AC-8, AC-17, AU-2, AU-6, AU-7, AU-9, AU-12, CA-7, IR-4, PE-3, RA-5, SC-7, SC-26, SC-35, SI-3, SI-7.
References: NIST Special Publications 800-61, 800-83, 800-92, 800-94, 800-137. |
link |
22 |
| FedRAMP_Moderate_R4 |
AU-12 |
FedRAMP_Moderate_R4_AU-12 |
FedRAMP Moderate AU-12 |
Audit And Accountability |
Audit Generation |
Shared |
n/a |
The information system:
a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];
b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and
c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Supplemental Guidance: Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. Related controls: AC-3, AU-2, AU-3, AU-6, AU-7.
References: None. |
link |
34 |
| FedRAMP_Moderate_R4 |
AU-6 |
FedRAMP_Moderate_R4_AU-6 |
FedRAMP Moderate AU-6 |
Audit And Accountability |
Audit Review, Analysis, And Reporting |
Shared |
n/a |
The organization:
a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and
b. Reports findings to [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP. Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority. Related controls: AC-2, AC-3, AC-6, AC-17, AT-3, AU-7, AU-16, CA-7, CM-5, CM-10, CM-11, IA-3, IA-5, IR-5, IR-6, MA-4, MP-4, PE-3, PE-6, PE-14, PE-16, RA-5, SC-7, SC-18, SC-19, SI-3, SI-4, SI-7.
References: None. |
link |
25 |
| FedRAMP_Moderate_R4 |
IR-4 |
FedRAMP_Moderate_R4_IR-4 |
FedRAMP Moderate IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
The organization:
a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinates incident handling activities with contingency planning activities; and
c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.
Supplemental Guidance: Organizations recognize that incident response capability is dependent on the capabilities of organizational information systems and the mission/business processes being supported by those systems. Therefore, organizations consider incident response as part of the definition, design, and development of mission/business processes and information systems. Incident-related information can be obtained from a variety of sources including, for example, audit monitoring, network monitoring, physical access monitoring, user/administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including, for example, mission/business owners, information system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive (function). Related controls: AU-6, CM-6, CP-2, CP-4, IR-2, IR-3, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: Executive Order 13587; NIST Special Publication 800-61. |
link |
24 |
| FedRAMP_Moderate_R4 |
IR-5 |
FedRAMP_Moderate_R4_IR-5 |
FedRAMP Moderate IR-5 |
Incident Response |
Incident Monitoring |
Shared |
n/a |
The organization tracks and documents information system security incidents.
Supplemental Guidance: Documenting information system security incidents includes, for example, maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including, for example, incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. Related controls: AU-6, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: NIST Special Publication 800-61. |
link |
13 |
| FedRAMP_Moderate_R4 |
RA-5 |
FedRAMP_Moderate_R4_RA-5 |
FedRAMP Moderate RA-5 |
Risk Assessment |
Vulnerability Scanning |
Shared |
n/a |
The organization:
a. Scans for vulnerabilities in the information system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;
b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyzes vulnerability scan reports and results from security control assessments;
d. Remediates legitimate vulnerabilities [Assignment: organization-defined response times], in accordance with an organizational assessment of risk; and
e. Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
Supplemental Guidance: Security categorization of information systems guides the frequency and comprehensiveness of vulnerability scans. Organizations determine the required vulnerability scanning for all information system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in a variety of tools (e.g., web-based application scanners, static analysis tools, binary analyzers) and in source code reviews. Vulnerability scanning includes, for example: (i) scanning for patch levels; (ii) scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and (iii) scanning for improperly configured or incorrectly operating information flow control mechanisms. Organizations consider using tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine/test for the presence of vulnerabilities. Suggested sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). In addition, security control assessments such as red team exercises provide other sources of potential vulnerabilities for which to scan. Organizations also consider using tools that express vulnerability impact by the
Common Vulnerability Scoring System (CVSS). Related controls: CA-2, CA-7, CM-4, CM-6, RA-2, RA-3, SA-11, SI-2.
References: NIST Special Publications 800-40, 800-70, 800-115; Web: http://cwe.mitre.org, http://nvd.nist.gov. |
link |
18 |
| FedRAMP_Moderate_R4 |
SI-4 |
FedRAMP_Moderate_R4_SI-4 |
FedRAMP Moderate SI-4 |
System And Information Integrity |
Information System Monitoring |
Shared |
n/a |
The organization:
a. Monitors the information system to detect:
1. Attacks and indicators of potential attacks in accordance with [Assignment: organization- defined monitoring objectives]; and
2. Unauthorized local, network, and remote connections;
b. Identifies unauthorized use of the information system through [Assignment: organization- defined techniques and methods];
c. Deploys monitoring devices: (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization;
d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;
e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;
f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and
g. Provides [Assignment: or ganization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].
Supplemental Guidance: Information system monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the information system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the information system. Organizations can monitor information systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include, for example, selected perimeter locations and near server farms supporting critical applications, with such devices typically being employed at the managed interfaces associated with controls SC-7 and AC-17. Einstein network monitoring devices from the Department of Homeland Security can also be included as monitoring devices. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of information systems to support such objectives. Specific types of transactions of interest include, for example, Hyper Text Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. Information system monitoring is an integral part of organizational continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless. Related controls: AC-3, AC-4, AC-8, AC-17, AU-2, AU-6, AU-7, AU-9, AU-12, CA-7, IR-4, PE-3, RA-5, SC-7, SC-26, SC-35, SI-3, SI-7.
References: NIST Special Publications 800-61, 800-83, 800-92, 800-94, 800-137. |
link |
22 |
| FFIEC_CAT_2017 |
1.2.3 |
FFIEC_CAT_2017_1.2.3 |
FFIEC CAT 2017 1.2.3 |
Cyber Risk Management and Oversight |
Audit |
Shared |
n/a |
- Independent audit or review evaluates policies, procedures, and controls across the institution for significant risks and control issues associated with the institution's operations, including risks in new products, emerging technologies, and information systems.
- The independent audit function validates controls related to the storage or transmission of confidential data.
- Logging practices are independently reviewed periodically to ensure appropriate log management (e.g., access controls, retention, and maintenance).
- Issues and corrective actions from internal audits and independent testing/assessments are formally tracked to ensure procedures and control lapses are resolved in a timely manner. |
|
13 |
| FFIEC_CAT_2017 |
2.2.1 |
FFIEC_CAT_2017_2.2.1 |
FFIEC CAT 2017 2.2.1 |
Threat Intelligence and Collaboration |
Monitoring and Analyzing |
Shared |
n/a |
- Audit log records and other security event logs are reviewed and retained in a secure manner.
- Computer event logs are used for investigations once an event has occurred. |
|
22 |
| FFIEC_CAT_2017 |
3.1.1 |
FFIEC_CAT_2017_3.1.1 |
FFIEC CAT 2017 3.1.1 |
Cybersecurity Controls |
Infrastructure Management |
Shared |
n/a |
- Network perimeter defense tools (e.g., border router and firewall) are used.
- Systems that are accessed from the Internet or by external parties are protected by firewalls or other similar devices.
- All ports are monitored.
- Up to date antivirus and anti-malware tools are used.
- Systems configurations (for servers, desktops, routers, etc.) follow industry standards and are enforced.
- Ports, functions, protocols and services are prohibited if no longer needed for business purposes.
- Access to make changes to systems configurations (including virtual machines and hypervisors) is controlled and monitored.
- Programs that can override system, object, network, virtual machine, and application controls are restricted.
- System sessions are locked after a pre-defined period of inactivity and are terminated after pre-defined conditions are met.
- Wireless network environments require security settings with strong encryption for authentication and transmission. (*N/A if there are no wireless networks.) |
|
71 |
| FFIEC_CAT_2017 |
3.2.2 |
FFIEC_CAT_2017_3.2.2 |
FFIEC CAT 2017 3.2.2 |
Cybersecurity Controls |
Anomalous Activity Detection |
Shared |
n/a |
- The institution is able to detect anomalous activities through monitoring across the environment.
- Customer transactions generating anomalous activity alerts are monitored and reviewed.
- Logs of physical and/or logical access are reviewed following events.
- Access to critical systems by third parties is monitored for unauthorized or unusual activity.
- Elevated privileges are monitored. |
|
26 |
| FFIEC_CAT_2017 |
3.2.3 |
FFIEC_CAT_2017_3.2.3 |
FFIEC CAT 2017 3.2.3 |
Cybersecurity Controls |
Event Detection |
Shared |
n/a |
- A normal network activity baseline is established.
- Mechanisms (e.g., antivirus alerts, log event alerts) are in place to alert management to potential attacks.
- Processes are in place to monitor for the presence of unauthorized users, devices, connections, and software.
- Responsibilities for monitoring and reporting suspicious systems activity have been assigned.
- The physical environment is monitored to detect potential unauthorized access. |
|
30 |
| HITRUST_CSF_v11.3 |
09.ab |
HITRUST_CSF_v11.3_09.ab |
HITRUST CSF v11.3 09.ab |
Monitoring |
Establish procedures for monitoring use of information processing systems and facilities to check for use and effectiveness of implemented controls. |
Shared |
1. It is to be specified how often audit logs are reviewed, how the reviews are documented, and the specific roles and responsibilities of the personnel conducting the reviews, including the professional certifications or other qualifications required.
2. All relevant legal requirements applicable to its monitoring of authorized access and unauthorized access attempts is to be complied with. |
Procedures for monitoring use of information processing systems and facilities shall be established to check for use and effectiveness of implemented controls. The results of the monitoring activities shall be reviewed regularly. |
|
109 |
| HITRUST_CSF_v11.3 |
09.j |
HITRUST_CSF_v11.3_09.j |
HITRUST CSF v11.3 09.j |
Protection Against Malicious and Mobile Code |
Ensure that integrity of information and software is protected from malicious or unauthorized code |
Shared |
1. Technologies are to be implemented for timely installation, upgrade and renewal of anti-malware protective measures.
2. Automatic periodic scans of information systems is to be implemented.
3. Anti-malware software that offers a centralized infrastructure that compiles information on file reputations is to be implemented.
4. Post-malicious code update, signature deployment, scanning files, email, and web traffic is to be verified by automated systems, while BYOD users require anti-malware, network-based malware detection is to be used on servers without host-based solutions use.
5. Anti-malware audit logs checks to be performed.
6. Protection against malicious code is to be based on malicious code detection and repair software, security awareness, appropriate system access, and change management controls. |
Detection, prevention, and recovery controls shall be implemented to protect against malicious code, and appropriate user awareness procedures on malicious code shall be provided. |
|
37 |
| HITRUST_CSF_v11.3 |
10.c |
HITRUST_CSF_v11.3_10.c |
HITRUST CSF v11.3 10.c |
Correct Processing in Applications |
Incorporate validation checks into applications to detect any corruption of information through processing errors or deliberate acts. |
Shared |
Data integrity controls which manage changes, prevent sequencing errors, ensure recovery from failures, and protect against buffer overrun attacks are to be implemented. |
Validation checks shall be incorporated into applications to detect any corruption of information through processing errors or deliberate acts. |
|
35 |
| HITRUST_CSF_v11.3 |
10.k |
HITRUST_CSF_v11.3_10.k |
HITRUST CSF v11.3 10.k |
Security In Development and Support Processes |
Ensure the security of application system software and information through the development process, project and support environments shall be strictly controlled. |
Shared |
1. The purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance for configuration management is to be formally addressed.
2. Changes to mobile device operating systems, patch levels, and/or applications is to be managed through a formal change management process.
3. A baseline configuration of the information system is to be developed, documented, and maintained under configuration control. |
The implementation of changes, including patches, service packs, and other updates and modifications, shall be controlled by the use of formal change control procedures. |
|
33 |
| HITRUST_CSF_v11.3 |
10.m |
HITRUST_CSF_v11.3_10.m |
HITRUST CSF v11.3 10.m |
Technical Vulnerability Management |
Reduce the risks resulting from exploitation of published technical vulnerabilities, technical vulnerability management shall be implemented in an effective, systematic, and repeatable way with measurements taken to confirm its effectiveness. |
Shared |
1. The necessary secure services, protocols required for the function of the system are to be enabled.
2. Security features to be implemented for any required services that are considered to be insecure.
3. Laptops, workstations, and servers to be configured so they will not auto-run content from removable media.
4. Configuration standards to be consistent with industry-accepted system hardening standards.
5. An enterprise security posture review within every 365 days is to be conducted.
6. Vulnerability scanning tools to be regularly updated with all relevant information system vulnerabilities. |
Timely information about technical vulnerabilities of information systems being used shall be obtained; the organization’s exposure to such vulnerabilities evaluated; and appropriate measures taken to address the associated risk. |
|
46 |
| IRS_1075_9.3 |
.14.3 |
IRS_1075_9.3.14.3 |
IRS 1075 9.3.14.3 |
Risk Assessment |
Vulnerability Scanning (RA-5) |
|
n/a |
The agency must:
a. Scan for vulnerabilities in the information system and hosted applications at a minimum of monthly for all systems and when new vulnerabilities potentially affecting the system/applications are identified and reported
b. Employ vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations
2. Formatting checklists and test procedures
3. Measuring vulnerability impact
c. Analyze vulnerability scan reports and results from security control assessments
d. Remediate legitimate vulnerabilities in accordance with an assessment of risk
e. Share information obtained from the vulnerability scanning process and security control assessments with designated agency officials to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies)
f. Employ vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned (CE1) |
link |
4 |
| IRS_1075_9.3 |
.16.15 |
IRS_1075_9.3.16.15 |
IRS 1075 9.3.16.15 |
System and Communications Protection |
Protection of Information at Rest (SC-28) |
|
n/a |
The information system must protect the confidentiality and integrity of FTI at rest. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems.
Agencies may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms, file share scanning, and integrity protection. Agencies may also employ other security controls, including, for example, secure offline storage in lieu of online storage, when adequate protection of information at rest cannot otherwise be achieved or when continuously monitoring to identify malicious code at rest.
The confidentiality and integrity of information at rest shall be protected when located on a secondary (non-mobile) storage device (e.g., disk drive, tape drive) with cryptography mechanisms
FTI stored on deployed user workstations, in non-volatile storage, shall be encrypted with FIPS-validated or National Security Agency (NSA)-approved encryption during storage (regardless of location) except when no approved encryption technology solution is available that addresses the specific technology.
Mobile devices do require encryption at rest (see Section 9.3.1.14, Access Control for Mobile Devices (AC-19), and Section 9.4.8, Mobile Devices). |
link |
3 |
| IRS_1075_9.3 |
.17.4 |
IRS_1075_9.3.17.4 |
IRS 1075 9.3.17.4 |
System and Information Integrity |
Information System Monitoring (SI-4) |
|
n/a |
The agency must:
a. Monitor the information system to detect:
1. Attacks and indicators of potential attacks
2. Unauthorized local, network, and remote connections
b. Identify unauthorized use of the information system
c. Deploy monitoring devices: (i) strategically within the information system to collect agency-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the agency
d. Protect information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion
e. Heighten the level of information system monitoring activity whenever there is an indication of increased risk to agency operations and assets, individuals, other organizations, or the nation, based on law enforcement information, intelligence information, or other credible sources of information
f. Provide information system monitoring information to designated agency officials as needed
g. Analyze outbound communications traffic at the external boundary of the information system and selected interior points within the network (e.g., subnetworks, subsystems) to discover anomalies--anomalies within agency information systems include, for example, large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses
h. Employ automated mechanisms to alert security personnel of inappropriate or unusual activities with security implications (CE11)
i. Implement host-based monitoring mechanisms (e.g., Host intrusion prevention system (HIPS)) on information systems that receive, process, store, or transmit FTI (CE23)
The information system must:
a. Monitor inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions (CE4)
b. Alert designated agency officials when indications of compromise or potential compromise occur--alerts may be generated from a variety of sources, including, for example, audit records or inputs from malicious code protection mechanisms; intrusion detection or prevention mechanisms; or boundary protection devices, such as firewalls, gateways, and routers and alerts can be transmitted, for example, telephonically, by electronic mail messages, or by text messaging; agency personnel on the notification list can include, for example, system administrators, mission/business owners, system owners, or information system security officers (CE5)
c. Notify designated agency officials of detected suspicious events and take necessary actions to address suspicious events (CE7)
Information system monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the information system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the information system.
Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software).
Strategic locations for monitoring devices include, for example, selected perimeter locations and nearby server farms supporting critical applications, with such devices typically being employed at the managed interfaces. |
link |
2 |
| IRS_1075_9.3 |
.3.11 |
IRS_1075_9.3.3.11 |
IRS 1075 9.3.3.11 |
Awareness and Training |
Audit Generation (AU-12) |
|
n/a |
The information system must:
a. Provide audit record generation capability for the auditable events defined in Section 9.3.3.2, Audit Events (AU-2)
b. Allow designated agency officials to select which auditable events are to be audited by specific components of the information system
c. Generate audit records for the events with the content defined in Section 9.3.3.4, Content of Audit Records (AU-3).
|
link |
4 |
| IRS_1075_9.3 |
.3.5 |
IRS_1075_9.3.3.5 |
IRS 1075 9.3.3.5 |
Awareness and Training |
Response to Audit Processing Failures (AU-5) |
|
n/a |
The information system must:
a. Alert designated agency officials in the event of an audit processing failure
b. Monitor system operational status using operating system or system audit logs and verify functions and performance of the system. Logs shall be able to identify where system process failures have taken place and provide information relative to corrective actions to be taken by the system administrator
c. Provide a warning when allocated audit record storage volume reaches a maximum audit record storage capacity (CE1) |
link |
4 |
| ISO_IEC_27001_2022 |
10.2 |
ISO_IEC_27001_2022_10.2 |
ISO IEC 27001 2022 10.2 |
Improvement |
Nonconformity and corrective action |
Shared |
1. When a nonconformity occurs, the organization shall:
a. react to the nonconformity, and as applicable:
i. take action to control and correct it;
ii. deal with the consequences;
b. evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by:
i. reviewing the nonconformity;
ii. determining the causes of the nonconformity; and
iii. determining if similar nonconformities exist, or could potentially occur;
c. implement any action needed;
d. review the effectiveness of any corrective action taken; and
e. make changes to the information security management system, if necessary.
2. Corrective actions shall be appropriate to the effects of the nonconformities encountered.
3. Documented information shall be available as evidence of:
a. the nature of the nonconformities and any subsequent actions taken,
b. the results of any corrective action. |
Specifies the actions that the organisation shall take in cases of nonconformity. |
|
18 |
| ISO_IEC_27001_2022 |
7.5.3 |
ISO_IEC_27001_2022_7.5.3 |
ISO IEC 27001 2022 7.5.3 |
Support |
Control of documented information |
Shared |
1. Documented information required by the information security management system and by this document shall be controlled to ensure:
a. it is available and suitable for use, where and when it is needed; and
b. it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).
2. For the control of documented information, the organization shall address the following activities, as applicable:
a. distribution, access, retrieval and use;
b. storage and preservation, including the preservation of legibility;
c. control of changes (e.g. version control); and
d. retention and disposition. |
Specifies that the documented information of external origin, determined by the organization to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled |
|
32 |
| ISO_IEC_27001_2022 |
9.1 |
ISO_IEC_27001_2022_9.1 |
ISO IEC 27001 2022 9.1 |
Performance Evaluation |
Monitoring, measurement, analysis and evaluation |
Shared |
1. The organization shall determine:
a. what needs to be monitored and measured, including information security processes and controls;
b. the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results. The methods selected should produce comparable and reproducible results to be considered valid;
c. when the monitoring and measuring shall be performed;
d. who shall monitor and measure;
e. when the results from monitoring and measurement shall be analysed and evaluated;
f. who shall analyse and evaluate these results.
2. Documented information shall be available as evidence of the results. |
Specifies that the organisation must evaluate information security performance and the effectiveness of the information security management system. |
|
43 |
| ISO_IEC_27001_2022 |
9.3.3 |
ISO_IEC_27001_2022_9.3.3 |
ISO IEC 27001 2022 9.3.3 |
Internal Audit |
Management Review Results |
Shared |
The results of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system. |
Specifies the considertions that the management review results shall include. |
|
16 |
| ISO_IEC_27002_2022 |
5.5 |
ISO_IEC_27002_2022_5.5 |
ISO IEC 27002 2022 5.5 |
Identifying,
Protection,
Response,
Recovery,
Preventive,
Corrective Control |
Contact with authorities |
Shared |
The organization should establish and maintain contact with relevant authorities.
|
To ensure appropriate flow of information takes place with respect to information security between
the organization and relevant legal, regulatory and supervisory authorities. |
|
13 |
| ISO_IEC_27002_2022 |
8.16 |
ISO_IEC_27002_2022_8.16 |
ISO IEC 27002 2022 8.16 |
Response,
Detection,
Corrective Control |
Monitoring activities |
Shared |
Networks, systems and applications should be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.
|
To detect anomalous behaviour and potential information security incidents. |
|
15 |
| ISO_IEC_27002_2022 |
8.7 |
ISO_IEC_27002_2022_8.7 |
ISO IEC 27002 2022 8.7 |
Identifying,
Protection,
Preventive Control |
Protection against malware |
Shared |
Protection against malware should be implemented and supported by appropriate user awareness.
|
To ensure information and other associated assets are protected against malware. |
|
19 |
| ISO_IEC_27002_2022 |
8.8 |
ISO_IEC_27002_2022_8.8 |
ISO IEC 27002 2022 8.8 |
Identifying,
Protection,
Preventive Control |
Management of technical vulnerabilities |
Shared |
Information about technical vulnerabilities of information systems in use should be obtained, the organization’s exposure to such vulnerabilities should be evaluated and appropriate measures should be taken.
|
To prevent exploitation of technical vulnerabilities. |
|
14 |
| New_Zealand_ISM |
07.1.7.C.02 |
New_Zealand_ISM_07.1.7.C.02 |
New_Zealand_ISM_07.1.7.C.02 |
07. Information Security Incidents |
07.1.7.C.02 Preventing and detecting information security incidents |
|
n/a |
Agencies SHOULD develop, implement and maintain tools and procedures covering the detection of potential information security incidents, incorporating: user awareness and training; counter-measures against malicious code, known attack methods and types; intrusion detection strategies; data egress monitoring & control; access control anomalies; audit analysis; system integrity checking; and vulnerability assessments. |
|
16 |
| NIST_CSF_v2.0 |
DE.CM |
NIST_CSF_v2.0_DE.CM |
404 not found |
|
|
|
n/a |
n/a |
|
15 |
| NIST_CSF_v2.0 |
DE.CM_09 |
NIST_CSF_v2.0_DE.CM_09 |
NIST CSF v2.0 DE.CM 09 |
DETECT- Continuous Monitoring |
Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events. |
Shared |
n/a |
To identify and analyze the cybersecurity attacks and compromises. |
|
24 |
| NIST_CSF_v2.0 |
GV.SC_07 |
NIST_CSF_v2.0_GV.SC_07 |
NIST CSF v2.0 GV.SC 07 |
GOVERN-Cybersecurity Supply Chain Risk Management |
The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship. |
Shared |
n/a |
To establish, communicate, and monitor the risk management strategy, expectations, and policy. |
|
17 |
| NIST_CSF_v2.0 |
PR.PS_05 |
NIST_CSF_v2.0_PR.PS_05 |
NIST CSF v2.0 PR.PS 05 |
PROTECT-Platform Security |
Installation and execution of unauthorized software are prevented. |
Shared |
n/a |
To implement safeguards for managing organization’s cybersecurity risks. |
|
9 |
| NIST_SP_800-171_R2_3 |
.11.2 |
NIST_SP_800-171_R2_3.11.2 |
NIST SP 800-171 R2 3.11.2 |
Risk Assessment |
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Organizations determine the required vulnerability scanning for all system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. The vulnerabilities to be scanned are readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This process ensures that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in source code reviews and in a variety of tools (e.g., static analysis tools, web-based application scanners, binary analyzers) and in source code reviews. Vulnerability scanning includes: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms. To facilitate interoperability, organizations consider using products that are Security Content Automated Protocol (SCAP)-validated, scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention, and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of system vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Security assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). In certain situations, the nature of the vulnerability scanning may be more intrusive or the system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates thorough vulnerability scanning and protects the sensitive nature of such scanning. [SP 800-40] provides guidance on vulnerability management. |
link |
19 |
| NIST_SP_800-171_R2_3 |
.11.3 |
NIST_SP_800-171_R2_3.11.3 |
NIST SP 800-171 R2 3.11.3 |
Risk Assessment |
Remediate vulnerabilities in accordance with risk assessments. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Vulnerabilities discovered, for example, via the scanning conducted in response to 3.11.2, are remediated with consideration of the related assessment of risk. The consideration of risk influences the prioritization of remediation efforts and the level of effort to be expended in the remediation for specific vulnerabilities. |
link |
18 |
| NIST_SP_800-171_R2_3 |
.14.6 |
NIST_SP_800-171_R2_3.14.6 |
NIST SP 800-171 R2 3.14.6 |
System and Information Integrity |
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the system. Organizations can monitor systems, for example, by observing audit record activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. System monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms supporting critical applications, with such devices being employed at managed system interfaces. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of systems to support such objectives. System monitoring is an integral part of continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless. Unusual or unauthorized activities or conditions related to inbound/outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. [SP 800-94] provides guidance on intrusion detection and prevention systems. |
link |
27 |
| NIST_SP_800-171_R2_3 |
.14.7 |
NIST_SP_800-171_R2_3.14.7 |
NIST SP 800-171 R2 3.14.7 |
System and Information Integrity |
Identify unauthorized use of organizational systems. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. System monitoring can detect unauthorized use of organizational systems. System monitoring is an integral part of continuous monitoring and incident response programs. Monitoring is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Output from system monitoring serves as input to continuous monitoring and incident response programs. Unusual/unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. [SP 800-94] provides guidance on intrusion detection and prevention systems. |
link |
20 |
| NIST_SP_800-171_R2_3 |
.3.1 |
NIST_SP_800-171_R2_3.3.1 |
NIST SP 800-171 R2 3.3.1 |
Audit and Accountability |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures. Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. [SP 800-92] provides guidance on security log management. |
link |
48 |
| NIST_SP_800-171_R2_3 |
.3.2 |
NIST_SP_800-171_R2_3.3.2 |
NIST SP 800-171 R2 3.3.2 |
Audit and Accountability |
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
This requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible. Organizations consider logging for traceability including results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, communications at system boundaries, configuration settings, physical access, nonlocal maintenance, use of maintenance tools, temperature and humidity, equipment delivery and removal, system component inventory, use of mobile code, and use of Voice over Internet Protocol (VoIP). |
link |
34 |
| NIST_SP_800-171_R2_3 |
.3.4 |
NIST_SP_800-171_R2_3.3.4 |
NIST SP 800-171 R2 3.3.4 |
Audit and Accountability |
Alert in the event of an audit logging process failure. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Audit logging process failures include software and hardware errors, failures in the audit record capturing mechanisms, and audit record storage capacity being reached or exceeded. This requirement applies to each audit record data storage repository (i.e., distinct system component where audit records are stored), the total audit record storage capacity of organizations (i.e., all audit record data storage repositories combined), or both. |
link |
12 |
| NIST_SP_800-171_R2_3 |
.3.5 |
NIST_SP_800-171_R2_3.3.5 |
NIST SP 800-171 R2 3.3.5 |
Audit and Accountability |
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Correlating audit record review, analysis, and reporting processes helps to ensure that they do not operate independently, but rather collectively. Regarding the assessment of a given organizational system, the requirement is agnostic as to whether this correlation is applied at the system level or at the organization level across all systems. |
link |
13 |
| NIST_SP_800-171_R3_3 |
.11.2 |
NIST_SP_800-171_R3_3.11.2 |
NIST 800-171 R3 3.11.2 |
Risk Assessment Control |
Vulnerability Monitoring and Scanning |
Shared |
Organizations determine the required vulnerability scanning for system components and ensure that potential sources of vulnerabilities (e.g., networked printers, scanners, and copiers) are not overlooked. Vulnerability analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, or binary analysis. Organizations can use these approaches in source code reviews and tools (e.g., static analysis tools, web-based application scanners, binary analyzers). Vulnerability scanning includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating flow control mechanisms.
To facilitate interoperability, organizations consider using products that are Security Content Automated Protocol (SCAP)-validated and that employ the Extensible Configuration Checklist Description Format (XCCDF). Organizations also consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL). Sources for vulnerability information also include the Common Weakness Enumeration (CWE) listing, the National Vulnerability Database (NVD), and the Common Vulnerability Scoring System (CVSS). |
a. Monitor and scan for vulnerabilities in the system periodically and when new vulnerabilities affecting the system are identified.
b. Remediate system vulnerabilities within [Assignment: organization-defined response times].
c. Update system vulnerabilities to be scanned periodically and when new vulnerabilities are identified and reported. |
|
15 |
| NIST_SP_800-171_R3_3 |
.12.3 |
NIST_SP_800-171_R3_3.12.3 |
NIST 800-171 R3 3.12.3 |
Security Assessment Control |
Continuous Monitoring |
Shared |
Continuous monitoring at the system level facilitates ongoing awareness of the system security posture to support risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their systems at a frequency that is sufficient to support risk based decisions. Different types of security requirements may require different monitoring frequencies. |
Continuous monitoring at the system level facilitates ongoing awareness of the system security posture to support risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their systems at a frequency that is sufficient to support risk based decisions. Different types of security requirements may require different monitoring frequencies. |
|
17 |
| NIST_SP_800-171_R3_3 |
.14.1 |
NIST_SP_800-171_R3_3.14.1 |
NIST 800-171 R3 3.14.1 |
System and Information Integrity Control |
Flaw Remediation |
Shared |
Organizations identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities that result from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address the flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources, such as the Common Weakness Enumeration (CWE) or Common Vulnerabilities and Exposures (CVE) databases, in remediating the flaws discovered in organizational systems. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors, including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types of remediation. |
a. Identify, report, and correct system flaws.
b. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates. |
|
23 |
| NIST_SP_800-171_R3_3 |
.14.2 |
NIST_SP_800-171_R3_3.14.2 |
NIST 800-171 R3 3.14.2 |
System and Information Integrity Control |
Malicious Code Protection |
Shared |
Malicious code insertions occur through the exploitation of system vulnerabilities. Periodic scans of the system and real-time scans of files from external sources as files are downloaded, opened, or executed can detect malicious code. Malicious code can be inserted into the system in many ways, including by email, the Internet, and portable storage devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can be encoded in various formats, contained in compressed or hidden files, or hidden in files using techniques such as steganography. In addition to the above technologies, pervasive configuration management, comprehensive software integrity controls, and anti-exploitation software may be effective in preventing the execution of unauthorized code. Malicious code may be present in commercial off-the-shelf software and custom-built software and could include logic bombs, backdoors, and other types of attacks that could affect organizational mission and business functions.
If malicious code cannot be detected by detection methods or technologies, organizations can rely on secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to help ensure that the software only performs intended functions. Organizations may determine that different actions are warranted in response to the detection of malicious code. For example, organizations can define actions to be taken in response to malicious code detection during scans, the detection of malicious downloads, or the detection of maliciousness when attempting to open or execute files. |
a. Implement malicious code protection mechanisms at designated locations within the system to detect and eradicate malicious code.
b. Update malicious code protection mechanisms as new releases are available in accordance with configuration management policy and procedures.
c. Configure malicious code protection mechanisms to:
1. Perform scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at endpoints or network entry and exit points as the files are downloaded, opened, or executed; and
2. Block malicious code, quarantine malicious code, or take other actions in response to malicious code detection. |
|
19 |
| NIST_SP_800-171_R3_3 |
.14.6 |
NIST_SP_800-171_R3_3.14.6 |
NIST 800-171 R3 3.14.6 |
System and Information Integrity Control |
System Monitoring |
Shared |
System monitoring involves external and internal monitoring. External monitoring includes the observation of events that occur at the system boundary. Internal monitoring includes the observation of events that occur within the system. Organizations can monitor the system, for example, by observing audit record activities in real time or by observing other system aspects, such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events.
A system monitoring capability is achieved through a variety of tools and techniques (e.g., audit record monitoring software, intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms that support critical applications with such devices being employed at managed system interfaces.
The granularity of monitoring the information collected is based on organizational monitoring objectives and the capability of the system to support such objectives.
Systems connections can be network, remote, or local. A network connection is any connection with a device that communicates through a network (e.g., local area network, the internet). A remote connection is any connection with a device that communicates through an external network (e.g., the internet). Network, remote, and local connections can be either wired or wireless.
Unusual or unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in the system or propagating among system components, the unauthorized export of information, or signaling to external systems. Evidence of malicious code is used to identify a potentially compromised system. System monitoring requirements, including the need for types of system monitoring, may be referenced in other requirements. |
a. Monitor the system to detect:
1. Attacks and indicators of potential attacks; and
2. Unauthorized connections.
b. Identify unauthorized use of the system.
c. Monitor inbound and outbound communications traffic to detect unusual or unauthorized activities or conditions. |
|
14 |
| NIST_SP_800-171_R3_3 |
.4.3 |
NIST_SP_800-171_R3_3.4.3 |
404 not found |
|
|
|
n/a |
n/a |
|
16 |
| NIST_SP_800-53_R4 |
AC-16 |
NIST_SP_800-53_R4_AC-16 |
NIST SP 800-53 Rev. 4 AC-16 |
Access Control |
Security Attributes |
Customer |
n/a |
The organization:
a. Provides the means to associate [Assignment: organization-defined types of security attributes] having [Assignment: organization-defined security attribute values] with information in storage, in process, and/or in transmission;
b. Ensures that the security attribute associations are made and retained with the information;
c. Establishes the permitted [Assignment: organization-defined security attributes] for [Assignment: organization-defined information systems]; and
d. Determines the permitted [Assignment: organization-defined values or ranges] for each of the established security attributes. |
link |
2 |
| NIST_SP_800-53_R4 |
AU-12 |
NIST_SP_800-53_R4_AU-12 |
NIST SP 800-53 Rev. 4 AU-12 |
Audit And Accountability |
Audit Generation |
Shared |
n/a |
The information system:
a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];
b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and
c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Supplemental Guidance: Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. Related controls: AC-3, AU-2, AU-3, AU-6, AU-7.
References: None. |
link |
34 |
| NIST_SP_800-53_R4 |
AU-12(1) |
NIST_SP_800-53_R4_AU-12(1) |
NIST SP 800-53 Rev. 4 AU-12 (1) |
Audit And Accountability |
System-Wide / Time-Correlated Audit Trail |
Shared |
n/a |
The information system compiles audit records from [Assignment: organization-defined information system components] into a system-wide (logical or physical) audit trail that is time- correlated to within [Assignment: organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail].
Supplemental Guidance: Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances. Related controls: AU-8, AU-12. |
link |
31 |
| NIST_SP_800-53_R4 |
AU-6 |
NIST_SP_800-53_R4_AU-6 |
NIST SP 800-53 Rev. 4 AU-6 |
Audit And Accountability |
Audit Review, Analysis, And Reporting |
Shared |
n/a |
The organization:
a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and
b. Reports findings to [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP. Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority. Related controls: AC-2, AC-3, AC-6, AC-17, AT-3, AU-7, AU-16, CA-7, CM-5, CM-10, CM-11, IA-3, IA-5, IR-5, IR-6, MA-4, MP-4, PE-3, PE-6, PE-14, PE-16, RA-5, SC-7, SC-18, SC-19, SI-3, SI-4, SI-7.
References: None. |
link |
25 |
| NIST_SP_800-53_R4 |
AU-6(4) |
NIST_SP_800-53_R4_AU-6(4) |
NIST SP 800-53 Rev. 4 AU-6 (4) |
Audit And Accountability |
Central Review And Analysis |
Shared |
n/a |
The information system provides the capability to centrally review and analyze audit records from multiple components within the system.
Supplemental Guidance: Automated mechanisms for centralized reviews and analyses include, for example, Security Information Management products. Related controls: AU-2, AU-12. |
link |
30 |
| NIST_SP_800-53_R4 |
AU-6(5) |
NIST_SP_800-53_R4_AU-6(5) |
NIST SP 800-53 Rev. 4 AU-6 (5) |
Audit And Accountability |
Integration / Scanning And Monitoring Capabilities |
Shared |
n/a |
The organization integrates analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; information system monitoring information; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.
Supplemental Guidance: This control enhancement does not require vulnerability scanning, the generation of performance data, or information system monitoring. Rather, the enhancement requires that the analysis of information being otherwise produced in these areas is integrated with the analysis of audit information. Security Event and Information Management System tools can facilitate audit record aggregation/consolidation from multiple information system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches for analyzing audit record information collected. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans and correlating attack detection events with scanning results. Correlation with performance data can help uncover denial of service attacks or cyber attacks resulting in unauthorized use of resources. Correlation with system monitoring information can assist in uncovering attacks and in better relating audit information to operational situations. Related controls: AU-12, IR-4, RA-5. |
link |
31 |
| NIST_SP_800-53_R4 |
IR-4 |
NIST_SP_800-53_R4_IR-4 |
NIST SP 800-53 Rev. 4 IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
The organization:
a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinates incident handling activities with contingency planning activities; and
c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.
Supplemental Guidance: Organizations recognize that incident response capability is dependent on the capabilities of organizational information systems and the mission/business processes being supported by those systems. Therefore, organizations consider incident response as part of the definition, design, and development of mission/business processes and information systems. Incident-related information can be obtained from a variety of sources including, for example, audit monitoring, network monitoring, physical access monitoring, user/administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including, for example, mission/business owners, information system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive (function). Related controls: AU-6, CM-6, CP-2, CP-4, IR-2, IR-3, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: Executive Order 13587; NIST Special Publication 800-61. |
link |
24 |
| NIST_SP_800-53_R4 |
IR-5 |
NIST_SP_800-53_R4_IR-5 |
NIST SP 800-53 Rev. 4 IR-5 |
Incident Response |
Incident Monitoring |
Shared |
n/a |
The organization tracks and documents information system security incidents.
Supplemental Guidance: Documenting information system security incidents includes, for example, maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including, for example, incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. Related controls: AU-6, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: NIST Special Publication 800-61. |
link |
13 |
| NIST_SP_800-53_R4 |
RA-5 |
NIST_SP_800-53_R4_RA-5 |
NIST SP 800-53 Rev. 4 RA-5 |
Risk Assessment |
Vulnerability Scanning |
Shared |
n/a |
The organization:
a. Scans for vulnerabilities in the information system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;
b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyzes vulnerability scan reports and results from security control assessments;
d. Remediates legitimate vulnerabilities [Assignment: organization-defined response times], in accordance with an organizational assessment of risk; and
e. Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
Supplemental Guidance: Security categorization of information systems guides the frequency and comprehensiveness of vulnerability scans. Organizations determine the required vulnerability scanning for all information system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in a variety of tools (e.g., web-based application scanners, static analysis tools, binary analyzers) and in source code reviews. Vulnerability scanning includes, for example: (i) scanning for patch levels; (ii) scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and (iii) scanning for improperly configured or incorrectly operating information flow control mechanisms. Organizations consider using tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine/test for the presence of vulnerabilities. Suggested sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). In addition, security control assessments such as red team exercises provide other sources of potential vulnerabilities for which to scan. Organizations also consider using tools that express vulnerability impact by the
Common Vulnerability Scoring System (CVSS). Related controls: CA-2, CA-7, CM-4, CM-6, RA-2, RA-3, SA-11, SI-2.
References: NIST Special Publications 800-40, 800-70, 800-115; Web: http://cwe.mitre.org, http://nvd.nist.gov. |
link |
18 |
| NIST_SP_800-53_R4 |
SI-4 |
NIST_SP_800-53_R4_SI-4 |
NIST SP 800-53 Rev. 4 SI-4 |
System And Information Integrity |
Information System Monitoring |
Shared |
n/a |
The organization:
a. Monitors the information system to detect:
1. Attacks and indicators of potential attacks in accordance with [Assignment: organization- defined monitoring objectives]; and
2. Unauthorized local, network, and remote connections;
b. Identifies unauthorized use of the information system through [Assignment: organization- defined techniques and methods];
c. Deploys monitoring devices: (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization;
d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;
e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;
f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and
g. Provides [Assignment: or ganization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].
Supplemental Guidance: Information system monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the information system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the information system. Organizations can monitor information systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include, for example, selected perimeter locations and near server farms supporting critical applications, with such devices typically being employed at the managed interfaces associated with controls SC-7 and AC-17. Einstein network monitoring devices from the Department of Homeland Security can also be included as monitoring devices. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of information systems to support such objectives. Specific types of transactions of interest include, for example, Hyper Text Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. Information system monitoring is an integral part of organizational continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless. Related controls: AC-3, AC-4, AC-8, AC-17, AU-2, AU-6, AU-7, AU-9, AU-12, CA-7, IR-4, PE-3, RA-5, SC-7, SC-26, SC-35, SI-3, SI-7.
References: NIST Special Publications 800-61, 800-83, 800-92, 800-94, 800-137. |
link |
22 |
| NIST_SP_800-53_R5.1.1 |
CA.7 |
NIST_SP_800-53_R5.1.1_CA.7 |
NIST SP 800-53 R5.1.1 CA.7 |
Assessment, Authorization and Monitoring Control |
Continuous Monitoring |
Shared |
Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:
a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];
b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness;
c. Ongoing control assessments in accordance with the continuous monitoring strategy;
d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
e. Correlation and analysis of information generated by control assessments and monitoring;
f. Response actions to address results of the analysis of control assessment and monitoring information; and
g. Reporting the security and privacy status of the system to [Assignment: organization-defined personnel or roles]
[Assignment: organization-defined frequency]. |
Continuous monitoring at the system level facilitates ongoing awareness of the system security and privacy posture to support organizational risk management decisions. The terms “continuous” and “ongoing” imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring generate risk response actions by organizations. When monitoring the effectiveness of multiple controls that have been grouped into capabilities, a root-cause analysis may be needed to determine the specific control that has failed. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security and privacy information on a continuing basis through reports and dashboards gives organizational officials the ability to make effective and timely risk management decisions, including ongoing authorization decisions.
Automation supports more frequent updates to hardware, software, and firmware inventories, authorization packages, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of systems. Monitoring requirements, including the need for specific monitoring, may be referenced in other controls and control enhancements, such as AC-2g, AC-2(7), AC-2(12)(a), AC-2(7)(b), AC-2(7)(c), AC-17(1), AT-4a, AU-13, AU-13(1), AU-13(2), CM-3f, CM-6d, CM-11c, IR-5, MA-2b, MA-3a, MA-4a, PE-3d, PE-6, PE-14b, PE-16, PE-20, PM-6, PM-23, PM-31, PS-7e, SA-9c, SR-4, SC-5(3)(b), SC-7a, SC-7(24)(b), SC-18c, SC-43b, and SI-4. |
|
17 |
| NIST_SP_800-53_R5.1.1 |
CA.7.4 |
NIST_SP_800-53_R5.1.1_CA.7.4 |
NIST SP 800-53 R5.1.1 CA.7.4 |
Assessment, Authorization and Monitoring Control |
Continuous Monitoring | Risk Monitoring |
Shared |
Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:
(a) Effectiveness monitoring;
(b) Compliance monitoring; and
(c) Change monitoring. |
Risk monitoring is informed by the established organizational risk tolerance. Effectiveness monitoring determines the ongoing effectiveness of the implemented risk response measures. Compliance monitoring verifies that required risk response measures are implemented. It also verifies that security and privacy requirements are satisfied. Change monitoring identifies changes to organizational systems and environments of operation that may affect security and privacy risk. |
|
14 |
| NIST_SP_800-53_R5.1.1 |
RA.5 |
NIST_SP_800-53_R5.1.1_RA.5 |
NIST SP 800-53 R5.1.1 RA.5 |
Risk Assessment Control |
Vulnerability Monitoring and Scanning |
Shared |
a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyze vulnerability scan reports and results from vulnerability monitoring;
d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;
e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and
f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned. |
Security categorization of information and systems guides the frequency and comprehensiveness of vulnerability monitoring (including scans). Organizations determine the required vulnerability monitoring for system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, guards, sensors), networked printers, scanners, and copiers—are not overlooked. The capability to readily update vulnerability monitoring tools as new vulnerabilities are discovered and announced and as new scanning methods are developed helps to ensure that new vulnerabilities are not missed by employed vulnerability monitoring tools. The vulnerability monitoring tool update process helps to ensure that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability monitoring and analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can use these analysis approaches in source code reviews and in a variety of tools, including web-based application scanners, static analysis tools, and binary analyzers.
Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).
Vulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation.
Organizations may also employ the use of financial incentives (also known as “bug bounties”) to further encourage external security researchers to report discovered vulnerabilities. Bug bounty programs can be tailored to the organization’s needs. Bounties can be operated indefinitely or over a defined period of time and can be offered to the general public or to a curated group. Organizations may run public and private bounties simultaneously and could choose to offer partially credentialed access to certain participants in order to evaluate security vulnerabilities from privileged vantage points. |
|
13 |
| NIST_SP_800-53_R5.1.1 |
SI.16 |
NIST_SP_800-53_R5.1.1_SI.16 |
NIST SP 800-53 R5.1.1 SI.16 |
System and Information Integrity Control |
Memory Protection |
Shared |
Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: organization-defined controls]. |
Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. Controls employed to protect memory include data execution prevention and address space layout randomization. Data execution prevention controls can either be hardware-enforced or software-enforced with hardware enforcement providing the greater strength of mechanism. |
|
8 |
| NIST_SP_800-53_R5.1.1 |
SI.2 |
NIST_SP_800-53_R5.1.1_SI.2 |
NIST SP 800-53 R5.1.1 SI.2 |
System and Information Integrity Control |
Flaw Remediation |
Shared |
a. Identify, report, and correct system flaws;
b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and
d. Incorporate flaw remediation into the organizational configuration management process. |
The need to remediate system flaws applies to all types of software and firmware. Organizations identify systems affected by software flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated organizational personnel with information security and privacy responsibilities. Security-relevant updates include patches, service packs, and malicious code signatures. Organizations also address flaws discovered during assessments, continuous monitoring, incident response activities, and system error handling. By incorporating flaw remediation into configuration management processes, required remediation actions can be tracked and verified.
Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of risk factors, including the security category of the system, the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw), the organizational risk tolerance, the mission supported by the system, or the threat environment. Some types of flaw remediation may require more testing than other types. Organizations determine the type of testing needed for the specific type of flaw remediation activity under consideration and the types of changes that are to be configuration-managed. In some situations, organizations may determine that the testing of software or firmware updates is not necessary or practical, such as when implementing simple malicious code signature updates. In testing decisions, organizations consider whether security-relevant software or firmware updates are obtained from authorized sources with appropriate digital signatures. |
|
23 |
| NIST_SP_800-53_R5.1.1 |
SI.3 |
NIST_SP_800-53_R5.1.1_SI.3 |
NIST SP 800-53 R5.1.1 SI.3 |
System and Information Integrity Control |
Malicious Code Protection |
Shared |
a. Implement [Selection (one or more): signature based; non-signature based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
c. Configure malicious code protection mechanisms to:
1. Perform periodic scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection (one or more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and
2. [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: organization-defined action]
]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection; and
d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system. |
System entry and exit points include firewalls, remote access servers, workstations, electronic mail servers, web servers, proxy servers, notebook computers, and mobile devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can also be encoded in various formats contained within compressed or hidden files or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways, including by electronic mail, the world-wide web, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities. A variety of technologies and methods exist to limit or eliminate the effects of malicious code.
Malicious code protection mechanisms include both signature- and nonsignature-based technologies. Nonsignature-based detection mechanisms include artificial intelligence techniques that use heuristics to detect, analyze, and describe the characteristics or behavior of malicious code and to provide controls against such code for which signatures do not yet exist or for which existing signatures may not be effective. Malicious code for which active signatures do not yet exist or may be ineffective includes polymorphic malicious code (i.e., code that changes signatures when it replicates). Nonsignature-based mechanisms also include reputation-based technologies. In addition to the above technologies, pervasive configuration management, comprehensive software integrity controls, and anti-exploitation software may be effective in preventing the execution of unauthorized code. Malicious code may be present in commercial off-the-shelf software as well as custom-built software and could include logic bombs, backdoors, and other types of attacks that could affect organizational mission and business functions.
In situations where malicious code cannot be detected by detection methods or technologies, organizations rely on other types of controls, including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to ensure that software does not perform functions other than the functions intended. Organizations may determine that, in response to the detection of malicious code, different actions may be warranted. For example, organizations can define actions in response to malicious code detection during periodic scans, the detection of malicious downloads, or the detection of maliciousness when attempting to open or execute files. |
|
19 |
| NIST_SP_800-53_R5.1.1 |
SI.4 |
NIST_SP_800-53_R5.1.1_SI.4 |
NIST SP 800-53 R5.1.1 SI.4 |
System and Information Integrity Control |
System Monitoring |
Shared |
a. Monitor the system to detect:
1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and
2. Unauthorized local, network, and remote connections;
b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];
c. Invoke internal monitoring capabilities or deploy monitoring devices:
1. Strategically within the system to collect organization-determined essential information; and
2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
d. Analyze detected events and anomalies;
e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
f. Obtain legal opinion regarding system monitoring activities; and
g. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles]
[Selection (one or more): as needed;
[Assignment: organization-defined frequency]
]. |
System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software.
Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls SC-7 and AC-17. The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., AC-2g, AC-2(7), AC-2(12)(a), AC-17(1), AU-13, AU-13(1), AU-13(2), CM-3f, CM-6d, MA-3a, MA-4a, SC-5(3)(b), SC-7a, SC-7(24)(b), SC-18b, SC-43b). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. |
|
13 |
| NIST_SP_800-53_R5 |
AC-16 |
NIST_SP_800-53_R5_AC-16 |
NIST SP 800-53 Rev. 5 AC-16 |
Access Control |
Security and Privacy Attributes |
Customer |
n/a |
a. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission;
b. Ensure that the attribute associations are made and retained with the information;
c. Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [Assignment: organization-defined systems]: [Assignment: organization-defined security and privacy attributes];
d. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges for established attributes];
e. Audit changes to attributes; and
f. Review [Assignment: organization-defined security and privacy attributes] for applicability [Assignment: organization-defined frequency]. |
link |
2 |
| NIST_SP_800-53_R5 |
AU-12 |
NIST_SP_800-53_R5_AU-12 |
NIST SP 800-53 Rev. 5 AU-12 |
Audit and Accountability |
Audit Record Generation |
Shared |
n/a |
a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: organization-defined system components];
b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3). |
link |
34 |
| NIST_SP_800-53_R5 |
AU-12(1) |
NIST_SP_800-53_R5_AU-12(1) |
NIST SP 800-53 Rev. 5 AU-12 (1) |
Audit and Accountability |
System-wide and Time-correlated Audit Trail |
Shared |
n/a |
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail]. |
link |
31 |
| NIST_SP_800-53_R5 |
AU-6 |
NIST_SP_800-53_R5_AU-6 |
NIST SP 800-53 Rev. 5 AU-6 |
Audit and Accountability |
Audit Record Review, Analysis, and Reporting |
Shared |
n/a |
a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
b. Report findings to [Assignment: organization-defined personnel or roles]; and
c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. |
link |
25 |
| NIST_SP_800-53_R5 |
AU-6(4) |
NIST_SP_800-53_R5_AU-6(4) |
NIST SP 800-53 Rev. 5 AU-6 (4) |
Audit and Accountability |
Central Review and Analysis |
Shared |
n/a |
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system. |
link |
30 |
| NIST_SP_800-53_R5 |
AU-6(5) |
NIST_SP_800-53_R5_AU-6(5) |
NIST SP 800-53 Rev. 5 AU-6 (5) |
Audit and Accountability |
Integrated Analysis of Audit Records |
Shared |
n/a |
Integrate analysis of audit records with analysis of [Selection (OneOrMore): vulnerability scanning information;performance data;system monitoring information; [Assignment: organization-defined data/information collected from other sources] ] to further enhance the ability to identify inappropriate or unusual activity. |
link |
31 |
| NIST_SP_800-53_R5 |
IR-4 |
NIST_SP_800-53_R5_IR-4 |
NIST SP 800-53 Rev. 5 IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinate incident handling activities with contingency planning activities;
c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization. |
link |
24 |
| NIST_SP_800-53_R5 |
IR-5 |
NIST_SP_800-53_R5_IR-5 |
NIST SP 800-53 Rev. 5 IR-5 |
Incident Response |
Incident Monitoring |
Shared |
n/a |
Track and document incidents. |
link |
13 |
| NIST_SP_800-53_R5 |
RA-5 |
NIST_SP_800-53_R5_RA-5 |
NIST SP 800-53 Rev. 5 RA-5 |
Risk Assessment |
Vulnerability Monitoring and Scanning |
Shared |
n/a |
a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyze vulnerability scan reports and results from vulnerability monitoring;
d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;
e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and
f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned. |
link |
18 |
| NIST_SP_800-53_R5 |
SI-4 |
NIST_SP_800-53_R5_SI-4 |
NIST SP 800-53 Rev. 5 SI-4 |
System and Information Integrity |
System Monitoring |
Shared |
n/a |
a. Monitor the system to detect:
1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and
2. Unauthorized local, network, and remote connections;
b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];
c. Invoke internal monitoring capabilities or deploy monitoring devices:
1. Strategically within the system to collect organization-determined essential information; and
2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
d. Analyze detected events and anomalies;
e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
f. Obtain legal opinion regarding system monitoring activities; and
g. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (OneOrMore): as needed; [Assignment: organization-defined frequency] ] . |
link |
22 |
| NZ_ISM_v3.5 |
ISI-2 |
NZ_ISM_v3.5_ISI-2 |
NZISM Security Benchmark ISI-2 |
Information Security Incidents |
7.1.7 Preventing and detecting information security incidents |
Customer |
n/a |
Processes and procedures for the detection of information security incidents will assist in mitigating attacks using the most common vectors in systems exploits. Automated tools are only as good as their implementation and the level of analysis they perform. If tools are not configured to assess all areas of potential security risk then some vulnerabilities or attacks will not be detected. In addition, if tools are not regularly updated, including updates for new vulnerabilities and attack methods, their effectiveness will be reduced. |
link |
11 |
| NZISM_Security_Benchmark_v1.1 |
DM-6 |
NZISM_Security_Benchmark_v1.1_DM-6 |
NZISM Security Benchmark DM-6 |
Data management |
20.4.4 Database files |
Customer |
Agencies SHOULD protect database files from access that bypass normal access controls. |
Even though a database may provide access controls to stored data, the database files themselves MUST also be protected. |
link |
2 |
| NZISM_v3.7 |
12.4.4.C.01. |
NZISM_v3.7_12.4.4.C.01. |
NZISM v3.7 12.4.4.C.01. |
Product Patching and Updating |
12.4.4.C.01. - mitigate the risk of exploitation by malicious actors and to ensure the ongoing security and integrity of the agency's IT systems and data. |
Shared |
n/a |
Agencies MUST apply all critical security patches as soon as possible and within two (2) days of the release of the patch or update. |
|
24 |
| NZISM_v3.7 |
12.4.4.C.02. |
NZISM_v3.7_12.4.4.C.02. |
NZISM v3.7 12.4.4.C.02. |
Product Patching and Updating |
12.4.4.C.02. - minimise the risk of disruptions or vulnerabilities introduced by the patches. |
Shared |
n/a |
Agencies MUST implement a patch management strategy, including an evaluation or testing process. |
|
28 |
| NZISM_v3.7 |
12.4.4.C.04. |
NZISM_v3.7_12.4.4.C.04. |
NZISM v3.7 12.4.4.C.04. |
Product Patching and Updating |
12.4.4.C.04. - mitigate the risk of exploitation by malicious actors and to ensure the ongoing security and integrity of the agency's IT systems and data. |
Shared |
n/a |
Agencies SHOULD apply all critical security patches as soon as possible and preferably within two (2) days of the release of the patch or update. |
|
28 |
| NZISM_v3.7 |
12.4.4.C.05. |
NZISM_v3.7_12.4.4.C.05. |
NZISM v3.7 12.4.4.C.05. |
Product Patching and Updating |
12.4.4.C.05. - reduce the potential attack surface for malicious actors. |
Shared |
n/a |
Agencies SHOULD apply all non-critical security patches as soon as possible. |
|
26 |
| NZISM_v3.7 |
12.4.4.C.06. |
NZISM_v3.7_12.4.4.C.06. |
NZISM v3.7 12.4.4.C.06. |
Product Patching and Updating |
12.4.4.C.06. - maintain the integrity and effectiveness of the patching process. |
Shared |
n/a |
Agencies SHOULD ensure that security patches are applied through a vendor recommended patch or upgrade process. |
|
25 |
| NZISM_v3.7 |
14.1.8.C.01. |
NZISM_v3.7_14.1.8.C.01. |
NZISM v3.7 14.1.8.C.01. |
Standard Operating Environments |
14.1.8.C.01. - minimise vulnerabilities and enhance system security |
Shared |
n/a |
Agencies SHOULD develop a hardened SOE for workstations and servers, covering:
1. removal of unneeded software and operating system components;
2. removal or disabling of unneeded services, ports and BIOS settings;
3. disabling of unused or undesired functionality in software and operating systems;
4. implementation of access controls on relevant objects to limit system users and programs to the minimum access required;
5. installation of antivirus and anti-malware software;
6. installation of software-based firewalls limiting inbound and outbound network connections;
7. configuration of either remote logging or the transfer of local event logs to a central server; and
8. protection of audit and other logs through the use of a one way pipe to reduce likelihood of compromise key transaction records. |
|
30 |
| NZISM_v3.7 |
14.2.4.C.01. |
NZISM_v3.7_14.2.4.C.01. |
NZISM v3.7 14.2.4.C.01. |
Application Allow listing |
14.2.4.C.01. - mitigate security risks, and ensure compliance with security policies and standards. |
Shared |
n/a |
Agencies SHOULD implement application allow listing as part of the SOE for workstations, servers and any other network device. |
|
25 |
| NZISM_v3.7 |
18.4.10.C.01. |
NZISM_v3.7_18.4.10.C.01. |
NZISM v3.7 18.4.10.C.01. |
Intrusion Detection and Prevention |
18.4.10.C.01. - ensure user awareness of the policies, and handling outbreaks according to established procedures. |
Shared |
n/a |
Agencies MUST:
1. develop and maintain a set of policies and procedures covering how to:
a.minimise the likelihood of malicious code being introduced into a system;
b. prevent all unauthorised code from executing on an agency network;
c. detect any malicious code installed on a system;
d. make their system users aware of the agency's policies and procedures; and
e. ensure that all instances of detected malicious code outbreaks are handled according to established procedures. |
|
16 |
| NZISM_v3.7 |
6.1.9.C.01. |
NZISM_v3.7_6.1.9.C.01. |
NZISM v3.7 6.1.9.C.01. |
Information Security Reviews |
6.1.9.C.01. - ensure alignment with the vulnerability disclosure policy, and implement adjustments and changes consistent with the findings of vulnerability analysis |
Shared |
n/a |
Agencies SHOULD review the components detailed below. Agencies SHOULD also ensure that any adjustments and changes as a result of any vulnerability analysis are consistent with the vulnerability disclosure policy.
1. Information security documentation - The SecPol, Systems Architecture, SRMPs, SSPs, SitePlan, SOPs, the VDP, the IRP, and any third party assurance reports.
2. Dispensations - Prior to the identified expiry date.
3. Operating environment - When an identified threat emerges or changes, an agency gains or loses a function or the operation of functions are moved to a new physical environment.
4. Procedures - After an information security incident or test exercise.
5. System security - Items that could affect the security of the system on a regular basis.
6. Threats - Changes in threat environment and risk profile.
7. NZISM - Changes to baseline or other controls, any new controls and guidance. |
|
16 |
|
op.exp.6 Protection against harmful code |
op.exp.6 Protection against harmful code |
404 not found |
|
|
|
n/a |
n/a |
|
61 |
| PCI_DSS_v4.0.1 |
10.3.4 |
PCI_DSS_v4.0.1_10.3.4 |
PCI DSS v4.0.1 10.3.4 |
Log and Monitor All Access to System Components and Cardholder Data |
Log Integrity Monitoring |
Shared |
n/a |
File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts. |
|
24 |
| PCI_DSS_v4.0.1 |
11.3.1 |
PCI_DSS_v4.0.1_11.3.1 |
PCI DSS v4.0.1 11.3.1 |
Test Security of Systems and Networks Regularly |
Internal Vulnerability Scans |
Shared |
n/a |
Internal vulnerability scans are performed as follows:
• At least once every three months.
• Vulnerabilities that are either high-risk or critical (according to the entity’s vulnerability risk rankings defined at Requirement 6.3.1) are resolved.
• Rescans are performed that confirm all high-risk and all critical vulnerabilities (as noted above) have been resolved.
• Scan tool is kept up to date with latest vulnerability information.
• Scans are performed by qualified personnel and organizational independence of the tester exists. |
|
15 |
| PCI_DSS_v4.0.1 |
11.3.1.1 |
PCI_DSS_v4.0.1_11.3.1.1 |
PCI DSS v4.0.1 11.3.1.1 |
Test Security of Systems and Networks Regularly |
Management of Other Vulnerabilities |
Shared |
n/a |
All other applicable vulnerabilities (those not ranked as high-risk vulnerabilities or critical vulnerabilities according to the entity’s vulnerability risk rankings defined at Requirement 6.3.1) are managed as follows:
• Addressed based on the risk defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1.
• Rescans are conducted as needed. |
|
14 |
| PCI_DSS_v4.0.1 |
11.4.4 |
PCI_DSS_v4.0.1_11.4.4 |
PCI DSS v4.0.1 11.4.4 |
Test Security of Systems and Networks Regularly |
Addressing Penetration Testing Findings |
Shared |
n/a |
Exploitable vulnerabilities and security weaknesses found during penetration testing are corrected as follows:
• In accordance with the entity’s assessment of the risk posed by the security issue as defined in Requirement 6.3.1.
• Penetration testing is repeated to verify the corrections. |
|
14 |
| PCI_DSS_v4.0.1 |
11.5.1 |
PCI_DSS_v4.0.1_11.5.1 |
PCI DSS v4.0.1 11.5.1 |
Test Security of Systems and Networks Regularly |
Intrusion Detection/Prevention |
Shared |
n/a |
Intrusion-detection and/or intrusion-prevention techniques are used to detect and/or prevent intrusions into the network as follows:
• All traffic is monitored at the perimeter of the CDE.
• All traffic is monitored at critical points in the CDE.
• Personnel are alerted to suspected compromises.
• All intrusion-detection and prevention engines, baselines, and signatures are kept up to date |
|
19 |
| PCI_DSS_v4.0.1 |
11.5.1.1 |
PCI_DSS_v4.0.1_11.5.1.1 |
PCI DSS v4.0.1 11.5.1.1 |
Test Security of Systems and Networks Regularly |
Covert Malware Detection |
Shared |
n/a |
Additional requirement for service providers only: Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels. |
|
17 |
| PCI_DSS_v4.0.1 |
11.5.2 |
PCI_DSS_v4.0.1_11.5.2 |
PCI DSS v4.0.1 11.5.2 |
Test Security of Systems and Networks Regularly |
Change-Detection Mechanism Deployment |
Shared |
n/a |
A change-detection mechanism (for example, file integrity monitoring tools) is deployed as follows:
• To alert personnel to unauthorized modification (including changes, additions, and deletions) of critical files.
• To perform critical file comparisons at least once weekly. |
|
27 |
| PCI_DSS_v4.0.1 |
12.4.1 |
PCI_DSS_v4.0.1_12.4.1 |
PCI DSS v4.0.1 12.4.1 |
Support Information Security with Organizational Policies and Programs |
Executive Management Responsibility for PCI DSS |
Shared |
n/a |
Additional requirement for service providers only: Responsibility is established by executive management for the protection of cardholder data and a PCI DSS compliance program to include:
• Overall accountability for maintaining PCI DSS compliance.
• Defining a charter for a PCI DSS compliance program and communication to executive management. |
|
17 |
| PCI_DSS_v4.0.1 |
5.2.1 |
PCI_DSS_v4.0.1_5.2.1 |
PCI DSS v4.0.1 5.2.1 |
Protect All Systems and Networks from Malicious Software |
An anti-malware solution(s) is deployed on all system components, except for those system components identified in periodic evaluations per Requirement 5.2.3 that concludes the system components are not at risk from malware |
Shared |
n/a |
Examine system components to verify that an anti-malware solution(s) is deployed on all system components, except for those determined to not be at risk from malware based on periodic evaluations per Requirement 5.2.3. For any system components without an anti-malware solution, examine the periodic evaluations to verify the component was evaluated and the evaluation concludes that the component is not at risk from malware |
|
19 |
| PCI_DSS_v4.0.1 |
5.2.2 |
PCI_DSS_v4.0.1_5.2.2 |
PCI DSS v4.0.1 5.2.2 |
Protect All Systems and Networks from Malicious Software |
The deployed anti-malware solution(s) detects all known types of malware and removes, blocks, or contains all known types of malware |
Shared |
n/a |
Examine vendor documentation and configurations of the anti-malware solution(s) to verify that the solution detects all known types of malware and removes, blocks, or contains all known types of malware |
|
19 |
| PCI_DSS_v4.0.1 |
5.2.3 |
PCI_DSS_v4.0.1_5.2.3 |
PCI DSS v4.0.1 5.2.3 |
Protect All Systems and Networks from Malicious Software |
Any system components that are not at risk for malware are evaluated periodically to include the following: a documented list of all system components not at risk for malware, identification and evaluation of evolving malware threats for those system components, confirmation whether such system components continue to not require anti-malware protection |
Shared |
n/a |
Examine documented policies and procedures to verify that a process is defined for periodic evaluations of any system components that are not at risk for malware that includes all elements specified in this requirement. Interview personnel to verify that the evaluations include all elements specified in this requirement. Examine the list of system components identified as not at risk of malware and compare to the system components without an anti-malware solution deployed per Requirement 5.2.1 to verify that the system components match for both requirements |
|
19 |
| PCI_DSS_v4.0.1 |
5.3.1 |
PCI_DSS_v4.0.1_5.3.1 |
PCI DSS v4.0.1 5.3.1 |
Protect All Systems and Networks from Malicious Software |
The anti-malware solution(s) is kept current via automatic updates |
Shared |
n/a |
Examine anti-malware solution(s) configurations, including any master installation of the software, to verify the solution is configured to perform automatic updates. Examine system components and logs, to verify that the anti-malware solution(s) and definitions are current and have been promptly deployed |
|
19 |
| PCI_DSS_v4.0.1 |
5.3.2 |
PCI_DSS_v4.0.1_5.3.2 |
PCI DSS v4.0.1 5.3.2 |
Protect All Systems and Networks from Malicious Software |
The anti-malware solution(s) performs periodic scans and active or real-time scans, or performs continuous behavioral analysis of systems or processes |
Shared |
n/a |
Examine anti-malware solution(s) configurations, including any master installation of the software, to verify the solution(s) is configured to perform at least one of the elements specified in this requirement. Examine system components, including all operating system types identified as at risk for malware, to verify the solution(s) is enabled in accordance with at least one of the elements specified in this requirement. Examine logs and scan results to verify that the solution(s) is enabled in accordance with at least one of the elements specified in this requirement |
|
19 |
| PCI_DSS_v4.0.1 |
5.3.3 |
PCI_DSS_v4.0.1_5.3.3 |
PCI DSS v4.0.1 5.3.3 |
Protect All Systems and Networks from Malicious Software |
For removable electronic media, the anti-malware solution(s) performs automatic scans of when the media is inserted, connected, or logically mounted, or performs continuous behavioral analysis of systems or processes when the media is inserted, connected, or logically mounted |
Shared |
n/a |
Examine anti-malware solution(s) configurations to verify that, for removable electronic media, the solution is configured to perform at least one of the elements specified in this requirement. Examine system components with removable electronic media connected to verify that the solution(s) is enabled in accordance with at least one of the elements as specified in this requirement. Examine logs and scan results to verify that the solution(s) is enabled in accordance with at least one of the elements specified in this requirement |
|
19 |
| PCI_DSS_v4.0.1 |
6.3.3 |
PCI_DSS_v4.0.1_6.3.3 |
PCI DSS v4.0.1 6.3.3 |
Develop and Maintain Secure Systems and Software |
All system components are protected from known vulnerabilities by installing applicable security patches/updates as follows: Patches/updates for critical vulnerabilities (identified according to the risk ranking process at Requirement 6.3.1) are installed within one month of release. All other applicable security patches/updates are installed within an appropriate time frame as determined by the entity’s assessment of the criticality of the risk to the environment as identified according to the risk ranking process at Requirement 6.3.1 |
Shared |
n/a |
Examine policies and procedures to verify processes are defined for addressing vulnerabilities by installing applicable security patches/updates in accordance with all elements specified in this requirement. Examine system components and related software and compare the list of installed security patches/updates to the most recent security patch/update information to verify vulnerabilities are addressed in accordance with all elements specified in this requirement |
|
23 |
| PCI_DSS_v4.0.1 |
6.4.1 |
PCI_DSS_v4.0.1_6.4.1 |
PCI DSS v4.0.1 6.4.1 |
Develop and Maintain Secure Systems and Software |
For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods as follows: At least once every 12 months and after significant changes. By an entity that specializes in application security. Including, at a minimum, all common software attacks in Requirement 6.2.4. All vulnerabilities are ranked in accordance with requirement 6.3.1. All vulnerabilities are corrected. The application is re-evaluated after the corrections. OR Installing an automated technical solution(s) that continually detects and prevents web-based attacks as follows: Installed in front of public-facing web applications to detect and prevent web-based attacks. Actively running and up to date as applicable. Generating audit logs. Configured to either block web-based attacks or generate an alert that is immediately investigated |
Shared |
n/a |
For public-facing web applications, ensure that either one of the required methods is in place as follows: If manual or automated vulnerability security assessment tools or methods are in use, examine documented processes, interview personnel, and examine records of application security assessments to verify that public-facing web applications are reviewed in accordance with all elements of this requirement specific to the tool/method. OR If an automated technical solution(s) is installed that continually detects and prevents web-based attacks, examine the system configuration settings and audit logs, and interview responsible personnel to verify that the automated technical solution(s) is installed in accordance with all elements of this requirement specific to the solution(s) |
|
15 |
| RBI_CSF_Banks_v2016 |
13.2 |
RBI_CSF_Banks_v2016_13.2 |
|
Advanced Real-Timethreat Defenceand Management |
Advanced Real-Timethreat Defenceand Management-13.2 |
|
n/a |
Implement Anti-malware, Antivirus protection including behavioural detection systems for all categories of devices ???(Endpoints such as PCs/laptops/ mobile devices etc.), servers (operating systems, databases, applications, etc.), Web/Internet gateways, email-gateways, Wireless networks, SMS servers etc. including tools and processes for centralised management and monitoring. |
|
17 |
| RBI_CSF_Banks_v2016 |
4.9 |
RBI_CSF_Banks_v2016_4.9 |
|
Network Management And Security |
Security Operation Centre-4.9 |
|
n/a |
Security Operation Centre to monitor the logs of various network activities and should have the capability to escalate any abnormal / undesirable activities. |
|
15 |
| RBI_CSF_Banks_v2016 |
5.1 |
RBI_CSF_Banks_v2016_5.1 |
|
Secure Configuration |
Secure Configuration-5.1 |
|
n/a |
Document and apply baseline security requirements/configurations to all
categories of devices (end-points/workstations, mobile devices, operating systems,
databases, applications, network devices, security devices, security systems, etc.),
throughout the lifecycle (from conception to deployment) and carry out reviews
periodically. |
|
8 |
| RBI_CSF_Banks_v2016 |
7.6 |
RBI_CSF_Banks_v2016_7.6 |
|
Patch/Vulnerability & Change Management |
Patch/Vulnerability & Change Management-7.6 |
|
n/a |
As a threat mitigation strategy, identify the root cause of incident and apply
necessary patches to plug the vulnerabilities. |
|
13 |
| RBI_ITF_NBFC_v2017 |
3.1.f |
RBI_ITF_NBFC_v2017_3.1.f |
RBI IT Framework 3.1.f |
Information and Cyber Security |
Maker-checker-3.1 |
|
n/a |
The IS Policy must provide for a IS framework with the following basic tenets:
Maker-checker is one of the important principles of authorization in the information systems of financial entities. For each transaction, there must be at least two individuals necessary for its completion as this will reduce the risk of error and will ensure reliability of information. |
link |
20 |
| RBI_ITF_NBFC_v2017 |
3.1.g |
RBI_ITF_NBFC_v2017_3.1.g |
RBI IT Framework 3.1.g |
Information and Cyber Security |
Trails-3.1 |
|
n/a |
The IS Policy must provide for a IS framework with the following basic tenets:
Trails- NBFCs shall ensure that audit trails exist for IT assets satisfying its business requirements including regulatory and legal requirements, facilitating audit, serving as forensic evidence when required and assisting in dispute resolution. If an employee, for instance, attempts to access an unauthorized section, this improper activity should be recorded in the audit trail. |
link |
33 |
| Sarbanes_Oxley_Act_(1)_2022_1 |
Sarbanes_Oxley_Act_(1)_2022_1 |
Sarbanes_Oxley_Act_(1)_2022_1 |
Sarbanes Oxley Act 2022 1 |
PUBLIC LAW |
Sarbanes Oxley Act 2022 (SOX) |
Shared |
n/a |
n/a |
|
92 |
| SOC_2 |
CC7.2 |
SOC_2_CC7.2 |
SOC 2 Type 2 CC7.2 |
System Operations |
Monitor system components for anomalous behavior |
Shared |
The customer is responsible for implementing this recommendation. |
• Implements Detection Policies, Procedures, and Tools — Detection policies and
procedures are defined and implemented and detection tools are implemented on infrastructure and software to identify anomalies in the operation or unusual activity
on systems. Procedures may include (1) a defined governance process for security
event detection and management that includes provision of resources; (2) use of intelligence sources to identify newly discovered threats and vulnerabilities; and (3)
logging of unusual system activities.
• Designs Detection Measures — Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers;
(2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software.
• Implements Filters to Analyze Anomalies — Management has implemented procedures to filter, summarize, and analyze anomalies to identify security events.
• Monitors Detection Tools for Effective Operation — Management has implemented
processes to monitor the effectiveness of detection tools |
|
20 |
| SOC_2023 |
A1.1 |
SOC_2023_A1.1 |
SOC 2023 A1.1 |
Additional Criteria for Availability |
Effectively manage capacity demand and facilitate the implementation of additional capacity as needed. |
Shared |
n/a |
The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives. |
|
107 |
| SOC_2023 |
CC2.3 |
SOC_2023_CC2.3 |
SOC 2023 CC2.3 |
Information and Communication |
Facilitate effective internal communication. |
Shared |
n/a |
Entity to communicate with external parties regarding matters affecting the functioning of internal control. |
|
214 |
| SOC_2023 |
CC5.3 |
SOC_2023_CC5.3 |
SOC 2023 CC5.3 |
Control Activities |
Maintain alignment with organizational objectives and regulatory requirements. |
Shared |
n/a |
Entity deploys control activities through policies that establish what is expected and in procedures that put policies into action by establishing Policies and Procedures to Support Deployment of Management’s Directives, Responsibility and Accountability for Executing Policies and Procedures, perform tasks in a timely manner, taking corrective actions, perform using competent personnel and reassess policies and procedures. |
|
225 |
| SOC_2023 |
CC6.1 |
SOC_2023_CC6.1 |
SOC 2023 CC6.1 |
Logical and Physical Access Controls |
Mitigate security events and ensuring the confidentiality, integrity, and availability of critical information assets. |
Shared |
n/a |
Entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives by identifying and managing the inventory of information assets, restricting logical access, identification and authentication of users, consider network segmentation, manage points of access, restricting access of information assets, managing identification and authentication, managing credentials for infrastructure and software, using encryption to protect data and protect using encryption keys. |
|
127 |
| SOC_2023 |
CC6.8 |
SOC_2023_CC6.8 |
SOC 2023 CC6.8 |
Logical and Physical Access Controls |
Mitigate the risk of cybersecurity threats, safeguard critical systems and data, and maintain operational continuity and integrity. |
Shared |
n/a |
Entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives. |
|
33 |
| SOC_2023 |
CC7.2 |
SOC_2023_CC7.2 |
SOC 2023 CC7.2 |
Systems Operations |
Maintain robust security measures and ensure operational resilience. |
Shared |
n/a |
The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events. |
|
163 |
| SOC_2023 |
CC7.4 |
SOC_2023_CC7.4 |
SOC 2023 CC7.4 |
Systems Operations |
Effectively manage security incidents, minimize their impact, and protect assets, operations, and reputation. |
Shared |
n/a |
The entity responds to identified security incidents by:
a. Executing a defined incident-response program to understand, contain, remediate, and communicate security incidents by assigning roles and responsibilities;
b. Establishing procedures to contain security incidents;
c. Mitigating ongoing security incidents, End Threats Posed by Security Incidents;
d. Restoring operations;
e. Developing and Implementing Communication Protocols for Security Incidents;
f. Obtains Understanding of Nature of Incident and Determines Containment Strategy;
g. Remediation Identified Vulnerabilities;
h. Communicating Remediation Activities; and,
i. Evaluating the Effectiveness of Incident Response and periodic incident evaluations. |
|
209 |
| SOC_2023 |
CC8.1 |
SOC_2023_CC8.1 |
SOC 2023 CC8.1 |
Change Management |
Minimise risks, ensure quality, optimise efficiency, and enhance resilience in the face of change. |
Shared |
n/a |
The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives by Managing Changes Throughout the System Life Cycle, authorizing changes, designing and developing changes, documenting all changes, tracking system changes, configuring software's, testing system changes, approving system changes, deploying system changes, identifying and evaluating system changes, creating baseline configurations for IT technologies and providing necessary changes in emergency situations. |
|
143 |
| SOC_2023 |
CC9.2 |
SOC_2023_CC9.2 |
SOC 2023 CC9.2 |
Risk Mitigation |
Ensure effective risk management throughout the supply chain and business ecosystem. |
Shared |
n/a |
Entity assesses and manages risks associated with vendors and business partners. |
|
43 |
| SWIFT_CSCF_2024 |
2.2 |
SWIFT_CSCF_2024_2.2 |
SWIFT Customer Security Controls Framework 2024 2.2 |
Risk Management |
Security Updates |
Shared |
1. The closure of known security vulnerabilities is effective in reducing the various pathways that an attacker may use during an attack.
2. A security update process that is comprehensive, repeatable, and implemented in a timely manner is necessary to continuously close these known vulnerabilities when security updates are available. |
To minimise the occurrence of known technical vulnerabilities on operator PCs and within the user’s Swift infrastructure by ensuring vendor support, applying mandatory software updates, and applying timely security updates aligned to the assessed risk. |
|
23 |
| SWIFT_CSCF_2024 |
2.7 |
SWIFT_CSCF_2024_2.7 |
SWIFT Customer Security Controls Framework 2024 2.7 |
Risk Management |
Vulnerability Scanning |
Shared |
1. The detection of known vulnerabilities allows vulnerabilities to be analysed, treated, and mitigated. The mitigation of vulnerabilities reduces the number of pathways that a malicious actor can use during an attack.
2. A vulnerability scanning process that is comprehensive, repeatable, and performed in a timely manner is necessary to continuously detect known vulnerabilities and to allow for further action. |
To identify known vulnerabilities within the user’s Swift environment by implementing a regular vulnerability scanning process and act upon results. |
|
16 |
| SWIFT_CSCF_2024 |
2.9 |
SWIFT_CSCF_2024_2.9 |
SWIFT Customer Security Controls Framework 2024 2.9 |
Transaction Controls |
Transaction Business Controls |
Shared |
1. Implementing business controls that restrict Swift transactions to the fullest extent possible reduces the opportunity for the sending (outbound) and, optionally, receiving (inbound) of fraudulent transactions.
2. These restrictions are best determined through an analysis of normal business activity. Parameters can then be set to restrict business to acceptable thresholds based on “normal” activity. |
To ensure outbound transaction activity within the expected bounds of normal business. |
|
21 |
| SWIFT_CSCF_2024 |
6.1 |
SWIFT_CSCF_2024_6.1 |
SWIFT Customer Security Controls Framework 2024 6.1 |
Risk Management |
Malware Protection |
Shared |
1. Malware is a general term that includes many types of intrusive and unwanted software, including viruses.
2. Anti-malware technology (a broader term for anti-virus) is effective in protecting against malicious code that has a known digital or behaviour profile |
To ensure that the user’s Swift infrastructure is protected against malware and act upon results. |
|
19 |
| SWIFT_CSCF_2024 |
6.4 |
SWIFT_CSCF_2024_6.4 |
SWIFT Customer Security Controls Framework 2024 6.4 |
Access Control |
Logging and Monitoring |
Shared |
1. Developing a logging and monitoring plan is the basis for effectively detecting abnormal behaviour and potential attacks and support further investigations.
2. As the operational environment becomes more complex, so will the logging and monitoring capability needed to perform adequate detection. Simplifying the operational environment will enable simpler logging and monitoring. |
To record security events, detect and respond to anomalous actions and operations within the user’s Swift environment. |
|
38 |
| SWIFT_CSCF_2024 |
6.5 |
SWIFT_CSCF_2024_6.5 |
404 not found |
|
|
|
n/a |
n/a |
|
18 |
| SWIFT_CSCF_2024 |
8.1 |
SWIFT_CSCF_2024_8.1 |
404 not found |
|
|
|
n/a |
n/a |
|
17 |
|
U.09.3 - Detection, prevention and recovery |
U.09.3 - Detection, prevention and recovery |
404 not found |
|
|
|
n/a |
n/a |
|
29 |
|
U.15.1 - Events Logged |
U.15.1 - Events logged |
404 not found |
|
|
|
n/a |
n/a |
|
51 |
| UK_NCSC_CAF_v3.2 |
C |
UK_NCSC_CAF_v3.2_C |
404 not found |
|
|
|
n/a |
n/a |
|
14 |
| UK_NCSC_CAF_v3.2 |
C1 |
UK_NCSC_CAF_v3.2_C1 |
404 not found |
|
|
|
n/a |
n/a |
|
15 |
| UK_NCSC_CAF_v3.2 |
C1.c |
UK_NCSC_CAF_v3.2_C1.c |
NCSC Cyber Assurance Framework (CAF) v3.2 C1.c |
Security Monitoring |
Generating Alerts |
Shared |
1. Logging data is enriched with other network knowledge and data when investigating certain suspicious activity or alerts.
2. A wide range of signatures and indicators of compromise is used for investigations of suspicious activity and alerts.
3. Alerts can be easily resolved to network assets using knowledge of networks and systems. The resolution of these alerts is performed in almost real time.
4. Security alerts relating to all essential functions are prioritised and this information is used to support incident management.
5. Logs are reviewed almost continuously, in real time.
6. Alerts are tested to ensure that they are generated reliably and that it is possible to distinguish genuine security incidents from false alarms. |
Evidence of potential security incidents contained in your monitoring data is reliably identified and triggers alerts. |
|
18 |
| UK_NCSC_CAF_v3.2 |
C1.d |
UK_NCSC_CAF_v3.2_C1.d |
NCSC Cyber Assurance Framework (CAF) v3.2 C1.d |
Security Monitoring |
Identifying Security Incidents |
Shared |
1. Select threat intelligence sources or services using risk-based and threat-informed decisions based on the business needs and sector (e.g. vendor reporting and patching, strong anti-virus providers, sector and community-based info share, special interest groups).
2. Apply all new signatures and IoCs within a reasonable (risk-based) time of receiving them.
3. Receive signature updates for all the protective technologies (e.g. AV, IDS).
4. Track the effectiveness of the intelligence feeds and actively share feedback on the usefulness of IoCs and any other indicators with the threat community (e.g.
sector partners, threat intelligence providers, government agencies). |
Contextualise alerts with knowledge of the threat and the systems, to identify those security incidents that require some form of response. |
|
17 |
| UK_NCSC_CAF_v3.2 |
C2 |
UK_NCSC_CAF_v3.2_C2 |
404 not found |
|
|
|
n/a |
n/a |
|
15 |
| UK_NCSC_CAF_v3.2 |
C2.b |
UK_NCSC_CAF_v3.2_C2.b |
NCSC Cyber Assurance Framework (CAF) v3.2 C2.b |
Proactive Security Event Discovery |
Proactive Attack Discovery |
Shared |
1. Routinely search for system abnormalities indicative of malicious activity on the networks and information systems supporting the operation of your essential function, generating alerts based on the results of such searches.
2. Have justified confidence in the effectiveness of the searches for system abnormalities indicative of malicious activity. |
Use an informed understanding of more sophisticated attack methods and of normal system behaviour to monitor proactively for malicious activity. |
|
15 |
| UK_NCSC_CSP |
13 |
UK_NCSC_CSP_13 |
UK NCSC CSP 13 |
Audit information for users |
Audit information for users |
Shared |
n/a |
You should be provided with the audit records needed to monitor access to your service and the data held within it. The type of audit information available to you will have a direct impact on your ability to detect and respond to inappropriate or malicious activity within reasonable timescales. |
link |
3 |
| UK_NCSC_CSP |
5.2 |
UK_NCSC_CSP_5.2 |
UK NCSC CSP 5.2 |
Operational security |
Vulnerability management |
Shared |
n/a |
Service providers should have a management processes in place to identify, triage and mitigate vulnerabilities. Services which don’t, will quickly become vulnerable to attack using publicly known methods and tools. |
link |
6 |