description:The organisation takes appropriate steps to identify, assess and understand security risks to the network and information systems supporting the operation of essential functions. This includes an overall organisational approach to risk management.
description:The organisation takes appropriate steps to identify, assess and understand security risks to the network and information systems supporting the operation of essential functions. This includes an overall organisational approach to risk management.
sub-principles:
sub-principles:
- sub-principle:
- sub-principle:
name:A2.a Risk Management Process
name:A2.a Risk Management Process
description:Your organisation has effective internal processes for managing risks to the security of network and information systems related to the operation of essential functions and communicating associated activities.
description:Your organisation has effective internal processes for managing risks to the security of network and information systems related to the operation of essential functions and communicating associated activities.
subprincipleitemgroups:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- Risk assessments are not based on a clearly defined set of threat assumptions.
- Risk assessments are not based on a clearly defined set of threat assumptions.
- Risk assessment outputs are too complex or unwieldy to be consumed by decision-makers and are not effectively communicated in a clear and timely manner.
- Risk assessment outputs are too complex or unwieldy to be consumed by decision-makers and are not effectively communicated in a clear and timely manner.
- Risk assessments for critical systems are a "one-off" activity (or not done at all).
- Risk assessments for critical systems are a "one-off" activity (or not done at all).
- The security elements of projects or programmes are solely dependent on the completion of a risk management assessment without any regard to the outcomes.
- The security elements of projects or programmes are solely dependent on the completion of a risk management assessment without any regard to the outcomes.
- There is no systematic process in place to ensure that identified security risks are managed effectively.
- There is no systematic process in place to ensure that identified security risks are managed effectively.
- Systems are assessed in isolation, without consideration of dependencies and interactions with other systems. (e.g. interactions between IT and OT environments).
- Systems are assessed in isolation, without consideration of dependencies and interactions with other systems. (e.g. interactions between IT and OT environments).
- Security requirements and mitigation's are arbitrary or are applied from a control catalogue without consideration of how they contribute to the security of the essential function.
- Security requirements and mitigation's are arbitrary or are applied from a control catalogue without consideration of how they contribute to the security of the essential function.
- Risks remain unresolved on a register for prolonged periods of time awaiting senior decision-making or resource allocation to resolve.
- Risks remain unresolved on a register for prolonged periods of time awaiting senior decision-making or resource allocation to resolve.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Partially
kind:Partially
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- Your organisational process ensures that security risks to networks and information systems relevant to essential functions are identified, analysed, prioritised, and managed.
- Your organisational process ensures that security risks to networks and information systems relevant to essential functions are identified, analysed, prioritised, and managed.
- Your risk assessments are informed by an understanding of the vulnerabilities in the networks and info<p style="color: green"><%= notice %></p>rmation systems supporting your essential function.
- Your risk assessments are informed by an understanding of the vulnerabilities in the network and information systems supporting your essential function(s).
- The output from your risk management process is a clear set of security requirements that will address the risks in line with your organisational approach to security.
- The output from your risk management process is a clear set of security requirements that will address the risks in line with your organisational approach to security.
- Significant conclusions reached in the course of your risk management process are communicated to key security decision-makers and accountable individuals.
- Significant conclusions reached in the course of your risk management process are communicated to key security decision-makers and accountable individuals.
- You conduct risk assessments when significant events potentially affect the essential function, such as replacing a system or a change in the cybe<p style="color: green"><%= notice %></p>r security threat.
- You conduct risk assessments when significant events potentially affect the essential function(s), such as replacing a system or a change in the cyber security threat.
- You perform threat analysis and understand how generic threats apply to your organisation.
- You perform threat analysis and understand how generic threats apply to your organisation.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- Your organisational process ensures that security risks to networks and information systems relevant to essential functions are identified, analysed, prioritised, and managed.
- Your organisational process ensures that security risks to networks and information systems relevant to essential functions are identified, analysed, prioritised, and managed.
- Your approach to risk is focused on the possibility of adverse impact to your essential function, leading to a detailed understanding of how such impact might arise as a consequence of possible attacker actions and the security properties of your networks and information systems.
- Your approach to risk is focused on the possibility of adverse impact to your essential function, leading to a detailed understanding of how such impact might arise as a consequence of possible attacker actions and the security properties of your networks and information systems.
- Your risk assessments are based on a clearly understood set of threat assumptions, informed by an up-to-date understanding of security threats to your essential function and your sector.
- Your risk assessments are based on a clearly understood set of threat assumptions, informed by an up-to-date understanding of security threats to your essential function and your sector.
- Your risk assessments are informed by an understanding of the vulnerabilities in the networks and information systems supporting your essential function.
- Your risk assessments are informed by an understanding of the vulnerabilities in the networks and information systems supporting your essential function.
- The output from your risk management process is a clear set of security requirements that will address the risks in line with your organisational approach to security.
- The output from your risk management process is a clear set of security requirements that will address the risks in line with your organisational approach to security.
- Significant conclusions reached in the course of your risk management process are communicated to key security decision-makers and accountable individuals.
- Significant conclusions reached in the course of your risk management process are communicated to key security decision-makers and accountable individuals.
- Your risk assessments are dynamic and updated in the light of relevant changes which may include technical changes to networks and information systems, change of use and new threat information.
- Your risk assessments are dynamic and updated in the light of relevant changes which may include technical changes to networks and information systems, change of use and new threat information.
- The effectiveness of your risk management process is reviewed periodically, and improvements made as required.
- The effectiveness of your risk management process is reviewed periodically, and improvements made as required.
- You perform detailed threat analysis and understand how this applies to your organisation in the context of the threat to your sector and the wider CNI.
- You perform detailed threat analysis and understand how this applies to your organisation in the context of the threat to your sector and the wider CNI.
- sub-principle:
- sub-principle:
name:A2.b Assurance
name:A2.b Assurance
description:You have gained confidence in the effectiveness of the security of your technology, people, and processes relevant to essential functions.
description:You have gained confidence in the effectiveness of the security of your technology, people, and processes relevant to essential functions.
subprincipleitemgroups:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- A particular product or service is seen as a "silver bullet" and vendor claims are taken at face value.
- A particular product or service is seen as a "silver bullet" and vendor claims are taken at face value.
- Assurance methods are applied without appreciation of their strengths and limitations, such as the risks of penetration testing in operational environments.
- Assurance methods are applied without appreciation of their strengths and limitations, such as the risks of penetration testing in operational environments.
- Assurance is assumed because there have been no known problems to date.
- Assurance is assumed because there have been no known problems to date.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- You validate that the security measures in place to protect the networks and information systems are effective and remain effective for the lifetime over which they are needed.
- You validate that the security measures in place to protect the networks and information systems are effective and remain effective for the lifetime over which they are needed.
- You understand the assurance methods available to you and choose appropriate methods to gain confidence in the security of essential functions.
- You understand the assurance methods available to you and choose appropriate methods to gain confidence in the security of essential functions.
- Your confidence in the security as it relates to your technology, people, and processes can be justified to, and verified by, a third party.
- Your confidence in the security as it relates to your technology, people, and processes can be justified to, and verified by, a third party.
- Security deficiencies uncovered by assurance activities are assessed, prioritised and remedied when necessary in a timely and effective way.
- Security deficiencies uncovered by assurance activities are assessed, prioritised and remedied when necessary in a timely and effective way.
- The methods used for assurance are reviewed to ensure they are working as intended and remain the most appropriate method to use.
- The methods used for assurance are reviewed to ensure they are working as intended and remain the most appropriate method to use.
- principle:
- principle:
name:Principle A3 Asset Management
name:Principle A3 Asset Management
description:Everything required to deliver, maintain or support network and information systems necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).
description:Everything required to deliver, maintain or support network and information systems necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).
@@ -159,40 +159,40 @@ objectives:
name:Principle A4 Supply Chain
name:Principle A4 Supply Chain
description:The organisation understands and manages security risks to network and information systems supporting the operation of essential functions that arise as a result of dependencies on external suppliers. This includes ensuring that appropriate measures are employed where third party services are used.
description:The organisation understands and manages security risks to network and information systems supporting the operation of essential functions that arise as a result of dependencies on external suppliers. This includes ensuring that appropriate measures are employed where third party services are used.
sub-principles:
sub-principles:
- sub-principle:
- sub-principle:
name:A4.a Supply Chain
name:A4.a Supply Chain
description:None
description:None
subprincipleitemgroups:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- You do not know what data belonging to you is held by suppliers, or how it is managed.
- You do not know what data belonging to you is held by suppliers, or how it is managed.
- Elements of the supply chain for essential function(s) are subcontracted and you have little or no visibility of the sub-contractors.
- Elements of the supply chain for essential function(s) are subcontracted and you have little or no visibility of the sub-contractors.
- You have no understanding of which contracts are relevant and / or relevant contracts do not specify appropriate security obligations.
- You have no understanding of which contracts are relevant and / or relevant contracts do not specify appropriate security obligations.
- Suppliers have access to systems that provide your essential function(s) that is unrestricted, not monitored or bypasses your own security controls.
- Suppliers have access to systems that provide your essential function(s) that is unrestricted, not monitored or bypasses your own security controls.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Partially
kind:Partially
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- You understand the general risks suppliers may pose to your essential function(s).
- You understand the general risks suppliers may pose to your essential function(s).
- You know the extent of your supply chain that supports your essential function(s), including sub-contractors.
- You know the extent of your supply chain that supports your essential function(s), including sub-contractors.
- You understand which contracts are relevant and you include appropriate security obligations in relevant contracts.
- You understand which contracts are relevant and you include appropriate security obligations in relevant contracts.
- You are aware of all third-party connections and have assurance that they meet your organisation’s security requirements.
- You are aware of all third-party connections and have assurance that they meet your organisation’s security requirements.
- Your approach to security incident management considers incidents that might arise in your supply chain.
- Your approach to security incident management considers incidents that might arise in your supply chain.
- You have confidence that information shared with suppliers that is necessary for the operation of your essential function(s) is appropriately protected from well-known attacks and known vulnerabilities.
- You have confidence that information shared with suppliers that is necessary for the operation of your essential function(s) is appropriately protected from well-known attacks and known vulnerabilities.
-subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- You have a deep understanding of your supply chain, including sub-contractors and the wider risks it faces. You consider factors such as supplier’s partnerships, competitors, nationality and other organisations with which they sub-contract. This informs your risk assessment and procurement processes.
- You have a deep understanding of your supply chain, including sub-contractors and the wider risks it faces. You consider factors such as supplier’s partnerships, competitors, nationality and other organisations with which they sub-contract. This informs your risk assessment and procurement processes.
- Your approach to supply chain risk management considers the risks to your essential function(s) arising from supply chain subversion by capable and well-resourced attackers.
- Your approach to supply chain risk management considers the risks to your essential function(s) arising from supply chain subversion by capable and well-resourced attackers.
- You have confidence that information shared with suppliers that is essential to the operation of your function(s) is appropriately protected from sophisticated attacks.
- You have confidence that information shared with suppliers that is essential to the operation of your function(s) is appropriately protected from sophisticated attacks.
- You understand which contracts are relevant and you include appropriate security obligations in relevant contracts. You have a proactive approach to contract management which may include a contract management plan for relevant contracts.
- You understand which contracts are relevant and you include appropriate security obligations in relevant contracts. You have a proactive approach to contract management which may include a contract management plan for relevant contracts.
- Customer / supplier ownership of responsibilities is laid out in contracts.
- Customer / supplier ownership of responsibilities is laid out in contracts.
- All network connections and data sharing with third parties are managed effectively and proportionately.
- All network connections and data sharing with third parties are managed effectively and proportionately.
- When appropriate, your incident management process and that of your suppliers provide mutual support in the resolution of incidents.
- When appropriate, your incident management process and that of your suppliers provide mutual support in the resolution of incidents.
- objective:
- objective:
name:Objective B - Protecting against cyber attack
name:Objective B - Protecting against cyber attack
description:Proportionate security measures are in place to protect the network and information systems supporting essential functions from cyber attack.
description:Proportionate security measures are in place to protect the network and information systems supporting essential functions from cyber attack.
principles:
principles:
@@ -201,165 +201,165 @@ objectives:
description:The organisation defines, implements, communicates and enforces appropriate policies, processes and procedures that direct its overall approach to securing systems and data that support operation of essential functions.
description:The organisation defines, implements, communicates and enforces appropriate policies, processes and procedures that direct its overall approach to securing systems and data that support operation of essential functions.
sub-principles:
sub-principles:
- sub-principle:
- sub-principle:
name:B1.a Policy, Process and Procedure Development
name:B1.a Policy, Process and Procedure Development
description:You have developed and continue to improve a set of cyber security and resilience policies, processes and procedures that manage and mitigate the risk of adverse impact on your essential function(s).
description:You have developed and continue to improve a set of cyber security and resilience policies, processes and procedures that manage and mitigate the risk of adverse impact on your essential function(s).
subprincipleitemgroups:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- Your policies, processes and procedures are absent or incomplete.
- Your policies, processes and procedures are absent or incomplete.
- Policies, processes and procedures are not applied universally or consistently.
- Policies, processes and procedures are not applied universally or consistently.
- People often or routinely circumvent policies, processes and procedures to achieve business objectives.
- People often or routinely circumvent policies, processes and procedures to achieve business objectives.
- Your organisation’s security governance and risk management approach has no bearing on your policies, processes and procedures.
- Your organisation’s security governance and risk management approach has no bearing on your policies, processes and procedures.
- System security is totally reliant on users' careful and consistent application of manual security processes.
- System security is totally reliant on users' careful and consistent application of manual security processes.
- Policies, processes and procedures have not been reviewed in response to major changes (e.g. technology or regulatory framework), or within a suitable period.
- Policies, processes and procedures have not been reviewed in response to major changes (e.g. technology or regulatory framework), or within a suitable period.
- Policies, processes and procedures are not readily available to staff, too detailed to remember, or too hard to understand.
- Policies, processes and procedures are not readily available to staff, too detailed to remember, or too hard to understand.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Partially
kind:Partially
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- Most of your policies, processes and procedures are followed and their application is monitored.
- Most of your policies, processes and procedures are followed and their application is monitored.
- Your policies, processes and procedures are integrated with other organisational policies, processes and procedures, including HR assessments of individuals' trustworthiness.
- Your policies, processes and procedures are integrated with other organisational policies, processes and procedures, including HR assessments of individuals' trustworthiness.
- All staff are aware of their responsibilities under your policies, processes and procedures. All breaches of policies, processes and procedures with the potential to adversely impact the essential function(s) are fully investigated. Other breaches are tracked, assessed for trends and action is taken to understand and address.
- All staff are aware of their responsibilities under your policies, processes and procedures. All breaches of policies, processes and procedures with the potential to adversely impact the essential function(s) are fully investigated. Other breaches are tracked, assessed for trends and action is taken to understand and address.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- All your policies, processes and procedures are followed, their correct application and security effectiveness is evaluated.
- All your policies, processes and procedures are followed, their correct application and security effectiveness is evaluated.
- Your policies, processes and procedures are integrated with other organisational policies, processes and procedures, including HR assessments of individuals' trustworthiness.
- Your policies, processes and procedures are integrated with other organisational policies, processes and procedures, including HR assessments of individuals' trustworthiness.
- Your policies, processes and procedures are effectively and appropriately communicated across all levels of the organisation resulting in good staff awareness of their responsibilities.
- Your policies, processes and procedures are effectively and appropriately communicated across all levels of the organisation resulting in good staff awareness of their responsibilities.
- Appropriate action is taken to address all breaches of policies, processes and procedures with potential to adversely impact the essential function(s) including aggregated breaches.
- Appropriate action is taken to address all breaches of policies, processes and procedures with potential to adversely impact the essential function(s) including aggregated breaches.
- principle:
- principle:
name:Principle B2 Identity and Access Control
name:Principle B2 Identity and Access Control
description:The organisation understands, documents and manages access to network and information systems supporting the operation of essential functions. Users (or automated functions) that can access data or systems are appropriately verified, authenticated and authorised.
description:The organisation understands, documents and manages access to network and information systems supporting the operation of essential functions. Users (or automated functions) that can access data or systems are appropriately verified, authenticated and authorised.
sub-principles:
sub-principles:
- sub-principle:
- sub-principle:
name:B2.a Identity Verification, Authentication and Authorisation
name:B2.a Identity Verification, Authentication and Authorisation
description:You robustly verify, authenticate and authorise access to the network and information systems supporting your essential function(s).
description:You robustly verify, authenticate and authorise access to the network and information systems supporting your essential function(s).
subprincipleitemgroups:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- Initial identity verification is not robust enough to provide an acceptable level of confidence of a user’s identity profile.
- Initial identity verification is not robust enough to provide an acceptable level of confidence of a user’s identity profile.
- Authorised users and systems with access to networks or information systems on which your essential function(s) depends cannot be individually identified.
- Authorised users and systems with access to networks or information systems on which your essential function(s) depends cannot be individually identified.
- Unauthorised individuals or devices can access your network or information systems on which your essential function(s) depends.
- Unauthorised individuals or devices can access your network or information systems on which your essential function(s) depends.
- The number of authorised users and systems that have access to your network and information systems are not limited to the minimum necessary.
- The number of authorised users and systems that have access to your network and information systems are not limited to the minimum necessary.
- Your approach to authenticating users, devices and systems does not follow up to date best practice.
- Your approach to authenticating users, devices and systems does not follow up to date best practice.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Partially
kind:Partially
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- Your process of initial identity verification is robust enough to provide a reasonable level of confidence of a user’s identity profile before allowing an authorised user access to network and information systems that support your essential function(s).
- Your process of initial identity verification is robust enough to provide a reasonable level of confidence of a user’s identity profile before allowing an authorised user access to network and information systems that support your essential function(s).
- All authorised users and systems with access to network or information systems on which your essential function(s) depends are individually identified and authenticated.
- All authorised users and systems with access to network or information systems on which your essential function(s) depends are individually identified and authenticated.
- The number of authorised users and systems that have access to essential function(s) network and information systems is limited to the minimum necessary.
- The number of authorised users and systems that have access to essential function(s) network and information systems is limited to the minimum necessary.
- You use additional authentication mechanisms, such as multi-factor (MFA), for privileged access to all network and information systems that operate or support your essential function(s).
- You use additional authentication mechanisms, such as multi-factor (MFA), for privileged access to all network and information systems that operate or support your essential function(s).
- You individually authenticate and authorise all remote access to all your network and information systems that support your essential function(s).
- You individually authenticate and authorise all remote access to all your network and information systems that support your essential function(s).
- The list of users and systems with access to network and information systems supporting and delivering the essential function(s) is reviewed on a regular basis, at least annually.
- The list of users and systems with access to network and information systems supporting and delivering the essential function(s) is reviewed on a regular basis, at least annually.
- Your approach to authenticating users, devices and systems follows up to date best practice.
- Your approach to authenticating users, devices and systems follows up to date best practice.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- Your process of initial identity verification is robust enough to provide a high level of confidence of a user’s identity profile before allowing an authorised user access to network and information systems that support your essential function(s).
- Your process of initial identity verification is robust enough to provide a high level of confidence of a user’s identity profile before allowing an authorised user access to network and information systems that support your essential function(s).
- Only authorised and individually authenticated users can physically access and logically connect to your network or information systems on which your essential function(s) depends.
- Only authorised and individually authenticated users can physically access and logically connect to your network or information systems on which your essential function(s) depends.
- The number of authorised users and systems that have access to all your network and information systems supporting the essential function(s) is limited to the minimum necessary.
- The number of authorised users and systems that have access to all your network and information systems supporting the essential function(s) is limited to the minimum necessary.
- You use additional authentication mechanisms, such as multi-factor (MFA), for all user access, including remote access, to all network and information systems that operate or support your essential function(s).
- You use additional authentication mechanisms, such as multi-factor (MFA), for all user access, including remote access, to all network and information systems that operate or support your essential function(s).
- The list of users and systems with access to network and information systems supporting and delivering the essential function(s) is reviewed on a regular basis, at least every six months.
- The list of users and systems with access to network and information systems supporting and delivering the essential function(s) is reviewed on a regular basis, at least every six months.
- Your approach to authenticating users, devices and systems follows up to date best practice.
- Your approach to authenticating users, devices and systems follows up to date best practice.
- sub-principle:
- sub-principle:
name:B2.b Device Management
name:B2.b Device Management
description:You fully know and have trust in the devices that are used to access your networks, information systems and data that support your essential function(s).
description:You fully know and have trust in the devices that are used to access your networks, information systems and data that support your essential function(s).
subprincipleitemgroups:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- Users can connect to your network and information systems supporting your essential function(s) using devices that are not corporately owned and managed.
- Users can connect to your network and information systems supporting your essential function(s) using devices that are not corporately owned and managed.
- Privileged users can perform privileged operations from devices that are not corporately owned and managed.
- Privileged users can perform privileged operations from devices that are not corporately owned and managed.
- You have not gained assurance in the security of any third-party devices or networks connected to your systems.
- You have not gained assurance in the security of any third-party devices or networks connected to your systems.
- Physically connecting a device to your network and information systems gives that device access without device or user authentication.
- Physically connecting a device to your network and information systems gives that device access without device or user authentication.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Partially
kind:Partially
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- Only corporately owned and managed devices can access your essential function(s) network and information systems.
- Only corporately owned and managed devices can access your essential function(s) network and information systems.
- All privileged operations are performed from corporately owned and managed devices.
- All privileged operations are performed from corporately owned and managed devices.
- These devices provide sufficient separation, using a risk-based approach, from the activities of standard users.
- These devices provide sufficient separation, using a risk-based approach, from the activities of standard users.
- You have sought to understand the security properties of third-party devices and networks before they can be connected to your systems.
- You have sought to understand the security properties of third-party devices and networks before they can be connected to your systems.
- You have taken appropriate steps to mitigate any risks identified.
- You have taken appropriate steps to mitigate any risks identified.
- The act of connecting to a network port or cable does not grant access to any systems.
- The act of connecting to a network port or cable does not grant access to any systems.
- You are able to detect unknown devices being connected to your network and information systems and investigate such incidents.
- You are able to detect unknown devices being connected to your network and information systems and investigate such incidents.
-subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- All privileged operations performed on your network and information systems supporting your essential function(s) are conducted from highly trusted devices, such as Privileged Access Workstations, dedicated solely to those operations.
- All privileged operations performed on your network and information systems supporting your essential function(s) are conducted from highly trusted devices, such as Privileged Access Workstations, dedicated solely to those operations.
- You either obtain independent and professional assurance of the security of third-party devices or networks before they connect to your network and information systems, or you only allow third-party devices or networks that are dedicated to supporting your network and information systems to connect.
- You either obtain independent and professional assurance of the security of third-party devices or networks before they connect to your network and information systems, or you only allow third-party devices or networks that are dedicated to supporting your network and information systems to connect.
- You perform certificate-based device identity management and only allow known devices to access systems necessary for the operation of your essential function(s).
- You perform certificate-based device identity management and only allow known devices to access systems necessary for the operation of your essential function(s).
- You perform regular scans to detect unknown devices and investigate any findings.
- You perform regular scans to detect unknown devices and investigate any findings.
- sub-principle:
- sub-principle:
name:B2.c Privileged User Management
name:B2.c Privileged User Management
description:You closely manage privileged user access to network and information systems supporting your essential function(s).
description:You closely manage privileged user access to network and information systems supporting your essential function(s).
subprincipleitemgroups:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- The identities of the individuals with privileged access to network and information systems (infrastructure, platforms, software, configuration etc) supporting your essential function(s) are not known or not managed.
- The identities of the individuals with privileged access to network and information systems (infrastructure, platforms, software, configuration etc) supporting your essential function(s) are not known or not managed.
- Privileged user access to network and information systems supporting your essential function(s) is via weak authentication mechanisms (e.g. only simple passwords).
- Privileged user access to network and information systems supporting your essential function(s) is via weak authentication mechanisms (e.g. only simple passwords).
- The list of privileged users has not been reviewed recently (e.g. within the last 12 months).
- The list of privileged users has not been reviewed recently (e.g. within the last 12 months).
- Privileged user access is granted on a system-wide basis rather than by role or function(s).
- Privileged user access is granted on a system-wide basis rather than by role or function(s).
- Privileged user access to your essential function(s) is via generic, shared or default name accounts.
- Privileged user access to your essential function(s) is via generic, shared or default name accounts.
- Where there are “always on” terminals which can perform privileged actions (such as in a control room), there are no additional controls (e.g. physical controls) to ensure access is appropriately restricted.
- Where there are “always on” terminals which can perform privileged actions (such as in a control room), there are no additional controls (e.g. physical controls) to ensure access is appropriately restricted.
- There is no logical separation between roles that an individual may have and hence the actions they perform (e.g. access to corporate email and privilege user actions).
- There is no logical separation between roles that an individual may have and hence the actions they perform (e.g. access to corporate email and privilege user actions).
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Partially
kind:Partially
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- All privileged user access to network and information systems supporting your essential function(s) requires strong authentication, such as multi-factor (MFA).
- All privileged user access to network and information systems supporting your essential function(s) requires strong authentication, such as multi-factor (MFA).
- The identities of the individuals with privileged access to network and information systems (infrastructure, platforms, software, configuration etc) supporting your essential function(s) are known and managed. This includes third parties.
- The identities of the individuals with privileged access to network and information systems (infrastructure, platforms, software, configuration etc) supporting your essential function(s) are known and managed. This includes third parties.
- Activity by privileged users is routinely reviewed and validated (e.g. at least annually).
- Activity by privileged users is routinely reviewed and validated (e.g. at least annually).
- Privileged users are only granted specific privileged user access rights which are essential to their business role or function.
- Privileged users are only granted specific privileged user access rights which are essential to their business role or function.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- Privileged user access to network and information systems supporting your essential function(s) is carried out from dedicated separate accounts that are closely monitored and managed.
- Privileged user access to network and information systems supporting your essential function(s) is carried out from dedicated separate accounts that are closely monitored and managed.
- The issuing of temporary, time-bound rights for privileged user access and / or external third-party support access is in place.
- The issuing of temporary, time-bound rights for privileged user access and / or external third-party support access is in place.
- Privileged user access rights are regularly reviewed and always updated as part of your joiners, movers and leavers process.
- Privileged user access rights are regularly reviewed and always updated as part of your joiners, movers and leavers process.
- All privileged user activity is routinely reviewed, validated and recorded for offline analysis and investigation.
- All privileged user activity is routinely reviewed, validated and recorded for offline analysis and investigation.
- sub-principle:
- sub-principle:
name:B2.d Identity and Access Management (IdAM)
name:B2.d Identity and Access Management (IdAM)
description:You closely manage and maintain identity and access control for users, devices and systems accessing the network and information systems supporting your essential function(s).
description:You closely manage and maintain identity and access control for users, devices and systems accessing the network and information systems supporting your essential function(s).
subprincipleitemgroup:
subprincipleitemgroups:
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Not
kind:Not
condition:At least one
condition:At least one
subprincipleitem:
subprincipleitem:
- Greater access rights are granted than necessary.
- Greater access rights are granted than necessary.
- Identity validation and requirement for access of a user, device or systems is not carried out.
- Identity validation and requirement for access of a user, device or systems is not carried out.
- User access rights are not reviewed when users change roles.
- User access rights are not reviewed when users change roles.
- User access rights remain active when users leave your organisation.
- User access rights remain active when users leave your organisation.
- Access rights granted to devices or systems to access other devices and systems are not reviewed on a regular basis (at least annually).
- Access rights granted to devices or systems to access other devices and systems are not reviewed on a regular basis (at least annually).
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Partially
kind:Partially
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- You follow a robust procedure to verify each user and issue the minimum required access rights.
- You follow a robust procedure to verify each user and issue the minimum required access rights.
- You regularly review access rights and those no longer needed are revoked.
- You regularly review access rights and those no longer needed are revoked.
- User access rights are reviewed when users change roles via your joiners, leavers and movers process.
- User access rights are reviewed when users change roles via your joiners, leavers and movers process.
- All user, device and system access to the systems supporting the essential function(s) is logged and monitored, but it is not compared to other log data or access records.
- All user, device and system access to the systems supporting the essential function(s) is logged and monitored, but it is not compared to other log data or access records.
- subprincipleitemgroup:
- subprincipleitemgroup:
kind:Achieved
kind:Achieved
condition:All
condition:All
subprincipleitem:
subprincipleitem:
- You follow a robust procedure to verify each user and issue the minimum required access rights, and the application of the procedure is regularly audited.
- You follow a robust procedure to verify each user and issue the minimum required access rights, and the application of the procedure is regularly audited.
- User access rights are reviewed both when people change roles via your joiners, leavers and movers process and at regular intervals - at least annually.
- User access rights are reviewed both when people change roles via your joiners, leavers and movers process and at regular intervals - at least annually.
- All user, device and systems access to the systems supporting the essential function(s) is logged and monitored.
- All user, device and systems access to the systems supporting the essential function(s) is logged and monitored.
- You regularly review access logs and correlate this data with other access records and expected activity.
- You regularly review access logs and correlate this data with other access records and expected activity.
- Attempts by unauthorised users, devices or systems to connect to the systems supporting the essential function(s) are alerted, promptly assessed and investigated.
- Attempts by unauthorised users, devices or systems to connect to the systems supporting the essential function(s) are alerted, promptly assessed and investigated.
@@ -11,4 +12,8 @@ class CafTest < ActiveSupport::TestCase
c=Caf.new
c=Caf.new
assert!c.save
assert!c.save
end
end
test"yaml file is valid"do
ymal=YAML.load_file('config/caf_text.yml')
end
end
end
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
