compliance controls are associated with this Policy definition 'Notify users of system logon or access' (fe2dff43-0a8c-95df-0432-cb1c794b17d0)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
AC-17(2) |
FedRAMP_High_R4_AC-17(2) |
FedRAMP High AC-17 (2) |
Access Control |
Protection Of Confidentiality / Integrity Using Encryption |
Shared |
n/a |
The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Supplemental Guidance: The encryption strength of mechanism is selected based on the security categorization of the information. Related controls: SC-8, SC-12, SC-13. |
link |
2 |
| FedRAMP_Moderate_R4 |
AC-17(2) |
FedRAMP_Moderate_R4_AC-17(2) |
FedRAMP Moderate AC-17 (2) |
Access Control |
Protection Of Confidentiality / Integrity Using Encryption |
Shared |
n/a |
The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Supplemental Guidance: The encryption strength of mechanism is selected based on the security categorization of the information. Related controls: SC-8, SC-12, SC-13. |
link |
2 |
| hipaa |
0902.09s2Organizational.13-09.s |
hipaa-0902.09s2Organizational.13-09.s |
0902.09s2Organizational.13-09.s |
09 Transmission Protection |
0902.09s2Organizational.13-09.s 09.08 Exchange of Information |
Shared |
n/a |
Remote (external) access to the organization's information assets and access to external information assets (for which the organization has no control) is based on clearly defined terms and conditions. |
|
14 |
| hipaa |
0912.09s1Organizational.4-09.s |
hipaa-0912.09s1Organizational.4-09.s |
0912.09s1Organizational.4-09.s |
09 Transmission Protection |
0912.09s1Organizational.4-09.s 09.08 Exchange of Information |
Shared |
n/a |
Cryptography is used to protect the confidentiality and integrity of remote access sessions to the internal network and to external systems. |
|
9 |
| hipaa |
1008.01d2System.3-01.d |
hipaa-1008.01d2System.3-01.d |
1008.01d2System.3-01.d |
10 Password Management |
1008.01d2System.3-01.d 01.02 Authorized Access to Information Systems |
Shared |
n/a |
Users sign a statement acknowledging their responsibility to keep passwords confidential. |
|
15 |
| hipaa |
1118.01j2Organizational.124-01.j |
hipaa-1118.01j2Organizational.124-01.j |
1118.01j2Organizational.124-01.j |
11 Access Control |
1118.01j2Organizational.124-01.j 01.04 Network Access Control |
Shared |
n/a |
The organization has implemented encryption (e.g., VPN solutions or private lines) and logs remote access to the organization's network by employees, contractors, or third-party. |
|
9 |
| hipaa |
1121.01j3Organizational.2-01.j |
hipaa-1121.01j3Organizational.2-01.j |
1121.01j3Organizational.2-01.j |
11 Access Control |
1121.01j3Organizational.2-01.j 01.04 Network Access Control |
Shared |
n/a |
Remote administration sessions are authorized, encrypted, and employ increased security measures. |
|
11 |
| hipaa |
1903.06d1Organizational.3456711-06.d |
hipaa-1903.06d1Organizational.3456711-06.d |
1903.06d1Organizational.3456711-06.d |
19 Data Protection & Privacy |
1903.06d1Organizational.3456711-06.d 06.01 Compliance with Legal Requirements |
Shared |
n/a |
The confidentiality and integrity of covered information at rest is protected using an encryption method appropriate to the medium where it is stored; where the organization chooses not to encrypt covered information, a documented rationale for not doing so is maintained or alternative compensating controls are used if the method is approved and reviewed annually by the CISO. |
|
5 |
| ISO27001-2013 |
A.13.1.1 |
ISO27001-2013_A.13.1.1 |
ISO 27001:2013 A.13.1.1 |
Communications Security |
Network controls |
Shared |
n/a |
Networks shall be managed and controlled to protect information in systems and applications. |
link |
40 |
| ISO27001-2013 |
A.14.1.2 |
ISO27001-2013_A.14.1.2 |
ISO 27001:2013 A.14.1.2 |
System Acquisition, Development And Maintenance |
Securing application services on public networks |
Shared |
n/a |
Information involved in application services passing over public networks shall be protected from fraudulent activity, contract dispute and unauthorized disclosure and modification. |
link |
32 |
| ISO27001-2013 |
A.6.2.1 |
ISO27001-2013_A.6.2.1 |
ISO 27001:2013 A.6.2.1 |
Organization of Information Security |
Mobile device policy |
Shared |
n/a |
A policy and supporting security measures shall be adopted to manage the risks introduced by using mobile devices. |
link |
13 |
| ISO27001-2013 |
A.6.2.2 |
ISO27001-2013_A.6.2.2 |
ISO 27001:2013 A.6.2.2 |
Organization of Information Security |
Teleworking |
Shared |
n/a |
A policy and supporting security measures shall be implemented to protect information accessed, processed or stored at teleworking sites. |
link |
16 |
| NIST_SP_800-171_R2_3 |
.1.13 |
NIST_SP_800-171_R2_3.1.13 |
NIST SP 800-171 R2 3.1.13 |
Access Control |
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography. See [NIST CRYPTO]; [NIST CAVP]; [NIST CMVP]; National Security Agency Cryptographic Standards. |
link |
31 |
| NIST_SP_800-53_R4 |
AC-17(2) |
NIST_SP_800-53_R4_AC-17(2) |
NIST SP 800-53 Rev. 4 AC-17 (2) |
Access Control |
Protection Of Confidentiality / Integrity Using Encryption |
Shared |
n/a |
The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Supplemental Guidance: The encryption strength of mechanism is selected based on the security categorization of the information. Related controls: SC-8, SC-12, SC-13. |
link |
2 |
| NIST_SP_800-53_R5 |
AC-17(2) |
NIST_SP_800-53_R5_AC-17(2) |
NIST SP 800-53 Rev. 5 AC-17 (2) |
Access Control |
Protection of Confidentiality and Integrity Using Encryption |
Shared |
n/a |
Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions. |
link |
2 |
| SOC_2 |
CC6.1 |
SOC_2_CC6.1 |
SOC 2 Type 2 CC6.1 |
Logical and Physical Access Controls |
Logical access security software, infrastructure, and architectures |
Shared |
The customer is responsible for implementing this recommendation. |
The following points of focus, specifically related to all engagements using the trust services criteria, highlight important characteristics relating to this criterion:
• Identifies and Manages the Inventory of Information Assets — The entity identifies,
Page 29
TSP
Ref. #
TRUST SERVICES CRITERIA AND POINTS OF FOCUS
inventories, classifies, and manages information assets.
• Restricts Logical Access — Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative
authorities, mobile devices, output, and offline system components is restricted
through the use of access control software and rule sets.
• Identifies and Authenticates Users — Persons, infrastructure, and software are
identified and authenticated prior to accessing information assets, whether locally
or remotely.
• Considers Network Segmentation — Network segmentation permits unrelated portions of the entity's information system to be isolated from each other.
• Manages Points of Access — Points of access by outside entities and the types of
data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified,
documented, and managed.
• Restricts Access to Information Assets — Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets.
• Manages Identification and Authentication — Identification and authentication requirements are established, documented, and managed for individuals and systems
accessing entity information, infrastructure, and software.
• Manages Credentials for Infrastructure and Software — New internal and external
infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point.
Credentials are removed and access is disabled when access is no longer required
or the infrastructure and software are no longer in use.
• Uses Encryption to Protect Data — The entity uses encryption to supplement other
measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk.
• Protects Encryption Keys — Processes are in place to protect encryption keys during generation, storage, use, and destruction |
|
80 |
| SOC_2 |
CC6.6 |
SOC_2_CC6.6 |
SOC 2 Type 2 CC6.6 |
Logical and Physical Access Controls |
Security measures against threats outside system boundaries |
Shared |
The customer is responsible for implementing this recommendation. |
• Restricts Access — The types of activities that can occur through a communication
channel (for example, FTP site, router port) are restricted.
• Protects Identification and Authentication Credentials — Identification and authentication credentials are protected during transmission outside its system boundaries.
• Requires Additional Authentication or Credentials — Additional authentication information or credentials are required when accessing the system from outside its
boundaries.
• Implements Boundary Protection Systems — Boundary protection systems (for example, firewalls, demilitarized zones, and intrusion detection systems) are implemented to protect external access points from attempts and unauthorized access and
are monitored to detect such attempts |
|
41 |
| SWIFT_CSCF_v2022 |
2.1 |
SWIFT_CSCF_v2022_2.1 |
SWIFT CSCF v2022 2.1 |
2. Reduce Attack Surface and Vulnerabilities |
Ensure the confidentiality, integrity, and authenticity of application data flows between local SWIFT-related components. |
Shared |
n/a |
Confidentiality, integrity, and authentication mechanisms are implemented to protect SWIFT-related component-to-component or system-to-system data flows. |
link |
36 |
| SWIFT_CSCF_v2022 |
2.4 |
SWIFT_CSCF_v2022_2.4 |
SWIFT CSCF v2022 2.4 |
2. Reduce Attack Surface and Vulnerabilities |
Ensure the confidentiality, integrity, and mutual authenticity of data flows between local or remote SWIFT infrastructure components and the back-office first hops they connect to. |
Shared |
n/a |
Confidentiality, integrity, and authentication mechanisms (at system, transport or message level) are implemented to protect data flows between SWIFT infrastructure components and the back-office first hops they connect to. |
link |
7 |