Az Policy Advertizer

CEK_03

CSA_v4.0.12_CEK_03

CSA Cloud Controls Matrix v4.0.12 CEK 03

Cryptography, Encryption & Key Management

Data Encryption

Shared

n/a

Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.

DSP_07

CSA_v4.0.12_DSP_07

CSA Cloud Controls Matrix v4.0.12 DSP 07

Data Security and Privacy Lifecycle Management

Data Protection by Design and Default

Shared

n/a

Develop systems, products, and business practices based upon a principle of security by design and industry best practices.

DSP_17

CSA_v4.0.12_DSP_17

CSA Cloud Controls Matrix v4.0.12 DSP 17

Data Security and Privacy Lifecycle Management

Sensitive Data Protection

Shared

n/a

Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.

UEM_08

CSA_v4.0.12_UEM_08

CSA Cloud Controls Matrix v4.0.12 UEM 08

Universal Endpoint Management

Storage Encryption

Shared

n/a

Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.

DORA_2022_2554

9.3b

DORA_2022_2554_9.3b

DORA 2022 2554 9.3b

Minimize Risks of Data Corruption and Loss in ICT Processes

Shared

n/a

Implement information and communication technology (ICT) processes that minimize the risk of data corruption or loss, unauthorized access, and technical flaws that may disrupt business activities.

DORA_2022_2554

9.3c

DORA_2022_2554_9.3c

DORA 2022 2554 9.3c

Prevent Data Availability and Integrity Issues in ICT Systems

Shared

n/a

Implement measures in information and communication technology (ICT) to prevent issues related to data availability, authenticity, integrity, confidentiality breaches, and data loss.

EU_2555_(NIS2)_2022

EU_2555_(NIS2)_2022_21

EU 2022/2555 (NIS2) 2022 21

Cybersecurity risk-management measures

Shared

n/a

Requires essential and important entities to take appropriate measures to manage cybersecurity risks.

189

EU_GDPR_2016_679_Art._24

EU General Data Protection Regulation (GDPR) 2016/679 Art. 24

Chapter 4 - Controller and processor

Responsibility of the controller

Shared

n/a

306

EU_GDPR_2016_679_Art._25

EU General Data Protection Regulation (GDPR) 2016/679 Art. 25

Chapter 4 - Controller and processor

Data protection by design and by default

Shared

n/a

306

EU_GDPR_2016_679_Art._28

EU General Data Protection Regulation (GDPR) 2016/679 Art. 28

Chapter 4 - Controller and processor

Processor

Shared

n/a

306

FBI_Criminal_Justice_Information_Services_v5.9.5_5

EU_GDPR_2016_679_Art._32

EU General Data Protection Regulation (GDPR) 2016/679 Art. 32

Chapter 4 - Controller and processor

Security of processing

Shared

n/a

306

FBI_Criminal_Justice_Information_Services_v5.9.5_5.1

FBI Criminal Justice Information Services (CJIS) v5.9.5 5.1

Policy and Implementation - Systems And Communications Protection

Systems And Communications Protection

Shared

In addition, applications, services, or information systems must have the capability to ensure system integrity through the detection and protection against unauthorized changes to software and information.

Examples of systems and communications safeguards range from boundary and transmission protection to securing an agency's virtualized environment.

110

FedRAMP_High_R4

SC-12

FedRAMP_High_R4_SC-12

FedRAMP High SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction]. Supplemental Guidance: Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance, specifying appropriate options, levels, and parameters. Organizations manage trust stores to ensure that only approved trust anchors are in such trust stores. This includes certificates with visibility external to organizational information systems and certificates related to the internal operations of systems. Related controls: SC-13, SC-17. References: NIST Special Publications 800-56, 800-57.

FedRAMP_Moderate_R4_SC-12

FedRAMP_Moderate_R4

SC-12

FedRAMP Moderate SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

ISO_IEC_27017_2015_18.1.3

HITRUST_CSF_v11.3

06.c

HITRUST_CSF_v11.3_06.c

HITRUST CSF v11.3 06.c

Compliance with Legal Requirements

Prevent loss, destruction and falsification of important records in accordance with statutory, regulatory, contractual, and business requirements.

Shared

1. Guidelines are to be issued and implemented by the organization on the ownership, classification, retention, storage, handling, and disposal of all records and information. 2. Accountings of disclosure as organizational records are to be documented and maintained for a pre-defined period.

Important records shall be protected from loss, destruction, and falsification, in accordance with statutory, regulatory, contractual, and business requirements.

ISO_IEC_27001_2022

7.5.3

ISO_IEC_27001_2022_7.5.3

ISO IEC 27001 2022 7.5.3

Support

Control of documented information

Shared

1. Documented information required by the information security management system and by this document shall be controlled to ensure: a. it is available and suitable for use, where and when it is needed; and b. it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity). 2. For the control of documented information, the organization shall address the following activities, as applicable: a. distribution, access, retrieval and use; b. storage and preservation, including the preservation of legibility; c. control of changes (e.g. version control); and d. retention and disposition.

Specifies that the documented information of external origin, determined by the organization to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled

ISO_IEC_27017_2015

18.1.3

ISO IEC 27017 2015 18.1.3

Compliance

Protection of Records

Shared

For Cloud Service Customer: The cloud service customer should request information from the cloud service provider about the protection of records gathered and stored by the cloud service provider that are relevant to the use of cloud services by the cloud service customer. For Cloud Service Provider: The cloud service provider should provide information to the cloud service customer about the protection of records that are gathered and stored by the cloud service provider relating to the use of cloud services by the cloud service customer.

To ensure compliance with legal, statutory, regulatory and contractual requirements, as well as community or societal expectations related to the protection and availability of records.

2.10.1

K_ISMS_P_2018_2.10.1

K ISMS P 2018 2.10.1

2.10

Establish Procedures for Managing the Security of System Operations

Shared

n/a

Establish and implement operating procedures for managing the security of system operations such as designating system administrators, updating policies, changing rulesets, monitoring events, managing policy implementations or exceptions.

455

2.10.2

K_ISMS_P_2018_2.10.2

K ISMS P 2018 2.10.2

2.10

Establish Protective Measures for Administrator Privileges and Security Configurations

Shared

n/a

Establish and implement protective measures with regard to administrator privileges and security configurations to ensure that important information and personal information are not exposed as a result of unauthorized access by service type or misconfigurations.

431

2.10.4

K_ISMS_P_2018_2.10.4

K ISMS P 2018 2.10.4

2.10

Establish Protective Measures when Working with Electronic Transactions or Fintech Services

Shared

n/a

Establish and implement protective measures such as authentication and encryption to prevent information leakage, data alteration, or fraud when working with electronic transactions and Fintech services. In the event connections to external systems are required, safety must be checked.

2.7.1b

K_ISMS_P_2018_2.7.1b

K ISMS P 2018 2.7.1b

2.7

Ensure Data is Encrypted at Rest and In-Transit

Shared

n/a

Ensure data is encrypted when storing and transmitting personal and important information.

2.7.2

K_ISMS_P_2018_2.7.2

K ISMS P 2018 2.7.2

2.7

Establish Encryption Key Management Procedures

Shared

n/a

Establish and implement procedures for securely creating, using, storing, distributing, and destroying encryption keys. Additionally, establish and implement procedures for recovering encryption keys, if necessary.

2.9.3

K_ISMS_P_2018_2.9.3

K ISMS P 2018 2.9.3

2.9

Establish Backup Recovery Procedures for Information Systems and Ensure Timely Recovery

Shared

n/a

Establish and implement backup recovery procedures for the information system such as backup targets, backup cycles, backup methods, storage places, storage periods, and vaulting. Ensure timely recovery of information systems following an incident.

NIST_SP_800-171_R2_3.13.10

3.4.3

K_ISMS_P_2018_3.4.3

K ISMS P 2018 3.4.3

3.4

Implement Measure to Protect the Personal Information of Dormant Users

Shared

n/a

Implement measures to protect the personal information of dormant users including notification of relevant matters, or disposal of storage of personal information.

LGPD_2018_Art.

LGPD_2018_Art._16

Brazilian General Data Protection Law (LGPD) 2018 Art. 16

Termination of Data Processing

Art. 16. Personal data shall be deleted following the termination of their processing

Shared

n/a

Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, but their storage is authorized for the following purposes: (1) compliance with a legal or regulatory obligation by the controller; (2) study by a research entity, ensuring, whenever possible, the anonymization of the personal data; (3) transfer to third parties, provided that the requirements for data processing as provided in this Law are obeyed; or (4) exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.

NIST_SP_800-171_R2_3

.13.10

NIST SP 800-171 R2 3.13.10

System and Communications Protection

Establish and manage cryptographic keys for cryptography employed in organizational systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters. [SP 800-56A] and [SP 800-57-1] provide guidance on cryptographic key management and key establishment.

NIST_SP_800-53_R4

SC-12

NIST_SP_800-53_R4_SC-12

NIST SP 800-53 Rev. 4 SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

NIST_SP_800-53_R5.1.1_SC.28

NIST_SP_800-53_R5.1.1

SC.28

NIST SP 800-53 R5.1.1 SC.28

System and Communications Protection

Protection of Information at Rest

Shared

Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].

Information at rest refers to the state of information when it is not in process or in transit and is located on system components. Such components include internal or external hard disk drives, storage area network devices, or databases. However, the focus of protecting information at rest is not on the type of storage device or frequency of access but rather on the state of the information. Information at rest addresses the confidentiality and integrity of information and covers user information and system information. System-related information that requires protection includes configurations or rule sets for firewalls, intrusion detection and prevention systems, filtering routers, and authentication information. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing write-once-read-many (WORM) technologies. When adequate protection of information at rest cannot otherwise be achieved, organizations may employ other controls, including frequent scanning to identify malicious code at rest and secure offline storage in lieu of online storage.

NIST_SP_800-53_R5

SC-12

NIST_SP_800-53_R5_SC-12

NIST SP 800-53 Rev. 5 SC-12

System and Communications Protection

Cryptographic Key Establishment and Management

Shared

n/a

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

RBI_ITF_NBFC_v2017

3.1.h

RBI_ITF_NBFC_v2017_3.1.h

RBI IT Framework 3.1.h

Information and Cyber Security

Public Key Infrastructure (PKI)-3.1

n/a

The IS Policy must provide for a IS framework with the following basic tenets: Public Key Infrastructure (PKI) - NBFCs may increase the usage of PKI to ensure confidentiality of data, access control, data integrity, authentication and nonrepudiation.