{"text_format":"1","workbook":"xlsx","n_sheets":16,"sheets":["v1.2 User Guide","v1.2 Impact Qs","v1.2 Diagnostic Statements","v1.2 FAQs","Summary of Changes for v1.2","Mapping to FFIEC CAT ","FFIEC CAT to CRI Profile","Mapping to FFIEC BCM Booklet","Mapping to NYDFS","Mapping to ECB","Mapping to EBA","Catalogue of Mapped Regs","Mapping to NAIC HBRS|ExC","Mapping to NIST CSF v1.1 v2","NIST to ISO|IEC 27001","Glossary Terms and Defs"],"not_rendered":{"charts":0,"images":14,"macros":1,"external_links":3,"defined_names":228,"comments":0,"pivot_tables":2},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"v1.2 User Guide","index":0,"n_rows":222,"n_cols":2,"rows_kept":222,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Table of Contents"]
[null,"I. Introduction"]
[null,"II. Which Types of Institutions Is the Profile Designed For?"]
[null,"III. Benefits to the Profile Approach"]
[null,"Benefits to Financial Institutions"]
[null,"Benefits to Regulatory Community"]
[null,"IV. Core Profile Components"]
[null,"V. How to Use the Profile"]
[null,"VI. Governance Process on Profile Iteration"]
[null,"VII. Points of Contact and Adding Trade Association Support through Logo Usage"]
[]
[]
[null,"I.                   Introduction"]
[]
[null,"Background: With the increasing volume and sophistication of cyber-attacks and a projected global shortfall of three and a half million cybersecurity professionals for this year, 2021, the financial services and supervisory community continue to struggle to find an efficient approach to cybersecurity risk management that effectively counters the dynamic, evolving threat and provides adequate assurance to government supervisors."]
[]
[null,"When last surveyed in 2016, Chief Information Security Officers for financial services institutions reported that up to 40% of their time was spent on the compliance requirements of various regulatory frameworks, not cybersecurity."]
[]
[null,"The CRI Profile (previously known as the \"FSSCC Profile,\" \"Financial Services Profile,\" the \"FSP,\" or “the Sector Cybersecurity Profile”) is an assessment framework based on: the National Institute of Standards and Technology’s “Framework for Improving Critical Infrastructure Cybersecurity” (NIST Framework or CSF), CPMI-IOSCO’s “Guidance on cyber resilience for financial market structures,” assessment questions based on relevant supervisory guidance and frameworks, and direct correlative mappings to ISO/IEC 27001/2 controls."]
[]
[null,"To enhance the Profile’s assessment capabilities, the industry developed an “Impact Tiering” questionnaire to identify the potential market risk presented by financial institutions of differing complexity, and sizes. This \"Impact Tiering\" approach was encouraged by the regulatory community, and the concepts included in this approach are concepts that they now express in their policy initiatives regarding operational resilience. While the original impact tiering focused on the North American financial sector, it is easily expandable to include other international jurisdictions."]
[]
[null,"Purpose and Intent: In addition to aligning cybersecurity regulatory expectations and authorities, the Profile also provides a flexible structure to absorb future cyber, as well as operational resilience, supervisory expectations within its organization, vocabulary, and taxonomy.  Institutions and supervisory agencies and organizations can focus on the core elements of their cyber risk management missions. With the efficiencies gained, more resources can then be applied to cybersecurity."]
[]
[]
[null,"II.                 Which Types of Institutions Is the Profile Designed For?"]
[]
[null,"While the Profile was developed by the financial services sector, it is a model that can be (and has been) used in other sectors. The Profile is organized around the seven Functions of (1) Governance, (2) Identify, (3) Protect, (4) Detect, (5) Respond, (6) Recover, and (7) Supply/Dependency Management and extended with Diagnostic Statements to connect these concepts with existing compliance requirements and informative references, such as the ISO 27000 series controls, which makes it flexible to address the needs of industries beyond the financial services. Indeed, the Business Software Alliance used the Profile architecture to construct its \"BSA Framework for Secure Software: A New Approach to Securing the Software Lifecycle,\" a framework to help stakeholders of the software industry to evaluate the security of specific software products and services."]
[]
[null,"With respect to the financial services industry, the Profile has been designed for use by all financial institutions, financial services companies, financial firms, and their third-party providers. A broad cross-section of the financial services industry—banking, insurance, asset management, market utilities, broker-dealers—designed it to scale across institutions of varying complexity, interconnectedness, and criticality. Regulatory issuances and best practices from across the sector and around the globe are incorporated and continue to be integrated through the work of CRI."]
[]
[null,"Through the impact tiering questionnaire, the Profile segments the financial services sector into four tiers of criticality. Each tier corresponds with the impact that an institution would have on the global, national, sector, or local market if substantially affected by a cybersecurity event.  These “Impact Tiers” are as follows:"]
[]
[null,"Tier 1: National/Super-National Impact. This tier includes institutions that are designated most critical by one or more U.S. or North American regulatory agencies and/or bodies (e.g., GSIB designation; Executive Order 13636, Section 9 designation). This category assumes the gross cyber risk exposure of an institution or service categorized as Tier 1 would have the most potential adverse impact to the overall stability of the global economy."]
[]
[null,"Tier 2: Subnational Impact. This tier includes institutions that provide mission critical services for millions of customer accounts. This category assumes the gross cyber risk exposure of an institution or service would have the potential for a substantial adverse impact to the financial services sector and subnational regional economy but does not rise to the level of Tier 1."]
[]
[null,"Tier 3: Sector Impact. This tier includes institutions that have a high degree of interconnectedness, with certain institutions acting as key nodes within and for the sector. The nature of the services that these institutions provide to the sector plays a significant role in determining their criticality."]
[]
[null,"Tier 4: Localized Impact. This tier includes institutions that have a limited impact on the overall financial services sector and national economy. Typical characteristics include: (a) institutions with a local presence and less than 1 million customers (e.g., community banks, state banks) and (b) providers of low criticality services in relation to the entire sector."]
[]
[null,"Upon determining an institution’s Impact Tier, the Profile is customized to meet the institution’s likely cybersecurity risk. The user is then prompted to answer a set of self-assessment questions—the Diagnostic Statements—coded by Function, Category, Subcategory, and associated numbering with the CPMI-IOSCO and NIST Cybersecurity Framework."]
[]
[null,"Financial institutions can use the Profile as the baseline examination assessment, and extend the functionality to evaluate partners, vendors, and third-party service providers."]
[]
[null,"It is important to note that these tiers are provided as guidance. An organization can include Diagnostic Statements associated with a different tier than the one with which they identify. Potential reasons for lower tiered organizations to include additional Diagnostic Statements corresponding with other tier levels may include business interests, risk appetite, or third-party or regulator expectations. Similarly, while an institution may categorize itself at a certain tier, an outside organization using the Profile to evaluate the institution’s cybersecurity posture may categorize the institution into a different Impact Tier."]
[]
[]
[null,"III.              Benefits to the Profile Approach"]
[]
[null,"The numerous and substantial benefits to the financial services sector are: "]
[null,"·       Focuses senior executive and boardroom review of cybersecurity risks and budgeting;"]
[null,"·       Brings plain language to benchmarking, risk management, audit, and in-house education;"]
[null,"·       Offers compliance efficiencies that grow with a financial institution’s complexity;"]
[null,"·       Aids prioritization and focused use of resources;"]
[null,"·       Creates a common vocabulary that eases collaboration with other financial institutions, third parties, and innovative non-bank financial companies;"]
[null,"·       Supports tailored supervision, examinations, and collaboration among state, federal, and international supervisors;"]
[null,"·       Enhances understanding of systemic risk within the sector, across sectors, and among institutions and third parties;"]
[null,"·       Creates a common baseline security threshold; and"]
[null,"·       Improves data collection and comparison."]
[]
[null,"Benefits to Financial Institutions"]
[null,"Boardroom Engagement to Advance Investment: For C-Suite and board directors, cybersecurity is a top concern and supervisors expect institutions to track their progress in mitigating identified security gaps. By using the Profile over several cycles, financial institutions can benchmark their programs with the Profile’s recommended practices, identify gaps, articulate those gaps to the C-Suite and board directors in plain language, discuss appropriate resourcing for mitigation, and track the advancement in mitigation efforts over time."]
[]
[null,"Efficiencies: The Profile promises to reduce the time a financial institution needs to complete a comprehensive assessment by offering a tailored set of statements used for assessment purposes– the Diagnostic Statements–reflecting the institution’s risk to the broader economy."]
[null,"·         73% Reduction for Community Institution Assessment Questions. For the least complex and interconnected institutions, it is expected that they will answer a total of 145 questions (9 tiering questions + 136 Diagnostic Statement questions). Compared with another widely-used assessment tool’s 533 questions, the Profile represents a 73% reduction in questions. "]
[null,"·         49% Reduction in Assessment Questions for the Largest Institutions. For the most complex and interconnected institutions, the reduction also is significant. With the Profile, it is expected that such institutions will answer 279 questions (2 tiering questions + 277 Diagnostic Statement questions) as compared with the other widely-used assessment’s 533, the Profile represents a 49% reduction in questions."]
[]
[null,"Benefits to Regulatory Community"]
[null,"For the regulatory community, the benefits also are numerous and substantial. With the Profile, state, federal, and global supervisors can:"]
[null,"·         Tailor examinations to institutional complexity and conduct “deeper dives” in those areas of greater importance;"]
[null,"·         Better discern the sector’s systemic risk by comparing answers across institutions using common terms and concepts;"]
[null,"·         Understand an institution’s baseline security status quickly, affording additional time for specialization, testing, and validation;"]
[null,"·         Broaden the ability to take collective supervisory action to address identified global, national, sector, and institution risks;"]
[null,"·         Improve data analysis and data comparisons from other agencies and jurisdictions; and"]
[null,"·         Enhance supervisors’ visibility into non-sector and third-party risks."]
[]
[null,"IV.              Core Profile Components"]
[]
[null,"The Core Profile Components consist of the following: "]
[null,"·       Functions (found in Column A in the \"v1.2 Diagnostic Statements\" tab);"]
[null,"·       Categories (found in Column B in the \"v1.2 Diagnostic Statements\" tab);"]
[null,"·       Subcategories (found in Column C in the \"v1.2 Diagnostic Statements\" tab);"]
[null,"·       Diagnostic Statements (found in Column F in the \"v1.2 Diagnostic Statements\" tab);"]
[null,"·       Potential Responses for each Impact Tier's Diagnostic Statements (for Impact Tier 1, 2, 3, and 4 firms, responses can be found by clicking on cells in Columns G, H, I, and J, respectively, in the \"v1.2 Diagnostic Statements\" tab);"]
[null,"·       Financial Sector Reference - i.e., where in existing regulations, guidance or other supervisory documents the concept is applied to the Financial Sector (found in Column K in the \"v1.2 Diagnostic Statements\" tab); and"]
[null,"·       Informative References - i.e., where the corresponding concept is expressed in international standards and best practices (found in Column L in the \"v1.2 Diagnostic Statements\" tab."]
[]
[null,"See figure below."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"There are seven overarching functions: (1) Governance, (2) Identify, (3) Detect, (4) Protect, (5) Respond, (6) Recover, and (7) Supply Chain/Dependency Management. These are adapted from the NIST Framework and CPMI-IOSCO to more closely align with the financial services sector approach to cybersecurity."]
[]
[null,"Functions are subdivided into more specific concept categories (Categories). "]
[]
[null,"Categories are sub-divided into subcategories (Subcategories), which are designed to reflect a particular element of an effective cyber risk management program.  "]
[]
[null,"Each Subcategory is associated with at least one Diagnostic Statement. Institutions use Diagnostic Statements to assess their own cyber risk management program. Institutions then note the outcome of their assessment by selecting one of eight potential Diagnostic Statement responses: "]
[null,"1)      Yes: An institution would select this response if it can confidently answer Yes;"]
[null,"2)      No: An institution would select this response if it has not fulfilled the Diagnostic Statement; "]
[null,"3)      Partial: An institution would select this response if it has not fully met the Diagnostic Statement, but it is currently working through an action plan to achieve a Yes outcome;"]
[null,"4)      Not Applicable: An institution might select this response if, after evaluating its business and security program, the Diagnostic Statement is not applicable even though it was suggested by its Impact Tier;"]
[null,"5)      Not Tested: An institution might select this response if it has yet to test controls associated with that specific Diagnostic Statement; "]
[null,"6)      Yes-Risk Based: An institution might select this response if the Diagnostic Statement, in using supervisory language, requires a more nuanced, risk-based answer and explanation than the Diagnostic Statement otherwise suggests;"]
[null,"7)      Yes-Compensating Controls Used: An institution might select this response if it meets the intent of the Diagnostic Statement by using compensating controls; and"]
[null,"8)      I don’t know: An individual assessment user might select this response as a note to check with other relevant stakeholders within the institution to determine the most accurate response. "]
[]
[null,"An institution would then collect and maintain documentation and other evidence to support its assessment and response."]
[]
[null,"Impact Tiers and the Impact Tier Questionnaire are a scaling device to customize the Profile based on an individual institution’s risk and activities. Completing the questionnaire results in a determination of which of the four tiers of impact are most reflective of the institution’s impact: National/Super-National, Subnational, Sectoral, or Localized. These are the Impact Tiers. The institution would then answer a set of Diagnostic Statements corresponding to its Impact Tier."]
[]
[null,"These Tiers are for guidance purposes only. Subcategories and Diagnostic Statements not associated with a particular tier may be included by a supervisor or other institution that is using the Profile to evaluate cyber risk management programs."]
[]
[null,"The two reference libraries—Financial Sector References and the Informative References—act as guideposts to assist institutions in understanding the origins of the concepts (and, at times, the language) reflected in each Diagnostic Statement. In most cases, the Diagnostic Statements merge state and federal financial services sector regulation, guidance, supervisory documentation and issuances, as well as international standards and common best practices."]
[]
[null,"V.                How to Use the Profile  "]
[]
[null,"The Profile may be used in multiple ways, from self-assessment and third-party risk management, to providing a common supervisory engagement approach among state, federal, and international regulatory bodies."]
[]
[null,"Cybersecurity Self-Assessment in Four Easy and Repeatable Steps: The Profile may assist institutions in assessing their cybersecurity risk management governance, processes, capabilities, and regulatory compliance posture as expected with the various Impact Tiers to which they correspond. In understanding their posture, institutions can then develop plans to close any identified gaps. This process can be reduced to four repeatable steps as depicted and further described below."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Step 1: The institution determines its Impact Tier by completing the Impact Tiering Questionnaire. The Questionnaire consists of nine questions that identify an institution’s Impact Tier:"]
[null,"·         Tier 1: National/Super-National Impact; "]
[null,"·         Tier 2: Subnational Impact; "]
[null,"·         Tier 3: Sector Impact; and"]
[null,"·         Tier 4: Localized Impact.  "]
[]
[null,"Step 2: Based on the Institution’s Impact Tier, the institution assesses itself against the corresponding Diagnostic Statements:"]
[null,"·         Tier 1: 277 Diagnostic Statements;"]
[null,"·         Tier 2: 262 Diagnostic Statements; "]
[null,"·         Tier 3: 188 Diagnostic Statements; and"]
[null,"·         Tier 4: 137 Diagnostic Statements.  "]
[]
[null,"Step 3: Based on the self-assessment, the institution identifies shortcomings and gaps in its cybersecurity risk management governance, processes, capabilities, and regulatory compliance posture."]
[]
[null,"Step 4: Once gaps are identified, the institution develops and implements a plan to close gaps and address shortcomings to satisfy the cybersecurity expectations of its Impact Tier."]
[null,"·         The reference libraries are included to assist the institution in developing a roadmap to address gaps and shortcomings. Many of the references have specific instructions or detail correct security approaches and best practices."]
[]
[null,"Repeat: The institution repeats the self-assessment and gap-closing process periodically, or upon an event, which warrants a re-evaluation of their Impact Tier, such as:"]
[null,"·         Acquisition of another entity;"]
[null,"·         Introduction of a new business line;"]
[null,"·         Significant growth in number of accounts, delivery of critical services, or interconnectedness;"]
[null,"·         A significant change in a threat landscape;"]
[null,"·         The institution believes that their Impact Tier has changed; and/or"]
[null,"·         A regulatory or supervisory body believes that the institution’s self-assessed Impact Tier is inaccurate or has changed."]
[]
[null,"Profile as Third-Party Risk Management Tool: Like self-assessment, a financial institution could evaluate partners, vendors, and service providers with the four Impact Tiers based upon the third parties’ criticality and interconnectivity. The financial institution could then request the third party to provide evidence against the corresponding set of Diagnostic Statements identified by their Impact Tier."]
[]
[null,"Profile as a Common Supervisory Approach: The organization, vocabulary, and taxonomy of the Profile offers a credible method of cybersecurity risk management and a basis for conducting supervisory exams. Supervisors may allow financial institutions to use the evidence in their Profile self-assessment exercise for supervisory reporting and analysis. This consistency will allow supervisors to evaluate and compare peer institutions and clearly identify gaps for remediation.  This approach is more efficient for the institution and supervisor and provides consistency for an institution in communicating its program both internally and externally."]
[]
[null,"The use of the Profile’s approach does not limit what a supervisor can review or require.  Rather, it provides an examination approach allowing financial institutions to confidently produce baseline evidence for review and more quickly respond to iterative and follow-up questions from the supervisor. This shared approach would produce a more efficient and consistent examination process for supervisors and financial institutions."]
[]
[]
[null,"VI.               Governance Process on Profile Iteration"]
[]
[null,"The Financial Sector Coordinating Council (FSSCC), trade associations, financial institutions, and other Profile development stakeholders recognized that future maintenance of the Profile is essential for its ultimate success. To assure the Profile's continued iteration and success, they established the Cyber Risk Institute (CRI) as a separate not-for-profit organization (originally a separate division within the Bank Policy Institute). CRI is tasked with maintaining and evolving the Profile.  For more information about CRI, please visit: "]
[null,"https://cyberriskinstitute.org/"]
[]
[null,"CRI plans to issue new, full revisions of the Profile, which would include any major updates, every 2-to-3-years similar to those cycles used by other standards bodies, such as NIST and ISO.  The next such major update will most likely occur in late 2022. In addition, CRI plans to issue more minor updates, such as updates to the informative references or regulatory mappings, on a more frequent or yearly basis."]
[]
[null,"CRI recognizes that users may suggest potential enhancements and new cyber risk management concepts between Profile versions. As these recommendations surface, CRI will evaluate their applicability within the regulatory landscape, utility to a cyber risk management program, and the feasibility of incorporation into a Profile’s next version. This process of evaluation includes a review by the CRI Board of Directors, Standards Committee, and other stakeholders, as appropriate, as was done to develop the Profile from concept to its first release in Version 1.0."]
[]
[]
[null,"VII.         Points of Contact and Adding Trade Association Support through Logo Usage"]
[]
[null,"To Learn More: To learn more about the Profile, participating in future Profile iterations, or CRI, please contact Josh Magri of the Cyber Risk Institute. To participate in Profile peer groups, please contact Denyette DePierro of the American Bankers Association, who helped lead the development of the Profile."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Adding Trade Association Support: We continue to appreciate the support of trade associations across the sector and would gladly accept additional support from additional associations as they believe the work of CRI is a benefit to their members."]

{"sheet":"v1.2 Impact Qs","index":1,"n_rows":27,"n_cols":2,"rows_kept":27,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"The CRI Profile v1.2"]
[null,"- Impact Tiering Questionnaire -"]
[]
[null,"Through 9 questions related to a financial institution’s inherent risk and systemic risk, this Impact Tiering Questionnaire helps financial institutions discern its \"Impact Tier\" using a four-tier model. Each of the four Impact Tiers are associated with a set of corresponding Diagnostic Statements. You will be directed to these questions on the next tab following completion of this questionnaire. Completing the questionnaire should take only 5-10 minutes."]
[]
[null,"Please keep the following in mind when completing this questionnaire:"]
[]
[null,"1.       Each numerically increasing tier from \"Tier 1: National/Super-National Impact\" to \"Tier 4: Localized Impact\" represents a step down in maturity expectations."]
[null,"2.       Institutions aligning to the highest impact tier—Tier 1: National/Super-National Impact—will be immediately “off-ramped” and will need to address every Diagnostic Statement. Other institutions will have to answer more up-front questions via the questionnaire, but would then need to complete fewer Diagnostic Statements:"]
[null,"a.       Institutions that self-assess at the Tier 1: National/Super-National Impact Tier would answer 1-2 Impact Questionnaire questions and then 277 corresponding Diagnostic Statements for a total of 278-279 responses."]
[null,"b.      Institutions that self-assess at the Tier 2: Subnational Impact Tier would answer 3-6 Impact Questionnaire questions and then 262 corresponding Diagnostic Statements for a total of 265-268 responses."]
[null,"c.       Institutions that self-assess at the Tier 3: Sector Impact Tier would answer 7-9 Impact Questionnaire questions and then 188 corresponding Diagnostic Statements for a total of 195-197 responses."]
[null,"d.      Institutions that self-assess at the Tier 4: Localized Impact Tier would answer all 9 Impact Questionnaire questions and then 137 Diagnostic Statements for a total of 146 responses."]
[null,"3.       If in doubt when responding to a question, institutions should always select a response that would lead to correlation with a higher Impact Tier (which is a numerically lower number)."]
[null,"4.       Institutions should consider institution-specific risk factors that may warrant elevating the institution to a higher tier than indicated by the questionnaire, or adopting additional Diagnostic Statements than may be indicated for the tier indicated by the questionnaire."]

{"sheet":"v1.2 Diagnostic Statements","index":2,"n_rows":286,"n_cols":12,"rows_kept":286,"cut":false,"hidden":false,"merged":[[2,0,2,11],[3,0,4,0],[3,1,4,1],[3,2,4,2],[3,3,4,3],[3,5,4,5],[3,6,3,9],[3,10,4,10],[3,11,4,11],[15,3,20,3],[21,2,23,2],[21,3,23,3],[24,2,26,2],[24,3,26,3],[5,0,63,0],[5,1,14,1],[5,2,9,2],[5,3,9,3],[11,2,13,2],[11,3,13,3],[15,1,26,1],[15,2,20,2],[35,1,39,1],[36,2,39,2],[36,3,39,3],[40,1,44,1],[40,2,41,2],[40,3,41,3],[42,2,44,2],[42,3,44,3],[27,1,34,1],[27,2,28,2],[27,3,28,3],[29,2,31,2],[29,3,31,3],[32,2,34,2],[32,3,34,3],[45,1,51,1],[45,2,48,2],[49,2,50,2],[49,3,50,3],[52,1,60,1],[52,2,55,2],[52,3,55,3],[56,2,57,2],[56,3,57,3],[58,2,60,2],[61,1,63,1],[61,2,62,2],[61,3,62,3],[64,0,86,0],[64,1,72,1],[66,2,68,2],[66,3,68,3],[70,2,71,2],[70,3,71,3],[73,1,86,1],[85,2,86,2],[85,3,86,3],[87,0,158,0],[87,1,100,1],[87,2,89,2],[87,3,89,3],[91,2,92,2],[91,3,92,3],[75,2,77,2],[75,3,77,3],[79,2,84,2],[79,3,84,3],[99,2,100,2],[99,3,100,3],[101,1,112,1],[101,2,103,2],[101,3,103,3],[104,2,106,2],[104,3,106,3],[93,2,95,2],[93,3,95,3],[96,2,97,2],[96,3,97,3],[113,1,122,1],[113,2,114,2],[113,3,114,3],[115,2,116,2],[115,3,116,3],[107,2,109,2],[107,3,109,3],[110,2,111,2],[110,3,111,3],[138,2,139,2],[138,3,139,3],[140,2,143,2],[140,3,143,3],[123,1,150,1],[123,2,125,2],[123,3,125,3],[126,2,128,2],[126,3,128,3],[130,2,133,2],[130,3,133,3],[151,1,152,1],[153,1,158,1],[153,2,154,2],[153,3,154,3],[159,0,190,0],[159,1,164,1],[161,2,162,2],[161,3,162,3],[144,2,146,2],[144,3,146,3],[147,2,150,2],[147,3,150,3],[183,2,184,2],[183,3,184,3],[185,1,190,1],[188,2,189,2],[188,3,189,3],[176,2,178,2],[176,3,178,3],[179,2,182,2],[179,3,182,3],[165,1,184,1],[165,2,168,2],[165,3,168,3],[170,2,172,2],[170,3,172,3],[173,2,174,2],[173,3,174,3],[202,2,204,2],[202,3,204,3],[205,1,212,1],[206,2,207,2],[206,3,207,3],[210,2,212,2],[210,3,212,3],[191,0,221,0],[192,1,204,1],[192,2,194,2],[192,3,194,3],[195,2,198,2],[195,3,198,3],[199,2,200,2],[199,3,200,3],[218,1,221,1],[218,2,220,2],[218,3,220,3],[213,1,217,1],[213,2,214,2],[213,3,214,3],[216,2,217,2],[216,3,217,3],[222,0,233,0],[222,1,227,1],[222,2,227,2],[222,3,227,3],[228,1,229,1],[269,1,276,1],[269,2,271,2],[269,3,271,3],[272,2,276,2],[272,3,276,3],[234,0,281,0],[234,1,238,1],[234,2,237,2],[234,3,237,3],[239,1,268,1],[239,2,241,2],[249,2,253,2],[249,3,253,3],[254,2,257,2],[230,1,233,1],[230,2,231,2],[230,3,231,3],[254,3,257,3],[258,2,264,2],[258,3,264,3],[239,3,241,3],[242,2,246,2],[242,3,246,3],[247,2,248,2],[247,3,248,3],[277,1,281,1],[277,2,278,2],[277,3,278,3],[279,2,280,2],[279,3,280,3],[265,2,268,2],[265,3,268,3]]}
[]
["Proprietary"]
["The CRI Profile v1.2"]
["Functions","Categories","Subcategories","NIST CSF v1.1 Ref",null,"Diagnostic Statements","Diagnostic Statement Responses",null,null,null,"FS References","Informative References from NIST CSF v1.1"]
[null,null,null,null,null,null,"Tier 1:\nNational+ Impact","Tier 2:\nSubnational Impact","Tier 3:\nSector Impact","Tier 4:\nLocalized Impact"]
["GOVERNANCE (GV)","Strategy and Framework (GV.SF): The organization has a cyber risk management framework that is reviewed and approved by the Board and is informed by the organization's risk tolerances and its role in critical infrastructure.","GV.SF-1: Organization has a cyber risk management strategy and framework.","ID.BE-3;  ID.RM-1 - with sector enhancement ","GV.SF-1.1","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.",null,null,null,null,"CFTC/A, FFIEC CAT D1, FFIEC IT Booklet/Information Security/I, FFIEC IT Booklet/Management/I, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-4.c, 12-1.b, FINRA, NAIC HBRS/ExC APO.03 & APO.09, SEC Regulation SCI, SEC Regulation S-ID, EBA GITSRM 3.2.2.5, ECB CROE 2.1.2.1-2, ECB CROE 2.1.2.1-2.k, ECB CROE 2.1.2.1-3, ECB CROE 2.1.2.1-4, ECB CROE 2.1.2.1-7, ECB CROE 2.1.2.1-10, ECB CROE 2.1.2.1-15, ECB CROE 2.1.2.2-17, ECB CROE 2.2.2-4","COBIT 5 APO02.06 & APO03.01, ISO/IEC 27001:2013 Clause 4.1, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,null,null,"GV.SF-1.2","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/I, FFIEC IT Booklet/Management/I.A.1, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-4.f, 12-1.d, FINRA, NAIC HBRS/ExC APO.03 & APO.09, NAIC ML/4, EBA GITSRM 3.2.1.2, EBA GITSRM 3.2.1.3, EBA GITSRM 3.2.1.4, ECB CROE 2.1.2.1-1, ECB CROE 2.1.2.2-19, ECB CROE 2.1.2.2-35","COBIT 5 APO02.06 & APO03.01, ISO/IEC 27001:2013 Clause 4.1, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,null,null,"GV.SF-1.3","GV.SF-1.3: The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them. ",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/I, FFIEC IT Booklet/Management/I.B, FFIEC IT Booklet/Operations, FINRA, NAIC HBRS/ExC APO.03 & APO.09, NYDFS/500.02, ECB CROE 2.1.2.1-14","COBIT 5 APO02.06 & APO03.01, ISO/IEC 27001:2013 Clause 4.1, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,null,null,"GV.SF-1.4","GV.SF-1.4: The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Management/I.A, FFIEC IT Booklet/Operations, FINRA, NAIC HBRS/ExC APO.03 & APO.09, ECB CROE 2.1.2.1-14, ECB CROE 2.2.2-13","COBIT 5 APO02.06 & APO03.01, ISO/IEC 27001:2013 Clause 4.1, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,null,null,"GV.SF-1.5","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/I, FFIEC IT Booklet/Management/I, FFIEC IT Booklet/Operations, FINRA, NAIC HBRS/ExC APO.03 & APO.09, EBA GITSRM 3.2.2.5.a, EBA GITSRM 3.2.2.5.c, EBA GITSRM 3.2.2.6, ECB CROE 2.1.2.1-1.a, ECB CROE 2.1.2.1-1.b, ECB CROE 2.1.2.1-2.a, ECB CROE 2.1.2.1-2.c, ECB CROE 2.1.2.2-33, ECB CROE 2.1.2.2-35","COBIT 5 APO02.06 & APO03.01, ISO/IEC 27001:2013 Clause 4.1, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,"GV.SF-2: Cyber risk management strategy and framework is appropriately informed by international, national, and industry standards and guidelines.","None","GV.SF-2.1","GV.SF-2.1: The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.",null,null,null,null,"CFTC/B, CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/II, FFIEC IT Booklet/Operations, FTC/4, G7/1, NAIC HBRS/ExC APO.02, NFA, EBA GITSRM 3.3.1.10, ECB CROE 2.1.2.1-8, ECB CROE 2.3.2.1-6, ECB CROE 2.3.2.1-52, ECB CROE 2.8.2.1-6","COBIT 5 EDM03.01 & APO01.03, ISO 27001:2013 Clause 5.3, NIST SP 800-53 Rev. 4 PL-1 & PM-1"]
[null,null,"GV.SF-3: Cyber risk management strategy and framework address applicable cybersecurity risks.","ID.GV-4 - with sector enhancement","GV.SF-3.1","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.",null,null,null,null,"CPMI-IOSCO/Governance, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/I, FFIEC IT Booklet/Operations, FFIEC-APX E/Monitoring and Reporting, FFIEC Booklet BCM/2-4.c, 2-5.g, 12-1.b, NAIC HBRS/ExC APO.12, NAIC ML/4, SEC Regulation S-ID, NYDFS 500.04, EBA GITSRM 3.3.1.13.e, ECB CROE 2.1.2.1-5, ECB CROE 2.1.2.1-10","COBIT 5 EDM03.02 & APO12.02 & APO12.05 & DSS04.02, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.3 & 4.2.3.8 & 4.2.3.9 & 4.2.3.11 & 4.3.2.4.3 & 4.3.2.6.3, ISO/IEC 27001:2013 Clause 6, NIST SP 800-53 Rev. 4 SA-2 & PM-3 & PM-7 & PM-9 & PM-10 & PM-11"]
[null,null,null,null,"GV.SF-3.2","GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.",null,null,null,null,"CPMI-IOSCO/Governance, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/I.A, FFIEC Booklet BCM/2-4.c, 2-5.h, 12-1.d, NAIC HBRS/ExC APO.12, NAIC ML/4, NYDFS 500.04, ECB CROE 2.1.2.1-5","COBIT 5 EDM03.02 & APO12.02 & APO12.05 & DSS04.02, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.3 & 4.2.3.8 & 4.2.3.9 & 4.2.3.11 & 4.3.2.4.3 & 4.3.2.6.3, ISO/IEC 27001:2013 Clause 6, NIST SP 800-53 Rev. 4 SA-2 & PM-3 & PM-7 & PM-9 & PM-10 & PM-11"]
[null,null,null,null,"GV.SF-3.3","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.",null,null,null,null,"CPMI-IOSCO/Governance, FFIEC CAT D1, FFIEC Booklet BCM/2-4.b, 2-5.b, 6-1.a, 6-1.b, 6-1.c, 6-4.a, NAIC HBRS/ExC APO.12, NAIC ML/4, NYDFS 500.04, EBA GITSRM 3.2.1.3, ECB CROE 2.1.2.2-23, ECB CROE 2.1.2.2-38, ECB CROE 2.1.2.2-39, ECB CROE 2.3.2.1-9, ECB CROE 2.8.2.1-2","COBIT 5 EDM03.02 & APO12.02 & APO12.05 & DSS04.02, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.3 & 4.2.3.8 & 4.2.3.9 & 4.2.3.11 & 4.3.2.4.3 & 4.3.2.6.3, ISO/IEC 27001:2013 Clause 6, NIST SP 800-53 Rev. 4 SA-2 & PM-3 & PM-7 & PM-9 & PM-10 & PM-11"]
[null,null,"GV.SF-4: The organization’s determination of cyber risk appetite is informed by its role in critical infrastructure and sector specific risk analysis.","ID.RM-3 - with sector enhancement","GV.SF-4.1","GV.SF-4.1: The risk appetite is informed by the organization’s role in critical infrastructure.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/II, NAIC HBRS/ExC APO.04 & APO.12","COBIT 5 APO12.02, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3, NIST SP 800-53 Rev. 4 SA-14 & PM-8 & PM-9 & PM-11"]
[null,"Risk Management (GV.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.","GV.RM-1: Cyber risk management processes are established, managed, and agreed to by organizational stakeholders.","ID.RM-1 - with sector enhancement","GV.RM-1.1","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/III, FFIEC IT Booklet/Operations, FINRA, NAIC HBRS/ExC APO.12, SEC Regulation SDR, SEC Regulation S-P, EBA GITSRM 3.3.1.10, EBA GITSRM 3.3.1.11, EBA GITSRM 3.3.1.13, EBA GITSRM 3.3.1.13.b, EBA GITSRM 3.6.1.62, ECB CROE 2.1.2.1-6, ECB CROE 2.6.2-19","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-1.2","GV.RM-1.2: The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.  ",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/III.C, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-4.d, FINRA, NAIC HBRS/ExC APO.12, EBA GITSRM 3.3.1.10, ECB CROE 2.1.2.1-2.k","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-1.3","GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/III, FFIEC IT Booklet/Operations, FINRA, NAIC HBRS/ExC APO.12, NYDFS 500.02, NYDFS/500.09, EBA GITSRM 3.3.1.13.f, EBA GITSRM 3.3.1.14, EBA GITSRM 3.3.3.20, ECB CROE 2.2.2-6, ECB CROE 2.6.2-21, ECB CROE 2.6.2-22","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-1.4","GV.RM-1.4: The cyber risk assessment process is consistent with the organization's policies and procedures and includes criteria for the evaluation and categorization of enterprise-specific cyber risks and threats.  ",null,null,null,null,"CFTC/A, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/II, FFIEC Booklet BCM/5-2.b, NAIC HBRS/ExC APO.12","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-1.5","GV.RM-1.5: The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls.",null,null,null,null,"CFTC/A, CFTC/E, CFTC/F, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/5-2.a, NAIC HBRS/ExC APO.12, NYDFS 500.15, EBA GITSRM 3.3.1.13.c, ECB CROE 2.3.2.1-2","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-1.6","GV.RM-1.6: The cyber risk management program addresses identified cyber risks in one of the following ways:  risk acceptance, risk mitigation, risk avoidance, or risk transfer, which includes cyber insurance.",null,null,null,null,"FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II, FFIEC IT Booklet/Management/III, FINRA/Cyber Insurance, NAIC HBRS/ExC APO.12","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,"GV.RM-2: Organizational risk tolerance is determined and clearly expressed.","ID.RM-2","GV.RM-2.1","GV.RM-2.1: The organization has established a cyber risk tolerance consistent with its risk appetite, and integrated it into technology or operational risk management, as appropriate.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.B, FFIEC IT Booklet/Management/III, FFIEC IT Booklet/Operations, NAIC HBRS/ExC APO.12, EBA GITSRM 3.3.1.13.a, ECB CROE 2.1.2.1-1.d, ECB CROE 2.1.2.1-2.e","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-2.2","GV.RM-2.2: The cyber risk management strategy articulates how the organization intends to address its inherent cyber risk (before mitigating controls or other factors are taken into consideration).",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Management/III, FFIEC IT Booklet/Operations, NAIC HBRS/ExC APO.12, ECB CROE 2.1.2.1-6","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-2.3","GV.RM-2.3: The cyber risk management strategy articulates how the organization would maintain an acceptable level of residual cyber risk set by the appropriate governing authority (e.g., the Board or one of its committees).",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.B, FFIEC IT Booklet/Management/III, FFIEC Booklet BCM/2-4.d, NAIC HBRS/ExC APO.12, ECB CROE 2.1.2.1-6","CIS CSC 4, COBIT 5 APO12.04 & APO12.05 & APO13.02 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 Clause 6.1.3 & Clause 8.3 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,"GV.RM-3: Cyber risk management framework is integrated into the enterprise risk management framework.","None","GV.RM-3.1","GV.RM-3.1: The cyber risk management framework is integrated into the enterprise risk management framework.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/I.B, FFIEC IT Booklet/Management/II, NAIC HBRS/ExC APO.12, EBA GITSRM 3.3.1.12, ECB CROE 2.1.2.1-9","COBIT 5 EDM03.02 & APO 12.03, ISO/IEC 27001:2013 Clause 4, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"GV.RM-3.2","GV.RM-3.2: The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.  ",null,null,null,null,"FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.A, FFIEC IT Booklet/Management/III.D, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-4.d, 5-5, NAIC HBRS/ExC APO.12, EBA GITSRM 3.3.1.13.d, ECB CROE 2.2.2-12","COBIT 5 EDM03.03 & APO 12.03, ISO/IEC 27001:2013 Clause 6.1.2, NIST SP 800-53 Rev. 4 RA-3 & PM-9"]
[null,null,null,null,"GV.RM-3.3","GV.RM-3.3: The organization's cyber risk management framework provides for segregation of duties between policy development, implementation, and oversight to ensure rigorous review of both policy and implementation.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.A, FFIEC IT Booklet/Management/III.C, FFIEC IT Booklet/Operations, NAIC HBRS/ExC APO.12","COBIT 5 DSS06.03, ISO/IEC 27001:2013 A.6.1.2"]
[null,"Policy (GV.PL): The organization has established a security policy in support of its cyber risk management framework.","GV.PL-1: Organizational cybersecurity policy is established and has been approved by appropriate governance bodies.","ID.GV-1 -\nwith sector enhancement","GV.PL-1.1","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/I.B, FFIEC IT Booklet/Management/III.C, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-2.c, NAIC HBRS/ExC APO.01, NYDFS/500.03/500.08, SEC Regulation SDR, SEC Regulation S-P, EBA GITSRM 3.4.1.28, EBA GITSRM 50, ECB CROE 2.1.2.1-7, ECB CROE 2.5.2.2-22","CIS CSC 19, COBIT 5 APO01.03 & APO13.01 & EDM01.01 & EDM01.02, ISA 62443-2-1:2009 4.3.2.6, ISO/IEC 27001:2013 A.5.1.1, NIST SP 800-53 Rev. 4 -1 controls from all security control families"]
[null,null,null,null,"GV.PL-1.2","GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/I.B, FFIEC IT Booklet/Management/III.C, NAIC HBRS/ExC APO.01, NYDFS/500.03/500.08, EBA GITSRM 3.4.1.29, ECB CROE 2.1.2.2-34, ECB CROE 2.1.2.2-35, ECB CROE 2.1.2.2-40, ECB CROE 2.3.2.2-66","CIS CSC 19, COBIT 5 APO01.03 & APO13.01 & EDM01.01 & EDM01.02, ISA 62443-2-1:2009 4.3.2.6, ISO/IEC 27001:2013 A.5.1.1, NIST SP 800-53 Rev. 4 -1 controls from all security control families"]
[null,null,"GV.PL-2: Organizational cybersecurity policy addresses appropriate controls, identified through risk assessment.","None","GV.PL-2.1","GV.PL-2.1: The cybersecurity policy is supported by the organization's risk management program.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Management/II, FFIEC-APX E, NAIC HBRS/ExC APO.01, NYDFS/500.08/500.09, SEC Regulation SCI, SEC Regulation SDR, SEC Regulation S-P, EBA GITSRM 3.4.1.28, ECB CROE 2.3.2.1-1","COBIT 5 APO01.03, ISO 27001:2013 Clause 5.2 & Clause 6.1, NIST SP 800-53 Rev. 4 PM-1"]
[null,null,null,null,"GV.PL-2.2","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Management/III.C, FFIEC IT Booklet/Operations, FFIEC-APX E, NAIC HBRS/ExC APO.01, FFIEC Booklet BCM/2-2.c, NYDFS/500.03/500.08/500.09, EBA GITSRM 3.4.1.30, EBA GITSRM 3.4.1.30.a, EBA GITSRM 3.4.1.30.b, EBA GITSRM 3.4.1.30.c, EBA GITSRM 3.4.1.30.d, EBA GITSRM 3.4.1.30.e, EBA GITSRM 3.4.1.30.f, EBA GITSRM 3.4.1.30.g, EBA GITSRM 50","COBIT 5 APO13.01, ISO 27001:2013 Clause 5.2 & Clause 6.2, NIST SP 800-53 Rev. 4 PM-1"]
[null,null,null,null,"GV.PL-2.3","GV.PL-2.3: The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).",null,null,null,null,"FFIEC CAT D1/ D5, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Management/I.B, FFIEC-APX E, NAIC HBRS/ExC APO.01, NFA, ECB CROE 2.1.2.1-13, ECB CROE 2.1.2.1-13.a, ECB CROE 2.3.2.1-9, ECB CROE 2.7.2.1-5","COBIT 5 APO01.02, ISO 27001:2013 Clause 5.2 & A.5.1.2, NIST SP 800-53 Rev. 4 PM-1 & PM-9"]
[null,null,"GV.PL-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed.","ID.GV-3","GV.PL-3.1","GV.PL-3.1: The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations.",null,null,null,null,"FFIEC CAT D1, FFIEC-APX E, NAIC HBRS/ExC MEA.03, NYDFS/500.02, SEC Regulation SDR, SEC Regulation S-P, ECB CROE 2.3.2.1-1.d","CIS CSC 19, COBIT 5 BAI02.01 & MEA03.01 & MEA03.04, ISA 62443-2-1:2009 4.4.3.7, ISO/IEC 27001:2013 A.18.1.1 & A.18.1.2 & A.18.1.3 & A.18.1.4 & A.18.1.5, NIST SP 800-53 Rev. 4 -1 controls from all security control families"]
[null,null,null,null,"GV.PL-3.2","GV.PL-3.2: The organization's cybersecurity policies are consistent with its privacy and civil liberty obligations.",null,null,null,null,"FFIEC CAT D1, FFIEC-APX E, NAIC HBRS/ExC MEA.03, NYDFS/500.02/500.03","CIS CSC 19, COBIT 5 BAI02.01 & MEA03.01 & MEA03.04, ISA 62443-2-1:2009 4.4.3.7, ISO/IEC 27001:2013 A.18.1.1 & A.18.1.2 & A.18.1.3 & A.18.1.4 & A.18.1.5, NIST SP 800-53 Rev. 4 -1 controls from all security control families"]
[null,null,null,null,"GV.PL-3.3","GV.PL-3.3: The organization implements and maintains a documented policy or policies that address customer data privacy, and is approved by a designated officer or the organization’s appropriate governing body (e.g., the Board or one of its committees).",null,null,null,null,"FFIEC CAT D1, FFIEC-APX E, FFIEC Booklet BCM/2-5.h, NAIC HBRS/ExC MEA.03, NYDFS/500.02/500.03, EBA GITSRM 3.4.1.28","CIS CSC 19, COBIT 5 BAI02.01 & MEA03.01 & MEA03.04, ISA 62443-2-1:2009 4.4.3.7, ISO/IEC 27001:2013 A.18.1.1 & A.18.1.2 & A.18.1.3 & A.18.1.4 & A.18.1.5, NIST SP 800-53 Rev. 4 -1 controls from all security control families"]
[null,"Roles and Responsibilities (GV.RR): The organization has designated appropriate roles and responsibilities, including an individual responsible for cybersecurity for the organization.","GV.RR-1: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners.","ID.GV-2","GV.RR-1.1","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.",null,null,null,null,"FFIEC CAT D1, G7/2, FFIEC Booklet BCM/1-3.d, 8-2.d, NAIC HBRS/ExC APO.01,, NYDFS 500.04, NYDFS 500.10, NYDFS 500.11, EBA GITSRM 3.3.1.12, EBA GITSRM 3.6.1.61, ECB CROE 2.1.2.1-1.c, ECB CROE 2.1.2.1-11, ECB CROE 2.1.2.2-29, ECB CROE 2.1.2.2-30, ECB CROE 2.1.2.2-38, ECB CROE 2.1.2.2-39, ECB CROE 2.5.2.4-54","CIS CSC 19, COBIT 5 APO01.02 & APO10.03 & APO13.02 & DSS05.04, ISA 62443-2-1:2009 4.3.2.3.3, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.1 & A.15.1.1, NIST SP 800-53 Rev. 4 PS-7 & PM-1 & PM-2"]
[null,null,"GV.RR-2: Organization has appointed a manager responsible for cybersecurity efforts within the organization, including authority, sufficient budget, and access to the executive suite and appropriate governing authority (e.g., the Board or one of its committees).","None","GV.RR-2.1","GV.RR-2.1: The organization has designated a Cybersecurity Officer (e.g., CISO) who is responsible and accountable for developing cybersecurity strategy, overseeing and implementing its cybersecurity program and enforcing its cybersecurity policy.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet / Management/I.B, FFIEC IT Booklet/Management/I.A, G7/2, NAIC HBRS/ExC APO.01 & APO.06, ECB CROE 2.1.2.1-2.h","COBIT 5 APO01.01 & APO01.02, ISO 27001:2013 A.6.1.1 & Clause 5.1 & Clause 5.3, NIST SP 800-53 Rev. 4 PM-2"]
[null,null,null,null,"GV.RR-2.2","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). ",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, FFIEC IT Booklet/Management/I.B, FFIEC Booklet BCM/2-4.b, 2-5.a, FINRA, NAIC HBRS/ExC APO.01 & APO.06, NAIC ML/4, NYDFS/500.04, EBA GITSRM 3.2.1.3, ECB CROE 2.1.2.1-2.j, ECB CROE 2.1.2.2-19, ECB CROE 2.1.2.2-29","COBIT 5 APO01.01, ISO 27001:2013 Clause 5.1 & Clause 5.3 & Clause 7.1, NIST SP 800-53 Rev. 4 PM-3"]
[null,null,null,null,"GV.RR-2.3","GV.RR-2.3: The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.  ",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1/ D5, FFIEC IT Booklet/Management/I.B, FINRA, NAIC HBRS/ExC APO.01 & APO.06, NAIC ML/4, NYDFS/500.04, ECB CROE 2.1.2.2-19, ECB CROE 2.1.2.2-22","COBIT 5 EDM01.02, ISO 27001:2013 Clause 5.3"]
[null,null,null,null,"GV.RR-2.4","GV.RR-2.4: The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/I.B, FFIEC Booklet BCM/2-4.b, NAIC HBRS/ExC APO.01 & APO.06, NAIC ML/4","COBIT 5 APO01.01 & EDM 01.02, ISO 27001:2013 Clause 5.1"]
[null,"Security Program (GV.SP):  The organization has a cybersecurity program that is continually measured and improved.","GV.SP-1: Organization has a cybersecurity program that implements, monitors and updates its policies, procedures, processes, and controls to continually manage cybersecurity risks to the organization.","None","GV.SP-1.1","GV.SP-1.1: The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II, G7/3, FFIEC Booklet BCM/6-3.a, NAIC HBRS/ExC APO.12, NAIC ML/4, NYDFS/500.02, SEC Regulation SCI, EBA GITSRM 3.3.3.18, ECB CROE 2.1.2.1-2.h, ECB CROE 2.3.2.1-1.c","COBIT 5 APO13.01, ISO 27001:2013 Clause 4, NIST SP 800-53 Rev. 4 PM-1"]
[null,null,null,null,"GV.SP-1.2","GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).",null,null,null,null,"CFTC/E, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.D, FFIEC-APX E/Risk Measurement, G7/3, FFIEC Booklet BCM/5-5, NAIC HBRS/ExC APO.12, NAIC ML/4, NYDFS/500.02, NYDFS/500.03, NYDFS/500.09, NYDFS 500.15, EBA GITSRM 3.3.4.22, EBA GITSRM 3.3.4.23, ECB CROE 2.1.2.1-2.f, ECB CROE 2.3.2.1-3, ECB CROE 2.3.2.1-9","COBIT 5 APO012.05 & APO13.02, ISO 27001:2013 Clause 8.3, NIST SP 800-53 Rev. 4 PL-1 & RA-1 & PS-1 & SA-1 & PM-9"]
[null,null,"GV.SP-2: Cybersecurity performance is measured and regularly reported to senior executives and the Board or an appropriate governing body.","None","GV.SP-2.1","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. ",null,null,null,null,"CFTC/A, FFIEC CAT D1/ D5, FFIEC IT Booklet/Information Security/II.D, FFIEC IT Booklet/Management/III.A, FFIEC Booklet BCM/2-2.d, 2-4.e, NAIC HBRS/ExC APO.09, ECB CROE 2.1.2.1-1.f, ECB CROE 2.1.2.1-12, ECB CROE 2.1.2.2-37, ECB CROE 2.8.2.1-7","COBIT 5 BAI01.07, ISO 27001:2013 Clause 9.1, NIST SP 800-53 Rev. 4 PM-6"]
[null,null,null,null,"GV.SP-2.2","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ",null,null,null,null,"CFTC/A, FFIEC CAT D1/ D5, FFIEC IT Booklet/Information Security/II.D, FFIEC IT Booklet/Management/III.D, FFIEC Booklet BCM/2-2.d, 2-4.e, 11-1.f, NAIC HBRS/ExC APO.09, EBA GITSRM 3.2.2.6, ECB CROE 2.1.2.1-2.f, ECB CROE 2.1.2.1-13.f, ECB CROE 2.1.2.2-21, ECB CROE 2.1.2.2-33, ECB CROE 2.1.2.2-42, ECB CROE 2.3.2.2-66, ECB CROE 2.6.2-33, ECB CROE 2.7.2.1-10, ECB CROE 2.8.2.1-7","ISO 27001:2013 Clause 9.1 & Clause 9.3, NIST SP 800-53 Rev. 4 PM-6"]
[null,null,null,null,"GV.SP-2.3","GV.SP-2.3: The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.",null,null,null,null,"CFTC/A, FFIEC CAT D1/ D4, FFIEC IT Booklet/Information Security/v.a-4, FFIEC IT Booklet/Management/III.D, FFIEC Booklet BCM/2-5.d, NAIC HBRS/ExC APO.09, ECB CROE 2.1.2.1-2.f, ECB CROE 2.1.2.2-45, ECB CROE 2.6.2-33","ISO 27001:2013 Clause 10.2, NIST SP 800-53 Rev. 4 PM"]
[null,"Independent Risk Management Function (GV.IR): The organization has an independent risk management function.","GV.IR-1: An independent risk management function provides assurance that the cybersecurity risk management framework has been implemented according to policy and is consistent with the organization's risk appetite and tolerance.","None","GV.IR-1.1","GV.IR-1.1: The organization's enterprise-wide cyber risk management framework includes an independent risk management function that provides assurance that the cyber risk management framework is implemented as intended.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/IV, NAIC HBRS/ExC APO.12, ECB CROE 2.1.2.1-12","COBIT 5 EDM03.02 & MEA02.05"]
[null,null,null,"None","GV.IR-1.2","GV.IR-1.2: An independent risk management function has sufficient independence, stature, authority, resources, and access to the appropriate governing body (e.g., the Board or one of its committees), including reporting lines, to ensure consistency with the organization's cyber risk management framework.",null,null,null,null,"FFIEC IT Booklet/Management/I.A, FFIEC IT Booklet/Management/I.B, FFIEC Booklet BCM/2-4.g, 2-5.f, NAIC HBRS/ExC APO.12, EBA GITSRM 3.3.1.11","COBIT 5 EDM03.02 & MEA02.05, ISO 27001:2013 A.18.2.1"]
[null,null,null,"None","GV.IR-1.3","GV.IR-1.3: The independent risk management function has appropriate understanding of the organization's structure, cybersecurity program, and relevant risks and threats.  ",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/III, FFIEC IT Booklet/Operations/Risk Identification/ Environmental Survey, NAIC HBRS/ExC APO.12","COBIT 5 EDM03.02 & APO12.01 & APO12.02 & APO12.03 & APO12.04 & APO12.05 & APO12.06, ISO 27001:2013 A.18.2.1"]
[null,null,null,"None","GV.IR-1.4","GV.IR-1.4: Individuals responsible for independent risk management and oversight are independent of business line management, including senior leadership.",null,null,null,null,"FFIEC IT Booklet/Management/I.B, NAIC HBRS/ExC APO.12","COBIT 5 EDM03.02, ISO 27001:2013 A.18.2.1"]
[null,null,"GV.IR-2: An independent risk management function assesses the appropriateness of the risk management program for the organization's risk appetite and proposes risk mitigation strategies.","None","GV.IR-2.1","GV.IR-2.1: An independent risk management function assesses the appropriateness of the cyber risk management program according to the organization's risk appetite.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/III, NAIC HBRS/ExC APO.12","COBIT 5 EDM03.02, ISO 27001:2013 A.18.2.1"]
[null,null,null,null,"GV.IR-2.2","GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/III, FFIEC IT Booklet/Operations/Control Self-Assessments, NAIC HBRS/ExC APO.12, ECB CROE 2.1.2.1-12, ECB CROE 2.1.2.1-13.e, ECB CROE 2.1.2.2-32, ECB CROE 2.3.2.1-3, ECB CROE 2.5.2.4-53, ECB CROE 2.7.2.1-11","COBIT 5 EDM03.02 & APO12.01 & APO12.02 & APO12.03 & APO12.04 & APO12.05 & APO12.06, ISO 27001:2013 A.18.2.1, NIST SP 800-53 Rev. 4 RA-1"]
[null,null,"GV.IR-3: An independent risk management function reports implementation of cyber risk management framework to the appropriate governing authority (e.g., the Board or one of its committees)","None","GV.IR-3.1","GV.IR-3.1: An independent risk management function reports to the appropriate governing authority (e.g., the Board or one of its committees) and to the appropriate risk management officer within the organization on the implementation of the cyber risk management framework throughout the organization.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/I.A, FFIEC IT Booklet/Operations/Risk Monitoring and Reporting, FFIEC Booklet BCM/1-1.c, 2-4.g, 2-5.f, NAIC HBRS/ExC APO.12, ECB CROE 2.1.2.2-21, ECB CROE 2.7.2.1-11","COBIT 5 MEA02.03 & APO12.04 & EDM03.02"]
[null,"Audit (GV.AU): The organization has an independent audit function to provide for appropriate oversight of the cybersecurity program.","GV.AU-1: An independent audit function assesses compliance with internal controls and applicable laws and regulations.  ","None","GV.AU-1.1","GV.AU-1.1: The organization has an independent audit function. ",null,null,null,null,"CFTC/B, FFIEC CAT D1, FFIEC IT Booklet/Audit, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/3-1, 3-4, NAIC HBRS/ExC MEA.02, EBA GITSRM 3.6.1.64","COBIT 5 MEA02.03 & MEA02.05, ISO 27001:2013 Clause 9.2"]
[null,null,null,null,"GV.AU-1.2","GV.AU-1.2: The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Audit, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/3-1, 3-5.c, NAIC HBRS/ExC MEA.02, EBA GITSRM 3.3.6.26","COBIT 5 MEA02.03, ISO 27001:2013 Clause 9.2"]
[null,null,null,null,"GV.AU-1.3","GV.AU-1.3: An independent audit function tests security controls and information security policies.",null,null,null,null,"CFTC/B, FFIEC CAT D1/ D3, FFIEC Booklet BCM/3-5.c, 3-5.d,  NAIC HBRS/ExC MEA.02, EBA GITSRM 3.3.1.11, EBA GITSRM 3.3.6.25, ECB CROE 2.1.2.1-12, ECB CROE 2.3.2.1-8","COBIT 5 MEA02.03, ISO 27001:2013 Clause 9.2"]
[null,null,null,null,"GV.AU-1.4","GV.AU-1.4: An independent audit function assesses compliance with applicable laws and regulations.",null,null,null,null,"CFTC/E, FFIEC CAT D1, FFIEC IT Booklet/Audit, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/1-1.a, NAIC HBRS/ExC MEA.02, SEC Regulation SCI","COBIT 5 MEA02.01, ISO 27001:2013 Clause 9.2"]
[null,null,"GV.AU-2: An independent audit function updates its procedures to adjust to the evolving cybersecurity environment.","None","GV.AU-2.1","GV.AU-2.1: A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector.",null,null,null,null,"FFIEC CAT D1, NAIC HBRS/ExC BAI.03, SEC Regulation SCI","COBIT 5 MEA02.01, ISO 27001:2013 Clause 9.2"]
[null,null,null,null,"GV.AU-2.2","GV.AU-2.2: A formal process is in place for the independent audit function to update its procedures based on changes to the organization's risk appetite and risk tolerance.",null,null,null,null,"FFIEC CAT D1, NAIC HBRS/ExC BAI.03, SEC Regulation SCI","COBIT 5 MEA02.01, ISO 27001:2013 Clause 9.2"]
[null,null,"GV.AU-3: An independent audit function identifies, tracks, and reports significant changes in the organization's cyber risk exposure to the appropriate governing authority (e.g., the Board or one of its committees).","None","GV.AU-3.1","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.",null,null,null,null,"FFIEC CAT D1/ D3, FFIEC Booklet BCM/3-5.a, 3-5.b, 3-5.e, 3-5.f, 10-7.j, NAIC HBRS/ExC BAI.03, ECB CROE 2.3.2.2-73","COBIT 5 MEA02.01, ISO 27001:2013 Clause 9.2"]
[null,null,null,"None","GV.AU-3.2","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Audit, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/ 1-2.a, 2.b, 2.c, 2-4.g, 2-5.g, 10-29, 11-2.e, NAIC HBRS/ExC BAI.03, EBA GITSRM 3.3.6.27, ECB CROE 2.6.2-23","COBIT 5 MEA02.01, ISO 27001:2013 Clause 9.2"]
[null,null,null,"None","GV.AU-3.3","GV.AU-3.3: An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Audit, FFIEC IT Booklet BCM/1-1b, 2-4.g, 3-2, NAIC HBRS/ExC BAI.03, EBA GITSRM 3.3.6.26","COBIT 5 MEA02.01, ISO 27001:2013 Clause 9.2"]
[null,"Technology (GV.TE): The organization integrates cyber risk considerations into new technology development, design, implementation, and adoption.","GV.TE-1: Organization integrates consideration of cyber risks into technology implementations.","None","GV.TE-1.1","GV.TE-1.1: The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception.",null,null,null,null,"FFIEC CAT D1/ D3, FFIEC IT Booklet/Management/I.B, FFIEC IT Booklet/Operations, FFIEC-APX E, FFIEC Booklet BCM/2-3.e, NAIC HBRS/ExC APO.04, NYDFS 500.08, EBA GITSRM 3.2.2.5.b, EBA GITSRM 3.6.2.67, ECB CROE 2.2.2-6","COBIT 5 APO02.03 & APO04.04, ISO 27001:2013 A.14.1.1"]
[null,null,null,null,"GV.TE-1.2","GV.TE-1.2: The organization applies its cyber risk management framework to all technology projects.",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC-APX E, NAIC HBRS/ExC APO.04, NYDFS 500.08, EBA GITSRM 3.6.1.62, ECB CROE 2.3.2.1-42.c, ECB CROE 2.5.2.2-30","COBIT 5 APO02.03 & BAI01.10, ISO 27001:2013 A.14.1.1"]
[null,null,"GV.TE-2: Organization should use technical security standards, architectures, and tools to ensure security to the maximum extent possible.","None","GV.TE-2.1","GV.TE-2.1: The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure.",null,null,null,null,"FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, FTC, NAIC HBRS/ExC BAI.10, SEC Regulation SCI, NYDFS 500.08, ECB CROE 2.3.2.1-53","COBIT 5 DSS01.01, NIST SP 800-53 Rev. 4 PM-7 & PM-11"]
["IDENTIFY (ID)","Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.","ID.AM-1: Physical devices and systems within the organization are inventoried.","ID.AM-1","ID.AM-1.1","ID.AM-1.1: The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.",null,null,null,null,"CFTC-Cyber Exam/A, CPMI-IOSCO/Identification, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Management/III.A, FFIEC IT Booklet/Operations, G7/3, FFIEC Booklet BCM/ 1-3.a, 3.c, NAIC HBRS/ExC DSS.05, NFA/Security Risk Analysis, EBA GITSRM 50, EBA GITSRM 53, ECB CROE 2.2.2-8","CIS CSC 6.1 Control 1.4, COBIT 5 BAI09.01, ISO 27001:2013 A.8.1.1, NIST SP 800-53 Rev. 4 PM-5 & CM-8"]
[null,null,"ID.AM-2: Software platforms and applications within the organization are inventoried.","ID.AM-2","ID.AM-2.1","ID.AM-2.1: The organization maintains a current and complete inventory of software platforms and business applications.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/III.A, FFIEC IT Booklet/Management/III.A, FFIEC IT Booklet/Operations, FFIEC IT Booklet/Operations/Risk Identification, FFIEC Booklet BCM/1-3.a, 3.c, NAIC HBRS/ExC DSS.05, EBA GITSRM 50, EBA GITSRM 53, EBA GITSRM 3.6.2.74","CIS CSC 6.1 Control 2.1, COBIT 5 BAI09.01, ISO 27001:2013 A.8.1.1, NIST SP 800-53 Rev. 4 PM-5"]
[null,null,"ID.AM-3: Organizational communication and data flows are mapped.","ID.AM-3","ID.AM-3.1","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ",null,null,null,null,"CPMI-IOSCO/Identification, FFIEC CAT D1/ D3/ D4, FFIEC IT Booklet/Management/III.A, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/1-3.f, 4-1.a,4-1.b, 4-1.c, 4-1.e, 4-2.a, 4-2.d, 4-3.a, 4-3.c, 4-3.d, 8-2.c, NAIC HBRS/ExC APO.03, EBA GITSRM 3.3.2.16, EBA GITSRM 53, ECB CROE 2.1.2.1-2.g, ECB CROE 2.2.2-1, ECB CROE 2.2.2-3, ECB CROE 2.5.2.1-14","COBIT 5 BAI 09.01, NIST SP 800-53 Rev. 4 PM-5 & CM-8"]
[null,null,null,null,"ID.AM-3.2","ID.AM-3.2: The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.",null,null,null,null,"EBA GITSRM 53, CPMI-IOSCO/Identification, FFIEC CAT D1/ D4, FFIEC IT Booklet/Management/III.A, FFIEC IT Booklet/Operations, NAIC HBRS/ExC APO.03, EBA GITSRM 3.3.3.19","CIS CSC 6.1 Control 13.1, COBIT 5 DSS06.02 & APO 01.06"]
[null,null,null,null,"ID.AM-3.3","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.",null,null,null,null,"CPMI-IOSCO/Identification, FFIEC CAT D4, FFIEC IT Booklet/Management/III.A, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/1-3.b, 4-1.d, NAIC HBRS/ExC APO.03, EBA GITSRM 53, ECB CROE 2.2.2-3, ECB CROE 2.2.2-5, ECB CROE 2.2.2-10, ECB CROE 2.3.2.1-20, ECB CROE 2.5.2.3-33","CIS CSC 6.1 Control 12.1, COBIT 5 BAI08.02, NIST SP 800-53 Rev. 4 PM-5 & CM-8"]
[null,null,"ID.AM-4: External information systems are catalogued.","ID.AM-4","ID.AM-4.1","ID.AM-4.1: The organization maintains an inventory of external information systems. ",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC Booklet BCM/1-3.b, NAIC HBRS/ExC DSS.05, ECB CROE 2.2.2-2, ECB CROE 2.2.2-3, ECB CROE 2.5.2.3-33","COBIT 5 APO12.01, ISO 27001:2013 A.11.2.6, NIST SP 800-53 Rev. 4 CM-2"]
[null,null,"ID.AM-5: Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value.","ID.AM-5","ID.AM-5.1","ID.AM-5.1: The organization implements and maintains a written risk-based policy or policies on data governance and classification, approved by a Senior Officer or the organization's governing body (e.g., the Board or one of its committees).  ",null,null,null,null,"CPMI-IOSCO/Identification, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.1, FFIEC IT Booklet/Operations, G7/3, NAIC HBRS/ExC DSS.04, NYDFS/500.03","COBIT 5 APO01.06 & BAI08.02 & DSS06.06, NIST SP 800-53 Rev. 4 CM-2"]
[null,null,null,null,"ID.AM-5.2","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.",null,null,null,null,"CFTC-Cyber Exam/A, FFIEC CAT D1/ D2, FFIEC IT Booklet/Information Security/II.C.5, FFIEC IT Booklet/Operations, FINRA/Cybersecurity Risk Assessment, G7/3, FFIEC Booklet BCM/4-2.b, 4-2.c, 4-2.d, 4-2.f, 4-2.g, 4-2.h, 4-2.i, 4-2.j, 4-3.d, 8-1.e, NAIC HBRS/ExC DSS.04, SEC Regulation SDR, SEC Regulation S-ID, EBA GITSRM 3.3.3.17, EBA GITSRM 3.3.3.19, EBA GITSRM 3.7.1.79, ECB CROE 2.2.2-1, ECB CROE 2.2.2-4, ECB CROE 2.2.2-8","CIS CSC 6.1 Control 13.1, COBIT 5 BAI09.02, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,"ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established.","ID.AM-6","ID.AM-6.1","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D3/ D4/ D5, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Management/I.B, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/1-3.d, 2-4.a, 2-5.a, 4-2.a, 6-5.b, 8-1.a, 8-2.d,  FINRA/Cybersecurity Governance and Risk Management, FTC/8, G7/2, NAIC HBRS/ExC APO.01, NAIC ML/4, SEC-OCIE/1, NYDFS/500.04, EBA GITSRM 3.6.1.63.b, ECB CROE 2.2.2-3","CIS CSC 17 & 19, COBIT 5 APO01.02 & APO07.06 & APO13.01 & DSS06.03, ISA 62443-2-1:2009 4.3.2.3.3, ISO/IEC 27001:2013 A.6.1.1, NIST SP 800-53 Rev. 4 CP-2 & PS-7 & PM-11"]
[null,"Risk Assessment (ID.RA): The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-1: Asset vulnerabilities are identified and documented.","ID.RA-1","ID.RA-1.1","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, FTC/7, G7/3, G7/7, FFIEC Booklet BCM/1-4.a, 2-3.a, 5-1.b,  NAIC HBRS/ExC DSS.05, NYDFS/500.03, NYDFS/500.09, SEC Regulation SCI, EBA GITSRM 3.3.3.20, EBA GITSRM 3.6.2.71, ECB CROE 2.2.2-6, ECB CROE 2.6.2-11","CIS CSC 4, COBIT 5 APO12.01 & APO12.02 & APO12.03 & APO12.04 & DSS05.01 & DSS05.02, ISA 62443-2-1:2009 4.2.3 & 4.2.3.7 & 4.2.3.9 & 4.2.3.12, ISO/IEC 27001:2013 A.12.6.1 & A.18.2.3, NIST SP 800-53 Rev. 4 CA-2 & CA-7 & CA-8 & RA-3 & RA-5 & SA-5 & SA-11 & SI-2 & SI-4 & SI-5"]
[null,null,"ID.RA-2: Cyber threat intelligence is received from information sharing forums and sources.","ID.RA-2","ID.RA-2.1","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ",null,null,null,null,"CFTC-Cyber Exam/A, CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, FTC/7, FTC/9, G7/7, G7/8, NAIC HBRS/ExC DSS.05, NAIC ML/4, NFA/Deployment, NYDFS/500.03, NYDFS/500.09, ECB CROE 2.1.2.1-2.f, ECB CROE 2.1.2.1-16, ECB CROE 2.1.2.2-44, ECB CROE 2.3.2.1-9, ECB CROE 2.4.2-20, ECB CROE 2.6.2-35, ECB CROE 2.6.2-36, ECB CROE 2.7.2.1-4.c, ECB CROE 2.7.2.2-15, ECB CROE 2.7.2.2-17, ECB CROE 2.7.2.2-20","CIS CSC 4, COBIT 5 BAI08.01, ISA 62443-2-1:2009 4.2.3 & 4.2.3.9 & 4.2.3.12, ISO/IEC 27001:2013 A.6.1.4, NIST SP 800-53 Rev. 4 SI-5 & PM-15 & PM-16"]
[null,null,"ID.RA-3: Cyber threats, both internal and external, are identified and documented.","ID.RA-3 - with sector enhancement","ID.RA-3.1","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.",null,null,null,null,"CFTC/E, CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2, FFIEC IT Booklet/Information Security/II.A, FFIEC IT Booklet/Operations, FINRA/Cyber Intelligence and Information Sharing, FINRA/Incident Response Planning, FTC/9, G7/3, G7/7, FFIEC Booklet BCM/1-4.b, 1-4.c, 5-1.a, 5-1.b, 5-1.c, 5-1.d, 5-2.a, NAIC HBRS/ExC APO.12, NAIC ML/4, NFA/Security Risk Analysis, NYDFS/500.03, NYDFS/500.09, SEC Regulation SCI, SEC Regulation S-ID, SEC Regulation S-P, EBA GITSRM 3.3.3.21, ECB CROE 2.1.2.1-4, ECB CROE 2.1.2.1-13.a, ECB CROE 2.4.2-9, ECB CROE 2.5.2.4-45, ECB CROE 2.7.2.1-1, ECB CROE 2.7.2.1-2, ECB CROE 2.7.2.1-3, ECB CROE 2.7.2.1-4, ECB CROE 2.7.2.1-10, ECB CROE 2.7.2.1-10.a, ECB CROE 2.7.2.1-10.b, ECB CROE 2.7.2.1-10.c, ECB CROE 2.7.2.1-13, ECB CROE 2.8.2.1-1","CIS CSC 4, COBIT 5 APO12.01 & APO12.02 & APO12.03 & APO12.04, ISA 62443-2-1:2009 4.2.3 & 4.2.3.9 & 4.2.3.12, ISO/IEC 27001:2013 Clause 6.1.2, NIST SP 800-53 Rev. 4 RA-3 & SI-5 & PM-12 & PM-16"]
[null,null,null,null,"ID.RA-3.2","ID.RA-3.2: The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past. ",null,null,null,null,"CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2, NAIC HBRS/ExC APO.12, ECB CROE 2.1.2.1-13.a, ECB CROE 2.7.2.1-1, ECB CROE 2.7.2.1-12","CIS CSC 4, COBIT 5 APO12.01 & APO12.02 & APO12.03 & APO12.04, ISA 62443-2-1:2009 4.2.3 & 4.2.3.9 & 4.2.3.12, ISO/IEC 27001:2013 Clause 6.1.2, NIST SP 800-53 Rev. 4 RA-3 & SI-5 & PM-12 & PM-16"]
[null,null,null,null,"ID.RA-3.3","ID.RA-3.3: The organization regularly reviews and updates results of its cyber threat analysis.",null,null,null,null,"CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2, FFIEC IT Booklet/Information Security/II.C, NAIC HBRS/ExC APO.12, EBA GITSRM 3.3.3.21, ECB CROE 2.1.2.1-13.b, ECB CROE 2.7.2.1-6","CIS CSC 4, COBIT 5 APO12.01 & APO12.02 & APO12.03 & APO12.04, ISA 62443-2-1:2009 4.2.3 & 4.2.3.9 & 4.2.3.12, ISO/IEC 27001:2013 Clause 6.1.2, NIST SP 800-53 Rev. 4 RA-3 & SI-5 & PM-12 & PM-16"]
[null,null,"ID.RA-4: Potential business impacts and likelihoods are identified.","ID.RA-4","ID.RA-4.1","ID.RA-4.1: The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.A, FFIEC IT Booklet/Operations, FFIEC-APX E/Mobile Financial Services Work Program, FFIEC-APX E/Risk Measurement, FFIEC Booklet BCM/4-4.a, 4-4.c, 5-4, NAIC HBRS/ExC DSS.04, SEC Regulation SDR, EBA GITSRM 3.7.1.78, ECB CROE 2.1.2.1-1.e","CIS CSC 4, COBIT 5 DSS04.02, ISA 62443-2-1:2009 4.2.3 & 4.2.3.9 & 4.2.3.12, ISO/IEC 27001:2013 A.16.1.6 & Clause 6.1.2, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & SA-14 & PM-9 & PM-11"]
[null,null,"ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk.","ID.RA-5","ID.RA-5.1","ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.",null,null,null,null,"CFTC/E, CFTC-Cyber Exam/A, CPMI-IOSCO/Situational awareness, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.B, FFIEC IT Booklet/Operations, FFIEC-APX E/Mobile Financial Services Work Program, G7/3, FFIEC Booklet BCM/1-4.b, 5-2.d, 5-3 NAIC HBRS/ExC APO.12, NAIC ML/4, NFA/Security Risk Analysis, NYDFS/500.02, NYDFS/500.03, NYDFS/500.09, SEC Regulation S-P, ECB CROE 2.6.2-2, ECB CROE 2.7.2.1-10.c","CIS CSC 4, COBIT 5 APO12.02, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & PM-16"]
[null,null,null,null,"ID.RA-5.2","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.",null,null,null,null,"CFTC/E, CFTC-Cyber Exam/A, CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, FFIEC-APX E/Mobile Financial Services Work Program, FFIEC Booklet BCM/1-3.g, 5-2.c, NAIC HBRS/ExC APO.12, NFA/Security Risk Analysis, NYDFS/500.02/500.03, NYDFS/500.09, ECB CROE 2.1.2.1-13.b, ECB CROE 2.4.2-9, ECB CROE 2.4.2-21, ECB CROE 2.7.2.1-2, ECB CROE 2.7.2.1-3, ECB CROE 2.7.2.1-13","CIS CSC 4, COBIT 5 APO12.02, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & PM-16"]
[null,null,null,null,"ID.RA-5.3","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.",null,null,null,null,"FFIEC CAT D2, FFIEC IT Booklet/Information Security/II.A, FFIEC IT Booklet/Management/I.A.3, FFIEC IT Booklet/Management/III, FFIEC Booklet BCM/4-4.a, 5-2.a, NAIC HBRS/ExC APO.12, ECB CROE 2.4.2-21, ECB CROE 2.7.2.1-1, ECB CROE 2.7.2.1-10.d, ECB CROE 2.7.2.1-10.e, ECB CROE 2.8.2.1-2","CIS CSC 4, COBIT 5 APO12.02, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & PM-16"]
[null,null,null,null,"ID.RA-5.4","ID.RA-5.4: The organization's business units assess, on an ongoing basis, the cyber risks associated with the activities of the business unit.",null,null,null,null,"CFTC/E, CFTC-Cyber Exam/A, CPMI-IOSCO/Situational awareness, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.A, FFIEC IT Booklet/Management/III, FFIEC IT Booklet/Operations, FFIEC-APX E/Mobile Financial Services Work Program, G7/3, FFIEC Booklet BCM/2-3.a, NAIC HBRS/ExC APO.12, NAIC ML/4, NFA/Security Risk Analysis, NYDFS/500.03, NYDFS/500.09, ECB CROE 2.1.2.1-1.e, ECB CROE 2.1.2.1-13.g","CIS CSC 4, COBIT 5 APO12.02, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & PM-16"]
[null,null,null,null,"ID.RA-5.5","ID.RA-5.5: The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, NAIC HBRS/ExC APO.12, EBA GITSRM 54, EBA GITSRM 55, ECB CROE 2.2.2-11, ECB CROE 2.4.2-17","CIS CSC 4, COBIT 5 APO12.02, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & PM-16"]
[null,null,null,null,"ID.RA-5.6","ID.RA-5.6: The organization determines ways to aggregate cyber risk to assess the organization's residual cyber risk.",null,null,null,null,"FFIEC IT Booklet/Information Security/II.D, FFIEC IT Booklet/Management/III.B, FFIEC IT Booklet/Operations/Risk Assessment, NAIC HBRS/ExC APO.12","CIS CSC 4, COBIT 5 APO12.02, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & PM-16"]
[null,null,"ID.RA-6: Risk responses are identified and prioritized.","ID.RA-6","ID.RA-6.1","ID.RA-6.1: The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk.",null,null,null,null,"FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/II.D, FFIEC IT Booklet/Management/III.D, FFIEC IT Booklet/Operations, FFIEC IT Booklet/Operations/Risk Monitoring and Reporting, FFIEC Booklet BCM/2-3.a, NAIC HBRS/ExC APO.12, EBA GITSRM 3.3.5.24","CIS CSC 4, COBIT 5 APO12.05 & APO13.02, ISO/IEC 27001:2013 Clause 6.1.3, NIST SP 800-53 Rev. 4 PM-4 & PM-9"]
[null,null,null,null,"ID.RA-6.2","ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units. ",null,null,null,null,"CFTC/E, CPMI-IOSCO/Situational awareness, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.D, FFIEC IT Booklet/Operations, FFIEC-APX E/Mobile Financial Services Work Program, FFIEC-APX E/Risk Measurement, NAIC HBRS/ExC APO.12, FFIEC Booklet BCM/2-3.a, NAIC ML/4, NYDFS/500.03, NYDFS/500.09, SEC Regulation SCI, EBA GITSRM 3.3.4.23, ECB CROE 2.2.2-4, ECB CROE 2.7.2.1-10.f","CIS CSC 4, COBIT 5 APO12.05 & APO13.02, ISO/IEC 27001:2013 Clause 6.1.3, NIST SP 800-53 Rev. 4 PM-4 & PM-9"]
["PROTECT (PR)","Identity Management and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.","PR.AC-1","PR.AC-1.1","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, FINRA/Technical Controls, FINRA/Vendor Management, G7/3, NAIC HBRS/ExC DSS.05, NFA/Deployment, EBA GITSRM 3.4.2.31, EBA GITSRM 3.4.2.31.a, ECB CROE 2.3.2.1-28, ECB CROE 2.3.2.1-29, ECB CROE 2.3.2.1-30, ECB CROE 2.3.2.1-39, ECB CROE 2.3.2.1-42.a, ECB CROE 2.3.2.2-57","CIS CSC 1 & 5 & 15 & 16, COBIT 5 DSS05.04 & DSS06.03, ISA 62443-2-1:2009 4.3.3.5.1, ISA 62443-3-3:2013 SR 1.1 & SR 1.2 & SR 1.3 & SR 1.4 & SR 1.5 & SR 1.7 & SR 1.8 & SR 1.9, ISO/IEC 27001:2013 A.9.2.1 & A.9.2.2 & A.9.2.3 & A.9.2.4 & A.9.2.6 & A.9.3.1 & A.9.4.2 & A.9.4.3, NIST SP 800-53 Rev. 4 AC-1 & AC-2 & IA-1 & IA-2 & IA-3 & IA-4 & IA-5 & IA-6 & IA-7 & IA-8 & IA-9 & IA-10 & IA-11"]
[null,null,null,null,"PR.AC-1.2","PR.AC-1.2: User access authorization is limited to individuals who are appropriately trained and monitored.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C.7, G7/3, NAIC HBRS/ExC DSS.05, ECB CROE 2.3.2.2-65","CIS CSC 1 & 5 & 15 & 16, COBIT 5 DSS05.04 & DSS06.03, ISA 62443-2-1:2009 4.3.3.5.1, ISA 62443-3-3:2013 SR 1.1 & SR 1.2 & SR 1.3 & SR 1.4 & SR 1.5 & SR 1.7 & SR 1.8 & SR 1.9, ISO/IEC 27001:2013 A.9.2.1 & A.9.2.2 & A.9.2.3 & A.9.2.4 & A.9.2.6 & A.9.3.1 & A.9.4.2 & A.9.4.3, NIST SP 800-53 Rev. 4 AC-1 & AC-2 & IA-1 & IA-2 & IA-3 & IA-4 & IA-5 & IA-6 & IA-7 & IA-8 & IA-9 & IA-10 & IA-11"]
[null,null,null,null,"PR.AC-1.3","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.7, FINRA/Technical Controls, FTC/3, G7/3, NAIC HBRS/ExC DSS.05, NFA/Deployment, SEC Regulation S-P, EBA GITSRM 3.4.2.31.b, EBA GITSRM 3.4.2.31.e, EBA GITSRM 3.4.2.31.f, ECB CROE 2.2.2-7, ECB CROE 2.2.2-9, ECB CROE 2.3.2.1-29, ECB CROE 2.3.2.1-31, ECB CROE 2.3.2.1-33, ECB CROE 2.3.2.1-39, ECB CROE 2.3.2.2-57, ECB CROE 2.3.2.2-59, ECB CROE 2.3.2.2-60","CIS CSC 1 & 5 & 15 & 16, COBIT 5 DSS05.04 & DSS06.03, ISA 62443-2-1:2009 4.3.3.5.1, ISA 62443-3-3:2013 SR 1.1 & SR 1.2 & SR 1.3 & SR 1.4 & SR 1.5 & SR 1.7 & SR 1.8 & SR 1.9, ISO/IEC 27001:2013 A.9.2.1 & A.9.2.2 & A.9.2.3 & A.9.2.4 & A.9.2.6 & A.9.3.1 & A.9.4.2 & A.9.4.3, NIST SP 800-53 Rev. 4 AC-1 & AC-2 & IA-1 & IA-2 & IA-3 & IA-4 & IA-5 & IA-6 & IA-7 & IA-8 & IA-9 & IA-10 & IA-11"]
[null,null,"PR.AC-2: Physical access to assets is managed and protected.","PR.AC-2","PR.AC-2.1","PR.AC-2.1: The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms).",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.5, FFIEC IT Booklet/Management/III.C, FFIEC IT Booklet/Operations, FINRA/Technical Controls, G7/3, NAIC HBRS/ExC DSS.01, NAIC ML/4, NFA/Deployment, NYDFS/500.03, SEC Regulation S-P, EBA GITSRM 3.4.3.33, EBA GITSRM 3.4.3.34","COBIT 5 DSS01.04 & DSS05.05, ISA 62443-2-1:2009 4.3.3.3.2 & 4.3.3.3.8, ISO/IEC 27001:2013 A.11.1.1 & A.11.1.2 & A.11.1.3 & A.11.1.4 & A.11.1.5 & A.11.1.6 & A.11.2.1 & A.11.2.3 & A.11.2.5 & A.11.2.6 & A.11.2.7 & A.11.2.8, NIST SP 800-53 Rev. 4 PE-2 & PE-3 & PE-4 & PE-5 & PE-6 & PE-8"]
[null,null,"PR.AC-3: Remote access is managed.","PR.AC-3","PR.AC-3.1","PR.AC-3.1: Remote access is actively managed and restricted to necessary systems.",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.15, FFIEC IT Booklet/Information Security/II.C.7, FFIEC IT Booklet/Operations, FINRA/Technical Controls, FTC/6, G7/3, NAIC HBRS/ExC DSS.05, NYDFS/500.03, ECB CROE 2.3.2.1-15","CIS CSC 12, COBIT 5 APO13.01 & DSS01.04 & DSS05.03, ISA 62443-2-1:2009 4.3.3.6.6, ISA 62443-3-3:2013 SR 1.13 & SR 2.6, ISO/IEC 27001:2013 A.6.2.1 & A.6.2.2 & A.11.2.6 & A.13.1.1 & A.13.2.1, NIST SP 800-53 Rev. 4 AC-1 & AC-17 & AC-19 & AC-20 & SC-15"]
[null,null,null,null,"PR.AC-3.2","PR.AC-3.2: The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations.",null,null,null,null,"CFTC-Cyber Exam/C, FFIEC CAT D3, FFIEC-APX E/Risk Mitigation, NAIC HBRS/ExC DSS.05, NYDFS 500.11, NYDFS/500.12","CIS CSC 12, COBIT 5 APO13.01 & DSS01.04 & DSS05.03, ISA 62443-2-1:2009 4.3.3.6.6, ISA 62443-3-3:2013 SR 1.13 & SR 2.6, ISO/IEC 27001:2013 A.6.2.1 & A.6.2.2 & A.11.2.6 & A.13.1.1 & A.13.2.1, NIST SP 800-53 Rev. 4 AC-1 & AC-17 & AC-19 & AC-20 & SC-15"]
[null,null,"PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.","PR.AC-4","PR.AC-4.1","PR.AC-4.1: The organization limits access privileges to the minimum necessary.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D3/ D4, FFIEC IT Booklet/Information Security/II.C.15, FFIEC IT Booklet/Management/III.C, G7/3, NAIC HBRS/ExC DSS.05, NYDFS/500.03, NYDFS/500.07, EBA GITSRM 3.4.2.31.a, EBA GITSRM 3.4.2.32, EBA GITSRM 3.4.3.34, ECB CROE 2.3.2.1-28, ECB CROE 2.3.2.1-30, ECB CROE 2.3.2.1-32, ECB CROE 2.3.2.2-57","CIS CSC 3 & 5 & 12 & 14 & 15 & 16 & 18, COBIT 5 DSS05.04, ISA 62443-2-1:2009 4.3.3.7.3, ISA 62443-3-3:2013 SR 2.1, ISO/IEC 27001:2013 A.6.1.2 & A.9.1.2 & A.9.2.3 & A.9.4.1 & A.9.4.4 & A.9.4.5, NIST SP 800-53 Rev. 4 AC-1 & AC-2 & AC-3 & AC-5 & AC-6 & AC-14 & AC-16 & AC-24"]
[null,null,null,null,"PR.AC-4.2","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. ",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D3/ D4, FFIEC IT Booklet/Information Security/II.C.15, FFIEC IT Booklet/Operations, FTC/2, FTC/6, G7/3, NAIC HBRS/ExC DSS.05, NAIC ML/4, EBA GITSRM 3.4.2.31.c, ECB CROE 2.3.2.1-30, ECB CROE 2.3.2.1-32, ECB CROE 2.3.2.1-35, ECB CROE 2.3.2.1-36, ECB CROE 2.3.2.1-40, ECB CROE 2.3.2.2-58","CIS CSC 3 & 5 & 12 & 14 & 15 & 16 & 18, COBIT 5 DSS05.04, ISA 62443-2-1:2009 4.3.3.7.3, ISA 62443-3-3:2013 SR 2.1, ISO/IEC 27001:2013 A.6.1.2 & A.9.1.2 & A.9.2.3 & A.9.4.1 & A.9.4.4 & A.9.4.5, NIST SP 800-53 Rev. 4 AC-1 & AC-2 & AC-3 & AC-5 & AC-6 & AC-14 & AC-16 & AC-24"]
[null,null,null,null,"PR.AC-4.3","PR.AC-4.3: The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.11, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, G7/3, NAIC HBRS/ExC DSS.05, SEC Regulation S-P, ECB CROE 2.2.2-7, ECB CROE 2.3.2.1-38","CIS CSC 3 & 5 & 12 & 14 & 15 & 16 & 18, COBIT 5 DSS05.04, ISA 62443-2-1:2009 4.3.3.7.3, ISA 62443-3-3:2013 SR 2.1, ISO/IEC 27001:2013 A.6.1.2 & A.9.1.2 & A.9.2.3 & A.9.4.1 & A.9.4.4 & A.9.4.5, NIST SP 800-53 Rev. 4 AC-1 & AC-2 & AC-3 & AC-5 & AC-6 & AC-14 & AC-16 & AC-24"]
[null,null,"PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate.","PR.AC-5 - with sector enhancement","PR.AC-5.1","PR.AC-5.1: Networks and systems are segmented to maintain appropriate security.",null,null,null,null,"CFTC-Cyber Exam/D, CPMI-IOSCO/Protection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.6, FINRA/Technical Controls, FTC/5, NAIC HBRS/ExC DSS.05, EBA GITSRM 3.4.4.36.c, ECB CROE 2.3.2.1-21, ECB CROE 2.3.2.1-22, ECB CROE 2.4.2-22, ECB CROE 2.5.2.3-36","CIS CSC 9 & 14 & 15 & 18, COBIT 5 DSS01.05 & DSS05.02, ISA 62443-2-1:2009 4.3.3.4, ISA 62443-3-3:2013 SR 3.1 & SR 3.8, ISO/IEC 27001:2013 A.13.1.1 & A.13.1.3 & A.13.2.1 & A.14.1.2 & A.14.1.3, NIST SP 800-53 Rev. 4 AC-4 & AC-10 & SC-7"]
[null,null,null,null,"PR.AC-5.2","PR.AC-5.2: The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).",null,null,null,null,"FFIEC CAT D3, NAIC HBRS/ExC DSS.05, ECB CROE 2.3.2.1-10, ECB CROE 2.3.2.1-11, ECB CROE 2.3.2.1-17","CIS CSC 9 & 14 & 15 & 18, COBIT 5 DSS01.05 & DSS05.02, ISA 62443-2-1:2009 4.3.3.4, ISA 62443-3-3:2013 SR 3.1 & SR 3.8, ISO/IEC 27001:2013 A.13.1.1 & A.13.1.3 & A.13.2.1 & A.14.1.2 & A.14.1.3, NIST SP 800-53 Rev. 4 AC-4 & AC-10 & SC-7"]
[null,null,"PR.AC-6: Identities are proofed and bound to credentials, and asserted in interactions.","PR.AC-6","PR.AC-6.1","PR.AC-6.1: The organization authenticates identity and validates the authorization level of a user before granting access to its systems.",null,null,null,null,"FFIEC CAT D3, FFIEC-APX E/Risk Mitigation, NAIC HBRS/ExC DSS.05, NFA/Information Security Programs, EBA GITSRM 3.4.2.31.g, ECB CROE 2.3.2.1-35, ECB CROE 2.3.2.1-40","CIS CSC 16, COBIT 5 DSS05.04 & DSS05.05 & DSS05.07 & DSS06.03, ISA 62443-2-1:2009 4.3.3.2.2 & 4.3.3.5.2 & 4.3.3.7.2 & 4.3.3.7.4, ISA 62443-3-3:2013 SR 1.1 & SR 1.2 & SR 1.4 & SR 1.5 & SR 1.9 & SR 2.1, ISO/IEC 27001:2013 & A.7.1.1 & A.9.2.1, NIST SP 800-53 Rev. 4 AC-1 & AC-2 & AC-3 & AC-16 & AC-19 & AC-24 & IA-1 & IA-2 & IA-4 & IA-5 & IA-8 & PE-2 & PS-3"]
[null,null,"PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).\n","PR.AC-7","PR.AC-7.1","PR.AC-7.1: The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D3/ D4, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, FFIEC Booklet BCM/4-2.a, FINRA/Technical Controls, NAIC HBRS/ExC DSS.05, NYDFS 500.11, NYDFS/500.12, EBA GITSRM 3.4.4.36.d, ECB CROE 2.3.2.1-42.b","CIS CSC 1 & 12 & 15 & 16, COBIT 5 DSS05.04 & DSS05.10 & DSS06.10, ISA 62443-2-1:2009 4.3.3.6.1 & 4.3.3.6.2 & 4.3.3.6.3 & 4.3.3.6.4 & 4.3.3.6.5 & 4.3.3.6.6 & 4.3.3.6.7 & 4.3.3.6.8 & 4.3.3.6.9, ISA 62443-3-3:2013 SR 1.1 & SR 1.2 & SR 1.5 & SR 1.7 & SR 1.8 & SR 1.9 & SR 1.10, ISO/IEC 27001:2013 A.9.2.1 & A.9.2.4 & A.9.3.1 & A.9.4.2 & A.9.4.3 & A.18.1.4, NIST SP 800-53 Rev. 4 AC-7 & AC-8 & AC-9 & AC-11 & AC-12 & AC-14 & IA-1 & IA-2 & IA-3 & IA-4 & IA-5 & IA-8 & IA-9 & IA-10 & IA-11"]
[null,null,null,null,"PR.AC-7.2","PR.AC-7.2: Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.",null,null,null,null,"CFTC-Cyber Exam/C, CPMI-IOSCO/Protection, FFIEC CAT D1/ D3/ D4, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, FTC/3, NAIC HBRS/ExC DSS.05, NYDFS 500.11, NYDFS/500.12, SEC Regulation S-P, EBA GITSRM 3.4.2.31.g, EBA GITSRM 3.4.6.47, ECB CROE 2.3.2.1-33","CIS CSC 1 & 12 & 15 & 16, COBIT 5 DSS05.04 & DSS05.10 & DSS06.10, ISA 62443-2-1:2009 4.3.3.6.1 & 4.3.3.6.2 & 4.3.3.6.3 & 4.3.3.6.4 & 4.3.3.6.5 & 4.3.3.6.6 & 4.3.3.6.7 & 4.3.3.6.8 & 4.3.3.6.9, ISA 62443-3-3:2013 SR 1.1 & SR 1.2 & SR 1.5 & SR 1.7 & SR 1.8 & SR 1.9 & SR 1.10, ISO/IEC 27001:2013 A.9.2.1 & A.9.2.4 & A.9.3.1 & A.9.4.2 & A.9.4.3 & A.18.1.4, NIST SP 800-53 Rev. 4 AC-7 & AC-8 & AC-9 & AC-11 & AC-12 & AC-14 & IA-1 & IA-2 & IA-3 & IA-4 & IA-5 & IA-8 & IA-9 & IA-10 & IA-11"]
[null,"Awareness and Training (PR.AT): The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-1: All users are informed and trained.","PR.AT-1","PR.AT-1.1","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Protection, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C.7, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, NAIC HBRS/ExC APO.01, FFIEC Booklet BCM/9-3, NAIC ML/4, NFA/Employee Training, SEC Regulation SCI, SEC Regulation S-ID, SEC Regulation S-P, EBA GITSRM 3.2.1.3, EBA GITSRM 3.4.7.49, ECB CROE 2.1.2.2-24, ECB CROE 2.1.2.2-35, ECB CROE 2.3.2.2-56, ECB CROE 2.3.2.2-63, ECB CROE 2.3.2.2-65, ECB CROE 2.8.2.1-4","CIS CSC 17 & 18, COBIT 5 APO07.03 & BAI05.07, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.7.2.2 & A.12.2.1, NIST SP 800-53 Rev. 4 AT-2 & PM-13"]
[null,null,null,null,"PR.AT-1.2","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Protection, FFIEC CAT D1/ D5, FFIEC IT Booklet/Information Security/II.C.7, FFIEC-APX E/Risk Mitigation, NAIC HBRS/ExC APO.01, NFA/Employee Training, EBA GITSRM 3.6.1.65, ECB CROE 2.1.2.2-25, ECB CROE 2.1.2.2-30, ECB CROE 2.3.2.2-62, ECB CROE 2.3.2.2-63, ECB CROE 2.4.2-7, ECB CROE 2.8.2.1-4","CIS CSC 17 & 18, COBIT 5 APO07.03 & BAI05.07, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.7.2.2 & A.12.2.1, NIST SP 800-53 Rev. 4 AT-2 & PM-13"]
[null,null,null,null,"PR.AT-1.3","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C.7, FFIEC IT Booklet/Operations, FINRA/Staff Training, FFIEC Booklet BCM/9-1.c, 9-4, NAIC HBRS/ExC APO.01, NYDFS 500.10, NYDFS/500.14, SEC Regulation SCI, ECB CROE 2.1.2.2-27, ECB CROE 2.1.2.2-36, ECB CROE 2.3.2.2-67, ECB CROE 2.8.2.1-6","CIS CSC 17 & 18, COBIT 5 APO07.03 & BAI05.07, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.7.2.2 & A.12.2.1, NIST SP 800-53 Rev. 4 AT-2 & PM-13"]
[null,null,"PR.AT-2: Privileged users understand their roles and responsibilities.","PR.AT-2","PR.AT-2.1","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1, FFIEC Booklet BCM/3-4, 8-1.a, 9-2.b, 9-2.c, 9-3, NAIC HBRS/ExC APO.01, EBA GITSRM 3.7.4.89.c, EBA GITSRM 92, ECB CROE 2.1.2.2-20, ECB CROE 2.1.2.2-28, ECB CROE 2.3.2.2-64, ECB CROE 2.3.2.2-65, ECB CROE 2.5.2.4-50, ECB CROE 2.5.2.4-51","CIS CSC 5 & 17 & 18, COBIT 5 APO07.02 & DSS05.04 & DSS06.03, ISA 62443-2-1:2009 4.3.2.4.2 & 4.3.2.4.3, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2, NIST SP 800-53 Rev. 4 AT-3 & PM-13"]
[null,null,null,null,"PR.AT-2.2","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ",null,null,null,null,"FFIEC CAT D1, FFIEC Booklet BCM/2-5.b, 9-1.c, 9-2.d, 9-2.e FINRA/Staff Training, NAIC HBRS/ExC APO.01, NYDFS/500.10, NYDFS 500.11, NYDFS/500.14, ECB CROE 2.1.2.2-20, ECB CROE 2.1.2.2-26, ECB CROE 2.1.2.2-30, ECB CROE 2.4.2-7, ECB CROE 2.5.2.1-6, ECB CROE 2.7.2.1-8, ECB CROE 2.8.2.1-5","CIS CSC 5 & 17 & 18, COBIT 5 APO07.02 & DSS05.04 & DSS06.03, ISA 62443-2-1:2009 4.3.2.4.2 & 4.3.2.4.3, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2, NIST SP 800-53 Rev. 4 AT-3 & PM-13"]
[null,null,null,null,"PR.AT-2.3","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ",null,null,null,null,"FFIEC CAT D1, FFIEC Booklet BCM/9-1.a, 10-11.e, 10-16.c, 10-17.b, NAIC HBRS/ExC APO.01, NYDFS/500.10, NYDFS 500.11, ECB CROE 2.1.2.2-27, ECB CROE 2.1.2.2-31, ECB CROE 2.1.2.2-36, ECB CROE 2.3.2.2-66, ECB CROE 2.6.2-18","CIS CSC 5 & 17 & 18, COBIT 5 APO07.02 & DSS05.04 & DSS06.03, ISA 62443-2-1:2009 4.3.2.4.2 & 4.3.2.4.3, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2, NIST SP 800-53 Rev. 4 AT-3 & PM-13"]
[null,null,"PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities.","PR.AT-3","PR.AT-3.1","PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate.",null,null,null,null,"CFTC-Cyber Exam/B, CFTC-Cyber Exam/C, CFTC-Cyber Exam/D, CPMI-IOSCO/Protection, FFIEC CAT D1, FFIEC-APX E/Risk Mitigation, NAIC HBRS/ExC APO.10, NYDFS/500.04, NYDFS/500.10, NYDFS/500.14, EBA GITSRM 3.4.7.49, EBA GITSRM 92, EBA GITSRM 93, EBA GITSRM 97","CIS CSC 17, COBIT 5 APO07.03 & APO07.06 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.1 & A.7.2.2, NIST SP 800-53 Rev. 4 PS-7 & SA-9 & SA-16"]
[null,null,null,null,"PR.AT-3.2","PR.AT-3.2: Cybersecurity training provided through a third-party service provider or affiliate should be consistent with the organization's cybersecurity policy and program.",null,null,null,null,"FINRA/Staff Training, NAIC HBRS/ExC APO.10, NYDFS/500.04, NYDFS/500.10, NYDFS/500.14","CIS CSC 17, COBIT 5 APO07.03 & APO07.06 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.1 & A.7.2.2, NIST SP 800-53 Rev. 4 PS-7 & SA-9 & SA-16"]
[null,null,null,null,"PR.AT-3.3","PR.AT-3.3: Cybersecurity training covers topics designed to minimize risks to or from interconnected parties.",null,null,null,null,"CFTC-Cyber Exam/B, CFTC-Cyber Exam/C, CFTC-Cyber Exam/D, CPMI-IOSCO/Protection, FFIEC CAT D1, NAIC HBRS/ExC APO.10, NYDFS/500.04, NYDFS/500.10, NYDFS/500.14","CIS CSC 17, COBIT 5 APO07.03 & APO07.06 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.1 & A.7.2.2, NIST SP 800-53 Rev. 4 PS-7 & SA-9 & SA-16"]
[null,null,"PR.AT-4: Senior executives understand their roles and responsibilities.","PR.AT-4","PR.AT-4.1","PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.",null,null,null,null,"CFTC/G, CPMI-IOSCO/Governance, CPMI-IOSCO/Protection, FFIEC CAT D1, FFIEC IT Booklet/Management/I.A, FINRA/Cybersecurity Governance and Risk Management, FFIEC Booklet BCM/9-1.b, 9-2.a, FINRA/Staff Training, G7/3, NAIC HBRS/ExC APO.01, NYDFS/500.14, ECB CROE 2.1.2.2-18, ECB CROE 2.1.2.2-27, ECB CROE 2.1.2.2-34","CIS CSC 17 & 19, COBIT 5 EDM01.01 & APO01.02 & APO07.03, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2, NIST SP 800-53 Rev. 4 AT-3 & PM-13"]
[null,null,null,null,"PR.AT-4.2","PR.AT-4.2: Where the organization's governing authority (e.g., the Board or one of its committees) does not have adequate cybersecurity expertise, they should have direct access to the senior officer responsible for cybersecurity to discuss cybersecurity related matters.",null,null,null,null,"CFTC/G, CPMI-IOSCO/Governance, CPMI-IOSCO/Protection, FFIEC CAT D1, FFIEC IT Booklet/Management/I.A, FINRA/Cybersecurity Governance and Risk Management, FINRA/Staff Training, G7/3, NAIC HBRS/ExC APO.01, ECB CROE 2.1.2.2-18, ECB CROE 2.1.2.2-41, NYDFS/500.14","CIS CSC 17 & 19, COBIT 5 EDM01.01 & APO01.02 & APO07.03, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2, NIST SP 800-53 Rev. 4 AT-3 & PM-13"]
[null,null,"PR.AT-5: Physical and information security personnel understand roles and responsibilities.","PR.AT-5","PR.AT-5.1","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.",null,null,null,null,"FFIEC CAT D1/ D3/ D4/ D5, FFIEC IT Booklet/Management/III.C, FFIEC Booklet BCM/2-5.c, 8-1.a, 9-1.b, 10-8.a,  FINRA/Staff Training, G7/3, NAIC HBRS/ExC APO.01, NYDFS/500.03, NYDFS/500.10, NYDFS/500.14, ECB CROE 2.3.2.2-56, ECB CROE 2.3.2.2-62","CIS CSC 17, COBIT 5 APO07.03, ISA 62443-2-1:2009 4.3.2.4.2, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2, NIST SP 800-53 Rev. 4 AT-3 & IR-2 & PM-13"]
[null,"Data Security (PR.DS): Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-1: Data-at-rest is protected.","PR.DS-1","PR.DS-1.1","PR.DS-1.1: Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.",null,null,null,null,"FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.13, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, FTC/10, FTC/4, G7/3, FFIEC Booklet BCM/8-1.f, NAIC HBRS/ExC DSS.05, NYDFS/500.03, SEC Regulation SDR, SEC Regulation S-P, ECB CROE 2.3.2.1-1.b, ECB CROE 2.3.2.1-34","CIS CSC 13 & 14, COBIT 5 APO01.06 & BAI02.01 & BAI06.01 & DSS04.07 & DSS05.03 & DSS06.06, ISA 62443-3-3:2013 SR 3.4 & SR 4.1, ISO/IEC 27001:2013 A.8.2.3, NIST SP 800-53 Rev. 4 MP-8 & SC-12 & SC-28"]
[null,null,null,null,"PR.DS-1.2","PR.DS-1.2: Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.  ",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.13, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, NAIC HBRS/ExC DSS.05, NYDFS/500.11, NYDFS/500.15, EBA GITSRM 3.4.4.36.f, ECB CROE 2.3.2.1-34, ECB CROE 2.3.2.1-37","CIS CSC 13 & 14, COBIT 5 APO01.06 & BAI02.01 & BAI06.01 & DSS04.07 & DSS05.03 & DSS06.06, ISA 62443-3-3:2013 SR 3.4 & SR 4.1, ISO/IEC 27001:2013 A.8.2.3, NIST SP 800-53 Rev. 4 MP-8 & SC-12 & SC-28"]
[null,null,"PR.DS-2: Data-in-transit is protected.","PR.DS-2","PR.DS-2.1","PR.DS-2.1: Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.13, FFIEC-APX E/Risk Mitigation, FTC/10, FTC/4, G7/3, FFIEC Booklet BCM/8-1.f, NAIC HBRS/ExC DSS.05, NAIC ML/4, NYDFS/500.03, SEC Regulation SDR, SEC Regulation S-P, ECB CROE 2.3.2.1-1.b, ECB CROE 2.3.2.1-34","CIS CSC 13 & 14, COBIT 5 APO01.06 & DSS05.02 & DSS06.06, ISA 62443-3-3:2013 SR 3.1 & SR 3.8 & SR 4.1 & SR 4.2, ISO/IEC 27001:2013 A.8.2.3 & A.13.1.1 & A.13.2.1 & A.13.2.3 & A.14.1.2 & A.14.1.3, NIST SP 800-53 Rev. 4 SC-8 & SC-11 & SC-12"]
[null,null,null,null,"PR.DS-2.2","PR.DS-2.2: Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.  ",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.19, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, NAIC HBRS/ExC DSS.05, NFA/Deployment, NYDFS/500.15, EBA GITSRM 3.4.4.36.c, EBA GITSRM 3.4.4.36.f, ECB CROE 2.3.2.1-14, ECB CROE 2.3.2.1-34","CIS CSC 13 & 14, COBIT 5 APO01.06 & DSS05.02 & DSS06.06, ISA 62443-3-3:2013 SR 3.1 & SR 3.8 & SR 4.1 & SR 4.2, ISO/IEC 27001:2013 A.8.2.3 & A.13.1.1 & A.13.2.1 & A.13.2.3 & A.14.1.2 & A.14.1.3, NIST SP 800-53 Rev. 4 SC-8 & SC-11 & SC-12"]
[null,null,"PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition.","PR.DS-3","PR.DS-3.1","PR.DS-3.1: The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D1/ D3/ D5, FFIEC IT Booklet/Information Security/II.C.5, FFIEC IT Booklet/Operations, G7/3, NAIC HBRS/ExC DSS.05, EBA GITSRM 54, EBA GITSRM 55, ECB CROE 2.2.2-11, ECB CROE 2.3.2.1-25","CIS CSC 1, COBIT 5 BAI09.03, ISA 62443-2-1:2009 4.3.3.3.9 & 4.3.4.4.1, ISA 62443-3-3:2013 SR 4.2, ISO/IEC 27001:2013 A.8.2.3 & A.8.3.1 & A.8.3.2 & A.8.3.3 & A.11.2.5 & A.11.2.7, NIST SP 800-53 Rev. 4 CM-8 & MP-6 & PE-16"]
[null,null,"PR.DS-4: Adequate capacity to ensure availability is maintained.","PR.DS-4","PR.DS-4.1","PR.DS-4.1: The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment.",null,null,null,null,"G7/3, NAIC HBRS/ExC BAI.04, NYDFS/500.03, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 51, EBA GITSRM 56, ECB CROE 2.3.2.1-1.a","CIS CSC 1 & 2 & 13, COBIT 5 APO13.01 & BAI04.04, ISA 62443-3-3:2013 SR 7.1 & SR 7.2, ISO/IEC 27001:2013 A.12.1.3 & A.17.2.1, NIST SP 800-53 Rev. 4 AU-4 & CP-2 & SC-5"]
[null,null,"PR.DS-5: Protections against data leaks are implemented.","PR.DS-5","PR.DS-5.1","PR.DS-5.1: The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.",null,null,null,null,"FFIEC CAT D3/ D5, FFIEC IT Booklet/Information Security/II.C.13, NAIC HBRS/ExC DSS.05, SEC Regulation SCI, SEC Regulation S-P, EBA GITSRM 3.4.4.36.c","CIS CSC 13, COBIT 5 APO01.06 & DSS05.04 & DSS05.07 & DSS06.02, ISA 62443-3-3:2013 SR 5.2, ISO/IEC 27001:2013 A.6.1.2 & A.7.1.1 & A.7.1.2 & A.7.3.1 & A.8.2.2 & A.8.2.3 & A.9.1.1 & A.9.1.2 & A.9.2.3 & A.9.4.1 & A.9.4.4 & A.9.4.5 & A.10.1.1 & A.11.1.4 & A.11.1.5 & A.11.2.1 & A.13.1.1 & A.13.1.3 & A.13.2.1 & A.13.2.3 & A.13.2.4 & A.14.1.2 & A.14.1.3, NIST SP 800-53 Rev. 4 AC-4 & AC-5 & AC-6 & PE-19 & PS-3 & PS-6 & SC-7 & SC-8 & SC-13 & SC-31 & SI-4"]
[null,null,"PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity.","PR.DS-6","PR.DS-6.1","PR.DS-6.1: The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable. ",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.10, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, G7/3, NAIC HBRS/ExC DSS.05, NAIC ML/4, NYDFS/500.06, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.4.4.36.e, EBA GITSRM 3.6.2.73, ECB CROE 2.3.2.1-1.b","CIS CSC 2 & 3, COBIT 5 APO01.06 & BAI06.01 & DSS06.02, ISA 62443-3-3:2013 SR 3.1 & SR 3.3 & SR 3.4 & SR 3.8, ISO/IEC 27001:2013 A.12.2.1 & A.12.5.1 & A.14.1.2 & A.14.1.3 & A.14.2.4, NIST SP 800-53 Rev. 4 SC-16 & SI-7"]
[null,null,"PR.DS-7: The development and testing environment(s) are separate from the production environment.","PR.DS-7","PR.DS-7.1","PR.DS-7.1: The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment.",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, FTC/5, G7/3, NAIC HBRS/ExC BAI.06 & 07, EBA GITSRM 3.6.2.70, EBA GITSRM 3.6.2.72, ECB CROE 2.3.2.1-22, ECB CROE 2.3.2.1-45, ECB CROE 2.3.2.1-54","CIS CSC 18 & 20, COBIT 5 BAI03.08 & BAI07.04, ISO/IEC 27001:2013 A.12.1.4, NIST SP 800-53 Rev. 4 CM-2"]
[null,null,"PR.DS-8: Integrity checking mechanisms are used to verify hardware integrity.","PR.DS-8","PR.DS-8.1","PR.DS-8.1: The organization uses integrity checking mechanisms to verify hardware integrity, as practicable.",null,null,null,null,"FFIEC IT Booklet/Information Security/II.C.10, FFIEC-APX J/Cyber Resilience, NAIC HBRS/ExC BAI.03, SEC Regulation SCI, SEC Regulation SDR, ECB CROE 2.3.2.1-45","COBIT 5 BAI03.05, ISA 62443-2-1:2009 4.3.4.4.4, ISO/IEC 27001:2013 A.11.2.4, NIST SP 800-53 Rev. 4 SA-10 & SI-7"]
[null,"Information Protection Processes and Procedures (PR.IP): Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.\n","PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g., concept of least functionality).","PR.IP-1","PR.IP-1.1","PR.IP-1.1: The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.10, FFIEC-APX E/Risk Mitigation, FTC/4, G7/3, NAIC HBRS/ExC BAI.10, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.4.4.36.b, EBA GITSRM 3.4.4.36.d, ECB CROE 2.3.2.1-12, ECB CROE 2.3.2.1-48, ECB CROE 2.3.2.1-52","CIS CSC 3 & 9 & 11, COBIT 5 BAI10.01 & BAI10.02 & BAI10.03 & BAI10.05, ISA 62443-2-1:2009 4.3.4.3.2 & 4.3.4.3.3, ISA 62443-3-3:2013 SR 7.6, ISO/IEC 27001:2013 A.12.1.2 & A.12.5.1 & A.12.6.2 & A.14.2.2 & A.14.2.3 & A.14.2.4, NIST SP 800-53 Rev. 4 CM-2 & CM-3 & CM-4 & CM-5 & CM-6 & CM-7 & CM-9 & SA-10"]
[null,null,null,null,"PR.IP-1.2","PR.IP-1.2: The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.7, NAIC HBRS/ExC BAI.10, NFA/Deployment, EBA GITSRM 3.4.4.36.d, ECB CROE 2.3.2.1-13","CIS CSC 3 & 9 & 11, COBIT 5 BAI10.01 & BAI10.02 & BAI10.03 & BAI10.05, ISA 62443-2-1:2009 4.3.4.3.2 & 4.3.4.3.3, ISA 62443-3-3:2013 SR 7.6, ISO/IEC 27001:2013 A.12.1.2 & A.12.5.1 & A.12.6.2 & A.14.2.2 & A.14.2.3 & A.14.2.4, NIST SP 800-53 Rev. 4 CM-2 & CM-3 & CM-4 & CM-5 & CM-6 & CM-7 & CM-9 & SA-10"]
[null,null,null,null,"PR.IP-1.3","PR.IP-1.3: The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.10, FFIEC Booklet BCM/10-1, 10-2, NAIC HBRS/ExC BAI.10, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.6.2.69, ECB CROE 2.3.2.1-13","CIS CSC 3 & 9 & 11, COBIT 5 BAI10.01 & BAI10.02 & BAI10.03 & BAI10.05, ISA 62443-2-1:2009 4.3.4.3.2 & 4.3.4.3.3, ISA 62443-3-3:2013 SR 7.6, ISO/IEC 27001:2013 A.12.1.2 & A.12.5.1 & A.12.6.2 & A.14.2.2 & A.14.2.3 & A.14.2.4, NIST SP 800-53 Rev. 4 CM-2 & CM-3 & CM-4 & CM-5 & CM-6 & CM-7 & CM-9 & SA-10"]
[null,null,"PR.IP-2: A System Development Life Cycle to manage systems is implemented.","PR.IP-2","PR.IP-2.1","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC IT Booklet/Management/III.C, FFIEC-APX E/Risk Mitigation, FTC/7, G7/3, NAIC HBRS/ExC BAI.01, NAIC ML/4, NFA/Deployment, NYDFS/500.03, NYDFS/500.08, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.6.1.65, EBA GITSRM 3.6.2.68, EBA GITSRM 3.6.2.73, ECB CROE 2.3.2.1-4, ECB CROE 2.3.2.1-7, ECB CROE 2.3.2.1-45, ECB CROE 2.5.2.2-30, ECB CROE 2.6.2-13, ECB CROE 2.6.2-24","CIS CSC 18, COBIT 5 APO13.01 & BAI03.01 & BAI03.02 & BAI03.03, ISA 62443-2-1:2009 4.3.4.3.3, ISO/IEC 27001:2013 A.6.1.5 & A.14.1.1 & A.14.2.1 & A.14.2.5, NIST SP 800-53 Rev. 4 PL-8 & SA-3 & SA-4 & SA-8 & SA-10 & SA-11 & SA-12 & SA-15 & SA-17 & SI-12 & SI-13 & SI-14 & SI-16 & SI-17"]
[null,null,null,null,"PR.IP-2.2","PR.IP-2.2: The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D4, FFIEC IT Booklet/Information Security/II.C.17, G7/3, NAIC HBRS/ExC BAI.01, NAIC ML/4, NYDFS/500.03, NYDFS 500.08, EBA GITSRM 3.6.2.68, EBA GITSRM 3.6.2.70, ECB CROE 2.3.2.1-4","CIS CSC 18, COBIT 5 APO13.01 & BAI03.01 & BAI03.02 & BAI03.03, ISA 62443-2-1:2009 4.3.4.3.3, ISO/IEC 27001:2013 A.6.1.5 & A.14.1.1 & A.14.2.1 & A.14.2.5, NIST SP 800-53 Rev. 4 PL-8 & SA-3 & SA-4 & SA-8 & SA-10 & SA-11 & SA-12 & SA-15 & SA-17 & SI-12 & SI-13 & SI-14 & SI-16 & SI-17"]
[null,null,null,null,"PR.IP-2.3","PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1/ D3, FFIEC IT Booklet/Information Security/II.C.17, G7/3, NAIC HBRS/ExC BAI.01, NYDFS/500.03, NYDFS 500.08, EBA GITSRM 3.6.1.63.c, EBA GITSRM 3.6.2.70, ECB CROE 2.3.2.1-4, ECB CROE 2.3.2.1-44, ECB CROE 2.3.2.1-47, ECB CROE 2.6.2-13","CIS CSC 18, COBIT 5 APO13.01 & BAI03.01 & BAI03.02 & BAI03.03, ISA 62443-2-1:2009 4.3.4.3.3, ISO/IEC 27001:2013 A.6.1.5 & A.14.1.1 & A.14.2.1 & A.14.2.5, NIST SP 800-53 Rev. 4 PL-8 & SA-3 & SA-4 & SA-8 & SA-10 & SA-11 & SA-12 & SA-15 & SA-17 & SI-12 & SI-13 & SI-14 & SI-16 & SI-17"]
[null,null,"PR.IP-3: Configuration change control processes are in place.","PR.IP-3","PR.IP-3.1","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ",null,null,null,null,"CFTC-Cyber Exam/A, CPMI-IOSCO/Protection, FFIEC CAT D1/ D3/ D4/ D5, FFIEC IT Booklet/Information Security/II.C.10, NAIC HBRS/ExC BAI.06 & 07, EBA GITSRM 3.4.4.37, EBA GITSRM 3.4.6.45, EBA GITSRM 3.6.1.63.f, EBA GITSRM 3.6.3.75, EBA GITSRM 3.6.3.76, ECB CROE 2.3.2.1-7, ECB CROE 2.3.2.1-42, ECB CROE 2.3.2.1-42.c, ECB CROE 2.3.2.1-43, ECB CROE 2.3.2.1-46","CIS CSC 3 & 11, COBIT 5 BAI01.06 & BAI06.01, ISA 62443-2-1:2009 4.3.4.3.2 & 4.3.4.3.3, ISA 62443-3-3:2013 SR 7.6, ISO/IEC 27001:2013 A.12.1.2 & A.12.5.1 & A.12.6.2 & A.14.2.2 & A.14.2.3 & A.14.2.4, NIST SP 800-53 Rev. 4 CM-3 & CM-4 & SA-10"]
[null,null,"PR.IP-4: Backups of information are conducted, maintained, and tested periodically.","PR.IP-4 - with sector enhancement","PR.IP-4.1","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Information Security/IV, G7/3, FFIEC Booklet BCM/6-3.e, 8-1.d, 8-1.f, 10-2, 10-9.f, 10-16.i, 10-24.e, NAIC HBRS/ExC DSS.04, NAIC ML/4, NYDFS/500.06, SEC Regulation SCI, EBA GITSRM 57, EBA GITSRM 58, EBA GITSRM 3.6.2.71, ECB CROE 2.5.2.2-23, ECB CROE 2.5.2.2-24","CIS CSC 10, COBIT 5 APO13.01 & DSS01.01 & DSS04.07, ISA 62443-2-1:2009 4.3.4.3.9, ISA 62443-3-3:2013 SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.12.3.1 & A.17.1.2 & A.17.1.3 & A.18.1.3, NIST SP 800-53 Rev. 4 CP-4 & CP-6 & CP-9"]
[null,null,null,null,"PR.IP-4.2","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/Other Policies/Standards and Processes/Data Synchronization Procedures, FFIEC Booklet BCM/6-3.b, 10-7.d, 10-15.d, 10-16.h, 10-19.e, NAIC HBRS/ExC DSS.04, NFA/Deployment, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 57, ECB CROE 2.3.2.1-50, ECB CROE 2.5.2.2-22, ECB CROE 2.5.2.2-25, ECB CROE 2.5.2.2-26, ECB CROE 2.5.2.2-31, ECB CROE 2.6.2-9","CIS CSC 10, COBIT 5 APO13.01 & DSS01.01 & DSS04.07, ISA 62443-2-1:2009 4.3.4.3.9, ISA 62443-3-3:2013 SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.12.3.1 & A.17.1.2 & A.17.1.3 & A.18.1.3, NIST SP 800-53 Rev. 4 CP-4 & CP-6 & CP-9"]
[null,null,null,null,"PR.IP-4.3","PR.IP-4.3: The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives. ",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing/Principles of the Business Continuity Testing Program, FFIEC Booklet BCM/8-11.b,  NAIC HBRS/ExC DSS.04, ECB CROE 2.5.2.2-27, ECB CROE 2.5.2.2-28","CIS CSC 10, COBIT 5 APO13.01 & DSS01.01 & DSS04.07, ISA 62443-2-1:2009 4.3.4.3.9, ISA 62443-3-3:2013 SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.12.3.1 & A.17.1.2 & A.17.1.3 & A.18.1.3, NIST SP 800-53 Rev. 4 CP-4 & CP-6 & CP-9"]
[null,null,null,null,"PR.IP-4.4","PR.IP-4.4: Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing/Principles of the Business Continuity Testing Program, FFIEC Booklet BCM/4-5.a, 4-5.c, NAIC HBRS/ExC DSS.04, SEC Regulation SCI, SEC Regulation SDR, ECB CROE 2.5.2.1-1, ECB CROE 2.5.2.2-29","CIS CSC 10, COBIT 5 APO13.01 & DSS01.01 & DSS04.07, ISA 62443-2-1:2009 4.3.4.3.9, ISA 62443-3-3:2013 SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.12.3.1 & A.17.1.2 & A.17.1.3 & A.18.1.3, NIST SP 800-53 Rev. 4 CP-4 & CP-6 & CP-9"]
[null,null,"PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met.","PR.IP-5","PR.IP-5.1","PR.IP-5.1: Physical and environmental security policies are implemented and managed. ",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.8, G7/3, FFIEC Booklet BCM/8-1.f, NAIC HBRS/ExC DSS.01, SEC Regulation SDR, SEC Regulation S-P, EBA GITSRM 3.4.3.35","COBIT 5 DSS01.04 & DSS05.05, ISA 62443-2-1:2009 4.3.3.3.1 & 4.3.3.3.2 & 4.3.3.3.3 & 4.3.3.3.5 & 4.3.3.3.6, ISO/IEC 27001:2013 A.11.1.4 & A.11.2.1 & A.11.2.2 & A.11.2.3, NIST SP 800-53 Rev. 4 PE-10 & PE-12 & PE-13 & PE-14 & PE-15 & PE-18"]
[null,null,"PR.IP-6: Data is destroyed according to policy.","PR.IP-6","PR.IP-6.1","PR.IP-6.1: Data is maintained, stored, retained and destroyed according to the organization's data retention policy.",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.13, FFIEC-APX E/Risk Mitigation, FTC/10, G7/3, NAIC HBRS/ExC DSS.05, NAIC ML/4, NYDFS/500.13","COBIT 5 BAI09.03 & DSS05.06, ISA 62443-2-1:2009 4.3.4.4.4, ISA 62443-3-3:2013 SR 4.2, ISO/IEC 27001:2013 A.8.2.3 & A.8.3.1 & A.8.3.2 & A.11.2.7, NIST SP 800-53 Rev. 4 MP-6"]
[null,null,"PR.IP-7: Protection processes are continuously improved.","PR.IP-7 - with sector enhancement","PR.IP-7.1","PR.IP-7.1:  A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.",null,null,null,null,"CPMI-IOSCO/Testing, FFIEC CAT D1/ D5, FFIEC IT Booklet/Management/Risk Mitigation/III.D, G7/3, G7/4, G7/8, NAIC HBRS/ExC APO.12, NYDFS/500.15, SEC Regulation SCI, ECB CROE 2.8.2.1-3","COBIT 5 APO11.06 & APO12.06 & DSS04.05, ISA 62443-2-1:2009 4.4.3.1 & 4.4.3.2 & 4.4.3.3 & 4.4.3.4 & 4.4.3.5 & 4.4.3.6 & 4.4.3.7 & 4.4.3.8, ISO/IEC 27001:2013 A.16.1.6 & Clause 9 & Clause 10, NIST SP 800-53 Rev. 4 CA-2 & CA-7 & CP-2 & IR-8 & PL-2 & PM-6"]
[null,null,"PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties.","PR.IP-8 - with sector enhancement","PR.IP-8.1","PR.IP-8.1:  The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.",null,null,null,null,"FFIEC CAT D1/ D2, FFIEC IT Booklet/Management/Risk Mitigation/III.D, NAIC HBRS/ExC DSS.01, SEC Regulation SCI","COBIT 5 BAI08.04 & DSS03.04, ISO/IEC 27001:2013 A.16.1.6, NIST SP 800-53 Rev. 4 AC-21 & CA-7 & SI-4"]
[null,null,"PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed.","PR.IP-9","PR.IP-9.1","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.",null,null,null,null,"CFTC/C, CFTC/E, CFTC-Cyber Exam/A, CPMI-IOSCO/Protection, CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D5, FFIEC IT Booklet/Business Continuity Planning Process, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-1.d, 2-4.a, 8-11.a, 11-3, 11-4, FINRA/Incident Response Planning, G7/3, NAIC HBRS/ExC DSS.02, NAIC ML/4, NFA/Response and Recovery, NYDFS/500.03, NYDFS/500.16, SEC Regulation SCI, EBA GITSRM 77, ECB CROE 2.5.2.2-26, ECB CROE 2.5.2.2-31","CIS CSC 19, COBIT 5 APO12.06 & DSS04.03, ISA 62443-2-1:2009 4.3.2.5.3 & 4.3.4.5.1, ISO/IEC 27001:2013 A.16.1.1 & A.17.1.1 & A.17.1.2 & A.17.1.3, NIST SP 800-53 Rev. 4 CP-2 & CP-7 & CP-12 & CP-13 & IR-7 & IR-8 & IR-9 & PE-17"]
[null,null,null,null,"PR.IP-9.2","PR.IP-9.2: The organization defines objectives for resumption of critical operations.",null,null,null,null,"CPMI-IOSCO/Protection, CPMI-IOSCO/Response & Recovery, FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing/Principles of the Business Continuity Testing Program, NAIC HBRS/ExC DSS.02, ECB CROE 2.5.2.1-11","CIS CSC 19, COBIT 5 APO12.06 & DSS04.03, ISA 62443-2-1:2009 4.3.2.5.3 & 4.3.4.5.1, ISO/IEC 27001:2013 A.16.1.1 & A.17.1.1 & A.17.1.2 & A.17.1.3, NIST SP 800-53 Rev. 4 CP-2 & CP-7 & CP-12 & CP-13 & IR-7 & IR-8 & IR-9 & PE-17"]
[null,null,"PR.IP-10: Response and recovery plans are tested.","PR.IP-10","PR.IP-10.1","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.",null,null,null,null,"CPMI-IOSCO/Testing, FFIEC CAT D2/ D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing, FFIEC-APX E/Mobile Financial Services Work Program, G7/3, FFIEC Booklet BCM/2-3.c, 2-5.e, 8-1.j, 10-7.a, 10-9.c, 10-13.b, 10-13.d, 10-25.a, 10-25.b, NAIC HBRS/ExC DSS.04, EBA GITSRM 3.4.6.43, EBA GITSRM 3.4.6.44, EBA GITSRM 3.4.6.48, EBA GITSRM 37.2.82, EBA GITSRM 3.7.4.89.c, ECB CROE 2.4.2-6, ECB CROE 2.5.2.1-8, ECB CROE 2.6.2-1, ECB CROE 2.6.2-2, ECB CROE 2.6.2-15, ECB CROE 2.6.2-17, ECB CROE 2.6.2-18, ECB CROE 2.6.2-26, ECB CROE 2.6.2-27, ECB CROE 2.6.2-28, ECB CROE 2.6.2-29, ECB CROE 2.6.2-30, ECB CROE 2.6.2-41","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 3.3, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-4 & IR-3 & PM-14"]
[null,null,null,null,"PR.IP-10.2","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.",null,null,null,null,"CPMI-IOSCO/Testing, FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing, FFIEC-APX E/Mobile Financial Services Work Program, G7/3, FFIEC Booklet BCM/2-3.c, 2-5.e, 8-1.j, 10-2, 10-3, 10-5, 10-6, 10-9.d, 10-10, 10-11.a, 10-16.b, 10-16.e, 10-16.g, 10-17.d, 10-17.e, 10-17.f, 10-18.c, 10-19.c, 10-19.d, 10-19.f, 10-19.g, 10-19.h, 10-23.f, NAIC HBRS/ExC DSS.04, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.4.6.44, ECB CROE 2.4.2-6, ECB CROE 2.5.2.1-8, ECB CROE 2.6.2-1, ECB CROE 2.6.2-2","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 3.3, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-4 & IR-3 & PM-14"]
[null,null,null,null,"PR.IP-10.3","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.",null,null,null,null,"CPMI-IOSCO/Testing, FFIEC CAT D5, FFIEC-APX E/Mobile Financial Services Work Program, G7/3, FFIEC Booklet BCM/2-3.c, 2-5.e, 2-5.h, 8-12.a, 10-16.b, 10-16.d, 10-17.c, 10-18.c, 10-23.d, NAIC HBRS/ExC DSS.04, SEC Regulation S-ID, ECB CROE 2.6.2-3, ECB CROE 2.6.2-6, ECB CROE 2.6.2-16, ECB CROE 2.6.2-20","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 3.3, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-4 & IR-3 & PM-14"]
[null,null,null,null,"PR.IP-10.4","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ",null,null,null,null,"CPMI-IOSCO/Testing, FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing, FFIEC-APX E/Mobile Financial Services Work Program, G7/3, FFIEC Booklet BCM/2-3.c, 3-5.e, 10-4, 10-7.b, 10-7.c, 10-7.e, 10-7.f, 10-7.g, 10-8.a, 10-8.b, 10-8.c, 10-8.d, 10-9.e, 10-11.b, 10-11.c, 10-11.d, 10-11.f, 10-11.g, 10-12a, 10-12.b, 10-12.c, 10-12.d, 10-12.f, 10-12.g, 10-12.h, 10-12.i, 10-13.a, 10-13.c, 10-14.a, 10-14.b, 10-14.c, 10-14.d, 10-14.e, 10-15.a, 10-15.b, 10-16.a, 10-16.j, 10-17.a, 10-17.g, 10-18.a, 10-18.b, 10-18.d, 10-18.e, 10-18.f, 10-19.a, 10-19.b, 10-21.d, 10-23.g, 10-24.a, 10-24.b, 10-24.c, 10-24.d, 10-28.a, 10-28.b, 10-28.c, 10-28.d, 10-28.e,10-28.f, 10-28.g, NAIC HBRS/ExC DSS.04, SEC Regulation SCI, ECB CROE 2.5.2.1-8, ECB CROE 2.6.2-3, ECB CROE 2.6.2-8, ECB CROE 2.6.2-18, ECB CROE 2.6.2-20","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 3.3, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-4 & IR-3 & PM-14"]
[null,null,"PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening).","PR.IP-11","PR.IP-11.1","PR.IP-11.1: The organization conducts background/screening checks on all new employees, as permitted by law.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1, FFIEC IT Booklet/Management/IT Risk Management/Risk Mitigation/III.C.2, FFIEC IT Booklet/Operations, NAIC HBRS/ExC BAI.08, ECB CROE 2.3.2.2-56.a","CIS CSC 5 & 16, COBIT 5 APO07.01 & APO07.02 & APO07.03 & APO07.04 & APO07.05, ISA 62443-2-1:2009 4.3.3.2.1 & 4.3.3.2.2 & 4.3.3.2.3, ISO/IEC 27001:2013 A.7.1.1 & A.7.1.2 & A.7.2.1 & A.7.2.2 & A.7.2.3 & A.7.3.1 & A.8.1.4, NIST SP 800-53 Rev. 4 PS-1 & PS-2 & PS-3 & PS-4 & PS-5 & PS-6 & PS-7 & PS-8 & SA-21"]
[null,null,null,null,"PR.IP-11.2","PR.IP-11.2: The organization conducts background/screening checks on all staff at regular intervals throughout their employment, commensurate with staff’s access to critical systems or a change in role, as permitted by law.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D1, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Management/IT Risk Management/Risk Mitigation/III.C.2, FFIEC IT Booklet/Operations, NAIC HBRS/ExC BAI.08, ECB CROE 2.3.2.2-56.b","CIS CSC 5 & 16, COBIT 5 APO07.01 & APO07.02 & APO07.03 & APO07.04 & APO07.05, ISA 62443-2-1:2009 4.3.3.2.1 & 4.3.3.2.2 & 4.3.3.2.3, ISO/IEC 27001:2013 A.7.1.1 & A.7.1.2 & A.7.2.1 & A.7.2.2 & A.7.2.3 & A.7.3.1 & A.8.1.4, NIST SP 800-53 Rev. 4 PS-1 & PS-2 & PS-3 & PS-4 & PS-5 & PS-6 & PS-7 & PS-8 & SA-21"]
[null,null,null,null,"PR.IP-11.3","PR.IP-11.3: The organization establishes processes and controls to mitigate cyber risks related to employment termination, as permitted by law.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, NAIC HBRS/ExC BAI.08, ECB CROE 2.3.2.2-56, ECB CROE 2.3.2.2-56.c","CIS CSC 5 & 16, COBIT 5 APO07.01 & APO07.02 & APO07.03 & APO07.04 & APO07.05, ISA 62443-2-1:2009 4.3.3.2.1 & 4.3.3.2.2 & 4.3.3.2.3, ISO/IEC 27001:2013 A.7.1.1 & A.7.1.2 & A.7.2.1 & A.7.2.2 & A.7.2.3 & A.7.3.1 & A.8.1.4, NIST SP 800-53 Rev. 4 PS-1 & PS-2 & PS-3 & PS-4 & PS-5 & PS-6 & PS-7 & PS-8 & SA-21"]
[null,null,"PR.IP-12: A vulnerability management plan is developed and implemented.","PR.IP-12","PR.IP-12.1","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.",null,null,null,null,"CFTC/E, CFTC-Cyber Exam/B, CPMI-IOSCO/Testing, FFIEC CAT D3, FFIEC IT Booklet/Information Security/III, FFIEC-APX E/Risk Mitigation, FIEC IT Booklet/Management/IT Risk Management/III.A, FFIEC Booklet BCM/1-4.c, FINRA/Incident Response Planning, G7/3, NAIC HBRS/ExC DSS.05, NFA/Deployment, NFA/Review of Information Security Programs, NFA/Security Risk Analysis, NYDFS/500.05, SEC Regulation SCI, EBA GITSRM 3.3.3.21, EBA GITSRM 3.4.4.36.a, ECB CROE 2.3.2.1-18, ECB CROE 2.4.2-21, ECB CROE 2.6.2-10, ECB CROE 2.6.2-11, ECB CROE 2.6.2-39","CIS CSC 4 & 18 & 20, COBIT 5 BAI03.10 & DSS05.01 & DSS05.02, ISO/IEC 27001:2013 A.12.6.1 & A.14.2.3 & A.16.1.3 & A.18.2.2 & A.18.2.3, NIST SP 800-53 Rev. 4 RA-3 & RA-5 & SI-2"]
[null,null,null,null,"PR.IP-12.2","PR.IP-12.2: The organization establishes a process to prioritize and remedy issues identified through vulnerability scanning.",null,null,null,null,"CPMI-IOSCO/Testing, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.10, NAIC HBRS/ExC DSS.05, EBA GITSRM 3.4.4.36.a, ECB CROE 2.4.2-21, ECB CROE 2.6.2-10","CIS CSC 4 & 18 & 20, COBIT 5 BAI03.10 & DSS05.01 & DSS05.02, ISO/IEC 27001:2013 A.12.6.1 & A.14.2.3 & A.16.1.3 & A.18.2.2 & A.18.2.3, NIST SP 800-53 Rev. 4 RA-3 & RA-5 & SI-2"]
[null,null,null,null,"PR.IP-12.3","PR.IP-12.3: The organization has a formal exception management process for vulnerabilities that cannot be mitigated due to business-related exceptions.",null,null,null,null,"CFTC/H, NAIC HBRS/ExC DSS.05","CIS CSC 4 & 18 & 20, COBIT 5 BAI03.10 & DSS05.01 & DSS05.02, ISO/IEC 27001:2013 A.12.6.1 & A.14.2.3 & A.16.1.3 & A.18.2.2 & A.18.2.3, NIST SP 800-53 Rev. 4 RA-3 & RA-5 & SI-2"]
[null,null,null,null,"PR.IP-12.4","PR.IP-12.4: The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC IT Booklet/Information Security/II.C.10, FFIEC-APX E/Risk Mitigation, EBA GITSRM 3.4.4.36.a, EBA GITSRM 55, ECB CROE 2.3.2.1-47, ECB CROE 2.3.2.1-49","CIS CSC 4 & 18 & 20, COBIT 5 BAI03.10 & DSS05.01 & DSS05.02, ISO/IEC 27001:2013 A.12.6.1 & A.14.2.3 & A.16.1.3 & A.18.2.2 & A.18.2.3, NIST SP 800-53 Rev. 4 RA-3 & RA-5 & SI-2"]
[null,"Maintenance (PR.MA): Maintenance and repairs of industrial control and information system components are performed consistent with policies and procedures.","PR.MA-1: Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools.","PR.MA-1 - with sector enhancement","PR.MA-1.1","PR.MA-1.1: Policies, standards and procedures for the maintenance of assets include, but are not limited to, physical entry controls, equipment maintenance and removal of assets.",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D3, FFIEC IT Booklet / Development and Acquisition / Maintenance, FFIEC IT Booklet/Information Security/II.C.11, G7/3, NAIC HBRS/ExC DSS.01, SEC Regulation SCI","COBIT 5 BAI03.10 & BAI09.02 & BAI09.03 & DSS01.05, ISA 62443-2-1:2009 4.3.3.3.7, ISO/IEC 27001:2013 A.11.1.2 & A.11.2.4 & A.11.2.5 & A.11.2.6, NIST SP 800-53 Rev. 4 MA-2 & MA-3 & MA-5 & MA-6"]
[null,null,"PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.","PR.MA-2","PR.MA-2.1","PR.MA-2.1: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet / Development and Acquisition / Maintenance, FFIEC IT Booklet / Operations / Preventive Maintenance, NAIC HBRS/ExC DSS.05, SEC Regulation SDR, ECB CROE 2.3.2.1-15","CIS CSC 3 & 5, COBIT 5 DSS05.04, ISA 62443-2-1:2009 4.3.3.6.5 & 4.3.3.6.6 & 4.3.3.6.7 & 4.3.3.6.8, ISO/IEC 27001:2013 A.11.2.4 & A.15.1.1 & A.15.2.1, NIST SP 800-53 Rev. 4 MA-4"]
[null,"Protective Technology (PR.PT): Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.","PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.","PR.PT-1","PR.PT-1.1","PR.PT-1.1: The organization's audit trails are designed to detect cybersecurity events that may materially harm normal operations of the organization.",null,null,null,null,"CFTC-Cyber Exam/A, FFIEC CAT D3, FFIEC IT Booklet/Audit, FFIEC IT Booklet/Information Security/II.C.22, FFIEC-APX E/Mobile Financial Services Work Program, FFIEC-APX E/Risk Mitigation, G7/3, G7/4, NAIC HBRS/ExC DSS.01, NAIC ML/4, NYDFS/500.06","CIS CSC 1 & 3 & 5 & 6 & 14 & 15 & 16, COBIT 5 APO11.04 & BAI03.05 & DSS05.04 & DSS05.07 & MEA02.01, ISA 62443-2-1:2009 4.3.3.3.9 & 4.3.3.5.8 & 4.3.4.4.7 & 4.4.2.1 & 4.4.2.2 & 4.4.2.4, ISA 62443-3-3:2013 SR 2.8 & SR 2.9 & SR 2.10 & SR 2.11 & SR 2.12, ISO/IEC 27001:2013 A.12.4.1 & A.12.4.2 & A.12.4.3 & A.12.4.4 & A.12.7.1, NIST SP 800-53 Rev. 4 AU Family"]
[null,null,null,null,"PR.PT-1.2","PR.PT-1.2: The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time.",null,null,null,null,"FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/II.C.22, NAIC HBRS/ExC DSS.01, NAIC ML/5, NYDFS 500.06","CIS CSC 1 & 3 & 5 & 6 & 14 & 15 & 16, COBIT 5 APO11.04 & BAI03.05 & DSS05.04 & DSS05.07 & MEA02.01, ISA 62443-2-1:2009 4.3.3.3.9 & 4.3.3.5.8 & 4.3.4.4.7 & 4.4.2.1 & 4.4.2.2 & 4.4.2.4, ISA 62443-3-3:2013 SR 2.8 & SR 2.9 & SR 2.10 & SR 2.11 & SR 2.12, ISO/IEC 27001:2013 A.12.4.1 & A.12.4.2 & A.12.4.3 & A.12.4.4 & A.12.7.1, NIST SP 800-53 Rev. 4 AU Family"]
[null,null,"PR.PT-2: Removable media is protected and its use restricted according to policy.","PR.PT-2","PR.PT-2.1","PR.PT-2.1: The organization's removable media and mobile devices are protected and use is restricted according to policy.",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.13, G7/3, NAIC HBRS/ExC DSS.05","CIS CSC 8 & 13, COBIT 5 APO13.01 & DSS05.02 & DSS05.06, ISA 62443-3-3:2013 SR 2.3, ISO/IEC 27001:2013 A.8.2.1 & A.8.2.2 & A.8.2.3 & A.8.3.1 & A.8.3.3 & A.11.2.9, NIST SP 800-53 Rev. 4 MP-2 & MP-3 & MP-4 & MP-5 & MP-7 & MP-8"]
[null,null,"PR.PT-3:  The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.","PR.PT-3","PR.PT-3.1","PR.PT-3.1: The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality.",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Protection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.10, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, FINRA/Vendor Management, FTC/2, FTC/6, G7/3, NAIC HBRS/ExC DSS.05, NAIC ML/4, NYDFS/500.02, NYDFS/500.11","CIS CSC 3 & 11 & 14, COBIT 5 DSS05.02 & DSS05.05 & DSS06.06, ISA 62443-2-1:2009 4.3.3.5.1 & 4.3.3.5.2 & 4.3.3.5.3 & 4.3.3.5.4 & 4.3.3.5.5 & 4.3.3.5.6 & 4.3.3.5.7 & 4.3.3.5.8 & 4.3.3.6.1 & 4.3.3.6.2 & 4.3.3.6.3 & 4.3.3.6.4 & 4.3.3.6.5 & 4.3.3.6.6 & 4.3.3.6.7 & 4.3.3.6.8 & 4.3.3.6.9 & 4.3.3.7.1 & 4.3.3.7.2 & 4.3.3.7.3 & 4.3.3.7.4, ISA 62443-3-3:2013 SR 1.1 & SR 1.2 & SR 1.3 & SR 1.4 & SR 1.5 & SR 1.6 & SR 1.7 & SR 1.8 & SR 1.9 & SR 1.10 & SR 1.11 & SR 1.12 & SR 1.13 & SR 2.1 & SR 2.2 & SR 2.3 & SR 2.4 & SR 2.5 & SR 2.6 & SR 2.7, ISO/IEC 27001:2013 A.9.1.2, NIST SP 800-53 Rev. 4 AC-3 & CM-7"]
[null,null,"PR.PT-4: Communications and control networks are protected.","PR.PT-4","PR.PT-4.1","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.6, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, FFIEC Booklet BCM/6-2.a, 8-1.h,  FINRA/Technical Controls, G7/3, NAIC HBRS/ExC DSS.05, ECB CROE 2.3.2.1-5, ECB CROE 2.3.2.1-10, ECB CROE 2.3.2.1-11, ECB CROE 2.3.2.1-21","CIS CSC 8 & 12 & 15, COBIT 5 DSS05.02 & APO13.01, ISA 62443-3-3:2013 SR 3.1 & SR 3.5 & SR 3.8 & SR 4.1 & SR 4.3 & SR 5.1 & SR 5.2 & SR 5.3 & SR 7.1 & SR 7.6, ISO/IEC 27001:2013 A.13.1.1 & A.13.2.1 & A.14.1.3, NIST SP 800-53 Rev. 4 AC-4 & AC-17 & AC-18 & CP-8 & SC-7 & SC-19 & SC-20 & SC-21 & SC-22 & SC-23 & SC-24 & SC-25 & SC-29 & SC-32 & SC-36 & SC-37 & SC-38 & SC-39 & SC-40 & SC-41 & SC-43"]
[null,null,"PR.PT-5: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.","PR.PT-5","PR.PT-5.1","PR.PT-5.1: The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.",null,null,null,null,"FFIEC CAT D4/ D5, FFIEC-APX J/Cyber Resilience, FFIEC Booklet BCM/2-3.e, 6-3.a,  NAIC HBRS/ExC DSS.01, SEC Regulation SCI, SEC Regulation SDR, ECB CROE 2.3.2.1-26, ECB CROE 2.3.2.1-54, ECB CROE 2.5.2.2-31","COBIT 5 BAI04.01 & BAI04.02 & BAI04.03 & BAI04.04 & BAI04.05 & DSS01.05, ISA 62443-2-1:2009 4.3.2.5.2, ISA 62443-3-3:2013 SR 7.1 & SR 7.2, ISO/IEC 27001:2013 A.17.1.2 & A.17.2.1, NIST SP 800-53 Rev. 4 CP-7 & CP-8 & CP-11 & CP-13 & PL-8 & SA-14 & SC-6"]
["DETECT (DE)","Anomalies and Events (DE.AE): Anomalous activity is detected in a timely manner and the potential impact of events is understood.","DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed.","DE.AE-1","DE.AE-1.1","DE.AE-1.1: The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows. ",null,null,null,null,"CFTC-Cyber Exam/A, FFIEC CAT D3/ D4, FFIEC IT Booklet/Information Security/II.C.6, FFIEC IT Booklet/Information Security/II.C.7.1, G7/3, G7/4, FFIEC Booklet BCM/1-3.b, 4-3.a, NAIC HBRS/ExC DSS.05, ECB CROE 2.3.2.1-20, ECB CROE 2.4.2-1, ECB CROE 2.4.2-19","CIS CSC 1 & 4 & 6 & 12 & 13 & 15 & 16, COBIT 5 DSS03.01, ISA 62443-2-1:2009 4.4.3.3, ISO/IEC 27001:2013 A.12.1.1 & A.12.1.2 & A.13.1.1 & A.13.1.2, NIST SP 800-53 Rev. 4 AC-4 & CA-3 & CM-2 & SI-4"]
[null,null,"DE.AE-2: Detected events are analyzed to understand attack targets and methods.","DE.AE-2","DE.AE-2.1","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.",null,null,null,null,"FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/III, G7/3, G7/4, G7/5, FFIEC Booklet BCM/11-1.g, NAIC HBRS/ExC DSS.02, NYDFS/500.02, SEC Regulation S-ID, EBA GITSRM 3.4.5.40, EBA GITSRM 52, ECB CROE 2.2.2-12, ECB CROE 2.3.2.1-10, ECB CROE 2.3.2.1-16, ECB CROE 2.4.2-16, ECB CROE 2.4.2-21, ECB CROE 2.5.2.1-21","CIS CSC 3 & 6 & 13 & 15, COBIT 5 DSS05.07, ISA 62443-2-1:2009 4.3.4.5.6 & 4.3.4.5.7 & 4.3.4.5.8, ISA 62443-3-3:2013 SR 2.8 & SR 2.9 & SR 2.10 & SR 2.11 & SR 2.12 & SR 3.9 & SR 6.1 & SR 6.2, ISO/IEC 27001:2013 A.12.4.1 & A.16.1.1 & A.16.1.4, NIST SP 800-53 Rev. 4 AU-6 & CA-7 & IR-4 & SI-4"]
[null,null,"DE.AE-3: Event data are collected and correlated from multiple sources and sensors.","DE.AE-3","DE.AE-3.1","DE.AE-3.1: The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.",null,null,null,null,"CPMI-IOSCO/Detection, FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/II.C.22, FFIEC IT Booklet/Operations, NAIC HBRS/ExC DSS.05, ECB CROE 2.2.2-12, ECB CROE 2.4.2-2, ECB CROE 2.4.2-5, ECB CROE 2.4.2-13","CIS CSC 1 & 3 & 4 & 5 & 6 & 7 & 8 & 11 & 12 & 13 & 14 & 15 & 16, COBIT 5 BAI08.02, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.12.4.1 & A.16.1.7, NIST SP 800-53 Rev. 4 AU-6 & CA-7 & IR-4 & IR-5 & IR-8 & SI-4"]
[null,null,null,null,"DE.AE-3.2","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.",null,null,null,null,"CPMI-IOSCO/Detection, FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/II.C.22, G7/4, FFIEC Booklet BCM/8-10.c, NAIC HBRS/ExC DSS.05, SEC Regulation S-ID, SEC Regulation S-P, EBA GITSRM 3.4.2.31, EBA GITSRM 3.4.5.38, EBA GITSRM 3.4.5.38.c, ECB CROE 2.3.2.1-27, ECB CROE 2.4.2-2, ECB CROE 2.4.2-5, ECB CROE 2.4.2-9, ECB CROE 2.4.2-12, ECB CROE 2.4.2-13, ECB CROE 2.4.2-21, ECB CROE 2.7.2.1-10, ECB CROE 2.7.2.1-10.a","CIS CSC 1 & 3 & 4 & 5 & 6 & 7 & 8 & 11 & 12 & 13 & 14 & 15 & 16, COBIT 5 BAI08.02, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.12.4.1 & A.16.1.7, NIST SP 800-53 Rev. 4 AU-6 & CA-7 & IR-4 & IR-5 & IR-8 & SI-4"]
[null,null,"DE.AE-4: Impact of events is determined.","DE.AE-4","DE.AE-4.1","DE.AE-4.1: The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector.",null,null,null,null,"FFIEC CAT D1/ D2, FFIEC IT Booklet/Information Security/III, G7/4, G7/5, FFIEC Booklet BCM/4-4.a, 4-4.b, NAIC HBRS/ExC DSS.03, NFA/Security Risk Analysis","CIS CSC 4 & 6, COBIT 5 APO12.06 & DSS03.01, ISO/IEC 27001:2013 A.16.1.4, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & RA-3 & SI-4"]
[null,null,"DE.AE-5: Incident alert thresholds are established.","DE.AE-5","DE.AE-5.1","DE.AE-5.1: The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.",null,null,null,null,"FFIEC CAT D3/ D5, FFIEC IT Booklet/Information Security/III, G7/3, G7/4, NAIC HBRS/ExC DSS.03, SEC Regulation S-ID, ECB CROE 2.4.2-10, ECB CROE 2.4.2-22, ECB CROE 2.5.2.1-7, ECB CROE 2.5.2.1-21","CIS CSC 6 & 19, COBIT 5 APO12.06 & DSS03.01, ISA 62443-2-1:2009 4.2.3.10, ISO/IEC 27001:2013 A.16.1.4, NIST SP 800-53 Rev. 4 IR-4 & IR-5 & IR-8"]
[null,"Security Continuous Monitoring (DE.CM): The information system and assets are monitored at discrete intervals to identify cybersecurity events and verify the effectiveness of protective measures.","DE.CM-1: The network is monitored to detect potential cybersecurity events.","DE.CM-1","DE.CM-1.1","DE.CM-1.1: The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods.",null,null,null,null,"FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/II.C.22, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, NAIC HBRS/ExC DSS.05, NAIC ML/5, EBA GITSRM 3.4.2.31.d, ECB CROE 2.5.2.4-47, ECB CROE 2.5.2.4-48","CIS CSC 1 & 7 & 8 & 12 & 13 & 15 & 16, COBIT 5 DSS01.03 & DSS03.05 & DSS05.07, ISA 62443-3-3:2013 SR 6.2, NIST SP 800-53 Rev. 4 AC-2 & AU-12 & CA-7 & CM-3 & SC-5 & SC-7 & SI-4"]
[null,null,null,null,"DE.CM-1.2","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).",null,null,null,null,"CFTC-Cyber Exam/E, CPMI-IOSCO/Detection, FFIEC CAT D2/ D3/ D4/ D5, FFIEC IT Booklet/Information Security/II.C.22, FFIEC IT Booklet/Operations, FINRA/Technical Controls, FTC/3, FTC/5, G7/4, NAIC HBRS/ExC DSS.05, NAIC ML/4, NFA/Deployment, NYDFS/500.03, SEC Regulation SCI, SEC Regulation S-P, EBA GITSRM 3.4.5.38, EBA GITSRM 3.4.5.38.a, EBA GITSRM 3.4.5.39, EBA GITSRM 52, ECB CROE 2.4.2-3, ECB CROE 2.4.2-8, ECB CROE 2.4.2-13, ECB CROE 2.4.2-17","CIS CSC 1 & 7 & 8 & 12 & 13 & 15 & 16, COBIT 5 DSS01.03 & DSS03.05 & DSS05.07, ISA 62443-3-3:2013 SR 6.2, NIST SP 800-53 Rev. 4 AC-2 & AU-12 & CA-7 & CM-3 & SC-5 & SC-7 & SI-4"]
[null,null,null,null,"DE.CM-1.3","DE.CM-1.3: The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery. ",null,null,null,null,"CPMI-IOSCO/Protection, FFIEC CAT D3/ D5, NAIC HBRS/ExC DSS.05, ECB CROE 2.3.2.1-26, ECB CROE 2.4.2-18, ECB CROE 2.4.2-22","CIS CSC 1 & 7 & 8 & 12 & 13 & 15 & 16, COBIT 5 DSS01.03 & DSS03.05 & DSS05.07, ISA 62443-3-3:2013 SR 6.2, NIST SP 800-53 Rev. 4 AC-2 & AU-12 & CA-7 & CM-3 & SC-5 & SC-7 & SI-4"]
[null,null,null,null,"DE.CM-1.4","DE.CM-1.4: The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks.",null,null,null,null,"FFIEC CAT D3/ D5, FFIEC-APX E/Risk Mitigation, NAIC HBRS/ExC DSS.05, ECB CROE 2.4.2-18","CIS CSC 1 & 7 & 8 & 12 & 13 & 15 & 16, COBIT 5 DSS01.03 & DSS03.05 & DSS05.07, ISA 62443-3-3:2013 SR 6.2, NIST SP 800-53 Rev. 4 AC-2 & AU-12 & CA-7 & CM-3 & SC-5 & SC-7 & SI-4"]
[null,null,"DE.CM-2: The physical environment is monitored to detect potential cybersecurity events.","DE.CM-2","DE.CM-2.1","DE.CM-2.1: The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.",null,null,null,null,"CPMI-IOSCO/Detection, CPMI-IOSCO/Protection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C, FINRA/Technical Controls, FTC/5, G7/4, NAIC HBRS/ExC DSS.01, NAIC ML/4, NFA/Deployment, SEC Regulation S-ID, SEC Regulation S-P, ECB CROE 2.4.2-2, ECB CROE 2.4.2-19","COBIT 5 DSS01.04 & DSS01.05, ISA 62443-2-1:2009 4.3.3.3.8, ISO/IEC 27001:2013 A.11.1.1 & A.11.1.2, NIST SP 800-53 Rev. 4 CA-7 & PE-3 & PE-6 & PE-20"]
[null,null,"DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events.","DE.CM-3","DE.CM-3.1","DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Detection, CPMI-IOSCO/Protection, FFIEC CAT D3/ D4/ D5, FFIEC IT Booklet/Information Security/II.C.15, FINRA/Technical Controls, FTC/5, NAIC HBRS/ExC DSS.05, NYDFS/500.14, SAMA/DETECT, SEC Regulation SCI, SEC Regulation SDR, SEC Regulation S-ID, SEC Regulation S-P, EBA GITSRM 3.4.4.36, ECB CROE 2.3.2.1-17, ECB CROE 2.3.2.1-24, ECB CROE 2.3.2.1-41, ECB CROE 2.3.2.2-61","CIS CSC 5 & 7 & 14 & 16, COBIT 5 DSS05.07, ISA 62443-3-3:2013 SR 6.2, ISO/IEC 27001:2013 A.12.4.1 & A.12.4.3, NIST SP 800-53 Rev. 4 AC-2 & AU-12 & AU-13 & CA-7 & CM-10 & CM-11"]
[null,null,null,null,"DE.CM-3.2","DE.CM-3.2: The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.",null,null,null,null,"CFTC-Cyber Exam/B, CPMI-IOSCO/Detection, CPMI-IOSCO/Protection, FFIEC CAT D3/ D5, FFIEC IT Booklet/Information Security/II.C.22, FINRA/Technical Controls, FTC/5, NAIC HBRS/ExC DSS.05, NYDFS/500.14, SAMA/DETECT, SEC Regulation SCI, SEC Regulation SDR, SEC Regulation S-ID, SEC Regulation S-P, EBA GITSRM 3.4.2.31.d, ECB CROE 2.3.2.2-58","CIS CSC 5 & 7 & 14 & 16, COBIT 5 DSS05.07, ISA 62443-3-3:2013 SR 6.2, ISO/IEC 27001:2013 A.12.4.1 & A.12.4.3, NIST SP 800-53 Rev. 4 AC-2 & AU-12 & AU-13 & CA-7 & CM-10 & CM-11"]
[null,null,null,null,"DE.CM-3.3","DE.CM-3.3: The organization conducts periodic cyber attack simulations to detect control gaps in employee behavior, policies, procedures and resources. ",null,null,null,null,"FFIEC CAT D3, G7/4, NAIC HBRS/ExC DSS.05, NAIC ML/4","CIS CSC 5 & 7 & 14 & 16, COBIT 5 DSS05.07, ISA 62443-3-3:2013 SR 6.2, ISO/IEC 27001:2013 A.12.4.1 & A.12.4.3, NIST SP 800-53 Rev. 4 AC-2 & AU-12 & AU-13 & CA-7 & CM-10 & CM-11"]
[null,null,"DE.CM-4: Malicious code is detected.","DE.CM-4","DE.CM-4.1","DE.CM-4.1: The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.",null,null,null,null,"CFTC-Cyber Exam/B, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.12, FFIEC-APX E/Risk Mitigation,FFIEC Booklet BCM/6-3.f,  FINRA/Technical Controls, G7/4, NAIC HBRS/ExC DSS.05, EBA GITSRM 3.4.5.39","CIS CSC 4 & 7 & 8 & 12, COBIT 5 DSS05.01, ISA 62443-2-1:2009 4.3.4.3.8, ISA 62443-3-3:2013 SR 3.2, ISO/IEC 27001:2013 A.12.2.1, NIST SP 800-53 Rev. 4 SI-3 & SI-8"]
[null,null,null,null,"DE.CM-4.2","DE.CM-4.2: The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email.",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.12, NAIC HBRS/ExC DSS.05","CIS CSC 4 & 7 & 8 & 12, COBIT 5 DSS05.01, ISA 62443-2-1:2009 4.3.4.3.8, ISA 62443-3-3:2013 SR 3.2, ISO/IEC 27001:2013 A.12.2.1, NIST SP 800-53 Rev. 4 SI-3 & SI-8"]
[null,null,"DE.CM-5: Unauthorized mobile code is detected.","DE.CM-5","DE.CM-5.1","DE.CM-5.1: The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.12, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, G7/4, NAIC HBRS/ExC DSS.05, NFA/Deployment, ECB CROE 2.3.2.1-47","CIS CSC 7 & 8, COBIT 5 DSS05.01, ISA 62443-3-3:2013 SR 2.4, ISO/IEC 27001:2013 A.12.5.1 & A.12.6.2, NIST SP 800-53 Rev. 4 SC-18 & SI-4 & SC-44"]
[null,null,"DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events.","DE.CM-6","DE.CM-6.1","DE.CM-6.1: The organization authorizes and monitors all third-party connections.",null,null,null,null,"CFTC-Cyber Exam/D, CPMI-IOSCO/Detection, CPMI-IOSCO/Protection, FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Operations, FINRA/Vendor Management, FTC/5, G7/4, NAIC HBRS/ExC APO.10, NAIC ML/4, NFA/Security Risk Analysis, NFA/Third-Party Service Providers, NYDFS/500.11, SEC Regulation SCI, SEC Regulation SDR, SEC Regulation S-ID, ECB CROE 2.3.2.2-71, ECB CROE 2.4.2-4","COBIT 5 APO07.06 & APO10.05, ISO/IEC 27001:2013 A.14.2.7 & A.15.2.1, NIST SP 800-53 Rev. 4 CA-7 & PS-7 & SA-4 & SA-9 & SI-4"]
[null,null,null,null,"DE.CM-6.2","DE.CM-6.2: The organization collaborates with third-party service providers to maintain and improve the security of external connections.",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Operations, NAIC HBRS/ExC APO.10, NAIC ML/4, ECB CROE 2.3.2.2-71, ECB CROE 2.5.2.3-35","COBIT 5 APO07.06 & APO10.05, ISO/IEC 27001:2013 A.14.2.7 & A.15.2.1, NIST SP 800-53 Rev. 4 CA-7 & PS-7 & SA-4 & SA-9 & SI-4"]
[null,null,null,null,"DE.CM-6.3","DE.CM-6.3: The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.",null,null,null,null,"FFIEC CAT D3/ D4, NAIC HBRS/ExC APO.10, NAIC ML/4, SEC Regulation SCI, EBA GITSRM 3.4.5.38.b, ECB CROE 2.3.2.1-17, ECB CROE 2.3.2.2-71","COBIT 5 APO07.06 & APO10.05, ISO/IEC 27001:2013 A.14.2.7 & A.15.2.1, NIST SP 800-53 Rev. 4 CA-7 & PS-7 & SA-4 & SA-9 & SI-4"]
[null,null,"DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed.","DE.CM-7","DE.CM-7.1","DE.CM-7.1: The organization implements appropriate controls to prevent use of unsupported and unauthorized software. ",null,null,null,null,"CFTC-Cyber Exam/E, FFIEC CAT D1/ D3, NAIC HBRS/ExC DSS.05, NFA/Deployment, ECB CROE 2.3.2.1-19, ECB CROE 2.3.2.1-23","CIS CSC 1 & 2 & 3 & 5 & 9 & 12 & 13 & 15 & 16, COBIT 5 DSS05.02 & DSS05.05, ISO/IEC 27001:2013 A.12.4.1 & A.14.2.7 & A.15.2.1, NIST SP 800-53 Rev. 4 AU-12 & CA-7 & CM-3 & CM-8 & PE-3 & PE-6 & PE-20 & SI-4"]
[null,null,null,null,"DE.CM-7.2","DE.CM-7.2: The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers.",null,null,null,null,"CFTC-Cyber Exam/E, CPMI-IOSCO/Detection, FFIEC CAT D3, FFIEC IT Booklet/Information Security/II.C.10, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, FTC/5, G7/4, NAIC HBRS/ExC DSS.05, NAIC ML/4, NFA/Deployment, NYDFS/500.14, SEC Regulation SCI, SEC Regulation SDR, SEC Regulation S-P, EBA GITSRM 3.4.5.38.b, ECB CROE 2.4.2-4, ECB CROE 2.4.2-14","CIS CSC 1 & 2 & 3 & 5 & 9 & 12 & 13 & 15 & 16, COBIT 5 DSS05.02 & DSS05.05, ISO/IEC 27001:2013 A.12.4.1 & A.14.2.7 & A.15.2.1, NIST SP 800-53 Rev. 4 AU-12 & CA-7 & CM-3 & CM-8 & PE-3 & PE-6 & PE-20 & SI-4"]
[null,null,null,null,"DE.CM-7.3","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.",null,null,null,null,"FFIEC CAT D1/ D2/ D3, NAIC HBRS/ExC DSS.05, EBA GITSRM 53, ECB CROE 2.3.2.1-13, ECB CROE 2.3.2.1-36, ECB CROE 2.3.2.1-44, ECB CROE 2.3.2.1-51, ECB CROE 2.3.2.1-55, ECB CROE 2.4.2-14, ECB CROE 2.6.2-23","CIS CSC 1 & 2 & 3 & 5 & 9 & 12 & 13 & 15 & 16, COBIT 5 DSS05.02 & DSS05.05, ISO/IEC 27001:2013 A.12.4.1 & A.14.2.7 & A.15.2.1, NIST SP 800-53 Rev. 4 AU-12 & CA-7 & CM-3 & CM-8 & PE-3 & PE-6 & PE-20 & SI-4"]
[null,null,null,null,"DE.CM-7.4","DE.CM-7.4: The organization implements web-filtering tools and technology to block access to inappropriate or malicious websites. ",null,null,null,null,"FFIEC CAT D3, NAIC HBRS/ExC DSS.05, NFA/Deployment","CIS CSC 1 & 2 & 3 & 5 & 9 & 12 & 13 & 15 & 16, COBIT 5 DSS05.02 & DSS05.05, ISO/IEC 27001:2013 A.12.4.1 & A.14.2.7 & A.15.2.1, NIST SP 800-53 Rev. 4 AU-12 & CA-7 & CM-3 & CM-8 & PE-3 & PE-6 & PE-20 & SI-4"]
[null,null,"DE.CM-8: Vulnerability scans are performed.","DE.CM-8","DE.CM-8.1","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.",null,null,null,null,"CFTC/E, CFTC-Cyber Exam/E, CPMI-IOSCO/Detection, CPMI-IOSCO/Testing, FFIEC CAT D3, FFIEC IT Booklet/Information Security/IV.A, FFIEC-APX E/Risk Mitigation, FINRA/Technical Controls, FTC/7, G7/4, NAIC HBRS/ExC DSS.05, NYDFS/500.05, SEC Regulation SCI, EBA GITSRM 3.4.5.39, EBA GITSRM 3.4.6.41, EBA GITSRM 3.4.6.43.b, ECB CROE 2.4.2-21, ECB CROE 2.6.2-12, ECB CROE 2.6.2-25","CIS CSC 4 & 20, COBIT 5 BAI03.10 & DSS05.01, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.7, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-5"]
[null,null,null,null,"DE.CM-8.2","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ",null,null,null,null,"CFTC-Cyber Exam/E, FFIEC CAT D3, FFIEC IT Booklet/Information Security/IV.A, FINRA/Technical Controls, NAIC HBRS/ExC DSS.05, SEC Regulation SCI, NYDFS 500.05, EBA GITSRM 3.4.6.41, EBA GITSRM 3.4.6.43.a, EBA GITSRM 3.4.6.43.b, ECB CROE 2.1.2.1-13.e, ECB CROE 2.4.2-6, ECB CROE 2.6.2-4, ECB CROE 2.6.2-7, ECB CROE 2.6.2-19, ECB CROE 2.6.2-31, ECB CROE 2.6.2-32, ECB CROE 2.6.2-42","CIS CSC 4 & 20, COBIT 5 BAI03.10 & DSS05.01, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.7, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 RA-5"]
[null,"Detection Processes (DE.DP): Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability.","DE.DP-1","DE.DP-1.1","DE.DP-1.1: The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.",null,null,null,null,"FFIEC CAT D2/ D3/ D5, FFIEC IT Booklet/Information Security/II.C.7, FFIEC IT Booklet/Operations, G7/4, NAIC HBRS/ExC APO.01","CIS CSC 19, COBIT 5 APO01.02 & DSS05.01 & DSS06.03, ISA 62443-2-1:2009 4.4.3.1, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2, NIST SP 800-53 Rev. 4 CA-2 & CA-7 & PM-14"]
[null,null,"DE.DP-2: Detection activities comply with all applicable requirements.","DE.DP-2","DE.DP-2.1","DE.DP-2.1: The organization's monitoring and detection processes comply with all applicable requirements.",null,null,null,null,"G7/4, NAIC HBRS/ExC MEA.03, SEC Regulation S-ID, NYDFS 500.17","COBIT 5 DSS06.01 & MEA03.03 & MEA03.04, ISA 62443-2-1:2009 4.4.3.2, ISO/IEC 27001:2013 A.18.1.4 & A.18.2.2 & A.18.2.3, NIST SP 800-53 Rev. 4 AC-25 & CA-2 & CA-7 & SA-18 & SI-4 & PM-14"]
[null,null,"DE.DP-3: Detection processes are tested.","DE.DP-3","DE.DP-3.1","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.",null,null,null,null,"CFTC-Cyber Exam/E, CPMI-IOSCO/Detection, CPMI-IOSCO/Testing, FFIEC CAT D3, FFIEC IT Booklet/Information Security/IV.A, FFIEC IT Booklet/Operations, FFIEC-APX E/Mobile, G7/4, FFIEC Booklet BCM/1-2.d, 2-5.e, 10-7.a NAIC HBRS/ExC DSS.05, SEC Regulation SCI, EBA GITSRM 3.4.6.42, ECB CROE 2.4.2-6, ECB CROE 2.6.2-1","COBIT 5 APO13.02 & DSS05.02, ISA 62443-2-1:2009 4.4.3.2, ISA 62443-3-3:2013 SR 3.3, ISO/IEC 27001:2013 A.14.2.8, NIST SP 800-53 Rev. 4 CA-2 & CA-7 & PE-3 & SI-3 & SI-4 & PM-14"]
[null,null,"DE.DP-4: Event detection information is communicated to appropriate parties.","DE.DP-4 - with sector enhancement","DE.DP-4.1","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.",null,null,null,null,"FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/II.D, FFIEC IT Booklet/Operations, G7/4, FFIEC Booklet BCM/8-3.a, 8-3.b, NAIC HBRS/ExC DSS.02, SEC Regulation SCI, SEC Regulation S-ID, SEC Regulation S-P, ECB CROE 2.4.2-15, ECB CROE 2.5.2.3-35, ECB CROE 2.7.2.1-7, ECB CROE 2.7.2.2-15, ECB CROE 2.7.2.2-21, ECB CROE 2.7.2.2-23","CIS CSC 19, COBIT 5 APO08.04 & APO12.06 & DSS02.05, ISA 62443-2-1:2009 4.3.4.5.9, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.16.1.2 & A.16.1.3, NIST SP 800-53 Rev. 4 AU-6 & CA-2 & CA-7 & RA-5 & SI-4"]
[null,null,null,null,"DE.DP-4.2","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Operations/Risk Mitigation and Control Implementation/Event-Problem Management, FFIEC Booklet BCM/10-9.a, 10-9.b, 10-16.a, 10-16.f, 10-23.c, 10-23.e, NAIC HBRS/ExC DSS.02, SEC Regulation SCI, EBA GITSRM 3.7.4.89.b, ECB CROE 2.3.2.2-75, ECB CROE 2.6.2-37","CIS CSC 19, COBIT 5 APO08.04 & APO12.06 & DSS02.05, ISA 62443-2-1:2009 4.3.4.5.9, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.16.1.2 & A.16.1.3, NIST SP 800-53 Rev. 4 AU-6 & CA-2 & CA-7 & RA-5 & SI-4"]
[null,null,"DE.DP-5: Detection processes are continuously improved.","DE.DP-5","DE.DP-5.1","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.",null,null,null,null,"CPMI-IOSCO/Detection, CPMI-IOSCO/Testing, FFIEC CAT D1/ D2/ D3/ D5, G7/4, G7/8, NAIC HBRS/ExC DSS.05, SEC Regulation SCI, SEC Regulation S-P, EBA GITSRM 3.4.5.40, ECB CROE 2.2.2-12, ECB CROE 2.4.2-21, ECB CROE 2.4.2-22, ECB CROE 2.5.2.1-15, ECB CROE 2.6.2-33, ECB CROE 2.7.2.1-5","COBIT 5 APO11.06 & APO12.06 & DSS04.05, ISA 62443-2-1:2009 4.4.3.4, ISO/IEC 27001:2013 A.16.1.6, NIST SP 800-53 Rev. 4 CA-2 & CA-7 & PL-2 & RA-5 & SI-4 & PM-14"]
["RESPOND (RS)","Response Planning (RS.RP): Response processes and procedures are executed and maintained, to ensure timely response to detected cybersecurity incidents.","RS.RP-1: Response plan is executed during or after an incident.","RS.RP-1","RS.RP-1.1","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, G7/5, FFIEC Booklet BCM/8-3.c, NAIC HBRS/ExC DSS.02, NAIC ML/4, NAIC ML/5, NFA/Response and Recovery, NYDFS/500.02, SEC Regulation S-ID, EBA GITSRM 3.5.1.59, EBA GITSRM 3.5.1.60, EBA GITSRM 3.5.1.60.e, EBA GITSRM 3.7.3.83, EBA GITSRM 3.7.3.84, ECB CROE 2.5.2.1-4, ECB CROE 2.5.2.1-13","CIS CSC 19, COBIT 5 APO12.06 & BAI01.10, ISA 62443-2-1:2009 4.3.4.5.1, ISO/IEC 27001:2013 A.16.1.5, NIST SP 800-53 Rev. 4 CP-2 & CP-10 & IR-4 & IR-8"]
[null,"Communications (RS.CO): Response activities are coordinated with internal and external stakeholders, as appropriate, to include external support from law enforcement agencies.","RS.CO-1: Personnel know their roles and order of operations when a response is needed.","RS.CO-1","RS.CO-1.1","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-4.a, 7-1.b, 7-1.c, NAIC HBRS/ExC APO.01, NYDFS/500.16, EBA GITSRM 3.5.1.60.b, ECB CROE 2.5.2.1-4, ECB CROE 2.5.2.1-20, ECB CROE 2.5.2.4-46, ECB CROE 2.5.2.4-47, ECB CROE 2.5.2.4-48","CIS CSC 19, COBIT 5 EDM03.02 & APO01.02 & APO12.03, ISA 62443-2-1:2009 4.3.4.5.2 & 4.3.4.5.3 & 4.3.4.5.4, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2 & A.16.1.1, NIST SP 800-53 Rev. 4 CP-2 & CP-3 & IR-3 & IR-8"]
[null,null,null,null,"RS.CO-1.2","RS.CO-1.2: The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.",null,null,null,null,"CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2/ D5, FFIEC IT Booklet/Information Security/III, FFIEC Booklet BCM/7-1.aNAIC HBRS/ExC APO.01, ECB CROE 2.5.2.1-20, ECB CROE 2.7.2.1-7","CIS CSC 19, COBIT 5 EDM03.02 & APO01.02 & APO12.03, ISA 62443-2-1:2009 4.3.4.5.2 & 4.3.4.5.3 & 4.3.4.5.4, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2 & A.16.1.1, NIST SP 800-53 Rev. 4 CP-2 & CP-3 & IR-3 & IR-8"]
[null,null,null,null,"RS.CO-1.3","RS.CO-1.3: The organization's personnel know their roles and responsibilities and order of operations when a response is needed.",null,null,null,null,"CPMI-IOSCO/Situational awareness, FFIEC CAT D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/10-8.a, NAIC HBRS/ExC APO.01, ECB CROE 2.5.2.1-4, ECB CROE 2.5.2.1-6, ECB CROE 2.5.2.1-20, ECB CROE 2.5.2.3-37","CIS CSC 19, COBIT 5 EDM03.02 & APO01.02 & APO12.03, ISA 62443-2-1:2009 4.3.4.5.2 & 4.3.4.5.3 & 4.3.4.5.4, ISO/IEC 27001:2013 A.6.1.1 & A.7.2.2 & A.16.1.1, NIST SP 800-53 Rev. 4 CP-2 & CP-3 & IR-3 & IR-8"]
[null,null,"RS.CO-2: Incidents are reported consistent with established criteria.","RS.CO-2","RS.CO-2.1","RS.CO-2.1: The organization's incident response plan describes how to appropriately document and report cyber events and related incident response activities.",null,null,null,null,"CFTC/D, CFTC-Cyber Exam/B, FFIEC CAT D1/ D3/ D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, FFIEC-APX E/Mobile Financial Services Work Program, NAIC HBRS/ExC DSS.02, NYDFS/500.16","CIS CSC 19, COBIT 5 DSS01.03, ISA 62443-2-1:2009 4.3.4.5.5, ISO/IEC 27001:2013 A.6.1.3 & A.16.1.2, NIST SP 800-53 Rev. 4 AU-6 & IR-6 & IR-8"]
[null,null,null,null,"RS.CO-2.2","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.",null,null,null,null,"CFTC-Cyber Exam/A, FFIEC CAT D1/ D2/ D5, FFIEC Booklet BCM/7-1.a, 7-1c, 8-6,  NAIC HBRS/ExC DSS.02, NAIC ML/6, NYDFS/500.11, NYDFS/500.17, SEC Regulation FD, SEC Regulation SCI, SEC Regulation S-ID, EBA GITSRM 3.5.1.60.f.ii, ECB CROE 2.5.2.3-39, ECB CROE 2.5.2.3-40, ECB CROE 2.5.2.3-40, ECB CROE 2.7.2.2-19","CIS CSC 19, COBIT 5 DSS01.03, ISA 62443-2-1:2009 4.3.4.5.5, ISO/IEC 27001:2013 A.6.1.3 & A.16.1.2, NIST SP 800-53 Rev. 4 AU-6 & IR-6 & IR-8"]
[null,null,null,null,"RS.CO-2.3","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.",null,null,null,null,"CFTC/G, CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D2/ D5, FFIEC IT Booklet/Information Security/III, G7/5, G7/7, FFIEC Booklet BCM/8-1.c, 8-3.a, NAIC HBRS/ExC DSS.02, NYDFS/500.16, SEC Regulation SCI, EBA GITSRM 3.5.1.60.d, EBA GITSRM 3.5.1.60.d.i, EBA GITSRM 3.5.1.60.d.ii, ECB CROE 2.5.2.1-4, ECB CROE 2.5.2.1-13, ECB CROE 2.5.2.3-39, ECB CROE 2.5.2.3-42, ECB CROE 2.5.2.3-43, ECB CROE 2.5.2.3-44, ECB CROE 2.7.2.2-16","CIS CSC 19, COBIT 5 DSS01.03, ISA 62443-2-1:2009 4.3.4.5.5, ISO/IEC 27001:2013 A.6.1.3 & A.16.1.2, NIST SP 800-53 Rev. 4 AU-6 & IR-6 & IR-8"]
[null,null,null,null,"RS.CO-2.4","RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.",null,null,null,null,"CFTC-Cyber Exam/A, CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D5, FFIEC IT Booklet/Information Security/III, FFIEC-APX E/Mobile Financial Services Work Program, G7/7, FFIEC Booklet BCM/7-1.d, NAIC HBRS/ExC DSS.02, NYDFS/500.11, NYDFS/500.16, NYDFS/500.17, ECB CROE 2.5.2.3-42, ECB CROE 2.5.2.3-43","CIS CSC 19, COBIT 5 DSS01.03, ISA 62443-2-1:2009 4.3.4.5.5, ISO/IEC 27001:2013 A.6.1.3 & A.16.1.2, NIST SP 800-53 Rev. 4 AU-6 & IR-6 & IR-8"]
[null,null,"RS.CO-3: Information is shared consistent with response plans.","RS.CO-3","RS.CO-3.1","RS.CO-3.1: Information is shared consistent with response plans.  ",null,null,null,null,"CFTC/D, CFTC/G, CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D2/ D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/2-1.c, 12-1.c, FINRA/Incident Response Planning, G7/5, G7/6, G7/7, NAIC HBRS/ExC DSS.02, NAIC ML/6, NYDFS/500.02, NYDFS/500.11, NYDFS/500.16","CIS CSC 19, COBIT 5 DSS03.04, ISA 62443-2-1:2009 4.3.4.5.2, ISO/IEC 27001:2013 A.16.1.2 & Clause 7.4 & Clause 16.1.2, NIST SP 800-53 Rev. 4 CA-2 & CA-7 & CP-2 & IR-4 & IR-8 & PE-6 & RA-5 & SI-4"]
[null,null,null,null,"RS.CO-3.2","RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.",null,null,null,null,"CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2/ D5, FFIEC Booklet BCM/7-1.d, NAIC HBRS/ExC DSS.02, SEC Regulation S-ID, EBA GITSRM 3.5.1.60.f.i, ECB CROE 2.5.2.1-13, ECB CROE 2.5.2.1-19, ECB CROE 2.7.2.2-15, ECB CROE 2.7.2.2-18","CIS CSC 19, COBIT 5 DSS03.04, ISA 62443-2-1:2009 4.3.4.5.2, ISO/IEC 27001:2013 A.16.1.2 & Clause 7.4 & Clause 16.1.2, NIST SP 800-53 Rev. 4 CA-2 & CA-7 & CP-2 & IR-4 & IR-8 & PE-6 & RA-5 & SI-4"]
[null,null,"RS.CO-4: Coordination with stakeholders occurs consistent with response plans.","RS.CO-4","RS.CO-4.1","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.",null,null,null,null,"CFTC/D, CFTC/G, CPMI-IOSCO/Response & Recovery, CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2/ D5, FFIEC-APX E/Mobile Financial Services Work Program, G7/5, G7/6, G7/7, FFIEC Booklet BCM/2-1.b, 7-1.b, 8-3.b, NAIC HBRS/ExC DSS.02, NAIC ML/6, NAIC ML/7, NYDFS/500.02, EBA GITSRM 3.5.1.60.f, EBA GITSRM 93, ECB CROE 2.5.2.1-4, ECB CROE 2.5.2.1-7, ECB CROE 2.5.2.1-13, ECB CROE 2.5.2.3-38","CIS CSC 19, COBIT 5 DSS03.04, ISA 62443-2-1:2009 4.3.4.5.5, ISO/IEC 27001:2013 Clause 7.4, NIST SP 800-53 Rev. 4 CP-2 & IR-3 & IR-8"]
[null,null,"RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness.","RS.CO-5","RS.CO-5.1","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.",null,null,null,null,"FFIEC CAT D1/ D2/ D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, FINRA/Cyber Intelligence and Information Sharing, FFIEC Booklet BCM/7-1.e, NAIC HBRS/ExC DSS.02, NFA/Response and Recovery, ECB CROE 2.1.2.1-16, ECB CROE 2.1.2.2-46, ECB CROE 2.5.2.1-19, ECB CROE 2.6.2-38, ECB CROE 2.6.2-40, ECB CROE 2.7.2.2-20, ECB CROE 2.7.2.2-24","CIS CSC 19, COBIT 5 BAI08.04, ISO/IEC 27001:2013 A.6.1.4, NIST SP 800-53 Rev. 4 SI-5 & PM-15"]
[null,null,null,null,"RS.CO-5.2","RS.CO-5.2: The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.",null,null,null,null,"CPMI-IOSCO/Situational awareness, FFIEC CAT D1/ D2/ D5, G7/7, FFIEC Booklet BCM/7-1.e, NAIC HBRS/ExC DSS.02, ECB CROE 2.5.2.1-16, ECB CROE 2.7.2.2-18, ECB CROE 2.7.2.2-22","CIS CSC 19, COBIT 5 BAI08.04, ISO/IEC 27001:2013 A.6.1.4, NIST SP 800-53 Rev. 4 SI-5 & PM-15"]
[null,null,null,null,"RS.CO-5.3","RS.CO-5.3: The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them.",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D5, NAIC HBRS/ExC DSS.02, SEC Regulation FD, SEC Regulation SDR, ECB CROE 2.5.2.1-13","CIS CSC 19, COBIT 5 BAI08.04, ISO/IEC 27001:2013 A.6.1.4, NIST SP 800-53 Rev. 4 SI-5 & PM-15"]
[null,"Analysis (RS.AN): Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-1: Notifications from detection systems are investigated.","RS.AN-1","RS.AN-1.1","RS.AN-1.1: Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.",null,null,null,null,"FFIEC CAT D2/ D3/ D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, NAIC HBRS/ExC DSS.02, SEC Regulation S-ID, EBA GITSRM 3.5.1.60, ECB CROE 2.4.2-5, ECB CROE 2.5.2.1-13","CIS CSC 4 & 6 & 8 & 19, COBIT 5 DSS02.04 & DSS02.07, ISA 62443-2-1:2009 4.3.4.5.6 & 4.3.4.5.7 & 4.3.4.5.8, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.12.4.1 & A.12.4.3 & A.16.1.5, NIST SP 800-53 Rev. 4 AU-6 & CA-7 & IR-4 & IR-5 & PE-6 & SI-4"]
[null,null,"RS.AN-2: The impact of the incident is understood.","RS.AN-2","RS.AN-2.1","RS.AN-2.1: The organization uses cyber-attack scenarios to determine potential impact to critical business processes.",null,null,null,null,"FFIEC CAT D3/ D5, G7/5, FFIEC Booklet BCM/4-4.a, 5-4, NAIC HBRS/ExC DSS.02, NAIC ML/5, ECB CROE 2.5.2.1-2","COBIT 5 DSS02.02, ISA 62443-2-1:2009 4.3.4.5.6 & 4.3.4.5.7 & 4.3.4.5.8, ISO/IEC 27001:2013 A.16.1.4 & A.16.1.6, NIST SP 800-53 Rev. 4 CP-2 & IR-4"]
[null,null,null,null,"RS.AN-2.2","RS.AN-2.2: The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/III, NAIC HBRS/ExC DSS.02, NAIC ML/5, SEC Regulation SCI, SEC Regulation S-ID, EBA GITSRM 3.5.1.60.c, ECB CROE 2.5.2.1-13","COBIT 5 DSS02.02, ISA 62443-2-1:2009 4.3.4.5.6 & 4.3.4.5.7 & 4.3.4.5.8, ISO/IEC 27001:2013 A.16.1.4 & A.16.1.6, NIST SP 800-53 Rev. 4 CP-2 & IR-4"]
[null,null,"RS.AN-3: Forensics are performed.","RS.AN-3","RS.AN-3.1","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D2/ D3/ D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, G7/5, G7/6, NAIC HBRS/ExC DSS.02, EBA GITSRM 3.5.1.60.c, ECB CROE 2.4.2-11, ECB CROE 2.5.2.1-10, ECB CROE 2.5.2.4-45, ECB CROE 2.5.2.4-46, ECB CROE 2.5.2.4-47, ECB CROE 2.5.2.4-48, ECB CROE 2.5.2.4-49, ECB CROE 2.5.2.4-50, ECB CROE 2.5.2.4-51, ECB CROE 2.5.2.4-52, ECB CROE 2.5.2.4-53, ECB CROE 2.5.2.4-54","COBIT 5 APO12.06 & DSS03.02 & DSS05.07, ISA 62443-3-3:2013 SR 2.8 & SR 2.9 & SR 2.10 & SR 2.11 & SR 2.12 & SR 3.9 & SR 6.1, ISO/IEC 27001:2013 A.16.1.7, NIST SP 800-53 Rev. 4 AU-7 & IR-4"]
[null,null,"RS.AN-4: Incidents are categorized consistent with response plans.","RS.AN-4","RS.AN-4.1","RS.AN-4.1: The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise.",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, G7/5, NAIC HBRS/ExC DSS.02, EBA GITSRM 3.5.1.60.a, ECB CROE 2.5.2.1-4, ECB CROE 2.5.2.1-11","CIS CSC 19, COBIT 5 DSS02.02, ISA 62443-2-1:2009 4.3.4.5.6, ISO/IEC 27001:2013 A.16.1.4, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & IR-5 & IR-8"]
[null,null,"RS.AN-5: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g., internal testing, security bulletins, or security researchers).","RS.AN-5","RS.AN-5.1","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).",null,null,null,null,"CFTC-Cyber Exam/A, CPMI-IOSCO/Detection, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, FFIEC-APX E/Risk Mitigation, FFIEC Booklet BCM/1-4.b, FFIEC Booklet BCM/1-4.c,  FTC/9, G7/5, G7/6, G7/7, NAIC HBRS/ExC DSS.05, ECB CROE 2.5.2.3-41, ECB CROE 2.7.2.1-3, ECB CROE 2.7.2.1-14, ECB CROE 2.8.2.1-1","CIS CSC 4 & 19, COBIT 5 EDM03.02 & DSS05.07, NIST SP 800-53 Rev. 4 SI-5 & PM-15"]
[null,null,null,null,"RS.AN-5.2","RS.AN-5.2: The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond.",null,null,null,null,"CBRC/10, FFIEC CAT D1/ D5, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, NAIC HBRS/ExC DSS.05, ECB CROE 2.5.2.3-41, ECB CROE 2.7.2.1-3, ECB CROE 2.7.2.1-4.a, ECB CROE 2.7.2.1-4.b, ECB CROE 2.7.2.1-9","CIS CSC 4 & 19, COBIT 5 EDM03.02 & DSS05.07, NIST SP 800-53 Rev. 4 SI-5 & PM-15"]
[null,null,null,null,"RS.AN-5.3","RS.AN-5.3: The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.",null,null,null,null,"FFIEC CAT D3/ D5, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, G7/7, NAIC HBRS/ExC DSS.05, SEC Regulation SCI, ECB CROE 2.6.2-10, ECB CROE 2.6.2-14","CIS CSC 4 & 19, COBIT 5 EDM03.02 & DSS05.07, NIST SP 800-53 Rev. 4 SI-5 & PM-15"]
[null,"Mitigation (RS.MI): Activities are performed to prevent expansion of an event, mitigate its effects, and resolve the incident.","RS.MI-1: Incidents are contained.","RS.MI-1","RS.MI-1.1","RS.MI-1.1: The organization contains cybersecurity incidents in a timely manner.  ",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D5, FFIEC IT Booklet/Information Security/III, G7/5, NAIC HBRS/ExC DSS.02, ECB CROE 2.5.2.1-13","CIS CSC 19, COBIT 5 APO12.06, ISA 62443-2-1:2009 4.3.4.5.6, ISA 62443-3-3:2013 SR 5.1 & SR 5.2 & SR 5.4, ISO/IEC 27001:2013 A.12.2.1 & A.16.1.5, NIST SP 800-53 Rev. 4 IR-4"]
[null,null,null,null,"RS.MI-1.2","RS.MI-1.2: The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Information Security/III, NAIC HBRS/ExC DSS.02, ECB CROE 2.3.2.2-72","CIS CSC 19, COBIT 5 APO12.06, ISA 62443-2-1:2009 4.3.4.5.6, ISA 62443-3-3:2013 SR 5.1 & SR 5.2 & SR 5.4, ISO/IEC 27001:2013 A.12.2.1 & A.16.1.5, NIST SP 800-53 Rev. 4 IR-4"]
[null,null,"RS.MI-2: Incidents are mitigated.","RS.MI-2","RS.MI-2.1","RS.MI-2.1: The organization mitigates cybersecurity incidents in a timely manner.  ",null,null,null,null,"FFIEC CAT D5, G7/5, G7/6, NAIC HBRS/ExC DSS.02, ECB CROE 2.5.2.1-13","CIS CSC 4 & 19, COBIT 5 APO12.06, ISA 62443-2-1:2009 4.3.4.5.6 & 4.3.4.5.10, ISO/IEC 27001:2013 A.12.2.1 & A.16.1.5, NIST SP 800-53 Rev. 4 IR-4"]
[null,null,"RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks.","RS.MI-3","RS.MI-3.1","RS.MI-3.1: The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls.",null,null,null,null,"CFTC/H, FFIEC CAT D5, FFIEC IT Booklet/Information Security/II.A, FFIEC IT Booklet/Operations, G7/6, NAIC HBRS/ExC MEA.02, NYDFS/500.16, NYDFS/500.16","CIS CSC 4, COBIT 5 APO12.06, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 CA-7 & RA-3 & RA-5"]
[null,null,null,null,"RS.MI-3.2","RS.MI-3.2: Vulnerabilities identified as a result of a cybersecurity incident are mitigated or documented by the organization as accepted risks and monitored.",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, FTC/7, G7/5, NAIC HBRS/ExC MEA.02","CIS CSC 4, COBIT 5 APO12.06, ISO/IEC 27001:2013 A.12.6.1, NIST SP 800-53 Rev. 4 CA-7 & RA-3 & RA-5"]
[null,"Improvements (RS.IM): Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.","RS.IM-1: Response plans incorporate lessons learned.","RS.IM-1","RS.IM-1.1","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.",null,null,null,null,"FFIEC CAT D1/ D5, FFIEC IT Booklet/Information Security/III, FFIEC IT Booklet/Operations, G7/5, G7/8, FFIEC Booklet BCM/10-8.d, 11-1.g, NAIC HBRS/ExC DSS.02, NYDFS/500.16, Regulation S-ID, SEC Regulation SCI, EBA GITSRM 3.5.1.60.c, ECB CROE 2.5.2.1-10, ECB CROE 2.5.2.1-15, ECB CROE 2.5.2.1-18, ECB CROE 2.7.2.1-5, ECB CROE 2.8.2.1-3","COBIT 5 BAI01.13, ISA 62443-2-1:2009 4.3.4.5.10 & 4.4.3.4, ISO/IEC 27001:2013 A.16.1.6 & Clause 10, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & IR-8"]
[null,null,null,null,"RS.IM-1.2","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.",null,null,null,null,"CPMI-IOSCO/Learning and evolving, CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D3/ D5, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, FFIEC Booklet BCM/1-1.d, 2-3.d, 2-5.g, 10-18.f, 10-30, 11-2.a, 11-2.b, NAIC HBRS/ExC DSS.02, EBA GITSRM 3.4.6.46, ECB CROE 2.1.2.1-13.e, ECB CROE 2.6.2-5","COBIT 5 BAI01.13, ISA 62443-2-1:2009 4.3.4.5.10 & 4.4.3.4, ISO/IEC 27001:2013 A.16.1.6 & Clause 10, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & IR-8"]
[null,null,null,null,"RS.IM-1.3","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.",null,null,null,null,"CPMI-IOSCO/Learning and evolving, CPMI-IOSCO/Response & Recovery, FFIEC CAT D5, FFIEC IT Booklet/Information Security/IV, FFIEC IT Booklet/Operations, G7/5, FFIEC Booklet BCM/10-8.d, 11-1.g, 11-2.a, 11-2.c, 11-2.d, NAIC HBRS/ExC DSS.02, ECB CROE 2.5.2.1-10, ECB CROE 2.5.2.1-15, ECB CROE 2.5.2.4-53, ECB CROE 2.6.2-2, ECB CROE 2.8.2.1-3","COBIT 5 BAI01.13, ISA 62443-2-1:2009 4.3.4.5.10 & 4.4.3.4, ISO/IEC 27001:2013 A.16.1.6 & Clause 10, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & IR-8"]
[null,null,"RS.IM-2: Response strategies are updated.","RS.IM-2","RS.IM-2.1","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.",null,null,null,null,"CPMI-IOSCO/Learning and evolving, CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D2/ D3/ D5, FFIEC IT Booklet/Information Security/III, G7/5, G7/8, FFIEC Booklet BCM/11-1.k, NAIC HBRS/ExC DSS.02, NYDFS/500.16, SEC Regulation SCI, ECB CROE 2.1.2.1-13.d, ECB CROE 2.1.2.1-13.g, ECB CROE 2.5.2.1-9, ECB CROE 2.5.2.1-17, ECB CROE 2.5.2.1-18, ECB CROE 2.7.2.1-5, ECB CROE 2.8.2.1-3","COBIT 5 BAI01.13 & DSS04.08, ISO/IEC 27001:2013 A.16.1.6 & Clause 10, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & IR-8"]
["RECOVER (RC)","Recovery Planning (RC.RP): Recovery processes and procedures are executed and maintained to ensure timely restoration of systems or assets affected by cybersecurity incidents.","RC.RP-1: Recovery plan is executed during or after a cybersecurity incident.","RC.RP-1","RC.RP-1.1","RC.RP-1.1: The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Operations, G7/6, FFIEC Booklet BCM/8-1.k, 8-4.a, NAIC HBRS/ExC DSS.02, NYDFS/500.02, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.7.3.83, ECB CROE 2.5.2.1-1, ECB CROE 2.5.2.1-13","CIS CSC 10, COBIT 5 APO12.06 & DSS02.05 & DSS03.04, ISO/IEC 27001:2013 A.16.1.5, NIST SP 800-53 Rev. 4 CP-10 & IR-4 & IR-8"]
[null,null,null,null,"RC.RP-1.2","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/ Risk Management, FFIEC Booklet BCM/8-1.d, NAIC HBRS/ExC DSS.02, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 37.2.81, EBA GITSRM 3.7.3.84.a, ECB CROE 2.5.2.1-1, ECB CROE 2.5.2.1-11, ECB CROE 2.5.2.3-34","CIS CSC 10, COBIT 5 APO12.06 & DSS02.05 & DSS03.04, ISO/IEC 27001:2013 A.16.1.5, NIST SP 800-53 Rev. 4 CP-10 & IR-4 & IR-8"]
[null,null,null,null,"RC.RP-1.3","RC.RP-1.3: The recovery plan includes a minimum recovery time for the sector critical systems.",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/Business Continuity Planning/Business Impact Analysis, FFIEC Booklet BCM/4-5.b, NAIC HBRS/ExC DSS.02, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.7.3.83, ECB CROE 2.5.2.1-1, ECB CROE 2.5.2.1-11","CIS CSC 10, COBIT 5 APO12.06 & DSS02.05 & DSS03.04, ISO/IEC 27001:2013 A.16.1.5, NIST SP 800-53 Rev. 4 CP-10 & IR-4 & IR-8"]
[null,null,null,null,"RC.RP-1.4","RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date.",null,null,null,null,"FFIEC IT Booklet/Business Continuity Planning/Business Impact Analysis, FFIEC Booklet BCM/8-8.a, 8-11.b, 10-25.e, 10-25.f, NAIC HBRS/ExC DSS.02, SEC Regulation SCI, SEC Regulation SDR, NYDFS 500.06, EBA GITSRM 3.7.3.83, ECB CROE 2.5.2.1-12","CIS CSC 10, COBIT 5 APO12.06 & DSS02.05 & DSS03.04, ISO/IEC 27001:2013 A.16.1.5, NIST SP 800-53 Rev. 4 CP-10 & IR-4 & IR-8"]
[null,null,null,null,"RC.RP-1.5","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.",null,null,null,null,"FFIEC IT Booklet/Business Continuity Planning/Business Impact Analysis, FFIEC Booklet BCM/8-1.g, 8-1.i, 8-5.a, 8-5.b, 8-11.c, NAIC HBRS/ExC DSS.02, EBA GITSRM 37.2.82, ECB CROE 2.5.2.1-3","CIS CSC 10, COBIT 5 APO12.06 & DSS02.05 & DSS03.04, ISO/IEC 27001:2013 A.16.1.5, NIST SP 800-53 Rev. 4 CP-10 & IR-4 & IR-8"]
[null,null,null,null,"RC.RP-1.6","RC.RP-1.6: The recovery plan includes plans to come back for both traditional and highly available (e.g., cloud) infrastructure.",null,null,null,null,"FFIEC IT Booklet/Business Continuity Planning/Business Impact Analysis, NAIC HBRS/ExC DSS.02, EBA GITSRM 37.2.82, ECB CROE 2.5.2.2-26, ECB CROE 2.5.2.2-31","CIS CSC 10, COBIT 5 APO12.06 & DSS02.05 & DSS03.04, ISO/IEC 27001:2013 A.16.1.5, NIST SP 800-53 Rev. 4 CP-10 & IR-4 & IR-8"]
[null,"Improvements (RC.IM): Recovery planning and processes are improved by incorporating lessons learned into future activities.","RC.IM-1: Recovery plans incorporate lessons learned.","RC.IM-1","RC.IM-1.1","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.",null,null,null,null,"CPMI-IOSCO/Learning and evolving, FFIEC CAT D1/ D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing, G7/8, FFIEC Booklet BCM/2-2.e, 2-3.d, 2-5.g, 10-7.i, 11-1.e, 11-1.i, NAIC HBRS/ExC DSS.04, SEC Regulation SDR, EBA GITSRM 3.7.3.84.c, EBA GITSRM 3.7.4.88, ECB CROE 2.1.2.1-13, ECB CROE 2.1.2.1-13.c, ECB CROE 2.1.2.1-13.d, ECB CROE 2.5.2.1-9, ECB CROE 2.6.2-5, ECB CROE 2.8.2.1-3","COBIT 5 APO12.06 & BAI05.07 & DSS04.08, ISA 62443-2-1:2009 4.4.3.4, ISO/IEC 27001:2013 A.16.1.6 & Clause 10, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & IR-8"]
[null,null,"RC.IM-2: Recovery strategies are updated.","RC.IM-2","RC.IM-2.1","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.",null,null,null,null,"CPMI-IOSCO/Learning and evolving, CPMI-IOSCO/Response & Recovery, FFIEC CAT D1/ D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing, G7/8, FFIEC Booklet BCM/1-3.g, 2-1.a, 2-5.g, 2-5.i, 6-3.c, 8-1.b, 9-1.c, 11-1.a, 11-1.b, 11-1.c, 11-1.d, 11-1.e, 11-1.i , 11-1.j, NAIC HBRS/ExC DSS.04, SEC Regulation SCI, EBA GITSRM 37.2.80, EBA GITSRM 3.7.4.90, ECB CROE 2.1.2.1-13.d, ECB CROE 2.1.2.1-13.g, ECB CROE 2.5.2.1-17, ECB CROE 2.5.2.1-18, ECB CROE 2.7.2.1-5, ECB CROE 2.8.2.1-3","COBIT 5 APO12.06 & BAI07.08, ISO/IEC 27001:2013 A.16.1.6 & Clause 10, NIST SP 800-53 Rev. 4 CP-2 & IR-4 & IR-8"]
[null,"Communications (RC.CO): Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.","RC.CO-1: Public relations are managed.","RC.CO-1","RC.CO-1.1","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.",null,null,null,null,"FFIEC CAT D2/ D5, FFIEC IT Booklet/Business Continuity Planning, FFIEC Booklet BCM/2-1.b, 2-5.k, 8-13.d, NAIC HBRS/ExC DSS.04, SEC Regulation SCI, EBA GITSRM 3.7.5.91","COBIT 5 EDM03.02, ISO/IEC 27001:2013 A.6.1.4 & Clause 7.4"]
[null,null,null,null,"RC.CO-1.2","RC.CO-1.2: The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.",null,null,null,null,"CPMI-IOSCO/Response & Recovery, FFIEC CAT D2/ D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing/Principles of the Business Continuity Testing Program, G7/6, G7/7, FFIEC Booklet BCM/8-13.a, NAIC HBRS/ExC DSS.04, SEC Regulation FD, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.7.5.91","COBIT 5 EDM03.02, ISO/IEC 27001:2013 A.6.1.4 & Clause 7.4"]
[null,null,"RC.CO-2: Reputation after an event is repaired.","RC.CO-2 - with sector enhancement","RC.CO-2.1","RC.CO-2.1: Actionable and effective mitigation techniques are taken and communicated appropriately to restore and improve the organization's reputation after an incident.",null,null,null,null,"FFIEC CAT D5, G7/6, G7/7, NAIC HBRS/ExC DSS.04","COBIT 5 MEA03.02, ISO/IEC 27001:2013 Clause 7.4"]
[null,null,"RC.CO-3: Recovery activities are communicated to internal and external stakeholders as well as and executive and management teams.","RC.CO-3","RC.CO-3.1","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.",null,null,null,null,"CFTC/D, CFTC/G, CPMI-IOSCO/Response & Recovery, FFIEC CAT D2/ D5, FFIEC IT Booklet/Business Continuity Planning/Risk Monitoring and Testing/Principles of the Business Continuity Testing Program, G7/6, G7/7, FFIEC Booklet BCM/2-1.b, 2-5.j, 8-12.a, 8-12.b, 8-12.c, 8-12.d, 8-12.e, 8-12.f, 8-12.g, NAIC HBRS/ExC DSS.04, NYDFS/500.02, SEC Regulation SDR, EBA GITSRM 3.7.3.84.b, EBA GITSRM 3.7.5.91","COBIT 5 APO12.06, ISO/IEC 27001:2013 Clause 7.4, NIST SP 800-53 Rev. 4 CP-2 & IR-4"]
["SUPPLY CHAIN/DEPENDENCY MANAGEMENT (DM)","Internal Dependencies (DM.ID): The organization manages risks associated with its internal dependencies.","DM.ID-1: The organization integrates internal dependency management strategy into the overall strategic risk management plan.","None","DM.ID-1.1","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.",null,null,null,null,"FFIEC IT Booklet/ Operations/ Operations Management, FFIEC IT Booklet/Management/III.A, FFIEC Booklet BCM/1-3.f, 4-2.a, 4-2.e, 6-4.b, 6-4.c, 6-4.d, 6-4.e, NAIC HBRS/ExC APO.12, Risk Assessment, Risk Identification, EBA GITSRM 3.2.2.5.b, EBA GITSRM 3.2.3.7, EBA GITSRM 3.3.2.15","COBIT 5 APO03.02 (General dependencies not specifically internal dependencies)"]
[null,null,null,null,"DM.ID-1.2","DM.ID-1.2: The organization monitors the effectiveness of its internal dependency management strategy.",null,null,null,null,"NAIC HBRS/ExC APO.12, SEC Regulation SCI","COBIT 5 APO03.02 (General dependencies not specifically internal dependencies)"]
[null,null,null,null,"DM.ID-1.3","DM.ID-1.3: The organization ensures appropriate oversight of and compliance with the internal dependency management strategy implementation.",null,null,null,null,"FFIEC IT Booklet/ Operations / Boards of Directors and Senior Management, NAIC HBRS/ExC APO.12","COBIT 5 APO03.02 (General dependencies not specifically internal dependencies)"]
[null,null,null,null,"DM.ID-1.4","DM.ID-1.4: The organization has established and applies appropriate controls to address the inherent risk of internal dependencies.",null,null,null,null,"FFIEC CAT D3, FFIEC IT Booklet/ Operations/Risk Mitigation and Control Implementation, NAIC HBRS/ExC APO.12","COBIT 5 APO03.02 (General dependencies not specifically internal dependencies)"]
[null,null,"DM.ID-2: Roles and responsibilities for internal dependency management are defined and assigned.","None","DM.ID-2.1","DM.ID-2.1: Roles and responsibilities for internal dependency management are defined and assigned.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/I.A, FFIEC Booklet BCM/8-1.a NAIC HBRS/ExC APO.01, EBA GITSRM 3.3.2.15","ISO 27001:2013 A.6.1.1 Clause 5.3 (General roles and responsibilities not specifically internal dependencies)"]
[null,"External Dependencies (DM.ED): The organization manages risks associated with its external dependencies.","DM.ED-1: The organization integrates external dependency management strategy into the overall strategic risk management plan.","None","DM.ED-1.1","DM.ED-1.1: The organization has integrated its external dependency management strategy into the overall cyber risk management plan.",null,null,null,null,"FFIEC CAT D1, FFIEC IT Booklet/Management/III.A-C, NAIC HBRS/ExC APO.12, EBA GITSRM 3.2.3.7, ECB CROE 2.3.2.2-68","COBIT 5 APO10.04, ISO 27001:2013 A.6.1.1 & Clause 5.3, NIST SP 800-53 Rev. 4 SA-9 & SA-12"]
[null,null,null,null,"DM.ED-1.2","DM.ED-1.2: The organization monitors the effectiveness of its external dependency management strategy to reduce cyber risks associated with external dependencies.",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC IT Booklet/Management/III.A-C, NAIC HBRS/ExC APO.12, SEC Regulation SCI","COBIT 5 APO10.02, ISO 27001:2013 A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 SA-9 & SA-12"]
[null,null,null,null,"DM.ED-1.3","DM.ED-1.3: The organization ensures appropriate oversight and compliance with the external dependency strategy implementation.",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC IT Booklet/Management/III.A-C, FFIEC Booklet BCM/8-2.b, NAIC HBRS/ExC APO.12, NYDFS 500.11","COBIT 5 APO10.02, ISO 27001:2013 A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 SA-9 & SA-12"]
[null,null,"DM.ED-2: Dependency management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders.","ID.SC-1 - with sector enhancement","DM.ED-2.1","DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.",null,null,null,null,"FFIEC CAT D1/ D3, FFIEC Booklet BCM/6-5.c, 8-2.a, NAIC HBRS/ExC APO.10, NAIC ML/4, NYDFS/500.02, NYDFS 500.04, SEC Regulation SCI, SEC Regulation SDR, ECB CROE 2.5.2.3-34, ECB CROE 2.6.2-36","CIS CSC 4, COBIT 5 APO10.01 & APO10.04 & APO12.04 & APO12.05 & APO13.02 & BAI01.03 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 SA-9 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-2.2","DM.ED-2.2: The organization's dependency management policies, plans, and procedures are regularly updated.",null,null,null,null,"FFIEC CAT D1/ D4, NAIC HBRS/ExC APO.10, NYDFS/500.02, SEC Regulation SCI","CIS CSC 4, COBIT 5 APO10.01 & APO10.04 & APO12.04 & APO12.05 & APO13.02 & BAI01.03 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 SA-9 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-2.3","DM.ED-2.3: The organization's dependency management policies, plans, and procedures have been reviewed and approved by appropriate organizational stakeholders.",null,null,null,null,"FFIEC CAT D1/ D4, NAIC HBRS/ExC APO.10, NYDFS/500.02","CIS CSC 4, COBIT 5 APO10.01 & APO10.04 & APO12.04 & APO12.05 & APO13.02 & BAI01.03 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 SA-9 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-2.4","DM.ED-2.4: Dependency management processes may allow the organization to the adopt  security program(s) of its \"affiliate(s)\" as long as such program provides an appropriate level of control and assurance.",null,null,null,null,"FFIEC CAT D1, NAIC HBRS/ExC APO.10, NYDFS/500.02","CIS CSC 4, COBIT 5 APO10.01 & APO10.04 & APO12.04 & APO12.05 & APO13.02 & BAI01.03 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 SA-9 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-2.5","DM.ED-2.5: The organization's dependency management process identifies third-party relationships that are in place, including those relationships that were established without formal approval.",null,null,null,null,"FFIEC CAT D4, FFIEC Booklet BCM/5-3, NAIC HBRS/ExC APO.10, NYDFS/500.02, ECB CROE 2.3.2.2-68","CIS CSC 4, COBIT 5 APO10.01 & APO10.04 & APO12.04 & APO12.05 & APO13.02 & BAI01.03 & BAI02.03 & BAI04.02, ISA 62443-2-1:2009 4.3.4.2, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 SA-9 & SA-12 & PM-9"]
[null,null,"DM.ED-3: Roles and responsibilities for external dependency management are defined and assigned.","None","DM.ED-3.1","DM.ED-3.1: Roles and responsibilities for external dependency management are defined and assigned.",null,null,null,null,"FFIEC CAT D1, FFIEC Booklet BCM/8-1.a, NAIC HBRS/ExC APO.01","COBIT 5 APO10.02"]
[null,null,null,null,"DM.ED-3.2","DM.ED-3.2: Responsibilities for ongoing independent oversight (external) of third-party access are defined and assigned.",null,null,null,null,"FFIEC CAT D1/ D4, NAIC HBRS/ExC APO.01, ECB CROE 2.3.2.2-73","COBIT 5 APO10.02"]
[null,null,"DM.ED-4: The organization manages cyber risks associated with external dependencies.","None","DM.ED-4.1","DM.ED-4.1: The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees).",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC IT Booklet/Information Security/II.C.20, NAIC HBRS/ExC APO.12, NYDFS/500.03, ECB CROE 2.3.2.2-69","ISO 27001:2013 A.15.1.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"DM.ED-4.2","DM.ED-4.2: The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate.",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC Booklet BCM/8-2.a, NAIC HBRS/ExC APO.12, NYDFS 500.03/500.04, EBA GITSRM 3.2.3.8, ECB CROE 2.3.2.2-69","COBIT 5 BAI09.02, ISO 27001:2013 A.15.1.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"DM.ED-4.3","DM.ED-4.3: The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC IT Booklet/Information Security/II.C.29, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC Booklet BCM/6-5.c,  NAIC HBRS/ExC APO.12, NYDFS 500.15, ECB CROE 2.3.2.2-69, ECB CROE 2.6.2-37","COBIT 5 APO10.04, ISO 27001:2013 A.15.1.3 & A.15.2.1, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,null,null,"DM.ED-4.4","DM.ED-4.4: The organization has a documented third-party termination/exit strategy to include procedures for timely removal of the third-party access when no longer required.",null,null,null,null,"FFIEC CAT D1/ D4, FFIEC IT Booklet/ Business Continuity Planning / Coordination with Outside Parties, NAIC HBRS/ExC APO.12, NFA/Third-Party Service Providers","ISO 27001:2013 A.15.1.3, NIST SP 800-53 Rev 4 PS-4 (General Requirement no details regarding 3rd party)"]
[null,null,null,null,"DM.ED-4.5","DM.ED-4.5: The organization establishes contingencies to address circumstances that might put a vendor out of business or severely impact delivery of services to the organization, sector-critical systems, or the financial sector as a whole.",null,null,null,null,"FFIEC CAT D1/ D4/ D5, FFIEC IT Booklet/Information Security/II.C, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC Booklet BCM/8-4.a, NAIC HBRS/ExC APO.12","ISO 27001:2013 A.15.1.3, NIST SP 800-53 Rev. 4 PM-9"]
[null,null,"DM.ED-5:  Functions, activities, products, and services - including interconnections, dependencies, and third parties - are identified and prioritized based on their criticality to the organization.","ID.SC-2; ID.BE-1; ID.BE-2 - with sector enhancement","DM.ED-5.1","DM.ED-5.1: The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.",null,null,null,null,"CPMI-IOSCO/Identification, FFIEC CAT D1/ D3/ D4, FFIEC IT Booklet/Information Security/II.C, FFIEC Booklet BCM/5-3, NAIC HBRS/ExC APO.10, ECB CROE 2.2.2-10, ECB CROE 2.5.2.3-33, ECB CROE 2.6.2-41","COBIT 5 APO02.06 & APO03.01 & APO10.01 & APO10.02 & APO10.04 & APO10.05 & APO12.01 & APO12.02 & APO12.03 & APO12.04 & APO12.05 & APO12.06 & APO13.02 & BAI02.03, COBIT 5 APO08.01 & APO08.04 & APO08.05 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.2 & 4.2.3.3 & 4.2.3.4 & 4.2.3.6 & 4.2.3.8 & 4.2.3.9 & 4.2.3.10 & 4.2.3.12 & 4.2.3.13 & 4.2.3.14, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2 & Clause 4.1, NIST SP 800-53 Rev. 4 CP-2 & SA-12 & PM-8, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & SA-12 & SA-14 & SA-15 & PM-9"]
[null,null,null,null,"DM.ED-5.2","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.",null,null,null,null,"CPMI-IOSCO/Identification, FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C, FFIEC Booklet BCM/1-3.e, 4-.1a, 4-2.a, 4-3.b, 4-3.c, 4-3.d, 5-3, 6-2.b, 8-2.c, 10-22.d, NAIC HBRS/ExC APO.10, EBA GITSRM 55, ECB CROE 2.2.2-2, ECB CROE 2.2.2-3, ECB CROE 2.2.2-10, ECB CROE 2.3.2.2-68","COBIT 5 APO02.06 & APO03.01 & APO10.01 & APO10.02 & APO10.04 & APO10.05 & APO12.01 & APO12.02 & APO12.03 & APO12.04 & APO12.05 & APO12.06 & APO13.02 & BAI02.03, COBIT 5 APO08.01 & APO08.04 & APO08.05 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.2 & 4.2.3.3 & 4.2.3.4 & 4.2.3.6 & 4.2.3.8 & 4.2.3.9 & 4.2.3.10 & 4.2.3.12 & 4.2.3.13 & 4.2.3.14, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2 & Clause 4.1, NIST SP 800-53 Rev. 4 CP-2 & SA-12 & PM-8, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & SA-12 & SA-14 & SA-15 & PM-9"]
[null,null,null,null,"DM.ED-5.3","DM.ED-5.3: The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Management/III.C.3, FFIEC Booklet BCM/ 1-3.a, 4-2.e, 4-2.k, NAIC HBRS/ExC APO.10, ECB CROE 2.2.2-4, ECB CROE 2.2.2-10","COBIT 5 APO02.06 & APO03.01 & APO10.01 & APO10.02 & APO10.04 & APO10.05 & APO12.01 & APO12.02 & APO12.03 & APO12.04 & APO12.05 & APO12.06 & APO13.02 & BAI02.03, COBIT 5 APO08.01 & APO08.04 & APO08.05 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.2 & 4.2.3.3 & 4.2.3.4 & 4.2.3.6 & 4.2.3.8 & 4.2.3.9 & 4.2.3.10 & 4.2.3.12 & 4.2.3.13 & 4.2.3.14, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2 & Clause 4.1, NIST SP 800-53 Rev. 4 CP-2 & SA-12 & PM-8, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & SA-12 & SA-14 & SA-15 & PM-9"]
[null,null,null,null,"DM.ED-5.4","DM.ED-5.4: The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.",null,null,null,null,"CPMI-IOSCO/Identification, FFIEC CAT D4, FFIEC Booklet BCM/10-21.a, NAIC HBRS/ExC APO.10, ECB CROE 2.2.2-4, ECB CROE 2.2.2-10","COBIT 5 APO02.06 & APO03.01 & APO10.01 & APO10.02 & APO10.04 & APO10.05 & APO12.01 & APO12.02 & APO12.03 & APO12.04 & APO12.05 & APO12.06 & APO13.02 & BAI02.03, COBIT 5 APO08.01 & APO08.04 & APO08.05 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.2.3.1 & 4.2.3.2 & 4.2.3.3 & 4.2.3.4 & 4.2.3.6 & 4.2.3.8 & 4.2.3.9 & 4.2.3.10 & 4.2.3.12 & 4.2.3.13 & 4.2.3.14, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3 & A.15.2.1 & A.15.2.2, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2 & Clause 4.1, NIST SP 800-53 Rev. 4 CP-2 & SA-12 & PM-8, NIST SP 800-53 Rev. 4 RA-2 & RA-3 & SA-12 & SA-14 & SA-15 & PM-9"]
[null,null,"DM.ED-6: Minimum cybersecurity practices for critical external dependencies designed to meet the objectives of the Cyber Risk Management Program or Cyber Supply Chain Risk Management Plan are identified and documented.","ID.SC-3 - with sector enhancement","DM.ED-6.1","DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC-APX J/Third-Party Management, FFIEC Booklet BCM/6-5.d, 6-5.e, 8-2.a, NAIC HBRS/ExC APO.10, NYDFS 500.04, NYDFS 500.10, NYDFS/500.11, SEC Regulation S-P, EBA GITSRM 3.2.3.8.a","COBIT 5 APO10.01 & APO10.02 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.6.4 & 4.3.2.6.7, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3, NIST SP 800-53 Rev. 4 SA-9 & SA-11 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-6.2","DM.ED-6.2: The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.",null,null,null,null,"FFIEC CAT D3/ D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC-APX J/Third-Party Management, NAIC HBRS/ExC APO.10, NYDFS 500.04, NYDFS/500.11, EBA GITSRM 3.2.3.8.a","COBIT 5 APO10.01 & APO10.02 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.6.4 & 4.3.2.6.7, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3, NIST SP 800-53 Rev. 4 SA-9 & SA-11 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-6.3","DM.ED-6.3: Minimum cybersecurity requirements for third-parties include how the organization will monitor security of its external dependencies to ensure that requirements are continually satisfied.",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC-APX J/Third-Party Management, NAIC HBRS/ExC APO.10, NYDFS 500.04, NYDFS/500.11, EBA GITSRM 3.2.3.9","COBIT 5 APO10.01 & APO10.02 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.6.4 & 4.3.2.6.7, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3, NIST SP 800-53 Rev. 4 SA-9 & SA-11 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-6.4","DM.ED-6.4: Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted.",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC-APX J/Third-Party Management, NAIC HBRS/ExC APO.10, NYDFS 500.04, NYDFS/500.11, EBA GITSRM 3.2.3.8.a, ECB CROE 2.5.2.2-32","COBIT 5 APO10.01 & APO10.02 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.6.4 & 4.3.2.6.7, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3, NIST SP 800-53 Rev. 4 SA-9 & SA-11 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-6.5","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.",null,null,null,null,"FFIEC CAT D4/ D5, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC-APX J/Third-Party Capacity and Cyber Resilience, FFIEC Booklet BCM/1-1.e, 6-5.d, 6-5.f, 8-13.c, 10-8.e, 10-8.f, 10-20, 10-21b, NAIC HBRS/ExC APO.10, NYDFS 500.04, NYDFS/500.11, EBA GITSRM 3.2.3.8.b, ECB CROE 2.5.2.2-30, ECB CROE 2.5.2.4-54, ECB CROE 2.6.2-36, ECB CROE 2.6.2-41","COBIT 5 APO10.01 & APO10.02 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.6.4 & 4.3.2.6.7, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3, NIST SP 800-53 Rev. 4 SA-9 & SA-11 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-6.6","DM.ED-6.6: Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements. ",null,null,null,null,"FFIEC CAT D3/ D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC-APX J/Third-Party Management, NAIC HBRS/ExC APO.10, NYDFS 500.04, NYDFS/500.11","COBIT 5 APO10.01 & APO10.02 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.6.4 & 4.3.2.6.7, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3, NIST SP 800-53 Rev. 4 SA-9 & SA-11 & SA-12 & PM-9"]
[null,null,null,null,"DM.ED-6.7","DM.ED-6.7: Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination.",null,null,null,null,"FFIEC CAT D4, NAIC HBRS/ExC APO.10, NYDFS 500.04, NYDFS/500.11, EBA GITSRM 3.2.3.8.a, ECB CROE 2.5.2.2-32","COBIT 5 APO10.01 & APO10.02 & APO10.03 & APO10.04 & APO10.05, ISA 62443-2-1:2009 4.3.2.6.4 & 4.3.2.6.7, ISO/IEC 27001:2013 A.15.1.1 & A.15.1.2 & A.15.1.3, NIST SP 800-53 Rev. 4 SA-9 & SA-11 & SA-12 & PM-9"]
[null,null,"DM.ED-7: Suppliers and partners are monitored to confirm that they have satisfied their obligations as required. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted.","ID.SC-4 - with sector enhancement","DM.ED-7.1","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.",null,null,null,null,"FFIEC CAT D4/ D5, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC Booklet BCM/1-1.e, 3-3, 6-5.d, 6-6.g, NAIC HBRS/ExC DSS.01, NYDFS/500.11, SEC Regulation SDR, EBA GITSRM 3.2.3.9, ECB CROE 2.3.2.2-70, ECB CROE 2.3.2.2-74","COBIT 5 APO10.01 & APO10.03 & APO10.04 & APO10.05 & MEA01.01 & MEA01.02 & MEA01.03 & MEA01.04 & MEA01.05, ISA 62443-2-1:2009 4.3.2.6.7, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 AU-2 & AU-6 & AU-12 & AU-16 & PS-7 & SA-9 & SA-12"]
[null,null,null,null,"DM.ED-7.2","DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC Booklet BCM/1-1.e, 3-3, 6-5.d, 6-6.d, 10-21c, NAIC HBRS/ExC DSS.01, NYDFS/500.11, ECB CROE 2.3.2.2-70","COBIT 5 APO10.01 & APO10.03 & APO10.04 & APO10.05 & MEA01.01 & MEA01.02 & MEA01.03 & MEA01.04 & MEA01.05, ISA 62443-2-1:2009 4.3.2.6.7, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 AU-2 & AU-6 & AU-12 & AU-16 & PS-7 & SA-9 & SA-12"]
[null,null,null,null,"DM.ED-7.3","DM.ED-7.3: A process is in place to confirm that the organization's third-party service providers conduct due diligence of their own third-parties (e.g., subcontractors).",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Information Security/II.C.20, NAIC HBRS/ExC DSS.01, NYDFS/500.11","COBIT 5 APO10.01 & APO10.03 & APO10.04 & APO10.05 & MEA01.01 & MEA01.02 & MEA01.03 & MEA01.04 & MEA01.05, ISA 62443-2-1:2009 4.3.2.6.7, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 AU-2 & AU-6 & AU-12 & AU-16 & PS-7 & SA-9 & SA-12"]
[null,null,null,null,"DM.ED-7.4","DM.ED-7.4: A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed.",null,null,null,null,"FFIEC CAT D4/ D5, FFIEC IT Booklet/Information Security/II.C.20, FFIEC IT Booklet/Supervision of Service Providers/Risk-Based Supervision, FFIEC Booklet BCM/1-1.e, 6-6.d, 10-22.a, NAIC HBRS/ExC DSS.01, NYDFS/500.11","COBIT 5 APO10.01 & APO10.03 & APO10.04 & APO10.05 & MEA01.01 & MEA01.02 & MEA01.03 & MEA01.04 & MEA01.05, ISA 62443-2-1:2009 4.3.2.6.7, ISA 62443-3-3:2013 SR 6.1, ISO/IEC 27001:2013 A.15.2.1 & A.15.2.2, NIST SP 800-53 Rev. 4 AU-2 & AU-6 & AU-12 & AU-16 & PS-7 & SA-9 & SA-12"]
[null,"Resilience (DM.RS): The organization is resilient and able to operate while experiencing a cyber attack.","DM.RS-1: Organization is capable of operating critical business functions in the face of cyber-attacks and continuously enhance its cyber resilience.","None","DM.RS-1.1","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.",null,null,null,null,"FFIEC CAT D1/ D5, FFIEC Booklet BCM/2-2.b,2.c, 3.b, 6-3.e, 6-6.a, 8-2.b, 8-1.h, 8-10.a, 8-10.b, 11-3, NAIC HBRS/ExC DSS.05, SEC Regulation SCI, EBA GITSRM 77, ECB CROE 2.1.2.1-2, ECB CROE 2.1.2.1-2.d, ECB CROE 2.5.2.1-4, ECB CROE 2.5.2.1-5, ECB CROE 2.5.2.2-26, ECB CROE 2.5.2.2-31, ECB CROE 2.5.2.4-53","COBIT 5 DSS04.01 & DSS04.02 & DSS04.03, ISO 27001:2013 A.16.1.4 & A.16.1.5 & A.17.1.1 & A.17.1.2, NIST SP 800-53 Rev. 4 CP-1 & CP-2 & CP-10 & IR-1 & IR-8"]
[null,null,null,null,"DM.RS-1.2","DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.",null,null,null,null,"FFIEC CAT D1, FFIEC Booklet BCM/2-2.a, 2-4.c, 5-1.b, 8-2.b, NAIC HBRS/ExC DSS.05, ECB CROE 2.1.2.1-14, ECB CROE 2.1.2.2-43","COBIT 5 DSS04.01 & DSS04.02 & DSS04.03 & APO09.03, ISO 27001:2013 A.16.1.4 & A.16.1.5 & A.17.1.1 & A.17.1.2, NIST SP 800-53 Rev. 4 CP-1 & CP-2 & CP-10 & IR-1 & IR-8"]
[null,null,null,null,"DM.RS-1.3","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ",null,null,null,null,"FFIEC CAT D1/ D5, FFIEC Booklet BCM/2-3.e, 6-3.f, 6-4.f, 8-1.d, 8-1.h, 8-2.b, 8-4.a, 8-4.b, 8-4.c, 8-5.a, 8-5.c, 8-7, 8-8.c, 8-9.a, 8-9.c, 8-9.d, 8-9.e, 8-9.f, NAIC HBRS/ExC DSS.05, NYDFS 500.06, EBA GITSRM 77, ECB CROE 2.1.2.1-1.b, ECB CROE 2.5.2.1-3, ECB CROE 2.5.2.1-11, ECB CROE 2.5.2.1-12","COBIT 5 DSS04.01 & DSS04.03, ISO 27001:2013 A.17.1.1 & A.17.1.2, NIST SP 800-53 Rev. 4 CP-1 & CP-2 & CP-10 & IR-1 & IR-8"]
[null,null,"DM.RS-2: Organizational incident response, business continuity, and disaster recovery plans and exercises incorporate its external dependencies and critical business partners.","ID.SC-5 - with sector enhancement","DM.RS-2.1","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ",null,null,null,null,"FFIEC CAT D1/ D4/ D5, FFIEC Booklet BCM/5-1.b, 6-5.a, 6-5.b, 6-5.f, 6-6.b, 10-22.d, NAIC HBRS/ExC DSS.02, NAIC ML/5, SEC Regulation SCI, SEC Regulation SDR, EBA GITSRM 3.7.3.86, EBA GITSRM 3.7.4.89.a, ECB CROE 2.5.2.1-13, ECB CROE 2.6.2-41","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 2.8 & SR 3.3 & SR.6.1 & SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-2 & CP-4 & IR-3 & IR-4 & IR-6 & IR-8 & IR-9"]
[null,null,null,null,"DM.RS-2.2","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ",null,null,null,null,"FFIEC CAT D1/ D5, FFIEC Booklet BCM/2-3.e, 5-1.b, 6-5.c, 6-6.a, 6-6.b, 6-6.c, 6-6.d, 6-6.e, 6-6.f, 6-6.h, 6-6.i, 6-7.a, 6-7.b, 6-7.c, 6-7.d, 8-1.g, 8-1.h, 8-1.i, 8-13.b, 8-13.c, 10-25.c, 10-25.d, NAIC HBRS/ExC DSS.02, NYDFS 500.06, ECB CROE 2.2.2-8, ECB CROE 2.5.2.1-11","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 2.8 & SR 3.3 & SR.6.1 & SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-2 & CP-4 & IR-3 & IR-4 & IR-6 & IR-8 & IR-9"]
[null,null,null,null,"DM.RS-2.3","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ",null,null,null,null,"FFIEC CAT D1/ D4/ D5, FFIEC Booklet BCM /1-1.d, 2-5.e, 6-5.c, 6-6.f, 6-6.i, 8-1.j, 8-4.d, 8-8.a, 8-8.b, 8-8.c, 8-9.a, 8-9.b, 8-9.c, 8-9.d, 8-9.e, 8-9.f, 10-5, 10-7.h, 10-15.c, 10-15.e, 10-22b, 10-22c, 10-22.e, 10-23.b, 10-26, 10-27.a, 10-27.b, NAIC HBRS/ExC DSS.02, EBA GITSRM 3.7.4.87, EBA GITSRM 3.7.4.89.a, ECB CROE 2.2.2-13, ECB CROE 2.3.2.2-75, ECB CROE 2.5.2.1-19, ECB CROE 2.6.2-7, ECB CROE 2.6.2-8, ECB CROE 2.6.2-34, ECB CROE 2.6.2-36, ECB CROE 2.6.2-38, ECB CROE 2.6.2-41","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 2.8 & SR 3.3 & SR.6.1 & SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-2 & CP-4 & IR-3 & IR-4 & IR-6 & IR-8 & IR-9"]
[null,null,null,null,"DM.RS-2.4","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ",null,null,null,null,"FFIEC CAT D4, FFIEC IT Booklet/Business Continuity Planning/ Mitigation Strategies/Testing with Third-Party Service Providers, FFIEC Booklet BCM/6-2.b, 6-5.a, 6-7.a, 6-7.b, 6-7.c, 6-7.d, 10-13.b, 10-23.a, NAIC HBRS/ExC DSS.02, EBA GITSRM 3.7.3.85, ECB CROE 2.5.2.1-3","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 2.8 & SR 3.3 & SR.6.1 & SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-2 & CP-4 & IR-3 & IR-4 & IR-6 & IR-8 & IR-9"]
[null,null,null,null,"DM.RS-2.5","DM.RS-2.5: When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1/ D5, NAIC HBRS/ExC DSS.02, SEC Regulation SCI, ECB CROE 2.5.2.1-19","CIS CSC 19 & 20, COBIT 5 DSS04.04, ISA 62443-2-1:2009 4.3.2.5.7 & 4.3.4.5.11, ISA 62443-3-3:2013 SR 2.8 & SR 3.3 & SR.6.1 & SR 7.3 & SR 7.4, ISO/IEC 27001:2013 A.17.1.3, NIST SP 800-53 Rev. 4 CP-2 & CP-4 & IR-3 & IR-4 & IR-6 & IR-8 & IR-9"]
[null,"Business Environment (DM.BE): The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","DM.BE-1: The organization’s place in critical infrastructure and its industry sector is identified and communicated.","ID.BE-2","DM.BE-1.1","DM.BE-1.1: The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector.  ",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, NAIC HBRS/ExC APO.02, ECB CROE 2.1.2.2-43","COBIT 5 APO02.06 & APO03.01, ISO/IEC 27001:2013 Clause 4.1, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,null,null,"DM.BE-1.2","DM.BE-1.2: A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across other sectors the institution depends upon.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1, NAIC HBRS/ExC APO.02, SEC Regulation SCI","COBIT 5 APO02.06 & APO03.01, ISO/IEC 27001:2013 Clause 4.1, NIST SP 800-53 Rev. 4 PM-8"]
[null,null,"DM.BE-2: Dependencies and critical functions for delivery of critical services are established.","ID.BE-4","DM.BE-2.1","DM.BE-2.1: The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.",null,null,null,null,"FFIEC CAT D1/ D3/ D4/ D5, FFIEC IT Booklet/Management/III.C.3, NAIC HBRS/ExC APO.12, ECB CROE 2.1.2.1-14, ECB CROE 2.1.2.2-43","COBIT 5 APO10.01 & BAI04.02 & BAI09.02, ISO/IEC 27001:2013 A.11.2.2 & A.11.2.3 & A.12.1.3, NIST SP 800-53 Rev. 4 CP-8 & PE-9 & PE-11 & PM-8 & SA-14"]
[null,null,null,null,"DM.BE-2.2","DM.BE-2.2: The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.",null,null,null,null,"CPMI-IOSCO, FFIEC CAT D1/ D5, NAIC HBRS/ExC APO.12, EBA GITSRM 3.6.1.62","COBIT 5 APO10.01 & BAI04.02 & BAI09.02, ISO/IEC 27001:2013 A.11.2.2 & A.11.2.3 & A.12.1.3, NIST SP 800-53 Rev. 4 CP-8 & PE-9 & PE-11 & PM-8 & SA-14"]
[null,null,"DM.BE-3: Resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","ID.BE-5","DM.BE-3.1","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).",null,null,null,null,"FFIEC CAT D5, FFIEC IT Booklet/ Business Continuity Planning / Contracts, FFIEC Booklet BCM/6-3.d, 8-4.a, 8-4.d, NAIC HBRS/ExC DSS.04, SEC Regulation SDR, NYDFS 500.06, EBA GITSRM 3.7.3.83, EBA GITSRM 3.7.4.89, ECB CROE 2.1.2.1-1.a, ECB CROE 2.1.2.1-2.b, ECB CROE 2.5.2.1-3, ECB CROE 2.5.2.1-11","COBIT 5 BAI03.02 & DSS04.02, ISO/IEC 27001:2013 A.11.1.4 & A.17.1.1 & A.17.1.2 & A.17.2.1, NIST SP 800-53 Rev. 4 CP-2 & CP-11 & SA-13 & SA-14"]
[]
[null,null,null,null,null,"Applicable Diagnostic Statements:  ",277,262,188,137]
[]
[null,null,null,null,null,"Diagnostic Statements Responded To:",{"$f":"COUNTA(G6:G282)","v":0},{"$f":"COUNTA(H6:H282)","v":0},0,0]

{"sheet":"v1.2 FAQs","index":3,"n_rows":317,"n_cols":3,"rows_kept":317,"cut":false,"hidden":false,"merged":[[25,1,25,2],[33,1,33,2],[34,1,34,2],[35,1,35,2],[36,1,36,2],[37,1,37,2],[50,1,50,2],[11,1,11,2],[12,1,12,2],[13,1,13,2],[14,1,14,2],[23,1,23,2],[24,1,24,2],[38,1,38,2],[39,1,39,2],[40,1,40,2],[52,1,52,2],[64,1,64,2],[65,1,65,2],[66,1,66,2],[67,1,67,2],[68,1,68,2],[41,1,41,2],[43,1,43,2],[42,1,42,2],[44,1,44,2],[46,1,46,2],[48,1,48,2],[69,1,69,2],[60,1,60,2],[63,1,63,2],[54,1,54,2],[55,1,55,2],[56,1,56,2],[57,1,57,2],[58,1,58,2],[59,1,59,2],[61,1,61,2],[70,1,70,2],[71,1,71,2],[72,1,72,2],[73,1,73,2],[74,1,74,2],[75,1,75,2],[96,1,96,2],[98,1,98,2],[76,1,76,2],[77,1,77,2],[78,1,78,2],[79,1,79,2],[80,1,80,2],[83,1,83,2],[81,1,81,2],[90,1,90,2],[91,1,91,2],[92,1,92,2],[93,1,93,2],[94,1,94,2],[84,1,84,2],[85,1,85,2],[86,1,86,2],[87,1,87,2],[88,1,88,2],[89,1,89,2],[126,1,126,2],[127,1,127,2],[128,1,128,2],[103,1,103,2],[104,1,104,2],[107,1,107,2],[108,1,108,2],[109,1,109,2],[110,1,110,2],[105,1,105,2],[111,1,111,2],[112,1,112,2],[113,1,113,2],[114,1,114,2],[115,1,115,2],[116,1,116,2],[117,1,117,2],[118,1,118,2],[119,1,119,2],[120,1,120,2],[121,1,121,2],[122,1,122,2],[123,1,123,2],[124,1,124,2],[125,1,125,2],[150,1,150,2],[151,1,151,2],[153,1,153,2],[129,1,129,2],[130,1,130,2],[131,1,131,2],[132,1,132,2],[133,1,133,2],[134,1,134,2],[135,1,135,2],[136,1,136,2],[137,1,137,2],[138,1,138,2],[139,1,139,2],[140,1,140,2],[141,1,141,2],[142,1,142,2],[143,1,143,2],[144,1,144,2],[145,1,145,2],[146,1,146,2],[147,1,147,2],[148,1,148,2],[149,1,149,2],[176,1,176,2],[177,1,177,2],[178,1,178,2],[154,1,154,2],[156,1,156,2],[157,1,157,2],[158,1,158,2],[159,1,159,2],[160,1,160,2],[161,1,161,2],[162,1,162,2],[163,1,163,2],[164,1,164,2],[165,1,165,2],[166,1,166,2],[167,1,167,2],[168,1,168,2],[169,1,169,2],[170,1,170,2],[171,1,171,2],[172,1,172,2],[173,1,173,2],[174,1,174,2],[175,1,175,2],[191,1,191,2],[192,1,192,2],[193,1,193,2],[194,1,194,2],[195,1,195,2],[197,1,197,2],[196,1,196,2],[179,1,179,2],[180,1,180,2],[181,1,181,2],[182,1,182,2],[183,1,183,2],[184,1,184,2],[185,1,185,2],[186,1,186,2],[187,1,187,2],[188,1,188,2],[189,1,189,2],[190,1,190,2],[248,1,248,2],[198,1,198,2],[199,1,199,2],[200,1,200,2],[201,1,201,2],[202,1,202,2],[205,1,205,2],[204,1,204,2],[203,1,203,2],[206,1,206,2],[207,1,207,2],[208,1,208,2],[209,1,209,2],[242,1,242,2],[245,1,245,2],[276,1,276,2],[249,1,249,2],[283,1,283,2],[284,1,284,2],[286,1,286,2],[288,1,288,2],[290,1,290,2],[278,1,278,2],[254,1,254,2],[259,1,259,2],[260,1,260,2],[251,1,251,2],[252,1,252,2],[256,1,256,2],[257,1,257,2],[315,1,315,2],[298,1,298,2],[299,1,299,2],[300,1,300,2],[301,1,301,2],[317,1,317,2],[318,1,318,2],[319,1,319,2],[7,1,7,2],[8,1,8,2],[9,1,9,2],[10,1,10,2],[316,1,316,2],[302,1,302,2],[304,1,304,2],[292,1,292,2],[263,1,263,2],[264,1,264,2],[265,1,265,2],[267,1,267,2],[274,1,274,2],[270,1,270,2],[271,1,271,2],[272,1,272,2],[294,1,294,2],[295,1,295,2],[296,1,296,2],[297,1,297,2],[281,1,281,2],[282,1,282,2],[303,1,303,2],[305,1,305,2],[306,1,306,2],[100,1,100,2],[220,1,220,2],[241,1,241,2],[246,1,246,2],[225,1,225,2],[226,1,226,2],[228,1,228,2],[240,1,240,2],[243,1,243,2],[244,1,244,2],[231,1,231,2],[232,1,232,2],[233,1,233,2],[235,1,235,2],[238,1,238,2],[227,1,227,2],[219,1,219,2],[222,1,222,2],[223,1,223,2],[224,1,224,2],[210,1,210,2],[216,1,216,2],[217,1,217,2],[218,1,218,2]]}
[]
[]
[]
[]
[]
[]
[]
[null,"The CRI Profile v1.2"]
[null,"- Frequently Asked Questions -"]
[]
[]
[null,"1.      Where can I find the Profile?"]
[]
[null,"The latest, free copy of the Profile is available for download on the Cyber Risk Institute (CRI) website: https://cyberriskinstitute.org/the-profile/, the NIST Cybersecurity Framework Critical Infrastructure Resources webpage: https://www.nist.gov/cyberframework/critical-infrastructure-resources, and on the websites of supporting trade associations."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"2.      What is the Profile?  And what is it NOT?"]
[]
[null,"What the Profile Is:","What the Profile is NOT:"]
[null,"·         It is built from existing regulations, guidance, frameworks, and standards.","·         It is not built from wholly original content without connection to pre-existing regulations, guidance, frameworks, and standards."]
[null,"·         It is unique because it efficiently weaves existing regulations and frameworks together to form a standardized taxonomy and foundational structure to organize an institution’s cybersecurity risk management program.","·         It is not a newly created “standard of good practice.” "]
[null,"·         It is comprehensive in scope.","·         It is not exhaustive in depth. An institution should determine for itself whether there are additional state, national, or international compliance requirements that are not part of the Profile."]
[null,"·         It describes the fundamental, universal elements of a cyber risk management program (i.e., the “what” of the program).  ","·         It is not intended describe how an institution should fulfill the program elements (i.e., the “how” of the program)."]
[null,"·         Through the addition of diagnostic statements and an impact tiering construct, it functions as a scalable self-assessment that can be used by financial institutions and third-parties of differing scope, size, and complexity.","·         It does not address in full the unique requirements of all institutions.  It is often referred to as the 80% solution leaving room for further institution and supervisory tailoring to individual business and regulatory requirements."]
[null,"·         It provides a sound and informed risk management roadmap.","·         It does not supersede regulatory authority, nor is it intended to replace reasonable business judgement."]
[]
[]
[null,"3.      Why was the Profile developed?"]
[]
[null,"Ensuring the industry is safe from cyber incidents is a critical priority for regulators. However, the rapid proliferation of cybersecurity requirements for financial firms has left institutions struggling to keep up. As a result, firms are forced to channel critical resources to ensure they meet requirements. When surveyed in 2016, Chief Information Security Officers for financial services institutions reported that up to 40% of their team's time was spent on the compliance requirements of various regulatory frameworks, not cybersecurity.*"]
[]
[null,"The Profile eases this burden on the financial services industry, enabling firms to both concentrate on risk and address multiple regulatory agencies' cyber requirements. Focusing cybersecurity experts’ time on protecting global financial platforms, rather than overlapping compliance activity, will significantly enhance security efforts. For an industry already burdened by a shortage of adequately skilled individuals, reducing this percentage by streamlining the compliance response process is an immediate gain in efficiency and managed risk."]
[]
[null,"For the regulatory community, Profile use would enhance transparency and improve visibility across institutions, subsectors, third-parties, and across sectors, enabling better analysis and mitigation of systemic and concentration risks."]
[]
[null,"* This predated the Financial Stability Board’s announcement in 2017 that 72% of its 25 member jurisdictions were self-reporting that each had plans to issue further cybersecurity regulatory frameworks.  "]
[]
[]
[null,"4.      Why was the Cyber Profile moved from the Financial Services Sector Coordinating Council (FSSCC)* to the newly established Cyber Risk Institute (CRI)**?"]
[]
[null,"After the Version 1.0 release, the FSSCC, a coalition of trade associations, and firms recognized that the Profile would need to be kept \"evergreen.\" To ensure that occurred, these firms established the Cyber Risk Insitute (CRI), a separate not-for-profit division within the Bank Policy Institute (one of the initial contributing trade associations). CRI publicly launched in May 2020, and even prior to its launch, it worked with the community to develop this newest version, Version 1.1., following the same governance process. "]
[]
[null,"* FSSCC’s mission is to strengthen the resiliency of the financial services sector and critical infrastructure against cyber and physical incidents by proactively identifying risks and promoting protection and mitigation, driving preparedness, and coordinating response for the benefit of its consumers, the sector, and the world. Established in 2002, FSSCC is now composed of over 70 member financial institutions, financial utilities, and financial services related trade associations (which, in turn, consist of 1000s of other member institutions). To achieve its mission, FSSCC and its member entities collaborate with appropriate government agencies and governmental bodies to develop and implement a variety of risk management and operational resilience strategies and initiatives. A list of FSSCC member entities can be found on its website: www.fsscc.org."]
[]
[null,"** CRI is a coalition of more than 35 firms and growing, respresenting the entire spectrum of the financial services industry. CRI was established to develop cybersecurity and resiliency strategies and standards to help institutions respond to evolving threats. By implementing a common language for cybersecurity risk assessment, CRI will continue to maintain and develop the Financial Services Cybersecurity Profile (\"the CRI Profile\").  To learn more click on this hyperlinked cell or visit: https://cyberriskinstitute.org."]
[]
[]
[null,"5.      Has there been broad financial services sector representation in the Profile’s development?"]
[]
[null,"Yes, there has been broad representation by subsectors (e.g., banking, insurance, asset management, market utilities, broker-dealers) as well as functional roles (e.g., Board Directors, CEOs, CISOs, Chief Information Risk Officers, cyber and privacy attorneys) in the Profile’s development."]
[]
[null,"Starting in Q3 2016, a coalition of trade associations gathered under the Financial Services Sector Coordinating Council (FSSCC)* and began working on what would become the Profile, Version 1.0, released in October 2018. The 50+ working sessions over those 2 years included the participation of over 300 individual experts, representing over 150 financial institutions, ranging from community banks and credit unions to large multinational banks, investment firms, and insurance institutions. Additionally, input was solicited, received, and integrated from a myriad of U.S. and international financial services regulatory bodies. In one major event in April 2018, NIST hosted an open workshop to further develop a scaling methodology for the Profile. Over 100 individuals attended the workshop, with representation from financial services institutions and the state and national supervisory community. Inputs, feedback, and recommendations provided by these sessions were reviewed, discussed, and incorporated based on the working group’s consensus."]
[]
[null,"This multi-stakeholder process continued with the issuance of Profile version 1.1. In November 2020, CRI released version 1.1 of the Profile, which included the National Association of Insurance Commissioners' mappings of its IT Handbook Amendments and Exhibit C to the Profile. Tthese insurance related items were considered along with other banking related items."]
[]
[]
[null,"6.      What were the objectives and principles used in developing the Profile?"]
[]
[null,"The Profile has to benefit customers, financial institutions, and supervisory agencies worldwide.  The working group consensus was that the Profile would be—"]
[null,"·         Generally applicable and usable by all types of financial institutions, and adaptable based on inherent risk and institutional circumstances;"]
[null,"·         Comprehensive in terms of the scope of assessment questions asked and adequately efficient to optimize cybersecurity staff time at the keyboard and supervisors’ time conducting higher-value analysis;"]
[null,"·         Usable and beneficial for those that are supervised by numerous agencies, in possibly multiple international jurisdictions, and by those that may have fewer supervisors, but want a credible, standardized self-assessment framework; and"]
[null,"·         Usable and beneficial for the most interconnected, systemically important institutions, and also among the smaller and least interconnected institutions."]
[]
[null,"To achieve these objectives, the original working group architects organized the Profile based on widely used frameworks and standards, as well as supervisory guidance and assessment tools, such as the NIST Cybersecurity Framework, the ISO/IEC 27001/2 controls, CPMI-IOSCO, and the Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT), among others. This principle of leveraging what existed—and not “starting from scratch”—extended into the creation of the Impact Tiering scaling methodology, with the use of existing criteria for financial sector criticality. It also extended to the formulation of the Diagnostic Statements, which reference current supervisory expectations. If assessment language existed that did not overlap or have redundant phrasing, that language is generally used. However, where supervisory agencies used similar, overlapping, or duplicative language or phrasing, the simplest or most ubiquitous language has been selected."]
[]
[]
[null,"7.      What are the differences between the Profile and the NIST Cybersecurity Framework?"]
[]
[null,"The Profile is a financial services sector-specific extension of the NIST Cybersecurity Framework (NIST CSF)—and other key guidance documents such as ISO and CPMI-IOSCO—to better address the sector’s regulatory environment. Like the NIST CSF, the Profile articulates desired security outcomes based on cyber risk management best practices and credible approaches. However, unlike the NIST CSF, the Profile extends the mapping of those risk management activities to sector-specific regulations, guidance, and supervisory materials and includes Diagnostic Statements to aid in assessing a risk management program.  It also adds two new functions to NIST’s five function design.  These two new functions are “Governance”* and “Dependency Management,” which were added due to their prioritization by the financial services regulators."]
[]
[null,"In sum, the Profile effectively extends the NIST CSF vertically, by adding two additional Functions, and horizontally, by adding Diagnostic Statements that elaborate desired Subcategory outcomes. These expansions align the Profile with the financial services sector’s cybersecurity environment, protection needs, and regulatory requirements."]
[]
[null,"* While the Function \"Governance\" is not yet a Function within the NIST CSF, NIST incorporated a similar function of \"Govern\" in its more recently released, \"The NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management.\" This addition was due in large part to the Profile. To view the NIST Privacy Framework, please visit the NIST website: https://www.nist.gov/privacy-framework."]
[]
[]
[null,"8.      Is NIST supportive of this Framework customization?"]
[]
[null,"Yes.  With the publication of Profile, NIST released this a written statement of support:"]
[]
[null,"“Congratulations on publication of the Financial Services Sector Cybersecurity Profile Version 1.0.  NIST encourages customization of our publications in ways that best meet the needs of each user.  The Financial Services Sector Cybersecurity Profile Version 1.0 builds upon the Cybersecurity Framework in ways that support the financial services community."]
[]
[null,"“NIST has found the Financial Services Sector Cybersecurity Profile Version 1.0 to be 1) correct with regard to Cybersecurity Framework Version 1.1, 2) supportive of a risk-based approach to cybersecurity, and 3) one of the more detailed Cybersecurity Framework-based, sector regulatory harmonization approaches to-date."]
[]
[null,"“NIST is happy to have supported the Financial Services Sector Coordinating Council in developing your work product.  As financial services users implement your guidance, let’s continue communicating, as user observations will likely inform future versions of the Financial Services Sector Cybersecurity Profile and the Cybersecurity Framework itself.”"]
[]
[null,"In addition to the statement, NIST has been an active facilitator and partner in the Profile’s development. In May 2017, NIST invited the Profile working group to present an early draft Profile at the annual CSF stakeholders meeting at NIST’s Gaithersburg, MD, location and posted a summary of the Profile on the NIST CSF webpage. On April 26, 2018, NIST hosted a full-day, open and public workshop, in concert with the Financial Services Sector Coordinating Council, at the U.S. Department of Commerce building in Washington, DC. This workshop considerably advanced the development of the Profile’s scaling methodology (what would later become the Profile’s Impact Tiering). "]
[]
[null,"For a link describing the event, please click here: https://www.nist.gov/news-events/events/2018/04/financial-services-sector-cybersecurity-workshop. "]
[]
[null,"Furthermore, NIST invited the working group to present the Profile, Version 1.0 at the NIST risk management conference in Baltimore, MD in November 2018. For a link describing the event, please click here: https://www.nist.gov/news-events/events/2018/11/nist-cybersecurity-risk-management-conference. "]
[]
[null,"Additionally, when NIST began developing its Privacy Framework, it included a new Function of \"Govern.\"  This addition was based on the Profile's addition of a \"Governance\" Function and is a likely bellwhether for the NIST CSF's inclusion of such a Function."]
[]
[]
[null,"9.      Which types of institutions can use the Profile?"]
[]
[null,"While the Profile was developed by the financial services sector, because it is organized around the Functions of Governance, Identify, Protect, Detect, Respond, Recover, and Supply/Dependency Management, extended with Diagnostic Statements to connect these concepts with existing compliance requirements and informative references such as the ISO 27000 controls, it is model that can be and has been used outside of the financial services industry.  Indeed, the Business Software Alliance used the Profile architecture to construct its \"BSA Framework for Secure Software:  A New Approach to Securing the Software Lifecycle,\" a framework to help stakeholders of the software industry to evaluate the security of specific software products and services."]
[]
[null,"With respect to the financial services industry, the Profile has been designed for use by all financial institutions, financial services companies, financial firms, and their third-party providers. A broad cross-section of the financial services industry—banking, insurance, asset management, market utilities, broker-dealers—designed it to scale across institutions of varying complexity, interconnectedness, and criticality. Regulatory issuances and best practices from across the sector (and around the globe are incorporated and continue to be integrated through the work of CRI)."]
[]
[null,"Through the impact tiering questionnaire, the Profile segments the financial services sector into four tiers of criticality. Each tier corresponds with the impact that an institution would have on the global, national, sector, or local market if substantially impacted by a cybersecurity event. These “Impact Tiers” are as follows:"]
[]
[null,"Tier 1: National/Super-National Impact. This tier includes institutions that are designated most critical by one or more U.S. or North American regulatory agencies and/or bodies (e.g., GSIB designation; Executive Order 13636, Section 9 designation). This category assumes the gross cyber risk exposure of an institution or service categorized as Tier 1 would have the most potential adverse impact to the overall stability of the global economy."]
[]
[null,"Tier 2: Subnational Impact. This tier includes institutions that provide mission critical services for millions of customer accounts. This category assumes the gross cyber risk exposure of an institution or service would have the potential for a substantial adverse impact to the financial services sector and subnational regional economy but does not rise to the level of Tier 1."]
[]
[null,"Tier 3: Sector Impact. This tier includes institutions that have a high degree of interconnectedness, with certain institutions acting as key nodes within and for the sector. The nature of the services that these institutions provide to the sector plays a significant role in determining their criticality."]
[]
[null,"Tier 4: Localized Impact. This tier includes institutions that have a limited impact on the overall financial services sector and national economy. Typical characteristics include: (a) institutions with a local presence and less than 1 million customers (e.g., community banks, state banks) and (b) providers of low criticality services in relation to the entire sector."]
[]
[null,"Upon determining an institution’s impact category, the Profile is customized to meet the institution’s likely cybersecurity risk. The user is then prompted to answer a set of self-assessment questions—the Diagnostic Statements—coded by function, category, subcategory, and associated numbering with the CPMI-IOSCO and NIST Cybersecurity Framework.  "]
[]
[null,"Financial institutions can use the Profile as the baseline examination assessment, and extend the functionality to evaluate partners, vendors, and third-party service providers."]
[]
[]
[null,"10.      Is the Profile Voluntary?  If so, what are some of the benefits of using the Profile?"]
[]
[null,"Usage of the Profile is entirely voluntary.  There is no mandate to use the Profile, but there are many benefits to using the Profile.  "]
[]
[null,"The numerous and substantial benefits to the financial services sector are: "]
[null,"·         Focuses senior executive and boardroom review of cybersecurity risks and budgeting;"]
[null,"·         Brings plain language to benchmarking, risk management, audit, and in-house education;"]
[null,"·         Offers compliance efficiencies that grow with a financial institution’s complexity;"]
[null,"·         Aids prioritization and focused use of resources;"]
[null,"·         Creates a common vocabularay that eases collaboration with other financial institutions, third parties, and innovative non-bank financial companies;"]
[null,"·         Supports tailored supervision, examinations, and collaboration among state, federal, and international supervisors;"]
[null,"·         Enhances understanding of systemic risk within the sector, across sectors, and among institutions and third parties;"]
[null,"·         Creates a common baseline security threshold; and"]
[null,"·         Improves data collection and comparison."]
[]
[null,"Benefits to Financial Institutions"]
[]
[null,"Boardroom Engagement to Advance Investment:  For C-Suite and board directors, cybersecurity is a top concern and supervisors expect institutions to track their progress in mitigating identified security gaps. By using the Profile over several cycles, financial institutions can benchmark their programs with the Profile’s recommended practices, identify gaps, articulate those gaps to the C-Suite and board directors in plain language, discuss appropriate resourcing for mitigation, and track the advancement in mitigation efforts over time.   "]
[]
[null,"Efficiencies:  The Profile promises to reduce the time a financial institution needs to complete a comprehensive assessment by offering a tailored set of statements used for assessment purposes, the Diagnostic Statements, reflecting the institution’s risk to the broader economy.  "]
[null,"·         73% Reduction for Community Institution Assessment Questions. For the least complex and interconnected institutions, it is expected that they will answer a total of 146 questions (9 tiering questions + 137 Diagnostic Statement questions).  Compared with another widely-used assessment tool’s 533 questions, this represents a 73% reduction in questions.  "]
[null,"·         49% Reduction in Assessment Questions for the Largest Institutions. For the most complex and interconnected institutions, the reduction also is significant. With the Profile, it is expected that such institutions would answer 279 questions (2 tiering questions + 277 Diagnostic Statement questions) as compared with the other widely-used assessment’s 533, a 49% reduction in questions.  "]
[]
[null,"Additional Benefits: While increased time and focus on cybersecurity projects and activities is a substantial benefit, continued use of the Profile would bring additional benefits. Immediate benefits for financial institutions include: "]
[null,"·         Enhanced internal and external oversight, due diligence, and risk identification using consistent terms and concepts;"]
[null,"·         More efficient third-party vendor management review and oversight;"]
[null,"·         Greater intra-sector, cross-sector and international cybersecurity collaboration due to the common use of ISO standards, CPMI-IOSCO, and the NIST Cybersecurity Framework; and"]
[null,"·         Encouraging innovation and adoption of emerging technology, as FinTech firms and startups can more readily demonstrate adherence to financial services sector cybersecurity requirements and supervisory expectations."]
[]
[]
[null,"Benefits to Regulatory Community"]
[]
[null,"For the regulatory community, the benefits also are numerous and substantial.  With the Profile, state, federal, and global supervisors could:"]
[null,"·         Tailor examinations to institutional complexity and conduct “deeper dives” in those areas of greater importance;"]
[null,"·         Better discern the sector’s systemic risk by comparing answers across institutions using common terms and concepts;"]
[null,"·         Understand an institution’s baseline security status quickly, affording additional time for specialization, testing, and validation;"]
[null,"·         Broaden the ability to take collective supervisory action to address identified global, national, sector, and institution risks;"]
[null,"·         Improve data analysis and data comparisons from other agencies and jurisdictions; and"]
[null,"·         Enhance supervisors’ visibility into non-sector and third-party risks."]
[]
[null,"The use of the Profile’s approach does not limit what a supervisor can review or require. Rather, it provides an examination approach allowing financial institutions to confidently produce baseline evidence for review and more quickly respond to iterative and follow-up questions from the supervisor. This shared approach would produce a more efficient and consistent examination process for supervisors and financial institutions. "]
[]
[]
[null,"11.  What are some of the benefits to Community Banks (or less inherently risky institutions) in using the Profile?"]
[]
[null,"Mergers and Acquisition/Institutional Safety and Soundness.  A common approach to cybersecurity is important for M&A purposes. When evaluating acquisition targets—even those located within a 1-state footprint—cyber readiness and compliance gaps are a primary concern. Cyber alignment and maturity would be easier to evaluate and compare across institutions with a common approach, such as the Profile."]
[]
[null,"Multibank or Financial Services Holding Company. A small community bank may be part of a multibank holding company, with sister banks holding differing charters and/or financial services affiliates subject to SEC, or other non-bank oversight. A common approach to cyber within the financial services family of companies is a better use of resources and would make all affiliated entities safer."]
[]
[null,"Bank Growth and Evolution/Safety and Soundness. A bank’s ability to evolve and grow would be aided by a common cyber approach. If a single-state bank wants to expand operations to a second state, change charters, acquire another institution—bank or nonbank financial company—a common cyber approach facilitates a bank’s ability to be responsive to market conditions and strategic planning."]
[]
[null,"Interconnectedness/Safety and Soundness. As the supervisory environment becomes more focused on third-party risk and vulnerability by interconnectedness, banks of all sizes could be asked to demonstrate a robust approach to cybersecurity before participating in certain payment activities, high-risk banking transactions, or lower premium cybersecurity insurance policies. A common approach to cybersecurity, based on the Profile, will allow banks of all sizes and business models to evaluate their cyber program—and the cyber program of other institutions—for threats, vulnerabilities, and defenses, in order to make an informed business decision about how, and with whom, to partner."]
[]
[]
[null,"12.  What are the use cases for the Profile?"]
[]
[null,"The Profile may be used in multiple ways, from self-assessment and third-party risk management, to providing a common supervisory engagement approach among state, federal, and international regulatory bodies.  "]
[]
[null,"Profile as Third-Party Risk Management Tool: Similar to self-assessment, a financial institution could evaluate partners, vendors, and service providers with the four impact tiers based upon the third-parties’ criticality and interconnectivity. The financial institution could then request the third-party to provide evidence against the corresponding set of Diagnostic Statements identified by their impact tier. "]
[]
[null,"Profile as a Common Supervisory Approach: The organization, vocabulary, and taxonomy of the Profile offers a credible method of cybersecurity risk management and a basis for conducting supervisory exams. Supervisors may allow financial institutions to use the evidence in their Profile self-assessment exercise for supervisory reporting and analysis. This consistency will allow supervisors to evaluate and compare peer institutions and clearly identify gaps for remediation. This approach is more efficient for the institution and supervisor and provides consistency for an institution in communicating its program, internally and externally.  "]
[]
[]
[null,"13.  Is the Profile widely supported by the financial services sector?"]
[]
[null,"Yes, the Profile has wide financial services sector support. It has the support of the Financial Services Sector Coordinating Council (FSSCC)*, financial institutions, and financial services trade associations representing financial institutions from each subsector."]
[]
[null,"Developed and released by the FSSCC, and now maintained by CRI, the Profile is supported by numerous financial and cross-sector trade associations and organizations. In alphabetical order, this coalition is composed of the following trade associations and organizations:  "]
[]
[null,"·         The American Bankers Association (ABA); "]
[null,"·         The Bank Policy Institute (BPI), and its technology policy subdivision—"]
[null,"o   BITS—Business, Innovation, Technology, Security;"]
[null,"·         The Financial Services Information Sharing and Analysis Center (FS-ISAC); "]
[null,"·         The Futures Industry Association (FIA); "]
[null,"·         The Global Financial Markets Association (GFMA), and its member associations of—"]
[null,"o   The Association for Financial Markets in Europe (AFME), "]
[null,"o   The Asia Securities Industry & Financial Markets Association (ASIFMA), and "]
[null,"o   The Securities Industry and Financial Markets Association (SIFMA);"]
[null,"·         The Institute of International Bankers (IIB);"]
[null,"·         The Institute of International Finance (IIF);"]
[null,"·         UK Finance; and"]
[null,"·         The World Economic Forum (WEF)."]
[]
[null,"Adding Your Trade Association’s Support:  We are collecting logos of trades that are supportive of the Profile."]
[]
[null,"For more information or to lend your support, please Josh Magri of the Cyber Risk Institute (CRI). To participate in Profile peer groups, please contact Denyette DePierro of the American Bankers Association."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"* CRI is a coalition of more than 30 firms and growing, respresenting the entire spectrum of the financial services industry. CRI was established to develop cybersecurity and resiliency strategies and standards to help institutions respond to evolving threats. By implementing a common language for cybersecurity risk assessment, CRI will continue to maintain and develop the Financial Services Cybersecurity Profile (\"Profile\"). To learn more click on this hyperlinked cell or visit: https://cyberriskinstitute.org."]
[]
[null,"* FSSCC’s mission is to strengthen the resiliency of the financial services sector and critical infrastructure against cyber and physical incidents by proactively identifying risks and promoting protection and mitigation, driving preparedness, and coordinating response for the benefit of its consumers, the sector, and the world. Established in 2002, FSSCC is now composed of over 70 member financial institutions, financial utilities, and financial services related trade associations (which, in turn, consist of 1000s of other member institutions). To achieve its mission, FSSCC and its member entities collaborate with appropriate government agencies and governmental bodies to develop and implement a variety of risk management and operational resilience strategies and initiatives. A list of FSSCC member entities can be found on its website: www.fsscc.org."]
[]
[]
[null,"14.  What do supervisory and other agencies think of the Profile?"]
[]
[null,"Numerous U.S. federal regulators and agencies have encouraged its development and announced their public support for the Profile and its use at its release event on October 25, 2018. Since its release, the number of statements of acceptance has grown. Here are some of those statements:"]
[]
[]
[]
[null,"New York Department of Financial Services (NYDFS)"]
[null,"On December 9, 2021, NYDFS published a new FAQ (FAQ41), stating the firms should use a cyber assessment framework as part of their risk assessment process and listed the CRI Profile as one of those assessments.  That FAQ and its response can be accessed by clicking on this hyperlinked cell."]
[]
[null,"The Reserve Bank of New Zealand:"]
[null,"In April 2021, the Reserve Bank recommended the Profile as a \"framework for regulated entities to refer to” in building their cyber resilience.  To see the Reserve Bank of New Zealand's guidance, click this hyperlinked cell."]
[]
[null,"European Union Agency for Cybersecurity (ENISA)"]
[null,"In March 2021, ENISA published, \"EU Cybersecurity Initiatives in the Financial Sector,\" listing the Profile as a \"major cybersecurity initiative in Europe\" in (see Section 2.5).  To view/download the report, click this hyperlinked cell."]
[]
[null,"The National Institute of Standards and Technology:"]
[null,"NIST 's letter supporting the Profile can be accessed by clicking on this hyperlinked cell or visiting the following: https://cyberriskinstitute.org/wp-content/uploads/2020/04/NIST-Letter-of-Support-re-FSSCC-Financial-Services-Sector-Cybersecurity-Profile.pdf."]
[null,"The Federal Financial Institutions Examination Council (FFIEC): "]
[null,"The FFIEC's support statement for the Profile in August 2019 can be accessed by clicking this hyperlinked cell."]
[]
[null,"The International Organization of Securities Commissioners (IOSCO):"]
[null,"IOSCO's June 2019 Cyber Task Force report referencing the Profile can be accessed by clicking on this hyperlinked cell."]
[]
[null,"The Federal Deposit Insurance Corporation (FDIC) and state banking agencies:"]
[null,"FDIC and CSBS amended the Information Technology Risk Examination (InTREx) Program’s examiners form to include the Profile (p.4/52: Q11).  It can be accessed by clicking on this hyperlinked cell."]
[]
[null,"The Commodity Futures Trading Commission (CFTC):"]
[null,"The CFTC's July 2020 full commission statement supporting the use of the Profile can be accessed by clicking on this hyperlinked cell."]
[]
[null,"Non Regulatory Organizations"]
[null,"World Economic Forum"]
[null,"In addition to the above regulatory bodies, groups such as the World Economic Forum's FinTech Cybersecurity Consorium have recommended the Profile for use by FinTechs. "]
[null,"To view the Consortium's recommendation in its July 2020 report entitled, \"Systems of Cyber Resilience: Secure and Trusted FinTech,\" click here."]
[]
[null,"International Regulatory Strategy Group (IRSG):"]
[null,"In June 2021, the IRSG recommended that the G7 call for the adoption of the Profile as the “accepted supervisory baseline upon which national variations can be established for supervisors.” To view, click this hyperlinked cell."]
[]
[]
[null,"15.  Are financial institutions using the Profile?"]
[]
[null,"Yes, financial institutions are already using the Profile. A number of those institutions described their usage at the Profile’s release event on October 25, 2018. Others volunteered to use earlier drafts alongside other frameworks and regulatory tools to compare and generate feedback. Based on feedback received, there are approximately 100+ institutions using the Profile across 4 continents."]
[]
[null,"To hear and learn from some of those firm use cases, visit the American Bankers Association Profile related webpage at: https://www.aba.com/banking-topics/technology/cybersecurity/cybersecurity-profile, or click on this hyperlinked cell."]
[]
[]
[null,"16.  What is one of leading best practices for using the Profile during a regulatory examination?"]
[]
[null,"If you are thinking about using the Profile for your firm's examination, it is best to communicate your desire to do so with your Examiner-in-Charge and the examination team as early as you can. Firms that have had these early and iterative conversations with their examiners about using the Profile during the next or an upcoming examination have reported fewer challenges and misunderstandings. This helps examiners gain comfort and avoids surprising them. While many agencies have publicly stated that they will accept the Profile, people are human and examiners may still have questions or lack full awareness of the Profile's comprehensive nature if they are working through it for the first time."]
[]
[null,"Also, it should be noted, that while the Profile is comprehensive, it is not exhaustive. By providing the Profile to your examiners, it does not mean that examiners cannot ask further questions. They are there to assure the safety and soundness of the financial system and it is within their authority and prerogrative to ask any follow up questions they deem necessary. "]
[]
[null,"In any event, CRI is always developing education materials and engagement opportunities to socialize the Profile with the regulatory community. We are more than happy to lend a hand if your organization is looking for a way to introduce the Profile to its examiner or examination team. "]
[]
[null,"If you have already engaged your regulatory examiner about using the Profile as your assessment framework, CRI is interested in hearing about your experience. Please reach out to CRI."]
[]
[]
[null,"17.  Is the Profile mapped to all existing global cybersecurity regulations, guidance, etc.?"]
[]
[null,"The Profile’s mappings are comprehensive, but they are not exhaustive. The Profile has mapped to and integrated numerous global standards and supervisory expectations, including the ISO 27000 series of controls and CPMI-IOSCO’s “Guidance on cyber resilience for financial market structures,” among others. More such mappings, however, have been requested. To satisfy these requests, the coalition established CRI to facilitate the mapping and validation of regulations, frameworks, guidance, standards etc., from leading jurisdictions and standards setting bodies on an iterative and rolling basis."]
[]
[]
[null,"18.  Are additional supervisory mappings being considered?  If so, what are the timelines for those mappings?"]
[]
[null,"Yes, CRI exists to facilitate this process and ensuring the Profile remains evergreen. Profile v1.1 integrated the National Association of Insurance Commissioners' (NAIC)  own mapping of its IT Handbook amendments and Exhibit C to the Profile. We  also integrated informative references to COBIT, NIST 800-53, and ISO 27000 to fully fill in the newer functions of Governance and Supply Chain/Dependency Management.  "]
[]
[null,"Profile version 1.2 includes granular bidirectional mappings to the FFIEC Cybersecurity Assessment Tool by user request, a mapping to the “FFIEC Information Technology Examination Handbook: Business Continuity Management\" (published November 2019), a more granular mapping to the New York State Department of Financial Services’ (NYDFS) 23 NYCRR Part 500, “Cybersecurity Requirements for Financial Services Companies” (published March 2017), and mappings to the European Central Bank's “Cyber resilience oversight expectations for financial market infrastructures” (published December 2018) and European Banking Authority's (EBA) “EBA Guidelines on ICT and security risk management” (published November 2019)."]
[]
[null,"In 2022, we will be releasing Profile v2.0, which will include additional global regulatory mappings, technology controls, and third-party risk management. To learn more, please feel free to contact CRI."]
[]
[]
[null,"19.  What is the governance structure and the process for Profile maintenance and updates going forward?"]
[]
[null,"CRI is committed to a 2- to 3-year update cycle to iterate new, full versions of the Profile, following cycles similar to those used by other standards bodies, such as the National Institute of Standards and Technology (NIST) and International Standards Organization (ISO). CRI is also committed to more flexible update timeframes to include additional global supervisory expectations as well as any newly issued supervisory expectations."]
[]
[null,"CRI recognizes that users may suggest potential enhancements and new cyber risk management concepts between Profile versions. As these recommendations surface, CRI will evaluate their applicability within the regulatory landscape, utility to a cyber risk management program, and the feasibility of incorporation into a Profile’s next version.  This process of evaluation includes a review by the CRI Board, its other committees, and other stakeholders, as appropriate, as was done to develop the Profile from concept to its first release in Version 1.0. For a roadmap and timelines for future mappings and Profile versions, please refer to the response to FAQ 18 above."]
[]
[]
[null,"20.  Can I add our support to the Profile efforts?  Or Join CRI?"]
[]
[null,"Yes, with open arms!  For more information in participating in working groups, to lend your support, or join CRI, please contact Josh Magri of Cyber Risk Institute (CRI). To participate in Profile peer groups, please contact Denyette DePierro of the American Bankers Association, who helped lead the development of the Profile."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"21.  Finally, are there Terms of Use and Legal Disclaimers Applicable to Profile versions 1.0 and 1.1 usage?"]

{"sheet":"Summary of Changes for v1.2","index":4,"n_rows":82,"n_cols":3,"rows_kept":82,"cut":false,"hidden":false,"merged":[[16,1,16,2],[17,1,17,2]]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"The CRI Profile v1.2"]
[null,"- Summary of Changes -"]
[]
[null,"Tab #","Tab Name"]
[null,1,"v1.2 User Guide"]
[null,1.2,"Title changed to CRI Profile v1.2."]
[null,1.3,"Reference to the Profile is now the CRI Profile rather than the FSSCC Profile."]
[null,1.4,"Included description of Diagnostic Statement responses."]
[null,1.5,"Tenses have changed from suggestive of how a firm may use the Profile to determinative on how firms now use the Profile. "]
[null,1.6,"Removed footnote and moved sentence into body of text."]
[null,1.7,"Multiple grammatical edits to improve clarity."]
[]
[null,2,"v1.2 Impact Qs"]
[null,2.1,"Title changed to CRI Profile v1.2."]
[]
[null,3,"v1.2 Diagnostic Statement"]
[null,3.1,"Title changed to CRI Profile v1.2."]
[null,3.2,"FS References updated with new NYDFS (highlighted in yellow), ECB \"Cyber resilience oversight expectations for financial market infrastructures\", EBA \"Guidelines on ICT and security risk management\", FFIEC CAT and BCM Booklet mappings."]
[]
[null,4,"v1.1 FAQs"]
[null,4.0999999999999996,"Title changed to CRI Profile v1.2."]
[null,4.2,"Updated additional mappings included in v1.2. "]
[null,4.3,"Updated FAQ #7 with hyperlinks."]
[null,4.4000000000000004,"Updated FAQ #14 with recent statements of support by regulators and industry groups."]
[null,4.5,"Revised FAQ #18 to clarify mappings included in v1.2 and future plans for Profile v2.0."]
[null,4.5999999999999996,"Updated FAQs ## 2, 10, 12, and 16 to include \"Call Out Boxes\""]
[null,4.7,"Multiple grammatical edits to improve clarity."]
[]
[null,5,"Summary of Changes for v1.2"]
[null,5.0999999999999996,"Tab moved from Tab 6 to Tab 5."]
[null,5.2,"Title changed to CRI Profile v1.2."]
[null,5.3,"New changes between v1.1 and v1.2 included and old change log stricken."]
[]
[null,6,"Mapping to FFIEC CAT"]
[null,6.1,"<New section added to Profile>"]
[]
[null,7,"FFIEC CAT to CRI Profile"]
[null,7.1,"<New section added to Profile>"]
[]
[null,8,"Mapping to FFIEC BCM Booklet"]
[null,8.1,"<New section added to Profile>"]
[]
[null,9,"Mapping to NYDFS"]
[null,9.1,"<New section added to Profile>"]
[]
[null,10,"Mapping to ECB"]
[null,10.1,"<New section added to Profile>"]
[]
[null,11,"Mapping to EBA"]
[null,11.1,"<New section added to Profile>"]
[]
[null,12,"Catalogue of Mapped Regs"]
[null,12.1,"Added ECB and EBA to the list."]
[null,12.2,"Updated FFIEC Business Continuity Management Booklet."]
[]
[null,13,"Mapping to NAIC HBRS|ExC"]
[null,13.1,"Tab moved from Tab 4 to Tab 13."]
[]
[null,14,"Mapping to NIST CSF v1.1 v2"]
[null,14.1,"Tab moved from Tab 8 to Tab 14."]
[]
[null,15,"Mapping to NAIC HBRS|ExC"]
[null,15.1,"Tab moved from Tab 9 to Tab 15."]
[]
[null,16,"Glossary Terms and Defs"]
[null,16.100000000000001,"Tab moved from Tab 10 to Tab 16."]

{"sheet":"Mapping to FFIEC CAT ","index":5,"n_rows":1218,"n_cols":7,"rows_kept":1218,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Proprietary"]
[]
[null,"CRI Profile to FFIEC CAT Mapping"]
[]
["FFIECNo","FFIECId","FFIECStatement","FSPNo","StmtId","DiagnosticStatement","Mapping Type"]
[1,"D1.G.Ov.B.1","Designated members of management are held accountable by the board or an appropriate board committee for implementing and managing the information security and business continuity programs.",2,"GV.SF-1.2","An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","Full"]
[2,"D1.G.Ov.B.2","Information security risks are discussed in management meetings when prompted by highly visible cyber events or regulatory alerts.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","Full"]
[null,null,null,21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","Full"]
[3,"D1.G.Ov.B.3","Management provides a written report on the overall status of the information security and business continuity programs to the board or an appropriate board committee at least annually.",34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.","Full"]
[4,"D1.G.Ov.B.4","The budgeting process includes information security related expenses and tools.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[null,null,null,33,"GV.RR-2.2","The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO).","Full"]
[5,"D1.G.Ov.B.5","Management considers the risks posed by other critical infrastructures (e.g., telecommunications, energy) to the institution.",238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.","Full"]
[null,null,null,245,"DM.ED-4.1","The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees).","Full"]
[null,null,null,273,"DM.BE-1.1","The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector.","Full"]
[6,"D1.G.Ov.E.1","At least annually, the board or an appropriate board committee reviews and approves the institution’s cybersecurity program.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","Partial"]
[7,"D1.G.Ov.E.2","Management is responsible for ensuring compliance with legal and regulatory requirements related to cybersecurity.",28,"GV.PL-3.1","The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations.","Full"]
[null,null,null,29,"GV.PL-3.2","The organization's cybersecurity policies are consistent with its privacy and civil liberty obligations.","Full"]
[8,"D1.G.Ov.E.3","Cybersecurity tools and staff are requested through the budget process.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Partial"]
[null,null,null,33,"GV.RR-2.2","The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO).","Partial"]
[9,"D1.G.Ov.E.4","There is a process to formally discuss and estimate potential expenses associated with cybersecurity incidents as part of the budgeting process.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Partial"]
[10,"D1.G.Ov.Int.1","The board or an appropriate board committee has cybersecurity expertise or engages experts to assist with oversight responsibilities.",106,"PR.AT-4.1","The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","Full"]
[null,null,null,107,"PR.AT-4.2","Where the organization's governing authority (e.g., the Board or one of its committees) does not have adequate cybersecurity expertise, they should have direct access to the senior officer responsible for cybersecurity to discuss cybersecurity related matters.","Full"]
[11,"D1.G.Ov.Int.2","The standard board meeting package includes reports and metrics that go beyond events and incidents to address threat intelligence trends and the institution’s security posture.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","Full"]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.","Full"]
[12,"D1.G.Ov.Int.3","The institution has a cyber risk appetite statement approved by the board or an appropriate board committee.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","Full"]
[13,"D1.G.Ov.Int.4","Cyber risks that exceed the risk appetite are escalated to management.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","Full"]
[14,"D1.G.Ov.Int.5","The board or an appropriate board committee ensures management’s annual cybersecurity self-assessment evaluates the institution’s ability to meet its cyber risk management standards.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","Full"]
[15,"D1.G.Ov.Int.6","The board or an appropriate board committee reviews and approves management’s prioritization and resource allocation decisions based on the results of the cyber assessments.",15,"GV.RM-1.5","The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls.","Full"]
[16,"D1.G.Ov.Int.7","The board or an appropriate board committee ensures management takes appropriate actions to address changing cyber risks or significant cybersecurity issues.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","Full"]
[null,null,null,13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Full"]
[17,"D1.G.Ov.Int.8","The budget process for requesting additional cybersecurity staff and tools is integrated into business units’ budget processes.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Partial"]
[18,"D1.G.Ov.A.1","The board or board committee approved cyber risk appetite statement is part of the enterprise-wide risk appetite statement.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","Full"]
[19,"D1.G.Ov.A.2","Management has a formal process to continuously improve cybersecurity oversight.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Partial"]
[20,"D1.G.Ov.A.3","The budget process for requesting additional cybersecurity staff and tools maps current resources and tools to the cybersecurity strategy.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Partial"]
[21,"D1.G.Ov.A.4","Management and the board or an appropriate board committee hold business units accountable for effectively managing all cyber risks associated with their activities.",2,"GV.SF-1.2","An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","Full"]
[22,"D1.G.Ov.A.5","Management identifies root cause(s) when cyber attacks result in material loss.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector.","Partial"]
[23,"D1.G.Ov.A.6","The board or an appropriate board committee ensures that management’s actions consider the cyber risks that the institution poses to the financial sector.",4,"GV.SF-1.4","The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry.","Full"]
[null,null,null,266,"DM.RS-1.2","The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","Full"]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications.","Full"]
[null,null,null,272,"DM.RS-2.5","When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems.","Partial"]
[null,null,null,273,"DM.BE-1.1","The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector.","Partial"]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","Partial"]
[24,"D1.G.Ov.Inn.1","The board or an appropriate board committee discusses ways for management to develop cybersecurity improvements that may be adopted sector-wide.",999,"None","None"]
[25,"D1.G.Ov.Inn.2","The board or an appropriate board committee verifies that management’s actions consider the cyber risks that the institution poses to other critical infrastructures (e.g., telecommunications, energy).",3,"GV.SF-1.3","The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them.","Full"]
[null,null,null,266,"DM.RS-1.2","The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","Full"]
[null,null,null,273,"DM.BE-1.1","The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector.","Full"]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","Full"]
[26,"D1.G.SP.B.1","The institution has an information security strategy that integrates technology, policies, procedures, and training to mitigate risk.",1,"GV.SF-1.1","The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","Full"]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","Full"]
[27,"D1.G.SP.B.2","The institution has policies commensurate with its risk and complexity that address the concepts of information technology risk management.",13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Full"]
[null,null,null,25,"GV.PL-2.1","The cybersecurity policy is supported by the organization's risk management program.","Full"]
[28,"D1.G.SP.B.3","The institution has policies commensurate with its risk and complexity that address the concepts of threat information sharing.",133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Partial"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Partial"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Partial"]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Partial"]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","Partial"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Partial"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Partial"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Partial"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Partial"]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","Partial"]
[29,"D1.G.SP.B.4","The institution has board-approved policies commensurate with its risk and complexity that address information security.",23,"GV.PL-1.1","The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","Full"]
[null,null,null,25,"GV.PL-2.1","The cybersecurity policy is supported by the organization's risk management program.","Full"]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","Full"]
[30,"D1.G.SP.B.5","The institution has policies commensurate with its risk and complexity that address the concepts of external dependency or third-party management.",235,"DM.ED-1.1","The organization has integrated its external dependency management strategy into the overall cyber risk management plan.","Full"]
[null,null,null,238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.","Partial"]
[31,"D1.G.SP.B.6","The institution has policies commensurate with its risk and complexity that address the concepts of incident response and resilience.",265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Partial"]
[32,"D1.G.SP.B.7","All elements of the information security program are coordinated enterprise-wide.",1,"GV.SF-1.1","The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","Full"]
[33,"D1.G.SP.E.1","The institution augmented its information security strategy to incorporate cybersecurity and resilience.",36,"GV.SP-1.1","The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite.","Full"]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[34,"D1.G.SP.E.2","The institution has a formal cybersecurity program that is based on technology and security industry standards or benchmarks.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","Full"]
[35,"D1.G.SP.E.3","A formal process is in place to update policies as the institution’s inherent risk profile changes.",27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Full"]
[36,"D1.G.SP.Int.1","The institution has a comprehensive set of policies commensurate with its risk and complexity that address the concepts of threat intelligence.",75,"ID.RA-5.1","Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.","Full"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[37,"D1.G.SP.Int.2","Management periodically reviews the cybersecurity strategy to address evolving cyber threats and changes to the institution’s inherent risk profile.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","Full"]
[null,null,null,18,"GV.RM-2.2","The cyber risk management strategy articulates how the organization intends to address its inherent cyber risk (before mitigating controls or other factors are taken into consideration).","Partial"]
[null,null,null,75,"ID.RA-5.1","Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.","Full"]
[38,"D1.G.SP.Int.3","The cybersecurity strategy is incorporated into, or conceptually fits within, the institution’s enterprise-wide risk management strategy.",20,"GV.RM-3.1","The cyber risk management framework is integrated into the enterprise risk management framework.","Full"]
[39,"D1.G.SP.Int.4","Management links strategic cybersecurity objectives to tactical goals.",5,"GV.SF-1.5","The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","Partial"]
[null,null,null,12,"GV.RM-1.2","The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.","Full"]
[40,"D1.G.SP.Int.5","A formal process is in place to cross-reference and simultaneously update all policies related to cyber risks across business lines.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","Full"]
[null,null,null,27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Partial"]
[41,"D1.G.SP.A.1","The cybersecurity strategy outlines the institution’s future state of cybersecurity with short-term and long-term perspectives.",5,"GV.SF-1.5","The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","Full"]
[42,"D1.G.SP.A.2","Industry-recognized cybersecurity standards are used as sources during the analysis of cybersecurity program gaps.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","Full"]
[43,"D1.G.SP.A.3","The cybersecurity strategy identifies and communicates the institution’s role as a component of critical infrastructure in the financial services industry.",4,"GV.SF-1.4","The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry.","Full"]
[44,"D1.G.SP.A.4","The risk appetite is informed by the institution’s role in critical infrastructure.",10,"GV.SF-4.1","The risk appetite is informed by the organization’s role in critical infrastructure.","Full"]
[45,"D1.G.SP.A.5","Management is continuously improving the existing cybersecurity program to adapt as the desired cybersecurity target state changes.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[46,"D1.G.SP.Inn.1","The cybersecurity strategy identifies and communicates the institution's role as it relates to other critical infrastructures.",3,"GV.SF-1.3","The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them.","Partial"]
[47,"D1.G.IT.B.1","An inventory of organizational assets (e.g., hardware, software, data, and systems hosted externally) is maintained.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","Full"]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications.","Full"]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.","Full"]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems.","Full"]
[48,"D1.G.IT.B.2","Organizational assets (e.g., hardware, systems, data, and applications) are prioritized for protection based on the data classification and business value.",67,"ID.AM-5.2","The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[49,"D1.G.IT.B.3","Management assigns accountability for maintaining an inventory of organizational assets.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","Full"]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications.","Full"]
[50,"D1.G.IT.B.4","A change management process is in place to request and approve changes to systems configurations, hardware, software, applications, and security tools.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Partial"]
[51,"D1.G.IT.E.1","The asset inventory, including identification of critical assets, is updated at least annually to address new, relocated, re-purposed, and sunset assets.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","Full"]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications.","Full"]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.","Full"]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems.","Full"]
[52,"D1.G.IT.E.2","The institution has a documented asset life-cycle process that considers whether assets to be acquired have appropriate security safeguards.",57,"GV.TE-1.1","The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception.","Full"]
[null,null,null,59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure.","Full"]
[null,null,null,113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Full"]
[null,null,null,123,"PR.IP-2.2","The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications.","Full"]
[53,"D1.G.IT.E.3","The institution proactively manages system EOL (e.g., replacement) to limit security risks.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Full"]
[54,"D1.G.IT.E.4","Changes are formally approved by an individual or committee with appropriate authority and with separation of duties.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Partial"]
[55,"D1.G.IT.Int.1","Baseline configurations cannot be altered without a formal change request, documented approval, and an assessment of security implications.",119,"PR.IP-1.1","The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","Full"]
[null,null,null,125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Full"]
[56,"D1.G.IT.Int.2","A formal IT change management process requires cybersecurity risk to be evaluated during the analysis, approval, testing, and reporting of changes.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Full"]
[57,"D1.G.IT.A.1","Supply chain risk is reviewed before the acquisition of mission-critical information systems including system components.",238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.","Full"]
[null,null,null,249,"DM.ED-4.5","The organization establishes contingencies to address circumstances that might put a vendor out of business or severely impact delivery of services to the organization, sector-critical systems, or the financial sector as a whole.","Full"]
[58,"D1.G.IT.A.2","Automated tools enable tracking, updating, asset prioritizing, and custom reporting of the asset inventory.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","Full"]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications.","Full"]
[59,"D1.G.IT.A.3","Automated processes are in place to detect and block unauthorized changes to software and hardware.",175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Full"]
[null,null,null,177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","Full"]
[60,"D1.G.IT.A.4","The change management system uses thresholds to determine when a risk assessment of the impact of the change is required.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Partial"]
[61,"D1.G.IT.Inn.1","A formal change management function governs decentralized or highly distributed change requests and identifies and measures security risks that may cause increased exposure to cyber attack.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Full"]
[62,"D1.G.IT.Inn.2","Comprehensive automated enterprise tools are implemented to detect and block unauthorized changes to software and hardware.",175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Partial"]
[null,null,null,177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","Partial"]
[63,"D1.RM.RMP.B.1","An information security and business continuity risk management function(s) exists within the institution.",36,"GV.SP-1.1","The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite.","Full"]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[64,"D1.RM.RMP.E.1","The risk management program incorporates cyber risk identification, measurement, mitigation, monitoring, and reporting.",11,"GV.RM-1.1","The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","Full"]
[65,"D1.RM.RMP.E.2","Management reviews and uses the results of audits to improve existing cybersecurity policies, procedures, and controls.",52,"GV.AU-2.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector.","Full"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Partial"]
[66,"D1.RM.RMP.E.3","Management monitors moderate and high residual risk issues from the cybersecurity risk assessment until items are addressed.",11,"GV.RM-1.1","The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","Full"]
[null,null,null,19,"GV.RM-2.3","The cyber risk management strategy articulates how the organization would maintain an acceptable level of residual cyber risk set by the appropriate governing authority (e.g., the Board or one of its committees).","Full"]
[null,null,null,21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","Full"]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","Full"]
[67,"D1.RM.RMP.Int.1","The cybersecurity function has a clear reporting line that does not present a conflict of interest.",22,"GV.RM-3.3","The organization's cyber risk management framework provides for segregation of duties between policy development, implementation, and oversight to ensure rigorous review of both policy and implementation.","Full"]
[68,"D1.RM.RMP.Int.2","The risk management program specifically addresses cyber risks beyond the boundaries of the technological impacts (e.g., financial, strategic, regulatory, compliance).",69,"ID.RA-1.1","The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","Full"]
[69,"D1.RM.RMP.Int.3","Benchmarks or target performance metrics have been established for showing improvements or regressions of the security posture over time.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics.","Full"]
[70,"D1.RM.RMP.Int.4","Management uses the results of independent audits and reviews to improve cybersecurity.",55,"GV.AU-3.2","An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution.","Full"]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Full"]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[71,"D1.RM.RMP.Int.5","There is a process to analyze and assign potential losses and related expenses, by cost center, associated with cybersecurity incidents.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector.","Full"]
[72,"D1.RM.RMP.A.1","Cybersecurity metrics are used to facilitate strategic decision-making and funding in areas of need.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics.","Full"]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.","Full"]
[null,null,null,40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[73,"D1.RM.RMP.A.2","Independent risk management sets and monitors cyber-related risk limits for business units.",45,"GV.IR-2.1","An independent risk management function assesses the appropriateness of the cyber risk management program according to the organization's risk appetite.","Full"]
[null,null,null,46,"GV.IR-2.2","An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","Full"]
[74,"D1.RM.RMP.A.3","Independent risk management staff escalates to management and the board or an appropriate board committee significant discrepancies from business unit’s assessments of cyber-related risk.",56,"GV.AU-3.3","An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization.","Full"]
[75,"D1.RM.RMP.A.4","A process is in place to analyze the financial impact cyber incidents have on the institution’s capital.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector.","Full"]
[76,"D1.RM.RMP.A.5","The cyber risk data aggregation and real-time reporting capabilities support the institution’s ongoing reporting needs, particularly during cyber incidents.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[77,"D1.RM.RMP.Inn.1","The risk management function identifies and analyzes commonalities in cyber events that occur both at the institution and across other sectors to enable more predictive risk management.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Partial"]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","Full"]
[78,"D1.RM.RMP.Inn.2","A process is in place to analyze the financial impact that a cyber incident at the institution may have across the financial sector.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","Full"]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","Full"]
[79,"D1.RM.RA.B.1","A risk assessment focused on safeguarding customer information identifies reasonable and foreseeable internal and external threats, the likelihood and potential damage of threats, and the sufficiency of policies, procedures, and customer information syste",11,"GV.RM-1.1","The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","Full"]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","Full"]
[null,null,null,74,"ID.RA-4.1","The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited.","Full"]
[80,"D1.RM.RA.B.2","The risk assessment identifies internet-based systems and high-risk transactions that warrant additional authentication controls.",67,"ID.AM-5.2","The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[null,null,null,95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm.","Full"]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[81,"D1.RM.RA.B.3","The risk assessment is updated to address new technologies, products, services, and connections before deployment.",13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Full"]
[82,"D1.RM.RA.E.1","Risk assessments are used to identify the cybersecurity risks stemming from new products, services, or relationships.",13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Full"]
[83,"D1.RM.RA.E.2","The focus of the risk assessment has expanded beyond customer information to address all information assets.",69,"ID.RA-1.1","The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","Full"]
[84,"D1.RM.RA.E.3","The risk assessment considers the risk of using EOL software and hardware components.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Partial"]
[85,"D1.RM.RA.Int.1","The risk assessment is adjusted to consider widely known risks or risk management practices.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","Full"]
[86,"D1.RM.RA.A.1","An enterprise-wide risk management function incorporates cyber threat analysis and specific risk exposure as part of the enterprise risk assessment.",14,"GV.RM-1.4","The cyber risk assessment process is consistent with the organization's policies and procedures and includes criteria for the evaluation and categorization of enterprise-specific cyber risks and threats.","Full"]
[87,"D1.RM.RA.Inn.1","The risk assessment is updated in real time as changes to the risk profile occur, new applicable standards are released or updated, and new exposures are anticipated.",59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure.","Full"]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them.","Full"]
[88,"D1.RM.RA.Inn.2","The institution uses information from risk assessments to predict threats and drive real-time responses.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Partial"]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Partial"]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them.","Partial"]
[89,"D1.RM.RA.Inn.3","Advanced or automated analytics offer predictive information and real-time risk metrics.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[90,"D1.G.RM.Au.B.1","Independent audit or review evaluates policies, procedures, and controls across the institution for significant risks and control issues associated with the institution's operations, including risks in new products, emerging technologies, and information",48,"GV.AU-1.1","The organization has an independent audit function.","Full"]
[null,null,null,49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.","Full"]
[null,null,null,50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Full"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[91,"D1.RM.Au.B.2","The independent audit function validates controls related to the storage or transmission of confidential data.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Full"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[92,"D1.RM.Au.B.3","Logging practices are independently reviewed periodically to ensure appropriate log management (e.g., access controls, retention, and maintenance).",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time.","Partial"]
[null,null,null,161,"DE.CM-1.1","The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods.","Partial"]
[93,"D1.RM.Au.B.4","Issues and corrective actions from internal audits and independent testing/assessments are formally tracked to ensure procedures and control lapses are resolved in a timely manner.",55,"GV.AU-3.2","An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution.","Full"]
[94,"D1.RM.Au.E.1","The independent audit function validates that the risk management function is commensurate with the institution’s risk and complexity.",49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.","Partial"]
[95,"D1.RM.Au.E.2","The independent audit function validates that the institution’s threat information sharing is commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Full"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","Full"]
[96,"D1.RM.Au.E.3","The independent audit function validates that the institution’s cybersecurity controls function is commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Partial"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Partial"]
[97,"D1.RM.Au.E.4","The independent audit function validates that the institution’s third-party relationship management is commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Partial"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Partial"]
[98,"D1.RM.Au.E.5","The independent audit function validates that the institution’s incident response program and resilience are commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Partial"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[99,"D1.RM.Au.Int.1","A formal process is in place for the independent audit function to update its procedures based on changes to the institution’s inherent risk profile.",52,"GV.AU-2.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector.","Partial"]
[null,null,null,53,"GV.AU-2.2","A formal process is in place for the independent audit function to update its procedures based on changes to the organization's risk appetite and risk tolerance.","Partial"]
[100,"D1.RM.Au.Int.2","The independent audit function validates that the institution’s threat intelligence and collaboration are commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Partial"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Partial"]
[101,"D1.RM.Au.Int.3","The independent audit function regularly reviews management’s cyber risk appetite statement.",49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.","Partial"]
[null,null,null,53,"GV.AU-2.2","A formal process is in place for the independent audit function to update its procedures based on changes to the organization's risk appetite and risk tolerance.","Partial"]
[102,"D1.RM.Au.Int.4","Independent audits or reviews are used to identify gaps in existing security capabilities and expertise.",54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures.","Full"]
[103,"D1.RM.Au.A.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector.",52,"GV.AU-2.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector.","Full"]
[104,"D1.RM.Au.A.2","The independent audit function regularly reviews the institution’s cyber risk appetite statement in comparison to assessment results and incorporates gaps into the audit strategy.",49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.","Full"]
[105,"D1.RM.Au.A.3","Independent audits or reviews are used to identify cybersecurity weaknesses, root causes, and the potential impact to business units.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Full"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[106,"D1.RM.Au.Inn.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across other sectors the institution depends upon.",274,"DM.BE-1.2","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across other sectors the institution depends upon.","Full"]
[107,"D1.RM.Au.Inn.2","The independent audit function uses sophisticated data mining tools to perform continuous monitoring of cybersecurity processes or controls.",999,"None","None"]
[108,"D1.R.St.B.1","Information security roles and responsibilities have been identified.",31,"GV.RR-1.1","The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","Full"]
[null,null,null,68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[null,null,null,234,"DM.ID-2.1","Roles and responsibilities for internal dependency management are defined and assigned.","Full"]
[null,null,null,243,"DM.ED-3.1","Roles and responsibilities for external dependency management are defined and assigned.","Full"]
[109,"D1.R.St.B.2","Processes are in place to identify additional expertise needed to improve information security defenses.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Full"]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Full"]
[110,"D1.R.St.E.1","A formal process is used to identify cybersecurity tools and expertise that may be needed.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[111,"D1.R.St.E.2","Management with appropriate knowledge and experience leads the institution's cybersecurity efforts.",101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures.","Full"]
[112,"D1.R.St.E.3","Staff with cybersecurity responsibilities have the requisite qualifications to perform the necessary tasks of the position.",101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures.","Full"]
[113,"D1.R.St.E.4","Employment candidates, contractors, and third parties are subject to background verification proportional to the confidentiality of the data accessed, business requirements, and acceptable risk.",140,"PR.IP-11.1","The organization conducts background/screening checks on all new employees, as permitted by law.","Full"]
[null,null,null,141,"PR.IP-11.2","The organization conducts background/screening checks on all staff at regular intervals throughout their employment, commensurate with staff’s access to critical systems or a change in role, as permitted by law.","Full"]
[114,"D1.R.St.Int.1","The institution has a program for talent recruitment, retention, and succession planning for the cybersecurity and resilience staffs.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[115,"D1.R.St.A.1","The institution benchmarks its cybersecurity staffing against peers to identify whether its recruitment, retention, and succession planning are commensurate.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[116,"D1.R.St.A.2","Dedicated cybersecurity staff develops, or contributes to developing, integrated enterprise-level security and cyber defense strategies.",27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Full"]
[117,"D1.R.St.Inn.1","The institution actively partners with industry associations and academia to inform curricula based on future cybersecurity staffing needs of the industry.",999,"None","None","Full"]
[118,"D1.TC.Tr.B.1","Annual information security training is provided.",97,"PR.AT-1.1","All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","Full"]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.","Full"]
[119,"D1.TC.Tr.B.2","Annual information security training includes incident response, current cyber threats (e.g., phishing, spear phishing, social engineering, and mobile security), and emerging issues.",97,"PR.AT-1.1","All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","Full"]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.","Full"]
[120,"D1.TC.Tr.B.3","Situational awareness materials are made available to employees when prompted by highly visible cyber events or by regulatory alerts.",97,"PR.AT-1.1","All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[121,"D1.TC.Tr.B.4","Customer awareness materials are readily available (e.g., DHS’ Cybersecurity Awareness Month materials).",103,"PR.AT-3.1","The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate.","Full"]
[122,"D1.TC.Tr.E.1","The institution has a program for continuing cybersecurity training and skill development for cybersecurity staff.",100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[null,null,null,101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures.","Full"]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures.","Full"]
[123,"D1.TC.Tr.E.2","Management is provided cybersecurity training relevant to their job responsibilities.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization.","Full"]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[null,null,null,101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures.","Full"]
[null,null,null,106,"PR.AT-4.1","The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","Full"]
[124,"D1.TC.Tr.E.3","Employees with privileged account permissions receive additional cybersecurity training commensurate with their levels of responsibility.",84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored.","Full"]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[125,"D1.TC.Tr.E.4","Business units are provided cybersecurity training relevant to their particular business risks.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization.","Full"]
[null,null,null,84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored.","Full"]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.","Full"]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[null,null,null,105,"PR.AT-3.3","Cybersecurity training covers topics designed to minimize risks to or from interconnected parties.","Full"]
[126,"D1.TC.Tr.E.5","The institution validates the effectiveness of training (e.g., social engineering or phishing tests).",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[null,null,null,84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored.","Full"]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","Full"]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures.","Full"]
[127,"D1.TC.Tr.Int.1","Management incorporates lessons learned from social engineering and phishing exercises to improve the employee awareness programs.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","Full"]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Full"]
[128,"D1.TC.Tr.Int.2","Cybersecurity awareness information is provided to retail customers and commercial clients at least annually.",103,"PR.AT-3.1","The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate.","Full"]
[129,"D1.TC.Tr.Int.3","Business units are provided cybersecurity training relevant to their particular business risks, over and above what is required of the institution as a whole.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization.","Full"]
[null,null,null,84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored.","Full"]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.","Full"]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[null,null,null,105,"PR.AT-3.3","Cybersecurity training covers topics designed to minimize risks to or from interconnected parties.","Full"]
[130,"D1.TC.Tr.Int.4","The institution routinely updates its training to security staff to adapt to new threats.",99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","Full"]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[null,null,null,101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures.","Full"]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures.","Full"]
[131,"D1.TC.Tr.A.1","Independent directors are provided with cybersecurity training that addresses how complex products, services, and lines of business affect the institution's cyber risk.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization.","Full"]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[null,null,null,106,"PR.AT-4.1","The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","Full"]
[132,"D1.TC.Tr.Inn.1","Key performance indicators are used to determine whether training and awareness programs positively influence behavior.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","Full"]
[133,"D1.TC.Cu.B.1","Management holds employees accountable for complying with the information security program.",24,"GV.PL-1.2","The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","Full"]
[134,"D1.TC.Cu.E.1","The institution has formal standards of conduct that hold all employees accountable for complying with cybersecurity policies and procedures.",24,"GV.PL-1.2","The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","Full"]
[135,"D1.TC.Cu.E.2","Cyber risks are actively discussed at business unit meetings.",12,"GV.RM-1.2","The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.","Full"]
[null,null,null,34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[136,"D1.TC.Cu.E.3","Employees have a clear understanding of how to identify and escalate potential cybersecurity issues.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","Full"]
[null,null,null,81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk.","Full"]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.","Full"]
[137,"D1.TC.Cu.Int.1","Management ensures performance plans are tied to compliance with cybersecurity policies and standards in order to hold employees accountable.",24,"GV.PL-1.2","The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","Full"]
[138,"D1.TC.Cu.Int.2","The risk culture requires formal consideration of cyber risks in all business decisions.",12,"GV.RM-1.2","The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.","Full"]
[139,"D1.TC.Cu.Int.3","Cyber risk reporting is presented and discussed at the independent risk management meetings.",34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.","Full"]
[null,null,null,41,"GV.IR-1.1","The organization's enterprise-wide cyber risk management framework includes an independent risk management function that provides assurance that the cyber risk management framework is implemented as intended.","Full"]
[null,null,null,43,"GV.IR-1.3","The independent risk management function has appropriate understanding of the organization's structure, cybersecurity program, and relevant risks and threats.","Full"]
[null,null,null,45,"GV.IR-2.1","An independent risk management function assesses the appropriateness of the cyber risk management program according to the organization's risk appetite.","Full"]
[null,null,null,46,"GV.IR-2.2","An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","Full"]
[null,null,null,82,"ID.RA-6.2","Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units.","Full"]
[140,"D1.TC.Cu.A.1","Management ensures continuous improvement of cyber risk cultural awareness.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.","Full"]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","Full"]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Full"]
[141,"D1.TC.Cu.Inn.1","The institution leads efforts to promote cybersecurity culture across the sector and to other sectors that they depend upon.",999,"None","None","Full"]
[142,"D2.TI.Ti.B.1","The institution belongs or subscribes to a threat and vulnerability information sharing source(s) that provides information on threats (e.g., Financial Services Information Sharing and Analysis Center [FS-ISAC], U.S. Computer Emergency Readiness Team [US-",133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Full"]
[143,"D2.TI.Ti.B.2","Threat information is used to monitor threats and vulnerabilities.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[144,"D2.TI.Th.B.3","Threat information is used to enhance internal risk management and controls.",186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[145,"D2.TI.Ti.E.1","Threat information received by the institution includes analysis of tactics, patterns, and risk mitigation recommendations.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[146,"D2.TI.Th.Int.1","A formal threat intelligence program is implemented and includes subscription to threat feeds from external providers and internal sources.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[147,"D2.TI.Ti.Int.2","Protocols are implemented for collecting information from industry peers and government.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[148,"D2.TI.Ti.Int.3","A read-only, central repository of cyber threat intelligence is maintained.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[149,"D2.TI.Ti.A.1","A cyber intelligence model is used for gathering threat information.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[null,null,null,73,"ID.RA-3.3","The organization regularly reviews and updates results of its cyber threat analysis.","Full"]
[null,null,null,77,"ID.RA-5.3","The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","Full"]
[150,"D2.TI.Ti.A.2","Threat intelligence is automatically received from multiple sources in real time.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[151,"D2.TI.Ti.A.3","The institution’s threat intelligence includes information related to geopolitical events that could increase cybersecurity threat levels.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[152,"D2.TI.Ti.Inn.1","A threat analysis system automatically correlates threat data to specific risks and then takes risk-based automated actions while alerting management.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[153,"D2.TI.Ti.Inn.2","The institution is investing in the development of new threat intelligence and collaboration mechanisms (e.g., technologies, business processes) that will transform how information is gathered and shared.",999,"None","None"]
[154,"D2.MA.Ma.B.1","Audit log records and other security event logs are reviewed and retained in a secure manner.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time.","Full"]
[null,null,null,161,"DE.CM-1.1","The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods.","Full"]
[155,"D2.MA.Ma.B.2","Computer event logs are used for investigations once an event has occurred.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","Full"]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","Full"]
[156,"D2.MA.Ma.E.1","A process is implemented to monitor threat information to discover emerging threats.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[null,null,null,72,"ID.RA-3.2","The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past.","Full"]
[null,null,null,73,"ID.RA-3.3","The organization regularly reviews and updates results of its cyber threat analysis.","Full"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[null,null,null,156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.","Full"]
[157,"D2.MA.Ma.E.2","The threat information and analysis process is assigned to a specific group or individual.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[158,"D2.MA.Ma.E.3","Security processes and technology are centralized and coordinated in a Security Operations Center (SOC) or equivalent.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.","Partial"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Partial"]
[159,"D2.MA.Ma.E.4","Monitoring systems operate continuously with adequate support for efficient incident handling.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Partial"]
[160,"D2.MA.Ma.Int.1","A threat intelligence team is in place that evaluates threat intelligence from multiple sources for credibility, relevance, and exposure.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Full"]
[161,"D2.MA.Ma.Int.2","A profile is created for each threat that identifies the likely intent, capability, and target of the threat.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[null,null,null,156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[162,"D2.MA.Ma.Int.3","Threat information sources that address all components of the threat profile are prioritized and monitored.",206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Partial"]
[163,"D2.MA.Ma.Int.4","Threat intelligence is analyzed to develop cyber threat summaries including risks to the institution and specific actions for the institution to consider.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[null,null,null,156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Partial"]
[164,"D2.MA.Ma.A.1","A dedicated cyber threat identification and analysis committee or team exists to centralize and coordinate initiatives and communications.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Full"]
[165,"D2.MA.Ma.A.2","Formal processes have been defined to resolve potential conflicts in information received from sharing and analysis centers or other sources.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Partial"]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Partial"]
[166,"D2.MA.Ma.A.3","Emerging internal and external threat intelligence and correlated log analysis are used to predict future attacks.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[167,"D2.MA.Ma.A.4","Threat intelligence is viewed within the context of the institution's risk profile and risk appetite to prioritize mitigating actions in anticipation of threats.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","Full"]
[null,null,null,71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[null,null,null,72,"ID.RA-3.2","The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past.","Full"]
[null,null,null,73,"ID.RA-3.3","The organization regularly reviews and updates results of its cyber threat analysis.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[168,"D2.MA.Ma.A.5","Threat intelligence is used to update architecture and configuration standards.",999,"None","None"]
[169,"D2.MA.Ma.Inn.1","The institution uses multiple sources of intelligence, correlated log analysis, alerts, internal traffic flows, and geopolitical events to predict potential future attacks and attack trends.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Full"]
[170,"D2.MA.Ma.Inn.2","Highest risk scenarios are used to predict threats against specific business targets.",67,"ID.AM-5.2","The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[null,null,null,136,"PR.IP-10.1","The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[171,"D2.MA.Ma.Inn.3","IT systems automatically detect configuration weaknesses based on threat intelligence and alert management so actions can be prioritized.",177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","Partial"]
[172,"D2.IS.Is.B.1","Information security threats are gathered and shared with applicable internal employees.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[173,"D2.IS.Is.B.2","Contact information for law enforcement and the regulator(s) is maintained and updated regularly.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[174,"D2.IS.Is.B.3","Information about threats is shared with law enforcement and regulators when required or prompted.",133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[175,"D2.IS.Is.E.1","A formal and secure process is in place to share threat and vulnerability information with other entities.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","Full"]
[176,"D2.IS.Is.E.2","A representative from the institution participates in law enforcement or information-sharing organization meetings.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Partial"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Partial"]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Partial"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Partial"]
[177,"D2.IS.Is.Int.1","A formal protocol is in place for sharing threat, vulnerability, and incident information to employees based on their specific job function.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[178,"D2.IS.Is.Int.2","Information-sharing agreements are used as needed or required to facilitate sharing threat information with other financial sector organizations or third parties.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","Full"]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[179,"D2.IS.Is.Int.3","Information is shared proactively with the industry, law enforcement, regulators, and information-sharing forums.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","Full"]
[180,"D2.IS.Is.Int.4","A process is in place to communicate and collaborate with the public sector regarding cyber threats.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","Full"]
[181,"D2.IS.Is.A.1","Management communicates threat intelligence with business risk context and specific risk management recommendations to the business units.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","Full"]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[null,null,null,229,"RC.CO-3.1","The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[182,"D2.IS.Is.A.2","Relationships exist with employees of peer institutions for sharing cyber threat intelligence.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","Full"]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","Full"]
[183,"D2.IS.Is.A.3","A network of trust relationships (formal and/or informal) has been established to evaluate information about cyber threats.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","Full"]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","Full"]
[184,"D2.IS.Is.Inn.1","A mechanism is in place for sharing cyber threat intelligence with business units in real time including the potential financial and operational impact of inaction.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[185,"D2.IS.Is.Inn.2","A system automatically informs management of the level of business risk specific to the institution and the progress of recommended steps taken to mitigate the risks.",81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[186,"D2.IS.Is.Inn.3","The institution is leading efforts to create new sector-wide information- sharing channels to address gaps in external-facing information-sharing mechanisms.",999,"None","None"]
[187,"D3.PC.Im.B.1","Network perimeter defense tools (e.g., border router and firewall) are used.",153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Full"]
[188,"D3.PC.Im.B.2","Systems that are accessed from the Internet or by external parties are protected by firewalls or other similar devices.",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security.","Full"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Partial"]
[189,"D3.PC.Im.B.3","All ports are monitored.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[190,"D3.PC.Im.B.4","Up to date antivirus and anti-malware tools are used.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","Partial"]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Partial"]
[191,"D3.PC.Im.B.5","Systems configurations (for servers, desktops, routers, etc.) follow industry standards and are enforced.",59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure.","Partial"]
[null,null,null,91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use.","Partial"]
[null,null,null,119,"PR.IP-1.1","The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","Partial"]
[null,null,null,121,"PR.IP-1.3","The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified.","Partial"]
[null,null,null,152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality.","Partial"]
[192,"D3.PC.Im.B.6","Ports, functions, protocols and services are prohibited if no longer needed for business purposes.",152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality.","Full"]
[193,"D3.PC.Im.B.7","Access to make changes to systems configurations (including virtual machines and hypervisors) is controlled and monitored.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[194,"D3.PC.Im.B.8","Programs that can override system, object, network, virtual machine, and application controls are restricted.",91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use.","Partial"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Full"]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Partial"]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Partial"]
[195,"D3.PC.Im.B.9","System sessions are locked after a pre-defined period of inactivity and are terminated after pre-defined conditions are met.",86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms).","Full"]
[196,"D3.PC.Im.B.10","Wireless network environments require security settings with strong encryption for authentication and transmission. (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Full"]
[197,"D3.PC.Im.E.1","There is a firewall at each Internet connection and between any Demilitarized Zone (DMZ) and internal network(s).",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security.","Full"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Partial"]
[198,"D3.PC.Im.E.2","Antivirus and intrusion detection/prevention systems (IDS/IPS) detect and block actual and attempted attacks or intrusions.",163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery.","Full"]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Full"]
[199,"D3.PC.Im.E.3","Technical controls prevent unauthorized devices, including rogue wireless access devices and removable media, from connecting to the internal network(s).",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Full"]
[200,"D3.PC.Im.E.4","A risk-based solution is in place at the institution or Internet hosting provider to mitigate disruptive cyber attacks (e.g., DDoS attacks).",164,"DE.CM-1.4","The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks.","Full"]
[201,"D3.PC.Im.E.5","Guest wireless networks are fully segregated from the internal network(s). (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Full"]
[202,"D3.PC.Im.E.6","Domain Name System Security Extensions (DNSSEC) is deployed across the enterprise.",999,"None","None"]
[203,"D3.PC.Im.E.7","Critical systems supported by legacy technologies are regularly reviewed to identify for potential vulnerabilities, upgrade opportunities, or new defense layers.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Full"]
[null,null,null,146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Full"]
[204,"D3.PC.Im.E.8","Controls for unsupported systems are implemented and tested.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Full"]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Full"]
[205,"D3.PC.Im.Int.1","The enterprise network is segmented in multiple, separate trust/security zones with defense-in-depth strategies (e.g., logical network segmentation, hard backups, air-gapping) to mitigate attacks.",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security.","Full"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Full"]
[206,"D3.PC.Im.Int.2","Security controls are used for remote access to all administrative consoles, including restricted virtual systems.",87,"PR.AC-3.1","Remote access is actively managed and restricted to necessary systems.","Full"]
[null,null,null,90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[207,"D3.PC.Im.Int.3","Wireless network environments have perimeter firewalls that are implemented and configured to restrict unauthorized traffic. (*N/A if there are no wireless networks.)",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security.","Full"]
[null,null,null,93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Full"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Full"]
[208,"D3.PC.Im.Int.4","Wireless networks use strong encryption with encryption keys that are changed frequently. (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Partial"]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[209,"D3.PC.Im.Int.5","The broadcast range of the wireless network(s) is confined to institution-controlled boundaries. (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Partial"]
[210,"D3.PC.Im.Int.6","Technical measures are in place to prevent the execution of unauthorized code on institution owned or managed devices, network infrastructure, and systems components.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Full"]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Full"]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Full"]
[211,"D3.PC.Im.A.1","Network environments and virtual instances are designed and configured to restrict and monitor traffic between trusted and untrusted zones.",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security.","Full"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[212,"D3.PC.Im.A.2","Only one primary function is permitted per server to prevent functions that require different security levels from co-existing on the same server.",152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality.","Partial"]
[213,"D3.PC.Im.A.3","Anti-spoofing measures are in place to detect and block forged source IP addresses from entering the network.",164,"DE.CM-1.4","The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks.","Full"]
[214,"D3.PC.Im.Inn.1","The institution risk scores all of its infrastructure assets and updates in real time based on threats, vulnerabilities, or operational changes.",77,"ID.RA-5.3","The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","Partial"]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","Partial"]
[215,"D3.PC.Im.Inn.2","Automated controls are put in place based on risk scores to infrastructure assets, including automatically disconnecting affected assets.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner.","Partial"]
[216,"D3.PC.Im.Inn.3","The institution proactively seeks to identify control gaps that may be used as part of a zero-day attack.",180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Partial"]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Partial"]
[217,"D3.PC.Im.Inn.4","Public-facing servers are routinely rotated and restored to a known clean state to limit the window of time a system is exposed to potential threats.",119,"PR.IP-1.1","The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","Partial"]
[218,"D3.PC.Am.B.1","Employee access is granted to systems and confidential data based on job responsibilities and the principles of least privilege.",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","Full"]
[null,null,null,89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary.","Full"]
[219,"D3.PC.Am.B.2","Employee access to systems and confidential data provides for separation of duties.",89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary.","Full"]
[220,"D3.PC.Am.B.3","Elevated privileges (e.g., administrator privileges) are limited and tightly controlled (e.g., assigned to individuals, not shared, and require stronger password controls).",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[221,"D3.PC.Am.B.4","User access reviews are performed periodically for all systems and applications based on the risk to the application or system.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","Full"]
[222,"D3.PC.Am.B.5","Changes to physical and logical user access, including those that result from voluntary and involuntary terminations, are submitted to and approved by appropriate personnel.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","Full"]
[null,null,null,86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms).","Full"]
[223,"D3.PC.Am.B.6","Identification and authentication are required and managed for access to systems, applications, and hardware.",94,"PR.AC-6.1","The organization authenticates identity and validates the authorization level of a user before granting access to its systems.","Full"]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[224,"D3.PC.Am.B.7","Access controls include password complexity and limits to password attempts and reuse.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","Full"]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[225,"D3.PC.Am.B.8","All default passwords and unnecessary default accounts are changed before system implementation.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","Full"]
[226,"D3.PC.Am.B.9","Customer access to Internet-based products or services requires authentication controls (e.g., layered controls, multifactor) that are commensurate with the risk.",95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm.","Full"]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[227,"D3.PC.Am.B.10","Production and non-production environments are segregated to prevent unauthorized access or changes to information assets. (*N/A if no production environment exists at the institution or the institution’s third party.)",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security.","Full"]
[null,null,null,117,"PR.DS-7.1","The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment.","Full"]
[228,"D3.PC.Am.B.11","Physical security controls are used to prevent unauthorized access to information systems and telecommunication systems.",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","Full"]
[null,null,null,86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms).","Full"]
[null,null,null,94,"PR.AC-6.1","The organization authenticates identity and validates the authorization level of a user before granting access to its systems.","Full"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Full"]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.","Full"]
[229,"D3.PC.Am.B.12","All passwords are encrypted in storage and in transit.",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[null,null,null,111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[230,"D3.PC.Am.B.13","Confidential data are encrypted when transmitted across public or untrusted networks (e.g., Internet).",111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[231,"D3.PC.Am.B.14","Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store confidential data. (*N/A if mobile devices are not used.)",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[232,"D3.PC.Am.B.15","Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication.",88,"PR.AC-3.2","The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations.","Full"]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[233,"D3.PC.Am.B.16","Administrative, physical, or technical controls are in place to prevent users without administrative responsibilities from installing unauthorized software.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Full"]
[234,"D3.PC.Am.B.17","Customer service (e.g., the call center) utilizes formal procedures to authenticate customers commensurate with the risk of the transaction or request.",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[235,"D3.PC.Am.B.18","Data is disposed of or destroyed according to documented requirements and within expected time frames.",131,"PR.IP-6.1","Data is maintained, stored, retained and destroyed according to the organization's data retention policy.","Full"]
[236,"D3.PC.Am.E.1","Changes to user access permissions trigger automated notices to appropriate personnel.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","Partial"]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.","Full"]
[237,"D3.PC.Am.E.2","Administrators have two accounts: one for administrative use and one for general purpose, non-administrative tasks.",89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary.","Partial"]
[null,null,null,90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Partial"]
[238,"D3.PC.Am.E.3","Use of customer data in non-production environments complies with legal, regulatory, and internal policy requirements for concealing or removing of sensitive data elements.",28,"GV.PL-3.1","The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations.","Full"]
[null,null,null,109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[null,null,null,111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[239,"D3.PC.Am.E.4","Physical access to high-risk or confidential systems is restricted, logged, and unauthorized access is blocked.",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","Full"]
[null,null,null,86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms).","Full"]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.","Full"]
[240,"D3.PC.Am.E.5","Controls are in place to prevent unauthorized access to cryptographic keys.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Partial"]
[241,"D3.PC.Am.Int.1","The institution has implemented tools to prevent unauthorized access to or exfiltration of confidential data.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","Full"]
[242,"D3.PC.Am.Int.2","Controls are in place to prevent unauthorized escalation of user privileges.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Partial"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[243,"D3.PC.Am.Int.3","Access controls are in place for database administrators to prevent unauthorized downloading or transmission of confidential data.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[null,null,null,115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[244,"D3.PC.Am.Int.4","All physical and logical access is removed immediately upon notification of involuntary termination and within 24 hours of an employee’s voluntary departure.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","Partial"]
[245,"D3.PC.Am.Int.5","Multifactor authentication and/or layered controls have been implemented to secure all third-party access to the institution's network and/or systems and applications.",88,"PR.AC-3.2","The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations.","Full"]
[246,"D3.PC.Am.Int.6","Multifactor authentication (e.g., tokens, digital certificates) techniques are used for employee access to high-risk systems as identified in the risk assessment(s). (*N/A if no high risk systems.)",88,"PR.AC-3.2","The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations.","Full"]
[null,null,null,95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm.","Full"]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[247,"D3.PC.Am.Int.7","Confidential data are encrypted in transit across private connections (e.g., frame relay and T1) and within the institution’s trusted zones.",111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Partial"]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.","Partial"]
[248,"D3.PC.Am.Int.8","Controls are in place to prevent unauthorized access to collaborative computing devices and applications (e.g., networked white boards, cameras, microphones, online applications such as instant messaging and document sharing). (* N/A if collaborative comp",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","Full"]
[null,null,null,94,"PR.AC-6.1","The organization authenticates identity and validates the authorization level of a user before granting access to its systems.","Full"]
[249,"D3.PC.Am.A.1","Encryption of select data at rest is determined by the institution’s data classification and risk assessment.",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[250,"D3.PC.Am.A.2","Customer authentication for high-risk transactions includes methods to prevent malware and man-in-the-middle attacks (e.g., using visual transaction signing).",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[251,"D3.PC.Am.Inn.1","Adaptive access controls de-provision or isolate an employee, third-party, or customer credentials to minimize potential damage if malicious behavior is suspected.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Partial"]
[252,"D3.PC.Am.Inn.2","Unstructured confidential data are tracked and secured through an identity-aware, cross-platform storage system that protects against internal threats, monitors user access, and tracks changes.",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[253,"D3.PC.Am.Inn.3","Tokenization is used to substitute unique values for confidential information (e.g., virtual credit card).",999,"None","None"]
[254,"D3.PC.Am.Inn.4","The institution is leading efforts to create new technologies and processes for managing customer, employee, and third-party authentication and access.",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Partial"]
[255,"D3.PC.Am.Inn.5","Real-time risk mitigation is taken based on automated risk scoring of user credentials.",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Partial"]
[256,"D3.PC.De.B.1","Controls are in place to restrict the use of removable media to authorized personnel.",151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Full"]
[257,"D3.PC.De.E.1","Tools automatically block attempted access from unpatched employee and third-party devices.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","Partial"]
[null,null,null,176,"DE.CM-7.2","The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers.","Partial"]
[258,"D3.PC.De.E.2","Tools automatically block attempted access by unregistered devices to internal networks.",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Partial"]
[null,null,null,120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","Partial"]
[null,null,null,176,"DE.CM-7.2","The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers.","Partial"]
[259,"D3.PC.De.E.3","The institution has controls to prevent the unauthorized addition of new connections.",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","Partial"]
[260,"D3.PC.De.E.4","Controls are in place to prevent unauthorized individuals from copying confidential data to removable media.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Full"]
[261,"D3.PC.De.E.5","Antivirus and anti-malware tools are deployed on end-point devices (e.g., workstations, laptops, and mobile devices).",151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Full"]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Full"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Full"]
[262,"D3.PC.De.E.6","Mobile devices with access to the institution’s data are centrally managed for antivirus and patch deployment. (*N/A if mobile devices are not used.)",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","Full"]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Full"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Full"]
[263,"D3.PC.De.E.7","The institution wipes data remotely on mobile devices when a device is missing or stolen. (*N/A if mobile devices are not used.)",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Full"]
[null,null,null,131,"PR.IP-6.1","Data is maintained, stored, retained and destroyed according to the organization's data retention policy.","Partial"]
[264,"D3.PC.De.Int.1","Data loss prevention controls or devices are implemented for inbound and outbound communications (e.g., e-mail, FTP, Telnet, prevention of large file transfers).",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Partial"]
[265,"D3.PC.De.Int.2","Mobile device management includes integrity scanning (e.g., jailbreak/rooted detection). (*N/A if mobile devices are not used.)",116,"PR.DS-6.1","The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable.","Partial"]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Partial"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Partial"]
[266,"D3.PC.De.Int.3","Mobile devices connecting to the corporate network for storing and accessing company information allow for remote software version/patch validation. (*N/A if mobile devices are not used.)",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","Full"]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Full"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Full"]
[267,"D3.PC.De.A.1","Employees’ and third parties’ devices (including mobile) without the latest security patches are quarantined and patched before the device is granted access to the network.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","Full"]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Full"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Full"]
[268,"D3.PC.De.A.2","Confidential data and applications on mobile devices are only accessible via a secure, isolated sandbox or a secure container.",110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.","Full"]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy.","Full"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Full"]
[269,"D3.PC.De.Inn.1","A centralized end-point management tool provides fully integrated patch, configuration, and vulnerability management, while also being able to detect malware upon arrival to prevent an exploit.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","Partial"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Partial"]
[270,"D3.PC.Se.B.1","Developers working for the institution follow secure program coding practices, as part of a system development life cycle (SDLC), that meet industry standards.",59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure.","Full"]
[null,null,null,122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Full"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Full"]
[271,"D3.PC.Se.B.2","The security controls of internally developed software are periodically reviewed and tested. (*N/A if there is no software development.)",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Full"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Full"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Full"]
[272,"D3.PC.Se.B.3","The security controls in internally developed software code are independently reviewed before migrating the code to production. (*N/A if there is no software development.)",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Full"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Full"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Full"]
[273,"D3.PC.Se.B.4","Intellectual property and production code are held in escrow. (*N/A if there is no production code to hold in escrow.)",238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.","Full"]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements.","Full"]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.","Full"]
[274,"D3.PC.Se.E.1","Security testing occurs at all post-design phases of the SDLC for all applications, including mobile applications. (*N/A if there is no software development.)",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Full"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Full"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Full"]
[275,"D3.PC.Se.Int.1","Processes are in place to mitigate vulnerabilities identified as part of the secure development of systems and applications.",121,"PR.IP-1.3","The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified.","Full"]
[null,null,null,122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Full"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Full"]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Full"]
[276,"D3.PC.Se.Int.2","The security of applications, including Web-based applications connected to the Internet, is tested against known types of cyber attacks (e.g., SQL injection, cross-site scripting, buffer overflow) before implementation or following significant changes.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Full"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Full"]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Full"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Full"]
[277,"D3.PC.Se.Int.3","Software code executables and scripts are digitally signed to confirm the software author and guarantee that the code has not been altered or corrupted.",116,"PR.DS-6.1","The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable.","Partial"]
[278,"D3.PC.Se.Int.4","A risk-based, independent information assurance function evaluates the security of internal applications.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Partial"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Partial"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Full"]
[279,"D3.PC.Se.A.1","Vulnerabilities identified through a static code analysis are remediated before implementing newly developed or changed applications into production.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Partial"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Partial"]
[280,"D3.PC.Se.A.2","All interdependencies between applications and services have been identified.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Full"]
[null,null,null,233,"DM.ID-1.4","The organization has established and applies appropriate controls to address the inherent risk of internal dependencies.","Full"]
[281,"D3.PC.Se.A.3","The security controls in internally developed software code are independently reviewed before migrating the code to production.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Partial"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Partial"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Full"]
[282,"D3.PC.Se.Inn.1","Software code is actively scanned by automated tools in the development environment so that security weaknesses can be resolved immediately during the design phase.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Partial"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Partial"]
[283,"D3.DC.Th.B.1","Independent testing (including penetration testing and vulnerability scanning) is conducted according to the risk assessment for external-facing systems and the internal network.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Partial"]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","Partial"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Partial"]
[284,"D3.DC.Th.B.2","Antivirus and anti-malware tools are used to detect attacks.",169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Full"]
[null,null,null,170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email.","Full"]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","Full"]
[285,"D3.DC.Th.B.3","Firewall rules are audited or verified at least quarterly.",152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality.","Partial"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Partial"]
[286,"D3.DC.Th.B.4","E-mail protection mechanisms are used to filter for common cyber threats (e.g., attached malware or malicious links).",170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email.","Full"]
[287,"D3.DC.Th.E.1","Independent penetration testing of network boundary and critical Web-facing applications is performed routinely to identify security control gaps.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Partial"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Partial"]
[288,"D3.DC.Th.E.2","Independent penetration testing is performed on Internet-facing applications or systems before they are launched or undergo significant change.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","Partial"]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment.","Partial"]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Partial"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Partial"]
[289,"D3.DC.Th.E.3","Antivirus and anti-malware tools are updated automatically.",169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Partial"]
[290,"D3.DC.Th.E.4","Firewall rules are updated routinely.",121,"PR.IP-1.3","The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified.","Partial"]
[null,null,null,152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality.","Partial"]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Partial"]
[291,"D3.DC.Th.E.5","Vulnerability scanning is conducted and analyzed before deployment/redeployment of new/existing devices.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Full"]
[292,"D3.DC.Th.E.6","Processes are in place to monitor potential insider activity that could lead to data theft or destruction.",91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use.","Full"]
[null,null,null,115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","Full"]
[293,"D3.DC.Th.Int.1","Audit or risk management resources review the penetration testing scope and results to help determine the need for rotating companies based on the quality of the work.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies.","Partial"]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Partial"]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Partial"]
[294,"D3.DC.Th.Int.2","E-mails and attachments are automatically scanned to detect malware and are blocked when malware is present.",170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email.","Full"]
[295,"D3.DC.Th.A.1","Weekly vulnerability scanning is rotated among environments to scan all environments throughout the year.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Full"]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","Full"]
[296,"D3.DC.Th.A.2","Penetration tests include cyber attack simulations and/or real-world tactics and techniques such as red team testing to detect control gaps in employee behavior, security defenses, policies, and resources.",168,"DE.CM-3.3","The organization conducts periodic cyber attack simulations to detect control gaps in employee behavior, policies, procedures and resources.","Full"]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Full"]
[297,"D3.DC.Th.A.3","Automated tool(s) proactively identifies high-risk behavior signaling an employee who may pose an insider threat.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","Full"]
[298,"D3.DC.Th.Inn.1","User tasks and content (e.g., opening an e-mail attachment) are automatically isolated in a secure container or virtual environment so that malware can be analyzed but cannot access vital data, end-point operating systems, or applications on the instituti",170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email.","Partial"]
[299,"D3.DC.Th.Inn.2","Vulnerability scanning is performed on a weekly basis across all environments.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Partial"]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","Partial"]
[300,"D3.DC.An.B.1","The institution is able to detect anomalous activities through monitoring across the environment.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[301,"D3.DC.An.B.2","Customer transactions generating anomalous activity alerts are monitored and reviewed.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Partial"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[302,"D3.DC.An.B.3","Logs of physical and/or logical access are reviewed following events.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time.","Full"]
[null,null,null,203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","Full"]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","Full"]
[303,"D3.DC.An.B.4","Access to critical systems by third parties is monitored for unauthorized or unusual activity.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","Full"]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","Full"]
[304,"D3.DC.An.B.5","Elevated privileges are monitored.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[null,null,null,91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","Full"]
[305,"D3.DC.An.E.1","Systems are in place to detect anomalous behavior automatically during customer, employee, and third-party authentication.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[306,"D3.DC.An.E.2","Security logs are reviewed regularly.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time.","Full"]
[307,"D3.DC.An.E.3","Logs provide traceability for all system access by individual users.",149,"PR.PT-1.1","The organization's audit trails are designed to detect cybersecurity events that may materially harm normal operations of the organization.","Full"]
[null,null,null,161,"DE.CM-1.1","The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[308,"D3.DC.An.E.4","Thresholds have been established to determine activity within logs that would warrant management response.",149,"PR.PT-1.1","The organization's audit trails are designed to detect cybersecurity events that may materially harm normal operations of the organization.","Full"]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[309,"D3.DC.An.Int.1","Online customer transactions are actively monitored for anomalous behavior.",999,"None","None"]
[310,"D3.DC.An.Int.2","Tools to detect unauthorized data mining are used.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[311,"D3.DC.An.Int.3","Tools actively monitor security logs for anomalous behavior and alert within established parameters.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[312,"D3.DC.An.Int.4","Audit logs are backed up to a centralized log server or media that is difficult to alter.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time.","Partial"]
[313,"D3.DC.An.Int.5","Thresholds for security logging are evaluated periodically.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Full"]
[314,"D3.DC.An.Int.6","Anomalous activity and other network and system alerts are correlated across business units to detect and prevent multifaceted attacks (e.g., simultaneous account takeover and DDoS attack).",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[315,"D3.DC.An.A.1","An automated tool triggers system and/or fraud alerts when customer logins occur within a short period of time but from physically distant IP locations.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Partial"]
[316,"D3.DC.An.A.2","External transfers from customer accounts generate alerts and require review and authorization if anomalous behavior is detected.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Partial"]
[317,"D3.DC.An.A.3","A system is in place to monitor and analyze employee behavior (network use patterns, work hours, and known devices) to alert on anomalous activities.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[318,"D3.DC.An.A.4","An automated tool(s) is in place to detect and prevent data mining by insider threats.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[319,"D3.DC.An.A.5","Tags on fictitious confidential data or files are used to provide advanced alerts of potential malicious activity when the data is accessed.",163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery.","Partial"]
[320,"D3.DC.An.Inn.1","The institution has a mechanism for real-time automated risk scoring of threats.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Partial"]
[321,"D3.DC.An.Inn.2","The institution is developing new technologies that will detect potential insider threats and block activity in real time.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Partial"]
[322,"D3.DC.Ev.B.1","A normal network activity baseline is established.",155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows.","Full"]
[323,"D3.DC.Ev.B.2","Mechanisms (e.g., antivirus alerts, log event alerts) are in place to alert management to potential attacks.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[324,"D3.DC.Ev.B.3","Processes are in place to monitor for the presence of unauthorized users, devices, connections, and software.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software.","Full"]
[null,null,null,176,"DE.CM-7.2","The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers.","Full"]
[null,null,null,177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","Full"]
[325,"D3.DC.Ev.B.4","Responsibilities for monitoring and reporting suspicious systems activity have been assigned.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.","Full"]
[326,"D3.DC.Ev.B.5","The physical environment is monitored to detect potential unauthorized access.",165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.","Full"]
[327,"D3.DC.Ev.E.1","A process is in place to correlate event information from multiple sources (e.g., network, application, or firewall).",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[328,"D3.DC.Ev.Int.1","Controls or tools (e.g., data loss prevention) are in place to detect potential unauthorized or unintentional transmissions of confidential data.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[329,"D3.DC.Ev.Int.2","Event detection processes are proven reliable.",183,"DE.DP-3.1","The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","Full"]
[330,"D3.DC.Ev.Int.3","Specialized security monitoring is used for critical assets throughout the infrastructure.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Partial"]
[331,"D3.DC.Ev.A.1","Automated tools detect unauthorized changes to critical system files, firewalls, IPS, IDS, or other security devices.",177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","Full"]
[332,"D3.DC.Ev.A.2","Real-time network monitoring and detection is implemented and incorporates sector-wide event information.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Partial"]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","Partial"]
[333,"D3.DC.Ev.A.3","Real-time alerts are automatically sent when unauthorized software, hardware, or changes occur.",177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","Full"]
[334,"D3.DC.Ev.A.4","Tools are in place to actively correlate event information from multiple sources and send alerts based on established parameters.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[335,"D3.DC.Ev.Inn.1","The institution is leading efforts to develop event detection systems that will correlate in real time when events are about to occur.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Partial"]
[null,null,null,183,"DE.DP-3.1","The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","Partial"]
[336,"D3.DC.Ev.Inn.2","The institution is leading the development effort to design new technologies that will detect potential insider threats and block activity in real time.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Partial"]
[null,null,null,183,"DE.DP-3.1","The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","Partial"]
[337,"D3.CC.Pa.B.1","A patch management program is implemented and ensures that software and firmware patches are applied in a timely manner.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[338,"D3.CC.Pa.B.2","Patches are tested before being applied to systems and/or software.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[339,"D3.CC.Pa.B.3","Patch management reports are reviewed and reflect missing security patches.",145,"PR.IP-12.3","The organization has a formal exception management process for vulnerabilities that cannot be mitigated due to business-related exceptions.","Full"]
[null,null,null,146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[340,"D3.CC.Pa.E.1","A formal process is in place to acquire, test, and deploy software patches based on criticality.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[341,"D3.CC.Pa.E.2","Systems are configured to retrieve patches automatically.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Partial"]
[342,"D3.CC.Pa.E.3","Operational impact is evaluated before deploying security patches.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[343,"D3.CC.Pa.E.4","An automated tool(s) is used to identify missing security patches as well as the number of days since each patch became available.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[344,"D3.CC.Pa.E.5","Missing patches across all environments are prioritized and tracked.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[345,"D3.CC.Pa.Int.1","Patches for high-risk vulnerabilities are tested and applied when released or the risk is accepted and accountability assigned.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[346,"D3.CC.Pa.A.1","Patch monitoring software is installed on all servers to identify any missing patches for the operating system software, middleware, database, and other key software.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","Full"]
[347,"D3.CC.Pa.A.2","The institution monitors patch management reports to ensure security patches are tested and implemented within aggressive time frames (e.g., 0-30 days).",145,"PR.IP-12.3","The organization has a formal exception management process for vulnerabilities that cannot be mitigated due to business-related exceptions.","Full"]
[null,null,null,146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","Full"]
[348,"D3.CC.Pa.Inn.1","The institution develops security patches or bug fixes or contributes to open source code development for systems it uses.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Full"]
[349,"D3.CC.Pa.Inn.2","Segregated or separate systems are in place that mirror production systems allowing for rapid testing and implementation of patches and provide for rapid fallback when needed.",999,"None","None"]
[350,"D3.CC.Re.B.1","Issues identified in assessments are prioritized and resolved based on criticality and within the time frames established in the response to the assessment report.",15,"GV.RM-1.5","The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls.","Full"]
[null,null,null,16,"GV.RM-1.6","The cyber risk management program addresses identified cyber risks in one of the following ways:  risk acceptance, risk mitigation, risk avoidance, or risk transfer, which includes cyber insurance.","Partial"]
[null,null,null,21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","Full"]
[351,"D3.CC.Re.E.1","Data is destroyed or wiped on hardware and portable/mobile media when a device is missing, stolen, or no longer needed.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Full"]
[null,null,null,131,"PR.IP-6.1","Data is maintained, stored, retained and destroyed according to the organization's data retention policy.","Full"]
[352,"D3.CC.Re.E.2","Formal processes are in place to resolve weaknesses identified during penetration testing.",144,"PR.IP-12.2","The organization establishes a process to prioritize and remedy issues identified through vulnerability scanning.","Full"]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.","Full"]
[353,"D3.CC.Re.Int.1","Remediation efforts are confirmed by conducting a follow-up vulnerability scan.",208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.","Partial"]
[354,"D3.CC.Re.Int.2","Penetration testing is repeated to confirm that medium- and high-risk, exploitable vulnerabilities have been resolved.",180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses.","Partial"]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.","Partial"]
[355,"D3.CC.Re.Int.3","Security investigations, forensic analysis, and remediation are performed by qualified staff or third parties.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","Partial"]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","Partial"]
[356,"D3.CC.Re.Int.4","Generally accepted and appropriate forensic procedures, including chain of custody, are used to gather and present evidence to support potential legal action.",191,"RS.CO-2.1","The organization's incident response plan describes how to appropriately document and report cyber events and related incident response activities.","Partial"]
[null,null,null,203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","Partial"]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","Partial"]
[357,"D3.CC.Re.Int.5","The maintenance and repair of organizational assets are performed by authorized individuals with approved and controlled tools.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[null,null,null,148,"PR.MA-2.1","Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.","Full"]
[358,"D3.CC.Re.Int.6","The maintenance and repair of organizational assets are logged in a timely manner.",147,"PR.MA-1.1","Policies, standards and procedures for the maintenance of assets include, but are not limited to, physical entry controls, equipment maintenance and removal of assets.","Partial"]
[null,null,null,148,"PR.MA-2.1","Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.","Partial"]
[359,"D3.CC.Re.A.1","All medium and high risk issues identified in penetration testing, vulnerability scanning, and other independent testing are escalated to the board or an appropriate board committee for risk acceptance if not resolved in a timely manner.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","Full"]
[null,null,null,81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk.","Full"]
[360,"D3.CC.Re.Inn.1","The institution is developing technologies that will remediate systems damaged by zero-day attacks to maintain current recovery time objectives.",225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Partial"]
[361,"D4.C.Co.B.1","The critical business processes that are dependent on external connectivity have been identified.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Full"]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","Full"]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","Full"]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[null,null,null,252,"DM.ED-5.3","The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.","Full"]
[null,null,null,253,"DM.ED-5.4","The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","Full"]
[362,"D4.C.Co.B.2","The institution ensures that third-party connections are authorized.",95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm.","Full"]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","Full"]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections.","Full"]
[363,"D4.C.Co.B.3","A network diagram is in place and identifies all external connections.",64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","Full"]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems.","Full"]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows.","Full"]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections.","Full"]
[364,"D4.C.Co.B.4","Data flow diagrams are in place and document information flow to external parties.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Full"]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.","Full"]
[null,null,null,64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","Full"]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems.","Full"]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows.","Full"]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections.","Full"]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[365,"D4.C.Co.E.1","Critical business processes have been mapped to the supporting external connections.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Full"]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.","Full"]
[null,null,null,64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","Full"]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems.","Full"]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","Full"]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","Full"]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[null,null,null,252,"DM.ED-5.3","The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.","Full"]
[null,null,null,253,"DM.ED-5.4","The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","Full"]
[366,"D4.C.Co.E.2","The network diagram is updated when connections with third parties change or at least annually.",64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","Full"]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows.","Full"]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections.","Full"]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[367,"D4.C.Co.E.3","Network and systems diagrams are stored in a secure manner with proper restrictions on access.",155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows.","Full"]
[368,"D4.C.Co.E.4","Controls for primary and backup third-party connections are monitored and tested on a regular basis.",154,"PR.PT-5.1","The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","Full"]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections.","Full"]
[null,null,null,173,"DE.CM-6.2","The organization collaborates with third-party service providers to maintain and improve the security of external connections.","Full"]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Full"]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.","Full"]
[369,"D4.C.Co.Int.1","A validated asset inventory is used to create comprehensive diagrams depicting data repositories, data flow, infrastructure, and connectivity.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Full"]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.","Full"]
[null,null,null,64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","Full"]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","Full"]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows.","Full"]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[370,"D4.C.Co.Int.2","Security controls are designed and verified to detect and prevent intrusions from third-party connections.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections.","Full"]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","Full"]
[371,"D4.C.Co.Int.3","Monitoring controls cover all external connections (e.g., third-party service providers, business partners, customers).",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections.","Full"]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","Full"]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","Full"]
[372,"D4.C.Co.Int.4","Monitoring controls cover all internal network-to-network connections.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[373,"D4.C.Co.A.1","The security architecture is validated and documented before network connection infrastructure changes.",58,"GV.TE-1.2","The organization applies its cyber risk management framework to all technology projects.","Full"]
[null,null,null,125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Full"]
[null,null,null,247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[374,"D4.C.Co.A.2","The institution works closely with third-party service providers to maintain and improve the security of external connections.",173,"DE.CM-6.2","The organization collaborates with third-party service providers to maintain and improve the security of external connections.","Full"]
[375,"D4.C.Co.Inn.1","Diagram(s) of external connections is interactive, shows real-time changes to the network connection infrastructure, new connections, and volume fluctuations, and alerts when risks arise.",999,"None","None"]
[376,"D4.C.Co.Inn.2","The institution's connections can be segmented or severed instantaneously to prevent contagion from cyber attacks.",270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Full"]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.","Full"]
[377,"D4.RM.Dd.B.1","Risk-based due diligence is performed on prospective third parties before contracts are signed, including reviews of their background, reputation, financial condition, stability, and security controls.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[378,"D4.RM.Dd.B.2","A list of third-party service providers is maintained.",251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[379,"D4.RM.Dd.B.3","A risk assessment is conducted to identify criticality of service providers.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[380,"D4.RM.Dd.E.1","A formal process exists to analyze assessments of third-party cybersecurity controls.",123,"PR.IP-2.2","The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications.","Full"]
[null,null,null,247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[381,"D4.RM.Dd.E.2","The board or an appropriate board committee reviews a summary of due diligence results including management’s recommendations to use third parties that will affect the institution’s inherent risk profile.",237,"DM.ED-1.3","The organization ensures appropriate oversight and compliance with the external dependency strategy implementation.","Full"]
[null,null,null,240,"DM.ED-2.3","The organization's dependency management policies, plans, and procedures have been reviewed and approved by appropriate organizational stakeholders.","Full"]
[null,null,null,245,"DM.ED-4.1","The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees).","Full"]
[null,null,null,246,"DM.ED-4.2","The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate.","Full"]
[382,"D4.RM.Dd.Int.1","A process is in place to confirm that the institution’s third-party service providers conduct due diligence of their third parties (e.g., subcontractors).",256,"DM.ED-6.3","Minimum cybersecurity requirements for third-parties include how the organization will monitor security of its external dependencies to ensure that requirements are continually satisfied.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,263,"DM.ED-7.3","A process is in place to confirm that the organization's third-party service providers conduct due diligence of their own third-parties (e.g., subcontractors).","Full"]
[383,"D4.RM.Dd.Int.2","Pre-contract, physical site visits of high-risk vendors are conducted by the institution or by a qualified third party.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[384,"D4.RM.Dd.A.1","A continuous process improvement program is in place for third-party due diligence activity.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[null,null,null,173,"DE.CM-6.2","The organization collaborates with third-party service providers to maintain and improve the security of external connections.","Full"]
[null,null,null,236,"DM.ED-1.2","The organization monitors the effectiveness of its external dependency management strategy to reduce cyber risks associated with external dependencies.","Full"]
[null,null,null,239,"DM.ED-2.2","The organization's dependency management policies, plans, and procedures are regularly updated.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[385,"D4.RM.Dd.A.2","Audits of high-risk vendors are conducted on an annual basis.",261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[386,"D4.RM.Dd.Inn.1","The institution promotes sector-wide efforts to build due diligence mechanisms that lead to in-depth and efficient security and resilience reviews.",275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","Full"]
[387,"D4.RM.Dd.Inn.2","The institution is leading efforts to develop new auditable processes and for conducting due diligence and ongoing monitoring of cybersecurity risks posed by third parties.",999,"None","None"]
[388,"D4.RM.Co.B.1","Formal contracts that address relevant security and privacy requirements are in place for all third parties that process, store, or transmit confidential data or provide critical services.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,257,"DM.ED-6.4","Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted.","Full"]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements.","Full"]
[389,"D4.RM.Co.B.2","Contracts acknowledge that the third party is responsible for the security of the institution’s confidential data that it possesses, stores, processes, or transmits.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[null,null,null,255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,257,"DM.ED-6.4","Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted.","Full"]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements.","Full"]
[390,"D4.RM.Co.B.3","Contracts stipulate that the third-party security controls are regularly reviewed and validated by an independent party.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","Full"]
[null,null,null,255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[391,"D4.RM.Co.B.4","Contracts identify the recourse available to the institution should the third party fail to meet defined security requirements.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements.","Full"]
[392,"D4.RM.Co.B.5","Contracts establish responsibilities for responding to security incidents.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[393,"D4.RM.Co.B.6","Contracts specify the security requirements for the return or destruction of data upon contract termination.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements.","Full"]
[null,null,null,260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination.","Full"]
[394,"D4.RM.Co.E.1","Responsibilities for managing devices (e.g., firewalls, routers) that secure connections with third parties are formally documented in the contract.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[395,"D4.RM.Co.E.2","Responsibility for notification of direct and indirect security incidents and vulnerabilities is documented in contracts or service-level agreements (SLAs).",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises.","Full"]
[396,"D4.RM.Co.E.3","Contracts stipulate geographic limits on where data can be stored or transmitted.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,257,"DM.ED-6.4","Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted.","Full"]
[397,"D4.RM.Co.Int.1","Third-party SLAs or similar means are in place that require timely notification of security events.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[398,"D4.RM.Co.A.1","Contracts require third-party service provider’s security policies meet or\nexceed those of the institution.",254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","Full"]
[null,null,null,255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","Full"]
[399,"D4.RM.Co.A.2","A third-party termination/exit strategy has been established and validated with management.",248,"DM.ED-4.4","The organization has a documented third-party termination/exit strategy to include procedures for timely removal of the third-party access when no longer required.","Full"]
[null,null,null,249,"DM.ED-4.5","The organization establishes contingencies to address circumstances that might put a vendor out of business or severely impact delivery of services to the organization, sector-critical systems, or the financial sector as a whole.","Full"]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.","Full"]
[400,"D4.RM.Co.Inn.1","The institution promotes a sector-wide effort to influence contractual requirements for critical third parties to the industry.",999,"None","None"]
[401,"D4.RM.Om.B.1","The third-party risk assessment is updated regularly.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[402,"D4.RM.Om.B.2","Audits, assessments, and operational performance reports are obtained and reviewed regularly validating security controls for critical third parties.",260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[403,"D4.RM.Om.B.3","Ongoing monitoring practices include reviewing critical third-parties’ resilience plans.",258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[null,null,null,264,"DM.ED-7.4","A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed.","Full"]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises.","Full"]
[404,"D4.RM.Om.E.1","A process to identify new third-party relationships is in place, including identifying new relationships that were established without formal approval.",242,"DM.ED-2.5","The organization's dependency management process identifies third-party relationships that are in place, including those relationships that were established without formal approval.","Full"]
[405,"D4.RM.Om.E.2","A formal program assigns responsibility for ongoing oversight of third- party access.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[null,null,null,244,"DM.ED-3.2","Responsibilities for ongoing independent oversight (external) of third-party access are defined and assigned.","Full"]
[406,"D4.RM.Om.E.3","Monitoring of third parties is scaled, in terms of depth and frequency, according to the risk of the third parties.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","Full"]
[407,"D4.RM.Om.E.4","Automated reminders or ticklers are in place to identify when required third-party information needs to be obtained or analyzed.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[408,"D4.RM.Om.Int.1","Third-party employee access to the institution's confidential data are tracked actively based on the principles of least privilege.",89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary.","Full"]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","Full"]
[409,"D4.RM.Om.Int.2","Periodic on-site assessments of high-risk vendors are conducted to ensure appropriate security controls are in place.",261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Full"]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[410,"D4.RM.Om.A.1","Third-party employee access to confidential data on third-party hosted systems is tracked actively via automated reports and alerts.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","Full"]
[411,"D4.RM.Om.Inn.1","The institution is leading efforts to develop new auditable processes for ongoing monitoring of cybersecurity risks posed by third parties.",999,"None","None"]
[412,"D5.IR.Pl.B.1","The institution has documented how it will react and respond to cyber incidents.",134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,187,"RS.RP-1.1","The organization's response plans are in place and executed during or after an incident.","Full"]
[413,"D5.IR.Pl.B.2","Communication channels exist to provide employees a means for reporting information security events in a timely manner.",193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[414,"D5.IR.Pl.B.3","Roles and responsibilities for incident response team members are defined.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[null,null,null,181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes.","Full"]
[null,null,null,188,"RS.CO-1.1","The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","Full"]
[null,null,null,190,"RS.CO-1.3","The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","Full"]
[415,"D5.IR.Pl.B.4","The response team includes individuals with a wide range of backgrounds and expertise, from many different areas within the institution (e.g., management, legal, public relations, as well as information technology).",999,"None","None"]
[416,"D5.IR.Pl.B.5","A formal backup and recovery plan exists for all critical business lines.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident.","Full"]
[null,null,null,127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[null,null,null,219,"RC.RP-1.2","Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","Full"]
[417,"D5.IR.Pl.B.6","The institution plans to use business continuity, disaster recovery, and data backup programs to recover operations following an incident.",127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[418,"D5.IR.Pl.E.1","The remediation plan and process outlines the mitigating actions, resources, and time parameters.",128,"PR.IP-4.3","The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives.","Full"]
[null,null,null,129,"PR.IP-4.4","Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.","Full"]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[null,null,null,135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations.","Full"]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.","Full"]
[null,null,null,212,"RS.MI-3.1","The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls.","Full"]
[null,null,null,220,"RC.RP-1.3","The recovery plan includes a minimum recovery time for the sector critical systems.","Full"]
[419,"D5.IR.Pl.E.2","The corporate disaster recovery, business continuity, and crisis management plans have integrated consideration of cyber incidents.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Partial"]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.","Partial"]
[420,"D5.IR.Pl.E.3","Alternative processes have been established to continue critical activity within a reasonable time period.",135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[null,null,null,219,"RC.RP-1.2","Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","Full"]
[null,null,null,220,"RC.RP-1.3","The recovery plan includes a minimum recovery time for the sector critical systems.","Full"]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications.","Full"]
[421,"D5.IR.Pl.E.4","Business impact analyses have been updated to include cybersecurity.",218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Partial"]
[422,"D5.IR.Pl.E.5","Due diligence has been performed on technical sources, consultants, or forensic service firms that could be called to assist the institution during or following an incident.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","Partial"]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","Partial"]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring.","Partial"]
[423,"D5.IR.Pl.Int.1","A strategy is in place to coordinate and communicate with internal and external stakeholders during or following a cyber attack.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises.","Full"]
[424,"D5.IR.Pl.Int.2","Plans are in place to re-route or substitute critical functions and/or services that may be affected by a successful attack on Internet-facing systems.",135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations.","Full"]
[null,null,null,205,"RS.AN-4.1","The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[null,null,null,219,"RC.RP-1.2","Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","Full"]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications.","Full"]
[null,null,null,276,"DM.BE-2.2","The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","Full"]
[425,"D5.IR.Pl.Int.3","A direct cooperative or contractual agreement(s) is in place with an incident response organization(s) or provider(s) to assist rapidly with mitigation efforts.",999,"None","None"]
[426,"D5.IR.Pl.Int.4","Lessons learned from real-life cyber incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Full"]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Full"]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[427,"D5.IR.Pl.A.1","Methods for responding to and recovering from cyber incidents are tightly woven throughout the business units’ disaster recovery, business continuity, and crisis management plans.",218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Partial"]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Partial"]
[null,null,null,267,"DM.RS-1.3","The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).","Partial"]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications.","Partial"]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Partial"]
[null,null,null,272,"DM.RS-2.5","When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems.","Partial"]
[428,"D5.IR.Pl.A.2","Multiple systems, programs, or processes are implemented into a comprehensive cyber resilience program to sustain, minimize, and recover operations from an array of potentially disruptive and destructive cyber incidents.",134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[null,null,null,267,"DM.RS-1.3","The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).","Full"]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises.","Full"]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications.","Full"]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Full"]
[null,null,null,272,"DM.RS-2.5","When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems.","Full"]
[null,null,null,277,"DM.BE-3.1","Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","Full"]
[429,"D5.IR.Pl.A.3","A process is in place to continuously improve the resilience plan.",185,"DE.DP-4.2","The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","Full"]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Full"]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Full"]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[430,"D5.IR.Pl.Inn.1","The incident response plan is designed to ensure recovery from disruption of services, assurance of data integrity, and recovery of lost or corrupted data following a cybersecurity incident.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident.","Full"]
[null,null,null,128,"PR.IP-4.3","The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives.","Full"]
[null,null,null,129,"PR.IP-4.4","Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.","Full"]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[null,null,null,135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations.","Full"]
[null,null,null,136,"PR.IP-10.1","The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[null,null,null,187,"RS.RP-1.1","The organization's response plans are in place and executed during or after an incident.","Full"]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[431,"D5.IR.Pl.Inn.2","The incident response process includes detailed actions and rule- based triggers for automated response.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[432,"D5.IR.Te.B.1","Scenarios are used to improve incident detection and response.",186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Full"]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[433,"D5.IR.Te.B.2","Business continuity testing involves collaboration with critical third parties.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Partial"]
[null,null,null,264,"DM.ED-7.4","A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed.","Partial"]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises.","Partial"]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Partial"]
[434,"D5.IR.Te.B.3","Systems, applications, and data recovery is tested at least annually.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident.","Full"]
[null,null,null,127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Partial"]
[null,null,null,137,"PR.IP-10.2","The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Partial"]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Partial"]
[435,"D5.IR.Te.E.1","Recovery scenarios include plans to recover from data destruction and impacts to data integrity, data loss, and system and data availability.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident.","Partial"]
[null,null,null,128,"PR.IP-4.3","The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives.","Partial"]
[null,null,null,129,"PR.IP-4.4","Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.","Partial"]
[436,"D5.IR.Te.E.2","Widely reported events are used to evaluate and improve the institution's response.",186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Full"]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[437,"D5.IR.Te.E.3","Information backups are tested periodically to verify they are accessible and readable.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident.","Full"]
[null,null,null,127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[null,null,null,137,"PR.IP-10.2","The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[438,"D5.IR.Te.Int.1","Cyber-attack scenarios are analyzed to determine potential impact to critical business processes.",202,"RS.AN-2.1","The organization uses cyber-attack scenarios to determine potential impact to critical business processes.","Full"]
[439,"D5.IR.Te.Int.2","The institution participates in sector-specific cyber exercises or scenarios (e.g., FS-ISAC Cyber Attack (against) Payment Processors (CAPP)).",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Full"]
[440,"D5.IR.Te.Int.3","Resilience testing is based on analysis and identification of realistic and highly likely threats as well as new and emerging threats facing the institution.",136,"PR.IP-10.1","The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[441,"D5.IR.Te.Int.4","The critical online systems and processes are tested to withstand stresses for extended periods (e.g., DDoS).",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,154,"PR.PT-5.1","The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","Full"]
[442,"D5.IR.Te.Int.5","The results of cyber event exercises are used to improve the incident response plan and automated triggers.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Partial"]
[null,null,null,185,"DE.DP-4.2","The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","Partial"]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Partial"]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Partial"]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Partial"]
[443,"D5.IR.Te.A.1","Resilience testing is comprehensive and coordinated across all critical business functions.",138,"PR.IP-10.3","The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Partial"]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Partial"]
[444,"D5.IR.Te.A.2","The institution validates that it is able to recover from cyber events similar to by known sophisticated attacks at other organizations.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Partial"]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Partial"]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Partial"]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Partial"]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Partial"]
[445,"D5.IR.Te.A.3","Incident response testing evaluates the institution from an attacker's perspective to determine how the institution or its assets at critical third parties may be targeted.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[446,"D5.IR.Te.A.4","The institution corrects root causes for problems discovered during cybersecurity resilience testing.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[447,"D5.IR.Te.A.5","Cybersecurity incident scenarios involving significant financial loss are used to stress test the institution's risk management.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,202,"RS.AN-2.1","The organization uses cyber-attack scenarios to determine potential impact to critical business processes.","Full"]
[448,"D5.IR.Te.Inn.1","The institution tests the ability to shift business processes or functions between different processing centers or technology systems for cyber incidents without interruption to business or loss of productivity or data.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,154,"PR.PT-5.1","The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","Full"]
[null,null,null,277,"DM.BE-3.1","Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","Full"]
[449,"D5.IR.Te.Inn.2","The institution has validated that it is able to remediate systems damaged by zero-day attacks to maintain current recovery time objectives.",999,"None","None"]
[450,"D5.IR.Te.Inn.3","The institution is leading the development of more realistic test environments.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[451,"D5.IR.Te.Inn.4","Cyber incident scenarios are used to stress test potential financial losses across the sector.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","Full"]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Full"]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","Full"]
[452,"D5.DR.De.B.1","Alert parameters are set for detecting information security incidents that prompt mitigating actions.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[453,"D5.DR.De.B.2","System performance reports contain information that can be used as a risk indicator to detect information security incidents.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Full"]
[454,"D5.DR.De.B.3","Tools and processes are in place to detect, alert, and trigger the incident response program.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery.","Full"]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","Full"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Full"]
[455,"D5.DR.De.E.1","The institution has processes to detect and alert the incident response team when potential insider activity manifests that could lead to data theft or destruction.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","Full"]
[456,"D5.DR.De.Int.1","The incident response program is triggered when anomalous behaviors and attack patterns or signatures are detected.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","Full"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Full"]
[457,"D5.DR.De.Int.2","The institution has the ability to discover infiltration, before the attacker traverses across systems, establishes a foothold, steals information, or causes damage to data and systems.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery.","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them.","Full"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Full"]
[458,"D5.DR.De.Int.3","Incidents are detected in real time through automated processes that include instant alerts to appropriate personnel who can respond.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[459,"D5.DR.De.Int.4","Network and system alerts are correlated across business units to better detect and prevent multifaceted attacks (e.g., simultaneous DDoS attack and account takeover).",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Full"]
[460,"D5.DR.De.Int.5","Incident detection processes are capable of correlating events across the enterprise.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[461,"D5.DR.De.A.1","Sophisticated and adaptive technologies are deployed that can detect and alert the incident response team of specific tasks when threat indicators across the enterprise indicate potential external and internal threats.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","Full"]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them.","Full"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Full"]
[462,"D5.DR.De.A.2","Automated tools are implemented to provide specialized security monitoring based on the risk of the assets to detect and alert incident response teams in real time.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","Full"]
[null,null,null,276,"DM.BE-2.2","The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","Full"]
[463,"D5.DR.De.Inn.1","The institution is able to detect and block zero-day attempts and inform management and the incident response team in real time.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","Full"]
[464,"D5.DR.Re.B.1","Appropriate steps are taken to contain and control an incident to prevent further unauthorized access to or use of customer information.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner.","Full"]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.","Full"]
[null,null,null,211,"RS.MI-2.1","The organization mitigates cybersecurity incidents in a timely manner.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[465,"D5.DR.Re.E.1","The incident response plan is designed to prioritize incidents, enabling a rapid response for significant cybersecurity incidents or vulnerabilities.",205,"RS.AN-4.1","The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[null,null,null,276,"DM.BE-2.2","The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","Full"]
[466,"D5.DR.Re.E.2","A process is in place to help contain incidents and restore operations with minimal service disruption.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner.","Full"]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.","Full"]
[null,null,null,211,"RS.MI-2.1","The organization mitigates cybersecurity incidents in a timely manner.","Full"]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[467,"D5.DR.Re.E.3","Containment and mitigation strategies are developed for multiple incident types (e.g., DDoS, malware).",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner.","Full"]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.","Full"]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[468,"D5.DR.Re.E.4","Procedures include containment strategies and notifying potentially impacted third parties.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner.","Full"]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.","Full"]
[469,"D5.DR.Re.E.5","Processes are in place to trigger the incident response program when an incident occurs at a third party.",258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises.","Full"]
[470,"D5.DR.Re.E.6","Records are generated to support incident investigation and mitigation.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","Full"]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","Full"]
[471,"D5.DR.Re.E.7","The institution calls upon third parties, as needed, to provide mitigation services",999,"None","None"]
[472,"D5.DR.Re.E.8","Analysis of events is used to improve the institution's security measures and policies.",27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","Full"]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","Full"]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","Full"]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Full"]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[473,"D5.DR.Re.Int.1","Analysis of security incidents is performed in the early stages of an intrusion to minimize the impact of the incident.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Full"]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery.","Full"]
[null,null,null,191,"RS.CO-2.1","The organization's incident response plan describes how to appropriately document and report cyber events and related incident response activities.","Full"]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","Full"]
[null,null,null,207,"RS.AN-5.2","The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond.","Full"]
[474,"D5.DR.Re.Int.2","Any changes to systems/applications or to access entitlements necessary for incident management are reviewed by management for formal approval before implementation.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change.","Partial"]
[475,"D5.DR.Re.Int.3","Processes are in place to ensure assets affected by a security incident that cannot be returned to operational status are quarantined, removed, disposed of, and/or replaced.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Full"]
[null,null,null,209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner.","Full"]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.","Full"]
[null,null,null,212,"RS.MI-3.1","The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls.","Full"]
[null,null,null,213,"RS.MI-3.2","Vulnerabilities identified as a result of a cybersecurity incident are mitigated or documented by the organization as accepted risks and monitored.","Full"]
[476,"D5.DR.Re.Int.4","Processes are in place to ensure that restored assets are appropriately reconfigured and thoroughly tested before being placed back into operation.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","Partial"]
[null,null,null,212,"RS.MI-3.1","The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls.","Partial"]
[477,"D5.DR.Re.A.1","The incident management function collaborates effectively with the cyber threat intelligence function during an incident.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[478,"D5.DR.Re.A.2","Links between threat intelligence, network operations, and incident response allow for proactive response to potential incidents.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[479,"D5.DR.Re.A.3","Technical measures apply defense-in-depth techniques such as deep- packet inspection and black holing for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns and/or DDoS attacks.",163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery.","Full"]
[null,null,null,164,"DE.CM-1.4","The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks.","Full"]
[480,"D5.DR.Re.Inn.1","The institution’s risk management of significant cyber incidents results in limited to no disruptions to critical services.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner.","Full"]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.","Full"]
[null,null,null,211,"RS.MI-2.1","The organization mitigates cybersecurity incidents in a timely manner.","Full"]
[481,"D5.DR.Re.Inn.2","The technology infrastructure has been engineered to limit the effects of a cyber attack on the production environment from migrating to the backup environment (e.g., air-gapped environment and processes).",999,"None","None"]
[482,"D5.ER.Es.B.1","A process exists to contact personnel who are responsible for analyzing and responding to an incident.",190,"RS.CO-1.3","The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","Full"]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[483,"D5.ER.Es.B.2","Procedures exist to notify customers, regulators, and law enforcement as required or necessary when the institution becomes aware of an incident involving the unauthorized access to or use of sensitive customer information.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Partial"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Partial"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Partial"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Partial"]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Partial"]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","Partial"]
[484,"D5.ER.Es.B.3","The institution prepares an annual report of security incidents or violations for the board or an appropriate board committee.",34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.","Full"]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.","Full"]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","Full"]
[485,"D5.ER.Es.B.4","Incidents are classified, logged, and tracked.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","Full"]
[486,"D5.ER.Es.E.1","Criteria have been established for escalating cyber incidents or vulnerabilities to the board and senior management based on the potential impact and criticality of the risk.",81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk.","Full"]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,229,"RC.CO-3.1","The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[487,"D5.ER.Es.E.2","Regulators, law enforcement, and service providers, as appropriate, are notified when the institution is aware of any unauthorized access to systems or a cyber incident occurs that could result in degradation of services.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","Full"]
[488,"D5.ER.Es.E.3","Tracked cyber incidents are correlated for trend analysis and reporting.",999,"None","None"]
[489,"D5.ER.Es.Int.1","Employees that are essential to mitigate the risk (e.g., fraud, business resilience) know their role in incident escalation.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[null,null,null,190,"RS.CO-1.3","The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","Full"]
[490,"D5.ER.Es.Int.2","A communication plan is used to notify other organizations, including third parties, of incidents that may affect them or their customers.",194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","Full"]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[491,"D5.ER.Es.Int.3","An external communication plan is used for notifying media regarding incidents when applicable.",195,"RS.CO-3.1","Information is shared consistent with response plans.","Full"]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[null,null,null,228,"RC.CO-2.1","Actionable and effective mitigation techniques are taken and communicated appropriately to restore and improve the organization's reputation after an incident.","Full"]
[492,"D5.ER.Es.A.1","The institution has established quantitative and qualitative metrics for the cybersecurity incident response process.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics.","Full"]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.","Full"]
[493,"D5.ER.Es.A.2","Detailed metrics, dashboards, and/or scorecards outlining cyber incidents and events are provided to management and are part of the board meeting package.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics.","Full"]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.","Full"]
[494,"D5.ER.Es.Inn.1","A mechanism is in place to provide instantaneous notification of incidents to management and essential employees through multiple communication channels with tracking and verification of receipt.",193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[998,"None","None",44,"GV.IR-1.4","Individuals responsible for independent risk management and oversight are independent of business line management, including senior leadership."]
[null,null,null,80,"ID.RA-5.6","The organization determines ways to aggregate cyber risk to assess the organization's residual cyber risk."]
[null,null,null,104,"PR.AT-3.2","Cybersecurity training provided through a third-party service provider or affiliate should be consistent with the organization's cybersecurity policy and program."]
[null,null,null,114,"PR.DS-4.1","The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment."]
[null,null,null,118,"PR.DS-8.1","The organization uses integrity checking mechanisms to verify hardware integrity, as practicable."]
[null,null,null,182,"DE.DP-2.1","The organization's monitoring and detection processes comply with all applicable requirements."]
[null,null,null,221,"RC.RP-1.4","The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date."]
[null,null,null,222,"RC.RP-1.5","The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps."]
[null,null,null,223,"RC.RP-1.6","The recovery plan includes plans to come back for both traditional and highly available (e.g., cloud) infrastructure."]
[null,null,null,230,"DM.ID-1.1","The organization has integrated its internal dependency management strategy into the overall strategic risk management plan."]
[null,null,null,231,"DM.ID-1.2","The organization monitors the effectiveness of its internal dependency management strategy."]
[null,null,null,232,"DM.ID-1.3","The organization ensures appropriate oversight of and compliance with the internal dependency management strategy implementation."]

{"sheet":"FFIEC CAT to CRI Profile","index":6,"n_rows":1218,"n_cols":6,"rows_kept":1218,"cut":false,"hidden":false,"merged":[]}
[]
["Proprietary"]
[]
["FFIEC CAT to FS Profile Mapping"]
[]
["FFIECNo","FFIECId","FFIECStatement","FSPNo","StmtId","DiagnosticStatement"]
[1,"D1.G.Ov.B.1","Designated members of management are held accountable by the board or an appropriate board committee for implementing and managing the information security and business continuity programs.",2,"GV.SF-1.2","An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework."]
[2,"D1.G.Ov.B.2","Information security risks are discussed in management meetings when prompted by highly visible cyber events or regulatory alerts.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile."]
[null,null,null,21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management."]
[3,"D1.G.Ov.B.3","Management provides a written report on the overall status of the information security and business continuity programs to the board or an appropriate board committee at least annually.",34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization."]
[4,"D1.G.Ov.B.4","The budgeting process includes information security related expenses and tools.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[null,null,null,33,"GV.RR-2.2","The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO)."]
[5,"D1.G.Ov.B.5","Management considers the risks posed by other critical infrastructures (e.g., telecommunications, energy) to the institution.",238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations."]
[null,null,null,245,"DM.ED-4.1","The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees)."]
[null,null,null,273,"DM.BE-1.1","The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector."]
[6,"D1.G.Ov.E.1","At least annually, the board or an appropriate board committee reviews and approves the institution’s cybersecurity program.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks."]
[7,"D1.G.Ov.E.2","Management is responsible for ensuring compliance with legal and regulatory requirements related to cybersecurity.",28,"GV.PL-3.1","The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations."]
[null,null,null,29,"GV.PL-3.2","The organization's cybersecurity policies are consistent with its privacy and civil liberty obligations."]
[8,"D1.G.Ov.E.3","Cybersecurity tools and staff are requested through the budget process.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[null,null,null,33,"GV.RR-2.2","The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO)."]
[9,"D1.G.Ov.E.4","There is a process to formally discuss and estimate potential expenses associated with cybersecurity incidents as part of the budgeting process.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[10,"D1.G.Ov.Int.1","The board or an appropriate board committee has cybersecurity expertise or engages experts to assist with oversight responsibilities.",106,"PR.AT-4.1","The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example."]
[null,null,null,107,"PR.AT-4.2","Where the organization's governing authority (e.g., the Board or one of its committees) does not have adequate cybersecurity expertise, they should have direct access to the senior officer responsible for cybersecurity to discuss cybersecurity related matters."]
[11,"D1.G.Ov.Int.2","The standard board meeting package includes reports and metrics that go beyond events and incidents to address threat intelligence trends and the institution’s security posture.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile."]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program."]
[12,"D1.G.Ov.Int.3","The institution has a cyber risk appetite statement approved by the board or an appropriate board committee.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile."]
[13,"D1.G.Ov.Int.4","Cyber risks that exceed the risk appetite are escalated to management.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management."]
[14,"D1.G.Ov.Int.5","The board or an appropriate board committee ensures management’s annual cybersecurity self-assessment evaluates the institution’s ability to meet its cyber risk management standards.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks."]
[15,"D1.G.Ov.Int.6","The board or an appropriate board committee reviews and approves management’s prioritization and resource allocation decisions based on the results of the cyber assessments.",15,"GV.RM-1.5","The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls."]
[16,"D1.G.Ov.Int.7","The board or an appropriate board committee ensures management takes appropriate actions to address changing cyber risks or significant cybersecurity issues.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks."]
[null,null,null,13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[17,"D1.G.Ov.Int.8","The budget process for requesting additional cybersecurity staff and tools is integrated into business units’ budget processes.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[18,"D1.G.Ov.A.1","The board or board committee approved cyber risk appetite statement is part of the enterprise-wide risk appetite statement.",7,"GV.SF-3.1","An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile."]
[19,"D1.G.Ov.A.2","Management has a formal process to continuously improve cybersecurity oversight.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[20,"D1.G.Ov.A.3","The budget process for requesting additional cybersecurity staff and tools maps current resources and tools to the cybersecurity strategy.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[21,"D1.G.Ov.A.4","Management and the board or an appropriate board committee hold business units accountable for effectively managing all cyber risks associated with their activities.",2,"GV.SF-1.2","An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework."]
[22,"D1.G.Ov.A.5","Management identifies root cause(s) when cyber attacks result in material loss.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector."]
[23,"D1.G.Ov.A.6","The board or an appropriate board committee ensures that management’s actions consider the cyber risks that the institution poses to the financial sector.",4,"GV.SF-1.4","The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry."]
[null,null,null,266,"DM.RS-1.2","The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector."]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications."]
[null,null,null,272,"DM.RS-2.5","When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems."]
[null,null,null,273,"DM.BE-1.1","The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector."]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders."]
[24,"D1.G.Ov.Inn.1","The board or an appropriate board committee discusses ways for management to develop cybersecurity improvements that may be adopted sector-wide.",999,"None","None"]
[25,"D1.G.Ov.Inn.2","The board or an appropriate board committee verifies that management’s actions consider the cyber risks that the institution poses to other critical infrastructures (e.g., telecommunications, energy).",3,"GV.SF-1.3","The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them."]
[null,null,null,266,"DM.RS-1.2","The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector."]
[null,null,null,273,"DM.BE-1.1","The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector."]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders."]
[26,"D1.G.SP.B.1","The institution has an information security strategy that integrates technology, policies, procedures, and training to mitigate risk.",1,"GV.SF-1.1","The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework."]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
[27,"D1.G.SP.B.2","The institution has policies commensurate with its risk and complexity that address the concepts of information technology risk management.",13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[null,null,null,25,"GV.PL-2.1","The cybersecurity policy is supported by the organization's risk management program."]
[28,"D1.G.SP.B.3","The institution has policies commensurate with its risk and complexity that address the concepts of threat information sharing.",133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced."]
[29,"D1.G.SP.B.4","The institution has board-approved policies commensurate with its risk and complexity that address information security.",23,"GV.PL-1.1","The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees)."]
[null,null,null,25,"GV.PL-2.1","The cybersecurity policy is supported by the organization's risk management program."]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
[30,"D1.G.SP.B.5","The institution has policies commensurate with its risk and complexity that address the concepts of external dependency or third-party management.",235,"DM.ED-1.1","The organization has integrated its external dependency management strategy into the overall cyber risk management plan."]
[null,null,null,238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations."]
[31,"D1.G.SP.B.6","The institution has policies commensurate with its risk and complexity that address the concepts of incident response and resilience.",265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program."]
[32,"D1.G.SP.B.7","All elements of the information security program are coordinated enterprise-wide.",1,"GV.SF-1.1","The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework."]
[33,"D1.G.SP.E.1","The institution augmented its information security strategy to incorporate cybersecurity and resilience.",36,"GV.SP-1.1","The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite."]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program."]
[34,"D1.G.SP.E.2","The institution has a formal cybersecurity program that is based on technology and security industry standards or benchmarks.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines."]
[35,"D1.G.SP.E.3","A formal process is in place to update policies as the institution’s inherent risk profile changes.",27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[36,"D1.G.SP.Int.1","The institution has a comprehensive set of policies commensurate with its risk and complexity that address the concepts of threat intelligence.",75,"ID.RA-5.1","Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[37,"D1.G.SP.Int.2","Management periodically reviews the cybersecurity strategy to address evolving cyber threats and changes to the institution’s inherent risk profile.",8,"GV.SF-3.2","An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks."]
[null,null,null,18,"GV.RM-2.2","The cyber risk management strategy articulates how the organization intends to address its inherent cyber risk (before mitigating controls or other factors are taken into consideration)."]
[null,null,null,75,"ID.RA-5.1","Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization."]
[38,"D1.G.SP.Int.3","The cybersecurity strategy is incorporated into, or conceptually fits within, the institution’s enterprise-wide risk management strategy.",20,"GV.RM-3.1","The cyber risk management framework is integrated into the enterprise risk management framework."]
[39,"D1.G.SP.Int.4","Management links strategic cybersecurity objectives to tactical goals.",5,"GV.SF-1.5","The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities."]
[null,null,null,12,"GV.RM-1.2","The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls."]
[40,"D1.G.SP.Int.5","A formal process is in place to cross-reference and simultaneously update all policies related to cyber risks across business lines.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines."]
[null,null,null,27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[41,"D1.G.SP.A.1","The cybersecurity strategy outlines the institution’s future state of cybersecurity with short-term and long-term perspectives.",5,"GV.SF-1.5","The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities."]
[42,"D1.G.SP.A.2","Industry-recognized cybersecurity standards are used as sources during the analysis of cybersecurity program gaps.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines."]
[43,"D1.G.SP.A.3","The cybersecurity strategy identifies and communicates the institution’s role as a component of critical infrastructure in the financial services industry.",4,"GV.SF-1.4","The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry."]
[44,"D1.G.SP.A.4","The risk appetite is informed by the institution’s role in critical infrastructure.",10,"GV.SF-4.1","The risk appetite is informed by the organization’s role in critical infrastructure."]
[45,"D1.G.SP.A.5","Management is continuously improving the existing cybersecurity program to adapt as the desired cybersecurity target state changes.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[46,"D1.G.SP.Inn.1","The cybersecurity strategy identifies and communicates the institution's role as it relates to other critical infrastructures.",3,"GV.SF-1.3","The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them."]
[47,"D1.G.IT.B.1","An inventory of organizational assets (e.g., hardware, software, data, and systems hosted externally) is maintained.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems."]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications."]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets."]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems."]
[48,"D1.G.IT.B.2","Organizational assets (e.g., hardware, systems, data, and applications) are prioritized for protection based on the data classification and business value.",67,"ID.AM-5.2","The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization."]
[49,"D1.G.IT.B.3","Management assigns accountability for maintaining an inventory of organizational assets.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems."]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications."]
[50,"D1.G.IT.B.4","A change management process is in place to request and approve changes to systems configurations, hardware, software, applications, and security tools.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[51,"D1.G.IT.E.1","The asset inventory, including identification of critical assets, is updated at least annually to address new, relocated, re-purposed, and sunset assets.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems."]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications."]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets."]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems."]
[52,"D1.G.IT.E.2","The institution has a documented asset life-cycle process that considers whether assets to be acquired have appropriate security safeguards.",57,"GV.TE-1.1","The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception."]
[null,null,null,59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure."]
[null,null,null,113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,null,123,"PR.IP-2.2","The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications."]
[53,"D1.G.IT.E.3","The institution proactively manages system EOL (e.g., replacement) to limit security risks.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[54,"D1.G.IT.E.4","Changes are formally approved by an individual or committee with appropriate authority and with separation of duties.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[55,"D1.G.IT.Int.1","Baseline configurations cannot be altered without a formal change request, documented approval, and an assessment of security implications.",119,"PR.IP-1.1","The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets."]
[null,null,null,125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[56,"D1.G.IT.Int.2","A formal IT change management process requires cybersecurity risk to be evaluated during the analysis, approval, testing, and reporting of changes.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[57,"D1.G.IT.A.1","Supply chain risk is reviewed before the acquisition of mission-critical information systems including system components.",238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations."]
[null,null,null,249,"DM.ED-4.5","The organization establishes contingencies to address circumstances that might put a vendor out of business or severely impact delivery of services to the organization, sector-critical systems, or the financial sector as a whole."]
[58,"D1.G.IT.A.2","Automated tools enable tracking, updating, asset prioritizing, and custom reporting of the asset inventory.",60,"ID.AM-1.1","The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems."]
[null,null,null,61,"ID.AM-2.1","The organization maintains a current and complete inventory of software platforms and business applications."]
[59,"D1.G.IT.A.3","Automated processes are in place to detect and block unauthorized changes to software and hardware.",175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[null,null,null,177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs."]
[60,"D1.G.IT.A.4","The change management system uses thresholds to determine when a risk assessment of the impact of the change is required.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[61,"D1.G.IT.Inn.1","A formal change management function governs decentralized or highly distributed change requests and identifies and measures security risks that may cause increased exposure to cyber attack.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[62,"D1.G.IT.Inn.2","Comprehensive automated enterprise tools are implemented to detect and block unauthorized changes to software and hardware.",175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[null,null,null,177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs."]
[63,"D1.RM.RMP.B.1","An information security and business continuity risk management function(s) exists within the institution.",36,"GV.SP-1.1","The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite."]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program."]
[64,"D1.RM.RMP.E.1","The risk management program incorporates cyber risk identification, measurement, mitigation, monitoring, and reporting.",11,"GV.RM-1.1","The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting."]
[65,"D1.RM.RMP.E.2","Management reviews and uses the results of audits to improve existing cybersecurity policies, procedures, and controls.",52,"GV.AU-2.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[66,"D1.RM.RMP.E.3","Management monitors moderate and high residual risk issues from the cybersecurity risk assessment until items are addressed.",11,"GV.RM-1.1","The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting."]
[null,null,null,19,"GV.RM-2.3","The cyber risk management strategy articulates how the organization would maintain an acceptable level of residual cyber risk set by the appropriate governing authority (e.g., the Board or one of its committees)."]
[null,null,null,21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management."]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
[67,"D1.RM.RMP.Int.1","The cybersecurity function has a clear reporting line that does not present a conflict of interest.",22,"GV.RM-3.3","The organization's cyber risk management framework provides for segregation of duties between policy development, implementation, and oversight to ensure rigorous review of both policy and implementation."]
[68,"D1.RM.RMP.Int.2","The risk management program specifically addresses cyber risks beyond the boundaries of the technological impacts (e.g., financial, strategic, regulatory, compliance).",69,"ID.RA-1.1","The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit."]
[69,"D1.RM.RMP.Int.3","Benchmarks or target performance metrics have been established for showing improvements or regressions of the security posture over time.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics."]
[70,"D1.RM.RMP.Int.4","Management uses the results of independent audits and reviews to improve cybersecurity.",55,"GV.AU-3.2","An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution."]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience."]
[71,"D1.RM.RMP.Int.5","There is a process to analyze and assign potential losses and related expenses, by cost center, associated with cybersecurity incidents.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector."]
[72,"D1.RM.RMP.A.1","Cybersecurity metrics are used to facilitate strategic decision-making and funding in areas of need.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics."]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program."]
[null,null,null,40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[73,"D1.RM.RMP.A.2","Independent risk management sets and monitors cyber-related risk limits for business units.",45,"GV.IR-2.1","An independent risk management function assesses the appropriateness of the cyber risk management program according to the organization's risk appetite."]
[null,null,null,46,"GV.IR-2.2","An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed."]
[74,"D1.RM.RMP.A.3","Independent risk management staff escalates to management and the board or an appropriate board committee significant discrepancies from business unit’s assessments of cyber-related risk.",56,"GV.AU-3.3","An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization."]
[75,"D1.RM.RMP.A.4","A process is in place to analyze the financial impact cyber incidents have on the institution’s capital.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector."]
[76,"D1.RM.RMP.A.5","The cyber risk data aggregation and real-time reporting capabilities support the institution’s ongoing reporting needs, particularly during cyber incidents.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[77,"D1.RM.RMP.Inn.1","The risk management function identifies and analyzes commonalities in cyber events that occur both at the institution and across other sectors to enable more predictive risk management.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
[78,"D1.RM.RMP.Inn.2","A process is in place to analyze the financial impact that a cyber incident at the institution may have across the financial sector.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders."]
[79,"D1.RM.RA.B.1","A risk assessment focused on safeguarding customer information identifies reasonable and foreseeable internal and external threats, the likelihood and potential damage of threats, and the sufficiency of policies, procedures, and customer information syste",11,"GV.RM-1.1","The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting."]
[null,null,null,37,"GV.SP-1.2","Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
[null,null,null,74,"ID.RA-4.1","The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited."]
[80,"D1.RM.RA.B.2","The risk assessment identifies internet-based systems and high-risk transactions that warrant additional authentication controls.",67,"ID.AM-5.2","The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization."]
[null,null,null,95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm."]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[81,"D1.RM.RA.B.3","The risk assessment is updated to address new technologies, products, services, and connections before deployment.",13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[82,"D1.RM.RA.E.1","Risk assessments are used to identify the cybersecurity risks stemming from new products, services, or relationships.",13,"GV.RM-1.3","As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[83,"D1.RM.RA.E.2","The focus of the risk assessment has expanded beyond customer information to address all information assets.",69,"ID.RA-1.1","The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit."]
[84,"D1.RM.RA.E.3","The risk assessment considers the risk of using EOL software and hardware components.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[85,"D1.RM.RA.Int.1","The risk assessment is adjusted to consider widely known risks or risk management practices.",6,"GV.SF-2.1","The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines."]
[86,"D1.RM.RA.A.1","An enterprise-wide risk management function incorporates cyber threat analysis and specific risk exposure as part of the enterprise risk assessment.",14,"GV.RM-1.4","The cyber risk assessment process is consistent with the organization's policies and procedures and includes criteria for the evaluation and categorization of enterprise-specific cyber risks and threats."]
[87,"D1.RM.RA.Inn.1","The risk assessment is updated in real time as changes to the risk profile occur, new applicable standards are released or updated, and new exposures are anticipated.",59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure."]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them."]
[88,"D1.RM.RA.Inn.2","The institution uses information from risk assessments to predict threats and drive real-time responses.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them."]
[89,"D1.RM.RA.Inn.3","Advanced or automated analytics offer predictive information and real-time risk metrics.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[90,"D1.G.RM.Au.B.1","Independent audit or review evaluates policies, procedures, and controls across the institution for significant risks and control issues associated with the institution's operations, including risks in new products, emerging technologies, and information",48,"GV.AU-1.1","The organization has an independent audit function."]
[null,null,null,49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance."]
[null,null,null,50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[91,"D1.RM.Au.B.2","The independent audit function validates controls related to the storage or transmission of confidential data.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[92,"D1.RM.Au.B.3","Logging practices are independently reviewed periodically to ensure appropriate log management (e.g., access controls, retention, and maintenance).",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time."]
[null,null,null,161,"DE.CM-1.1","The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods."]
[93,"D1.RM.Au.B.4","Issues and corrective actions from internal audits and independent testing/assessments are formally tracked to ensure procedures and control lapses are resolved in a timely manner.",55,"GV.AU-3.2","An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution."]
[94,"D1.RM.Au.E.1","The independent audit function validates that the risk management function is commensurate with the institution’s risk and complexity.",49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance."]
[95,"D1.RM.Au.E.2","The independent audit function validates that the institution’s threat information sharing is commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
[96,"D1.RM.Au.E.3","The independent audit function validates that the institution’s cybersecurity controls function is commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[97,"D1.RM.Au.E.4","The independent audit function validates that the institution’s third-party relationship management is commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[98,"D1.RM.Au.E.5","The independent audit function validates that the institution’s incident response program and resilience are commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[99,"D1.RM.Au.Int.1","A formal process is in place for the independent audit function to update its procedures based on changes to the institution’s inherent risk profile.",52,"GV.AU-2.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector."]
[null,null,null,53,"GV.AU-2.2","A formal process is in place for the independent audit function to update its procedures based on changes to the organization's risk appetite and risk tolerance."]
[100,"D1.RM.Au.Int.2","The independent audit function validates that the institution’s threat intelligence and collaboration are commensurate with the institution’s risk and complexity.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[101,"D1.RM.Au.Int.3","The independent audit function regularly reviews management’s cyber risk appetite statement.",49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance."]
[null,null,null,53,"GV.AU-2.2","A formal process is in place for the independent audit function to update its procedures based on changes to the organization's risk appetite and risk tolerance."]
[102,"D1.RM.Au.Int.4","Independent audits or reviews are used to identify gaps in existing security capabilities and expertise.",54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures."]
[103,"D1.RM.Au.A.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector.",52,"GV.AU-2.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector."]
[104,"D1.RM.Au.A.2","The independent audit function regularly reviews the institution’s cyber risk appetite statement in comparison to assessment results and incorporates gaps into the audit strategy.",49,"GV.AU-1.2","The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance."]
[105,"D1.RM.Au.A.3","Independent audits or reviews are used to identify cybersecurity weaknesses, root causes, and the potential impact to business units.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[106,"D1.RM.Au.Inn.1","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across other sectors the institution depends upon.",274,"DM.BE-1.2","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across other sectors the institution depends upon."]
[107,"D1.RM.Au.Inn.2","The independent audit function uses sophisticated data mining tools to perform continuous monitoring of cybersecurity processes or controls.",999,"None","None"]
[108,"D1.R.St.B.1","Information security roles and responsibilities have been identified.",31,"GV.RR-1.1","The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners."]
[null,null,null,68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities."]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
[null,null,null,234,"DM.ID-2.1","Roles and responsibilities for internal dependency management are defined and assigned."]
[null,null,null,243,"DM.ED-3.1","Roles and responsibilities for external dependency management are defined and assigned."]
[109,"D1.R.St.B.2","Processes are in place to identify additional expertise needed to improve information security defenses.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[110,"D1.R.St.E.1","A formal process is used to identify cybersecurity tools and expertise that may be needed.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[111,"D1.R.St.E.2","Management with appropriate knowledge and experience leads the institution's cybersecurity efforts.",101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
[112,"D1.R.St.E.3","Staff with cybersecurity responsibilities have the requisite qualifications to perform the necessary tasks of the position.",101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
[113,"D1.R.St.E.4","Employment candidates, contractors, and third parties are subject to background verification proportional to the confidentiality of the data accessed, business requirements, and acceptable risk.",140,"PR.IP-11.1","The organization conducts background/screening checks on all new employees, as permitted by law."]
[null,null,null,141,"PR.IP-11.2","The organization conducts background/screening checks on all staff at regular intervals throughout their employment, commensurate with staff’s access to critical systems or a change in role, as permitted by law."]
[114,"D1.R.St.Int.1","The institution has a program for talent recruitment, retention, and succession planning for the cybersecurity and resilience staffs.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[115,"D1.R.St.A.1","The institution benchmarks its cybersecurity staffing against peers to identify whether its recruitment, retention, and succession planning are commensurate.",9,"GV.SF-3.3","The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[116,"D1.R.St.A.2","Dedicated cybersecurity staff develops, or contributes to developing, integrated enterprise-level security and cyber defense strategies.",27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[117,"D1.R.St.Inn.1","The institution actively partners with industry associations and academia to inform curricula based on future cybersecurity staffing needs of the industry.",999,"None","None"]
[118,"D1.TC.Tr.B.1","Annual information security training is provided.",97,"PR.AT-1.1","All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law."]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents."]
[119,"D1.TC.Tr.B.2","Annual information security training includes incident response, current cyber threats (e.g., phishing, spear phishing, social engineering, and mobile security), and emerging issues.",97,"PR.AT-1.1","All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law."]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents."]
[120,"D1.TC.Tr.B.3","Situational awareness materials are made available to employees when prompted by highly visible cyber events or by regulatory alerts.",97,"PR.AT-1.1","All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[121,"D1.TC.Tr.B.4","Customer awareness materials are readily available (e.g., DHS’ Cybersecurity Awareness Month materials).",103,"PR.AT-3.1","The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate."]
[122,"D1.TC.Tr.E.1","The institution has a program for continuing cybersecurity training and skill development for cybersecurity staff.",100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[null,null,null,101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures."]
[123,"D1.TC.Tr.E.2","Management is provided cybersecurity training relevant to their job responsibilities.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization."]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[null,null,null,101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
[null,null,null,106,"PR.AT-4.1","The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example."]
[124,"D1.TC.Tr.E.3","Employees with privileged account permissions receive additional cybersecurity training commensurate with their levels of responsibility.",84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored."]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[125,"D1.TC.Tr.E.4","Business units are provided cybersecurity training relevant to their particular business risks.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization."]
[null,null,null,84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored."]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents."]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[null,null,null,105,"PR.AT-3.3","Cybersecurity training covers topics designed to minimize risks to or from interconnected parties."]
[126,"D1.TC.Tr.E.5","The institution validates the effectiveness of training (e.g., social engineering or phishing tests).",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[null,null,null,84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored."]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment."]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures."]
[127,"D1.TC.Tr.Int.1","Management incorporates lessons learned from social engineering and phishing exercises to improve the employee awareness programs.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment."]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[128,"D1.TC.Tr.Int.2","Cybersecurity awareness information is provided to retail customers and commercial clients at least annually.",103,"PR.AT-3.1","The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate."]
[129,"D1.TC.Tr.Int.3","Business units are provided cybersecurity training relevant to their particular business risks, over and above what is required of the institution as a whole.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization."]
[null,null,null,84,"PR.AC-1.2","User access authorization is limited to individuals who are appropriately trained and monitored."]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents."]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[null,null,null,105,"PR.AT-3.3","Cybersecurity training covers topics designed to minimize risks to or from interconnected parties."]
[130,"D1.TC.Tr.Int.4","The institution routinely updates its training to security staff to adapt to new threats.",99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment."]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[null,null,null,101,"PR.AT-2.2","Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
[null,null,null,102,"PR.AT-2.3","A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures."]
[131,"D1.TC.Tr.A.1","Independent directors are provided with cybersecurity training that addresses how complex products, services, and lines of business affect the institution's cyber risk.",35,"GV.RR-2.4","The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization."]
[null,null,null,100,"PR.AT-2.1","High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[null,null,null,106,"PR.AT-4.1","The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example."]
[132,"D1.TC.Tr.Inn.1","Key performance indicators are used to determine whether training and awareness programs positively influence behavior.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment."]
[133,"D1.TC.Cu.B.1","Management holds employees accountable for complying with the information security program.",24,"GV.PL-1.2","The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures."]
[134,"D1.TC.Cu.E.1","The institution has formal standards of conduct that hold all employees accountable for complying with cybersecurity policies and procedures.",24,"GV.PL-1.2","The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures."]
[135,"D1.TC.Cu.E.2","Cyber risks are actively discussed at business unit meetings.",12,"GV.RM-1.2","The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls."]
[null,null,null,34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[136,"D1.TC.Cu.E.3","Employees have a clear understanding of how to identify and escalate potential cybersecurity issues.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management."]
[null,null,null,81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk."]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents."]
[137,"D1.TC.Cu.Int.1","Management ensures performance plans are tied to compliance with cybersecurity policies and standards in order to hold employees accountable.",24,"GV.PL-1.2","The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures."]
[138,"D1.TC.Cu.Int.2","The risk culture requires formal consideration of cyber risks in all business decisions.",12,"GV.RM-1.2","The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls."]
[139,"D1.TC.Cu.Int.3","Cyber risk reporting is presented and discussed at the independent risk management meetings.",34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization."]
[null,null,null,41,"GV.IR-1.1","The organization's enterprise-wide cyber risk management framework includes an independent risk management function that provides assurance that the cyber risk management framework is implemented as intended."]
[null,null,null,43,"GV.IR-1.3","The independent risk management function has appropriate understanding of the organization's structure, cybersecurity program, and relevant risks and threats."]
[null,null,null,45,"GV.IR-2.1","An independent risk management function assesses the appropriateness of the cyber risk management program according to the organization's risk appetite."]
[null,null,null,46,"GV.IR-2.2","An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed."]
[null,null,null,82,"ID.RA-6.2","Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units."]
[140,"D1.TC.Cu.A.1","Management ensures continuous improvement of cyber risk cultural awareness.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[null,null,null,98,"PR.AT-1.2","Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents."]
[null,null,null,99,"PR.AT-1.3","Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment."]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[141,"D1.TC.Cu.Inn.1","The institution leads efforts to promote cybersecurity culture across the sector and to other sectors that they depend upon.",999,"None","None"]
[142,"D2.TI.Ti.B.1","The institution belongs or subscribes to a threat and vulnerability information sharing source(s) that provides information on threats (e.g., Financial Services Information Sharing and Analysis Center [FS-ISAC], U.S. Computer Emergency Readiness Team [US-",133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[143,"D2.TI.Ti.B.2","Threat information is used to monitor threats and vulnerabilities.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[144,"D2.TI.Th.B.3","Threat information is used to enhance internal risk management and controls.",186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[145,"D2.TI.Ti.E.1","Threat information received by the institution includes analysis of tactics, patterns, and risk mitigation recommendations.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[146,"D2.TI.Th.Int.1","A formal threat intelligence program is implemented and includes subscription to threat feeds from external providers and internal sources.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[147,"D2.TI.Ti.Int.2","Protocols are implemented for collecting information from industry peers and government.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[148,"D2.TI.Ti.Int.3","A read-only, central repository of cyber threat intelligence is maintained.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[149,"D2.TI.Ti.A.1","A cyber intelligence model is used for gathering threat information.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
[null,null,null,73,"ID.RA-3.3","The organization regularly reviews and updates results of its cyber threat analysis."]
[null,null,null,77,"ID.RA-5.3","The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed."]
[150,"D2.TI.Ti.A.2","Threat intelligence is automatically received from multiple sources in real time.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[151,"D2.TI.Ti.A.3","The institution’s threat intelligence includes information related to geopolitical events that could increase cybersecurity threat levels.",76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[152,"D2.TI.Ti.Inn.1","A threat analysis system automatically correlates threat data to specific risks and then takes risk-based automated actions while alerting management.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[153,"D2.TI.Ti.Inn.2","The institution is investing in the development of new threat intelligence and collaboration mechanisms (e.g., technologies, business processes) that will transform how information is gathered and shared.",999,"None","None"]
[154,"D2.MA.Ma.B.1","Audit log records and other security event logs are reviewed and retained in a secure manner.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time."]
[null,null,null,161,"DE.CM-1.1","The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods."]
[155,"D2.MA.Ma.B.2","Computer event logs are used for investigations once an event has occurred.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process."]
[156,"D2.MA.Ma.E.1","A process is implemented to monitor threat information to discover emerging threats.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
[null,null,null,72,"ID.RA-3.2","The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past."]
[null,null,null,73,"ID.RA-3.3","The organization regularly reviews and updates results of its cyber threat analysis."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[157,"D2.MA.Ma.E.2","The threat information and analysis process is assigned to a specific group or individual.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[158,"D2.MA.Ma.E.3","Security processes and technology are centralized and coordinated in a Security Operations Center (SOC) or equivalent.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[159,"D2.MA.Ma.E.4","Monitoring systems operate continuously with adequate support for efficient incident handling.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[160,"D2.MA.Ma.Int.1","A threat intelligence team is in place that evaluates threat intelligence from multiple sources for credibility, relevance, and exposure.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams)."]
[161,"D2.MA.Ma.Int.2","A profile is created for each threat that identifies the likely intent, capability, and target of the threat.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
[null,null,null,156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[162,"D2.MA.Ma.Int.3","Threat information sources that address all components of the threat profile are prioritized and monitored.",206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams)."]
[163,"D2.MA.Ma.Int.4","Threat intelligence is analyzed to develop cyber threat summaries including risks to the institution and specific actions for the institution to consider.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
[null,null,null,156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams)."]
[164,"D2.MA.Ma.A.1","A dedicated cyber threat identification and analysis committee or team exists to centralize and coordinate initiatives and communications.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams)."]
[165,"D2.MA.Ma.A.2","Formal processes have been defined to resolve potential conflicts in information received from sharing and analysis centers or other sources.",71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams)."]
[166,"D2.MA.Ma.A.3","Emerging internal and external threat intelligence and correlated log analysis are used to predict future attacks.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[167,"D2.MA.Ma.A.4","Threat intelligence is viewed within the context of the institution's risk profile and risk appetite to prioritize mitigating actions in anticipation of threats.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management."]
[null,null,null,71,"ID.RA-3.1","The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
[null,null,null,72,"ID.RA-3.2","The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past."]
[null,null,null,73,"ID.RA-3.3","The organization regularly reviews and updates results of its cyber threat analysis."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[168,"D2.MA.Ma.A.5","Threat intelligence is used to update architecture and configuration standards.",999,"None","None"]
[169,"D2.MA.Ma.Inn.1","The institution uses multiple sources of intelligence, correlated log analysis, alerts, internal traffic flows, and geopolitical events to predict potential future attacks and attack trends.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,206,"RS.AN-5.1","The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams)."]
[170,"D2.MA.Ma.Inn.2","Highest risk scenarios are used to predict threats against specific business targets.",67,"ID.AM-5.2","The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization."]
[null,null,null,136,"PR.IP-10.1","The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients."]
[171,"D2.MA.Ma.Inn.3","IT systems automatically detect configuration weaknesses based on threat intelligence and alert management so actions can be prioritized.",177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs."]
[172,"D2.IS.Is.B.1","Information security threats are gathered and shared with applicable internal employees.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[173,"D2.IS.Is.B.2","Contact information for law enforcement and the regulator(s) is maintained and updated regularly.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[174,"D2.IS.Is.B.3","Information about threats is shared with law enforcement and regulators when required or prompted.",133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate."]
[175,"D2.IS.Is.E.1","A formal and secure process is in place to share threat and vulnerability information with other entities.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced."]
[176,"D2.IS.Is.E.2","A representative from the institution participates in law enforcement or information-sharing organization meetings.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[177,"D2.IS.Is.Int.1","A formal protocol is in place for sharing threat, vulnerability, and incident information to employees based on their specific job function.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[178,"D2.IS.Is.Int.2","Information-sharing agreements are used as needed or required to facilitate sharing threat information with other financial sector organizations or third parties.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced."]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate."]
[179,"D2.IS.Is.Int.3","Information is shared proactively with the industry, law enforcement, regulators, and information-sharing forums.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate."]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate."]
[180,"D2.IS.Is.Int.4","A process is in place to communicate and collaborate with the public sector regarding cyber threats.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate."]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate."]
[181,"D2.IS.Is.A.1","Management communicates threat intelligence with business risk context and specific risk management recommendations to the business units.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,189,"RS.CO-1.2","The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[null,null,null,229,"RC.CO-3.1","The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders."]
[182,"D2.IS.Is.A.2","Relationships exist with employees of peer institutions for sharing cyber threat intelligence.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced."]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate."]
[183,"D2.IS.Is.A.3","A network of trust relationships (formal and/or informal) has been established to evaluate information about cyber threats.",70,"ID.RA-2.1","The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
[null,null,null,76,"ID.RA-5.2","The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,133,"PR.IP-8.1","The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,199,"RS.CO-5.2","The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced."]
[184,"D2.IS.Is.Inn.1","A mechanism is in place for sharing cyber threat intelligence with business units in real time including the potential financial and operational impact of inaction.",159,"DE.AE-4.1","The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[185,"D2.IS.Is.Inn.2","A system automatically informs management of the level of business risk specific to the institution and the progress of recommended steps taken to mitigate the risks.",81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[186,"D2.IS.Is.Inn.3","The institution is leading efforts to create new sector-wide information- sharing channels to address gaps in external-facing information-sharing mechanisms.",999,"None","None"]
[187,"D3.PC.Im.B.1","Network perimeter defense tools (e.g., border router and firewall) are used.",153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[188,"D3.PC.Im.B.2","Systems that are accessed from the Internet or by external parties are protected by firewalls or other similar devices.",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[189,"D3.PC.Im.B.3","All ports are monitored.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[190,"D3.PC.Im.B.4","Up to date antivirus and anti-malware tools are used.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[191,"D3.PC.Im.B.5","Systems configurations (for servers, desktops, routers, etc.) follow industry standards and are enforced.",59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure."]
[null,null,null,91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use."]
[null,null,null,119,"PR.IP-1.1","The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets."]
[null,null,null,121,"PR.IP-1.3","The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified."]
[null,null,null,152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
[192,"D3.PC.Im.B.6","Ports, functions, protocols and services are prohibited if no longer needed for business purposes.",152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
[193,"D3.PC.Im.B.7","Access to make changes to systems configurations (including virtual machines and hypervisors) is controlled and monitored.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[194,"D3.PC.Im.B.8","Programs that can override system, object, network, virtual machine, and application controls are restricted.",91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[195,"D3.PC.Im.B.9","System sessions are locked after a pre-defined period of inactivity and are terminated after pre-defined conditions are met.",86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms)."]
[196,"D3.PC.Im.B.10","Wireless network environments require security settings with strong encryption for authentication and transmission. (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[197,"D3.PC.Im.E.1","There is a firewall at each Internet connection and between any Demilitarized Zone (DMZ) and internal network(s).",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[198,"D3.PC.Im.E.2","Antivirus and intrusion detection/prevention systems (IDS/IPS) detect and block actual and attempted attacks or intrusions.",163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery."]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[199,"D3.PC.Im.E.3","Technical controls prevent unauthorized devices, including rogue wireless access devices and removable media, from connecting to the internal network(s).",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[200,"D3.PC.Im.E.4","A risk-based solution is in place at the institution or Internet hosting provider to mitigate disruptive cyber attacks (e.g., DDoS attacks).",164,"DE.CM-1.4","The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks."]
[201,"D3.PC.Im.E.5","Guest wireless networks are fully segregated from the internal network(s). (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[202,"D3.PC.Im.E.6","Domain Name System Security Extensions (DNSSEC) is deployed across the enterprise.",999,"None","None"]
[203,"D3.PC.Im.E.7","Critical systems supported by legacy technologies are regularly reviewed to identify for potential vulnerabilities, upgrade opportunities, or new defense layers.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,null,146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[204,"D3.PC.Im.E.8","Controls for unsupported systems are implemented and tested.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[205,"D3.PC.Im.Int.1","The enterprise network is segmented in multiple, separate trust/security zones with defense-in-depth strategies (e.g., logical network segmentation, hard backups, air-gapping) to mitigate attacks.",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[206,"D3.PC.Im.Int.2","Security controls are used for remote access to all administrative consoles, including restricted virtual systems.",87,"PR.AC-3.1","Remote access is actively managed and restricted to necessary systems."]
[null,null,null,90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[207,"D3.PC.Im.Int.3","Wireless network environments have perimeter firewalls that are implemented and configured to restrict unauthorized traffic. (*N/A if there are no wireless networks.)",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security."]
[null,null,null,93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[208,"D3.PC.Im.Int.4","Wireless networks use strong encryption with encryption keys that are changed frequently. (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control."]
[209,"D3.PC.Im.Int.5","The broadcast range of the wireless network(s) is confined to institution-controlled boundaries. (*N/A if there are no wireless networks.)",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[210,"D3.PC.Im.Int.6","Technical measures are in place to prevent the execution of unauthorized code on institution owned or managed devices, network infrastructure, and systems components.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[211,"D3.PC.Im.A.1","Network environments and virtual instances are designed and configured to restrict and monitor traffic between trusted and untrusted zones.",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[212,"D3.PC.Im.A.2","Only one primary function is permitted per server to prevent functions that require different security levels from co-existing on the same server.",152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
[213,"D3.PC.Im.A.3","Anti-spoofing measures are in place to detect and block forged source IP addresses from entering the network.",164,"DE.CM-1.4","The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks."]
[214,"D3.PC.Im.Inn.1","The institution risk scores all of its infrastructure assets and updates in real time based on threats, vulnerabilities, or operational changes.",77,"ID.RA-5.3","The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed."]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets."]
[215,"D3.PC.Im.Inn.2","Automated controls are put in place based on risk scores to infrastructure assets, including automatically disconnecting affected assets.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner."]
[216,"D3.PC.Im.Inn.3","The institution proactively seeks to identify control gaps that may be used as part of a zero-day attack.",180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[217,"D3.PC.Im.Inn.4","Public-facing servers are routinely rotated and restored to a known clean state to limit the window of time a system is exposed to potential threats.",119,"PR.IP-1.1","The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets."]
[218,"D3.PC.Am.B.1","Employee access is granted to systems and confidential data based on job responsibilities and the principles of least privilege.",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized."]
[null,null,null,89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary."]
[219,"D3.PC.Am.B.2","Employee access to systems and confidential data provides for separation of duties.",89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary."]
[220,"D3.PC.Am.B.3","Elevated privileges (e.g., administrator privileges) are limited and tightly controlled (e.g., assigned to individuals, not shared, and require stronger password controls).",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[221,"D3.PC.Am.B.4","User access reviews are performed periodically for all systems and applications based on the risk to the application or system.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.)."]
[222,"D3.PC.Am.B.5","Changes to physical and logical user access, including those that result from voluntary and involuntary terminations, are submitted to and approved by appropriate personnel.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.)."]
[null,null,null,86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms)."]
[223,"D3.PC.Am.B.6","Identification and authentication are required and managed for access to systems, applications, and hardware.",94,"PR.AC-6.1","The organization authenticates identity and validates the authorization level of a user before granting access to its systems."]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[224,"D3.PC.Am.B.7","Access controls include password complexity and limits to password attempts and reuse.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.)."]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[225,"D3.PC.Am.B.8","All default passwords and unnecessary default accounts are changed before system implementation.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.)."]
[226,"D3.PC.Am.B.9","Customer access to Internet-based products or services requires authentication controls (e.g., layered controls, multifactor) that are commensurate with the risk.",95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm."]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[227,"D3.PC.Am.B.10","Production and non-production environments are segregated to prevent unauthorized access or changes to information assets. (*N/A if no production environment exists at the institution or the institution’s third party.)",92,"PR.AC-5.1","Networks and systems are segmented to maintain appropriate security."]
[null,null,null,117,"PR.DS-7.1","The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment."]
[228,"D3.PC.Am.B.11","Physical security controls are used to prevent unauthorized access to information systems and telecommunication systems.",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized."]
[null,null,null,86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms)."]
[null,null,null,94,"PR.AC-6.1","The organization authenticates identity and validates the authorization level of a user before granting access to its systems."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems."]
[229,"D3.PC.Am.B.12","All passwords are encrypted in storage and in transit.",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control."]
[null,null,null,111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control."]
[230,"D3.PC.Am.B.13","Confidential data are encrypted when transmitted across public or untrusted networks (e.g., Internet).",111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control."]
[231,"D3.PC.Am.B.14","Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store confidential data. (*N/A if mobile devices are not used.)",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control."]
[232,"D3.PC.Am.B.15","Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication.",88,"PR.AC-3.2","The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations."]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control."]
[233,"D3.PC.Am.B.16","Administrative, physical, or technical controls are in place to prevent users without administrative responsibilities from installing unauthorized software.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[234,"D3.PC.Am.B.17","Customer service (e.g., the call center) utilizes formal procedures to authenticate customers commensurate with the risk of the transaction or request.",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[235,"D3.PC.Am.B.18","Data is disposed of or destroyed according to documented requirements and within expected time frames.",131,"PR.IP-6.1","Data is maintained, stored, retained and destroyed according to the organization's data retention policy."]
[236,"D3.PC.Am.E.1","Changes to user access permissions trigger automated notices to appropriate personnel.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.)."]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems."]
[237,"D3.PC.Am.E.2","Administrators have two accounts: one for administrative use and one for general purpose, non-administrative tasks.",89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary."]
[null,null,null,90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[238,"D3.PC.Am.E.3","Use of customer data in non-production environments complies with legal, regulatory, and internal policy requirements for concealing or removing of sensitive data elements.",28,"GV.PL-3.1","The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations."]
[null,null,null,109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[239,"D3.PC.Am.E.4","Physical access to high-risk or confidential systems is restricted, logged, and unauthorized access is blocked.",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized."]
[null,null,null,86,"PR.AC-2.1","The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms)."]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems."]
[240,"D3.PC.Am.E.5","Controls are in place to prevent unauthorized access to cryptographic keys.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[241,"D3.PC.Am.Int.1","The institution has implemented tools to prevent unauthorized access to or exfiltration of confidential data.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider."]
[242,"D3.PC.Am.Int.2","Controls are in place to prevent unauthorized escalation of user privileges.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[243,"D3.PC.Am.Int.3","Access controls are in place for database administrators to prevent unauthorized downloading or transmission of confidential data.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[null,null,null,115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[244,"D3.PC.Am.Int.4","All physical and logical access is removed immediately upon notification of involuntary termination and within 24 hours of an employee’s voluntary departure.",85,"PR.AC-1.3","Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.)."]
[245,"D3.PC.Am.Int.5","Multifactor authentication and/or layered controls have been implemented to secure all third-party access to the institution's network and/or systems and applications.",88,"PR.AC-3.2","The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations."]
[246,"D3.PC.Am.Int.6","Multifactor authentication (e.g., tokens, digital certificates) techniques are used for employee access to high-risk systems as identified in the risk assessment(s). (*N/A if no high risk systems.)",88,"PR.AC-3.2","The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations."]
[null,null,null,95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm."]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[247,"D3.PC.Am.Int.7","Confidential data are encrypted in transit across private connections (e.g., frame relay and T1) and within the institution’s trusted zones.",111,"PR.DS-2.1","Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,112,"PR.DS-2.2","Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control."]
[248,"D3.PC.Am.Int.8","Controls are in place to prevent unauthorized access to collaborative computing devices and applications (e.g., networked white boards, cameras, microphones, online applications such as instant messaging and document sharing). (* N/A if collaborative comp",83,"PR.AC-1.1","Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized."]
[null,null,null,94,"PR.AC-6.1","The organization authenticates identity and validates the authorization level of a user before granting access to its systems."]
[249,"D3.PC.Am.A.1","Encryption of select data at rest is determined by the institution’s data classification and risk assessment.",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control."]
[250,"D3.PC.Am.A.2","Customer authentication for high-risk transactions includes methods to prevent malware and man-in-the-middle attacks (e.g., using visual transaction signing).",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[251,"D3.PC.Am.Inn.1","Adaptive access controls de-provision or isolate an employee, third-party, or customer credentials to minimize potential damage if malicious behavior is suspected.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[252,"D3.PC.Am.Inn.2","Unstructured confidential data are tracked and secured through an identity-aware, cross-platform storage system that protects against internal threats, monitors user access, and tracks changes.",109,"PR.DS-1.1","Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control."]
[253,"D3.PC.Am.Inn.3","Tokenization is used to substitute unique values for confidential information (e.g., virtual credit card).",999,"None","None"]
[254,"D3.PC.Am.Inn.4","The institution is leading efforts to create new technologies and processes for managing customer, employee, and third-party authentication and access.",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[255,"D3.PC.Am.Inn.5","Real-time risk mitigation is taken based on automated risk scoring of user credentials.",96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[256,"D3.PC.De.B.1","Controls are in place to restrict the use of removable media to authorized personnel.",151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[257,"D3.PC.De.E.1","Tools automatically block attempted access from unpatched employee and third-party devices.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,176,"DE.CM-7.2","The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers."]
[258,"D3.PC.De.E.2","Tools automatically block attempted access by unregistered devices to internal networks.",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[null,null,null,120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,176,"DE.CM-7.2","The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers."]
[259,"D3.PC.De.E.3","The institution has controls to prevent the unauthorized addition of new connections.",93,"PR.AC-5.2","The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[260,"D3.PC.De.E.4","Controls are in place to prevent unauthorized individuals from copying confidential data to removable media.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[261,"D3.PC.De.E.5","Antivirus and anti-malware tools are deployed on end-point devices (e.g., workstations, laptops, and mobile devices).",151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[null,null,null,169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[262,"D3.PC.De.E.6","Mobile devices with access to the institution’s data are centrally managed for antivirus and patch deployment. (*N/A if mobile devices are not used.)",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[263,"D3.PC.De.E.7","The institution wipes data remotely on mobile devices when a device is missing or stolen. (*N/A if mobile devices are not used.)",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,null,131,"PR.IP-6.1","Data is maintained, stored, retained and destroyed according to the organization's data retention policy."]
[264,"D3.PC.De.Int.1","Data loss prevention controls or devices are implemented for inbound and outbound communications (e.g., e-mail, FTP, Telnet, prevention of large file transfers).",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[265,"D3.PC.De.Int.2","Mobile device management includes integrity scanning (e.g., jailbreak/rooted detection). (*N/A if mobile devices are not used.)",116,"PR.DS-6.1","The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable."]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[266,"D3.PC.De.Int.3","Mobile devices connecting to the corporate network for storing and accessing company information allow for remote software version/patch validation. (*N/A if mobile devices are not used.)",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[267,"D3.PC.De.A.1","Employees’ and third parties’ devices (including mobile) without the latest security patches are quarantined and patched before the device is granted access to the network.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[268,"D3.PC.De.A.2","Confidential data and applications on mobile devices are only accessible via a secure, isolated sandbox or a secure container.",110,"PR.DS-1.2","Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control."]
[null,null,null,151,"PR.PT-2.1","The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[269,"D3.PC.De.Inn.1","A centralized end-point management tool provides fully integrated patch, configuration, and vulnerability management, while also being able to detect malware upon arrival to prevent an exploit.",120,"PR.IP-1.2","The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[270,"D3.PC.Se.B.1","Developers working for the institution follow secure program coding practices, as part of a system development life cycle (SDLC), that meet industry standards.",59,"GV.TE-2.1","The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure."]
[null,null,null,122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[271,"D3.PC.Se.B.2","The security controls of internally developed software are periodically reviewed and tested. (*N/A if there is no software development.)",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[272,"D3.PC.Se.B.3","The security controls in internally developed software code are independently reviewed before migrating the code to production. (*N/A if there is no software development.)",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[273,"D3.PC.Se.B.4","Intellectual property and production code are held in escrow. (*N/A if there is no production code to hold in escrow.)",238,"DM.ED-2.1","The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations."]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements."]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected."]
[274,"D3.PC.Se.E.1","Security testing occurs at all post-design phases of the SDLC for all applications, including mobile applications. (*N/A if there is no software development.)",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[275,"D3.PC.Se.Int.1","Processes are in place to mitigate vulnerabilities identified as part of the secure development of systems and applications.",121,"PR.IP-1.3","The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified."]
[null,null,null,122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[276,"D3.PC.Se.Int.2","The security of applications, including Web-based applications connected to the Internet, is tested against known types of cyber attacks (e.g., SQL injection, cross-site scripting, buffer overflow) before implementation or following significant changes.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[277,"D3.PC.Se.Int.3","Software code executables and scripts are digitally signed to confirm the software author and guarantee that the code has not been altered or corrupted.",116,"PR.DS-6.1","The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable."]
[278,"D3.PC.Se.Int.4","A risk-based, independent information assurance function evaluates the security of internal applications.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[279,"D3.PC.Se.A.1","Vulnerabilities identified through a static code analysis are remediated before implementing newly developed or changed applications into production.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[280,"D3.PC.Se.A.2","All interdependencies between applications and services have been identified.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows."]
[null,null,null,233,"DM.ID-1.4","The organization has established and applies appropriate controls to address the inherent risk of internal dependencies."]
[281,"D3.PC.Se.A.3","The security controls in internally developed software code are independently reviewed before migrating the code to production.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[282,"D3.PC.Se.Inn.1","Software code is actively scanned by automated tools in the development environment so that security weaknesses can be resolved immediately during the design phase.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[283,"D3.DC.Th.B.1","Independent testing (including penetration testing and vulnerability scanning) is conducted according to the risk assessment for external-facing systems and the internal network.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[284,"D3.DC.Th.B.2","Antivirus and anti-malware tools are used to detect attacks.",169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[null,null,null,170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email."]
[null,null,null,171,"DE.CM-5.1","The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[285,"D3.DC.Th.B.3","Firewall rules are audited or verified at least quarterly.",152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[286,"D3.DC.Th.B.4","E-mail protection mechanisms are used to filter for common cyber threats (e.g., attached malware or malicious links).",170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email."]
[287,"D3.DC.Th.E.1","Independent penetration testing of network boundary and critical Web-facing applications is performed routinely to identify security control gaps.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[288,"D3.DC.Th.E.2","Independent penetration testing is performed on Internet-facing applications or systems before they are launched or undergo significant change.",122,"PR.IP-2.1","The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,124,"PR.IP-2.3","The organization assesses the cyber risks of software prior to deployment."]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[289,"D3.DC.Th.E.3","Antivirus and anti-malware tools are updated automatically.",169,"DE.CM-4.1","The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[290,"D3.DC.Th.E.4","Firewall rules are updated routinely.",121,"PR.IP-1.3","The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified."]
[null,null,null,152,"PR.PT-3.1","The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
[null,null,null,153,"PR.PT-4.1","The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[291,"D3.DC.Th.E.5","Vulnerability scanning is conducted and analyzed before deployment/redeployment of new/existing devices.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[292,"D3.DC.Th.E.6","Processes are in place to monitor potential insider activity that could lead to data theft or destruction.",91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use."]
[null,null,null,115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented."]
[293,"D3.DC.Th.Int.1","Audit or risk management resources review the penetration testing scope and results to help determine the need for rotating companies based on the quality of the work.",50,"GV.AU-1.3","An independent audit function tests security controls and information security policies."]
[null,null,null,54,"GV.AU-3.1","An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[null,null,null,143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[294,"D3.DC.Th.Int.2","E-mails and attachments are automatically scanned to detect malware and are blocked when malware is present.",170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email."]
[295,"D3.DC.Th.A.1","Weekly vulnerability scanning is rotated among environments to scan all environments throughout the year.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers."]
[296,"D3.DC.Th.A.2","Penetration tests include cyber attack simulations and/or real-world tactics and techniques such as red team testing to detect control gaps in employee behavior, security defenses, policies, and resources.",168,"DE.CM-3.3","The organization conducts periodic cyber attack simulations to detect control gaps in employee behavior, policies, procedures and resources."]
[null,null,null,180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[297,"D3.DC.Th.A.3","Automated tool(s) proactively identifies high-risk behavior signaling an employee who may pose an insider threat.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented."]
[298,"D3.DC.Th.Inn.1","User tasks and content (e.g., opening an e-mail attachment) are automatically isolated in a secure container or virtual environment so that malware can be analyzed but cannot access vital data, end-point operating systems, or applications on the instituti",170,"DE.CM-4.2","The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email."]
[299,"D3.DC.Th.Inn.2","Vulnerability scanning is performed on a weekly basis across all environments.",143,"PR.IP-12.1","The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers."]
[300,"D3.DC.An.B.1","The institution is able to detect anomalous activities through monitoring across the environment.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[301,"D3.DC.An.B.2","Customer transactions generating anomalous activity alerts are monitored and reviewed.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[302,"D3.DC.An.B.3","Logs of physical and/or logical access are reviewed following events.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time."]
[null,null,null,203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process."]
[303,"D3.DC.An.B.4","Access to critical systems by third parties is monitored for unauthorized or unusual activity.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider."]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector."]
[304,"D3.DC.An.B.5","Elevated privileges are monitored.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[null,null,null,91,"PR.AC-4.3","The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented."]
[305,"D3.DC.An.E.1","Systems are in place to detect anomalous behavior automatically during customer, employee, and third-party authentication.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[306,"D3.DC.An.E.2","Security logs are reviewed regularly.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time."]
[307,"D3.DC.An.E.3","Logs provide traceability for all system access by individual users.",149,"PR.PT-1.1","The organization's audit trails are designed to detect cybersecurity events that may materially harm normal operations of the organization."]
[null,null,null,161,"DE.CM-1.1","The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[308,"D3.DC.An.E.4","Thresholds have been established to determine activity within logs that would warrant management response.",149,"PR.PT-1.1","The organization's audit trails are designed to detect cybersecurity events that may materially harm normal operations of the organization."]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[309,"D3.DC.An.Int.1","Online customer transactions are actively monitored for anomalous behavior.",999,"None","None"]
[310,"D3.DC.An.Int.2","Tools to detect unauthorized data mining are used.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[311,"D3.DC.An.Int.3","Tools actively monitor security logs for anomalous behavior and alert within established parameters.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[312,"D3.DC.An.Int.4","Audit logs are backed up to a centralized log server or media that is difficult to alter.",150,"PR.PT-1.2","The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time."]
[313,"D3.DC.An.Int.5","Thresholds for security logging are evaluated periodically.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[314,"D3.DC.An.Int.6","Anomalous activity and other network and system alerts are correlated across business units to detect and prevent multifaceted attacks (e.g., simultaneous account takeover and DDoS attack).",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[315,"D3.DC.An.A.1","An automated tool triggers system and/or fraud alerts when customer logins occur within a short period of time but from physically distant IP locations.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[316,"D3.DC.An.A.2","External transfers from customer accounts generate alerts and require review and authorization if anomalous behavior is detected.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[317,"D3.DC.An.A.3","A system is in place to monitor and analyze employee behavior (network use patterns, work hours, and known devices) to alert on anomalous activities.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[318,"D3.DC.An.A.4","An automated tool(s) is in place to detect and prevent data mining by insider threats.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[319,"D3.DC.An.A.5","Tags on fictitious confidential data or files are used to provide advanced alerts of potential malicious activity when the data is accessed.",163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery."]
[320,"D3.DC.An.Inn.1","The institution has a mechanism for real-time automated risk scoring of threats.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[321,"D3.DC.An.Inn.2","The institution is developing new technologies that will detect potential insider threats and block activity in real time.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[322,"D3.DC.Ev.B.1","A normal network activity baseline is established.",155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows."]
[323,"D3.DC.Ev.B.2","Mechanisms (e.g., antivirus alerts, log event alerts) are in place to alert management to potential attacks.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[324,"D3.DC.Ev.B.3","Processes are in place to monitor for the presence of unauthorized users, devices, connections, and software.",166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,175,"DE.CM-7.1","The organization implements appropriate controls to prevent use of unsupported and unauthorized software."]
[null,null,null,176,"DE.CM-7.2","The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers."]
[null,null,null,177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs."]
[325,"D3.DC.Ev.B.4","Responsibilities for monitoring and reporting suspicious systems activity have been assigned.",181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[326,"D3.DC.Ev.B.5","The physical environment is monitored to detect potential unauthorized access.",165,"DE.CM-2.1","The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems."]
[327,"D3.DC.Ev.E.1","A process is in place to correlate event information from multiple sources (e.g., network, application, or firewall).",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[328,"D3.DC.Ev.Int.1","Controls or tools (e.g., data loss prevention) are in place to detect potential unauthorized or unintentional transmissions of confidential data.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[329,"D3.DC.Ev.Int.2","Event detection processes are proven reliable.",183,"DE.DP-3.1","The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls."]
[330,"D3.DC.Ev.Int.3","Specialized security monitoring is used for critical assets throughout the infrastructure.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[331,"D3.DC.Ev.A.1","Automated tools detect unauthorized changes to critical system files, firewalls, IPS, IDS, or other security devices.",177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs."]
[332,"D3.DC.Ev.A.2","Real-time network monitoring and detection is implemented and incorporates sector-wide event information.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders."]
[333,"D3.DC.Ev.A.3","Real-time alerts are automatically sent when unauthorized software, hardware, or changes occur.",177,"DE.CM-7.3","The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs."]
[334,"D3.DC.Ev.A.4","Tools are in place to actively correlate event information from multiple sources and send alerts based on established parameters.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[335,"D3.DC.Ev.Inn.1","The institution is leading efforts to develop event detection systems that will correlate in real time when events are about to occur.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[null,null,null,183,"DE.DP-3.1","The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls."]
[336,"D3.DC.Ev.Inn.2","The institution is leading the development effort to design new technologies that will detect potential insider threats and block activity in real time.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[null,null,null,183,"DE.DP-3.1","The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls."]
[337,"D3.CC.Pa.B.1","A patch management program is implemented and ensures that software and firmware patches are applied in a timely manner.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[338,"D3.CC.Pa.B.2","Patches are tested before being applied to systems and/or software.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[339,"D3.CC.Pa.B.3","Patch management reports are reviewed and reflect missing security patches.",145,"PR.IP-12.3","The organization has a formal exception management process for vulnerabilities that cannot be mitigated due to business-related exceptions."]
[null,null,null,146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[340,"D3.CC.Pa.E.1","A formal process is in place to acquire, test, and deploy software patches based on criticality.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[341,"D3.CC.Pa.E.2","Systems are configured to retrieve patches automatically.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[342,"D3.CC.Pa.E.3","Operational impact is evaluated before deploying security patches.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[343,"D3.CC.Pa.E.4","An automated tool(s) is used to identify missing security patches as well as the number of days since each patch became available.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[344,"D3.CC.Pa.E.5","Missing patches across all environments are prioritized and tracked.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[345,"D3.CC.Pa.Int.1","Patches for high-risk vulnerabilities are tested and applied when released or the risk is accepted and accountability assigned.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[346,"D3.CC.Pa.A.1","Patch monitoring software is installed on all servers to identify any missing patches for the operating system software, middleware, database, and other key software.",146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[null,null,null,179,"DE.CM-8.1","The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers."]
[347,"D3.CC.Pa.A.2","The institution monitors patch management reports to ensure security patches are tested and implemented within aggressive time frames (e.g., 0-30 days).",145,"PR.IP-12.3","The organization has a formal exception management process for vulnerabilities that cannot be mitigated due to business-related exceptions."]
[null,null,null,146,"PR.IP-12.4","The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[348,"D3.CC.Pa.Inn.1","The institution develops security patches or bug fixes or contributes to open source code development for systems it uses.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[349,"D3.CC.Pa.Inn.2","Segregated or separate systems are in place that mirror production systems allowing for rapid testing and implementation of patches and provide for rapid fallback when needed.",999,"None","None"]
[350,"D3.CC.Re.B.1","Issues identified in assessments are prioritized and resolved based on criticality and within the time frames established in the response to the assessment report.",15,"GV.RM-1.5","The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls."]
[null,null,null,16,"GV.RM-1.6","The cyber risk management program addresses identified cyber risks in one of the following ways:  risk acceptance, risk mitigation, risk avoidance, or risk transfer, which includes cyber insurance."]
[null,null,null,21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management."]
[351,"D3.CC.Re.E.1","Data is destroyed or wiped on hardware and portable/mobile media when a device is missing, stolen, or no longer needed.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,null,131,"PR.IP-6.1","Data is maintained, stored, retained and destroyed according to the organization's data retention policy."]
[352,"D3.CC.Re.E.2","Formal processes are in place to resolve weaknesses identified during penetration testing.",144,"PR.IP-12.2","The organization establishes a process to prioritize and remedy issues identified through vulnerability scanning."]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness."]
[353,"D3.CC.Re.Int.1","Remediation efforts are confirmed by conducting a follow-up vulnerability scan.",208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness."]
[354,"D3.CC.Re.Int.2","Penetration testing is repeated to confirm that medium- and high-risk, exploitable vulnerabilities have been resolved.",180,"DE.CM-8.2","The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses."]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness."]
[355,"D3.CC.Re.Int.3","Security investigations, forensic analysis, and remediation are performed by qualified staff or third parties.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process."]
[356,"D3.CC.Re.Int.4","Generally accepted and appropriate forensic procedures, including chain of custody, are used to gather and present evidence to support potential legal action.",191,"RS.CO-2.1","The organization's incident response plan describes how to appropriately document and report cyber events and related incident response activities."]
[null,null,null,203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process."]
[357,"D3.CC.Re.Int.5","The maintenance and repair of organizational assets are performed by authorized individuals with approved and controlled tools.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[null,null,null,148,"PR.MA-2.1","Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access."]
[358,"D3.CC.Re.Int.6","The maintenance and repair of organizational assets are logged in a timely manner.",147,"PR.MA-1.1","Policies, standards and procedures for the maintenance of assets include, but are not limited to, physical entry controls, equipment maintenance and removal of assets."]
[null,null,null,148,"PR.MA-2.1","Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access."]
[359,"D3.CC.Re.A.1","All medium and high risk issues identified in penetration testing, vulnerability scanning, and other independent testing are escalated to the board or an appropriate board committee for risk acceptance if not resolved in a timely manner.",21,"GV.RM-3.2","The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management."]
[null,null,null,81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk."]
[360,"D3.CC.Re.Inn.1","The institution is developing technologies that will remediate systems damaged by zero-day attacks to maintain current recovery time objectives.",225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[361,"D4.C.Co.B.1","The critical business processes that are dependent on external connectivity have been identified.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows."]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets."]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector."]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions."]
[null,null,null,252,"DM.ED-5.3","The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality."]
[null,null,null,253,"DM.ED-5.4","The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector."]
[362,"D4.C.Co.B.2","The institution ensures that third-party connections are authorized.",95,"PR.AC-7.1","The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm."]
[null,null,null,96,"PR.AC-7.2","Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections."]
[363,"D4.C.Co.B.3","A network diagram is in place and identifies all external connections.",64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources."]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems."]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows."]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections."]
[364,"D4.C.Co.B.4","Data flow diagrams are in place and document information flow to external parties.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows."]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets."]
[null,null,null,64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources."]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems."]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows."]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections."]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions."]
[365,"D4.C.Co.E.1","Critical business processes have been mapped to the supporting external connections.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows."]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets."]
[null,null,null,64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources."]
[null,null,null,65,"ID.AM-4.1","The organization maintains an inventory of external information systems."]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets."]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector."]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions."]
[null,null,null,252,"DM.ED-5.3","The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality."]
[null,null,null,253,"DM.ED-5.4","The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector."]
[366,"D4.C.Co.E.2","The network diagram is updated when connections with third parties change or at least annually.",64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources."]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows."]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections."]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions."]
[367,"D4.C.Co.E.3","Network and systems diagrams are stored in a secure manner with proper restrictions on access.",155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows."]
[368,"D4.C.Co.E.4","Controls for primary and backup third-party connections are monitored and tested on a regular basis.",154,"PR.PT-5.1","The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations."]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections."]
[null,null,null,173,"DE.CM-6.2","The organization collaborates with third-party service providers to maintain and improve the security of external connections."]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc."]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected."]
[369,"D4.C.Co.Int.1","A validated asset inventory is used to create comprehensive diagrams depicting data repositories, data flow, infrastructure, and connectivity.",62,"ID.AM-3.1","The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows."]
[null,null,null,63,"ID.AM-3.2","The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets."]
[null,null,null,64,"ID.AM-3.3","The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources."]
[null,null,null,79,"ID.RA-5.5","The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets."]
[null,null,null,155,"DE.AE-1.1","The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows."]
[null,null,null,251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions."]
[370,"D4.C.Co.Int.2","Security controls are designed and verified to detect and prevent intrusions from third-party connections.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections."]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider."]
[371,"D4.C.Co.Int.3","Monitoring controls cover all external connections (e.g., third-party service providers, business partners, customers).",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,172,"DE.CM-6.1","The organization authorizes and monitors all third-party connections."]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider."]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector."]
[372,"D4.C.Co.Int.4","Monitoring controls cover all internal network-to-network connections.",162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[373,"D4.C.Co.A.1","The security architecture is validated and documented before network connection infrastructure changes.",58,"GV.TE-1.2","The organization applies its cyber risk management framework to all technology projects."]
[null,null,null,125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[null,null,null,247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[374,"D4.C.Co.A.2","The institution works closely with third-party service providers to maintain and improve the security of external connections.",173,"DE.CM-6.2","The organization collaborates with third-party service providers to maintain and improve the security of external connections."]
[375,"D4.C.Co.Inn.1","Diagram(s) of external connections is interactive, shows real-time changes to the network connection infrastructure, new connections, and volume fluctuations, and alerts when risks arise.",999,"None","None"]
[376,"D4.C.Co.Inn.2","The institution's connections can be segmented or severed instantaneously to prevent contagion from cyber attacks.",270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc."]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected."]
[377,"D4.RM.Dd.B.1","Risk-based due diligence is performed on prospective third parties before contracts are signed, including reviews of their background, reputation, financial condition, stability, and security controls.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[378,"D4.RM.Dd.B.2","A list of third-party service providers is maintained.",251,"DM.ED-5.2","The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions."]
[379,"D4.RM.Dd.B.3","A risk assessment is conducted to identify criticality of service providers.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[380,"D4.RM.Dd.E.1","A formal process exists to analyze assessments of third-party cybersecurity controls.",123,"PR.IP-2.2","The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications."]
[null,null,null,247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[381,"D4.RM.Dd.E.2","The board or an appropriate board committee reviews a summary of due diligence results including management’s recommendations to use third parties that will affect the institution’s inherent risk profile.",237,"DM.ED-1.3","The organization ensures appropriate oversight and compliance with the external dependency strategy implementation."]
[null,null,null,240,"DM.ED-2.3","The organization's dependency management policies, plans, and procedures have been reviewed and approved by appropriate organizational stakeholders."]
[null,null,null,245,"DM.ED-4.1","The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees)."]
[null,null,null,246,"DM.ED-4.2","The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate."]
[382,"D4.RM.Dd.Int.1","A process is in place to confirm that the institution’s third-party service providers conduct due diligence of their third parties (e.g., subcontractors).",256,"DM.ED-6.3","Minimum cybersecurity requirements for third-parties include how the organization will monitor security of its external dependencies to ensure that requirements are continually satisfied."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,263,"DM.ED-7.3","A process is in place to confirm that the organization's third-party service providers conduct due diligence of their own third-parties (e.g., subcontractors)."]
[383,"D4.RM.Dd.Int.2","Pre-contract, physical site visits of high-risk vendors are conducted by the institution or by a qualified third party.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[384,"D4.RM.Dd.A.1","A continuous process improvement program is in place for third-party due diligence activity.",40,"GV.SP-2.3","The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[null,null,null,173,"DE.CM-6.2","The organization collaborates with third-party service providers to maintain and improve the security of external connections."]
[null,null,null,236,"DM.ED-1.2","The organization monitors the effectiveness of its external dependency management strategy to reduce cyber risks associated with external dependencies."]
[null,null,null,239,"DM.ED-2.2","The organization's dependency management policies, plans, and procedures are regularly updated."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[385,"D4.RM.Dd.A.2","Audits of high-risk vendors are conducted on an annual basis.",261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[386,"D4.RM.Dd.Inn.1","The institution promotes sector-wide efforts to build due diligence mechanisms that lead to in-depth and efficient security and resilience reviews.",275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders."]
[387,"D4.RM.Dd.Inn.2","The institution is leading efforts to develop new auditable processes and for conducting due diligence and ongoing monitoring of cybersecurity risks posed by third parties.",999,"None","None"]
[388,"D4.RM.Co.B.1","Formal contracts that address relevant security and privacy requirements are in place for all third parties that process, store, or transmit confidential data or provide critical services.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,257,"DM.ED-6.4","Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted."]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements."]
[389,"D4.RM.Co.B.2","Contracts acknowledge that the third party is responsible for the security of the institution’s confidential data that it possesses, stores, processes, or transmits.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities."]
[null,null,null,255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,257,"DM.ED-6.4","Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted."]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements."]
[390,"D4.RM.Co.B.3","Contracts stipulate that the third-party security controls are regularly reviewed and validated by an independent party.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
[null,null,null,255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[391,"D4.RM.Co.B.4","Contracts identify the recourse available to the institution should the third party fail to meet defined security requirements.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements."]
[392,"D4.RM.Co.B.5","Contracts establish responsibilities for responding to security incidents.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[393,"D4.RM.Co.B.6","Contracts specify the security requirements for the return or destruction of data upon contract termination.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,259,"DM.ED-6.6","Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements."]
[null,null,null,260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination."]
[394,"D4.RM.Co.E.1","Responsibilities for managing devices (e.g., firewalls, routers) that secure connections with third parties are formally documented in the contract.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[395,"D4.RM.Co.E.2","Responsibility for notification of direct and indirect security incidents and vulnerabilities is documented in contracts or service-level agreements (SLAs).",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises."]
[396,"D4.RM.Co.E.3","Contracts stipulate geographic limits on where data can be stored or transmitted.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,257,"DM.ED-6.4","Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted."]
[397,"D4.RM.Co.Int.1","Third-party SLAs or similar means are in place that require timely notification of security events.",255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[398,"D4.RM.Co.A.1","Contracts require third-party service provider’s security policies meet or\nexceed those of the institution.",254,"DM.ED-6.1","The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
[null,null,null,255,"DM.ED-6.2","The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[399,"D4.RM.Co.A.2","A third-party termination/exit strategy has been established and validated with management.",248,"DM.ED-4.4","The organization has a documented third-party termination/exit strategy to include procedures for timely removal of the third-party access when no longer required."]
[null,null,null,249,"DM.ED-4.5","The organization establishes contingencies to address circumstances that might put a vendor out of business or severely impact delivery of services to the organization, sector-critical systems, or the financial sector as a whole."]
[null,null,null,271,"DM.RS-2.4","The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected."]
[400,"D4.RM.Co.Inn.1","The institution promotes a sector-wide effort to influence contractual requirements for critical third parties to the industry.",999,"None","None"]
[401,"D4.RM.Om.B.1","The third-party risk assessment is updated regularly.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[402,"D4.RM.Om.B.2","Audits, assessments, and operational performance reports are obtained and reviewed regularly validating security controls for critical third parties.",260,"DM.ED-6.7","Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[403,"D4.RM.Om.B.3","Ongoing monitoring practices include reviewing critical third-parties’ resilience plans.",258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[null,null,null,264,"DM.ED-7.4","A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed."]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises."]
[404,"D4.RM.Om.E.1","A process to identify new third-party relationships is in place, including identifying new relationships that were established without formal approval.",242,"DM.ED-2.5","The organization's dependency management process identifies third-party relationships that are in place, including those relationships that were established without formal approval."]
[405,"D4.RM.Om.E.2","A formal program assigns responsibility for ongoing oversight of third- party access.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities."]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
[null,null,null,244,"DM.ED-3.2","Responsibilities for ongoing independent oversight (external) of third-party access are defined and assigned."]
[406,"D4.RM.Om.E.3","Monitoring of third parties is scaled, in terms of depth and frequency, according to the risk of the third parties.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,250,"DM.ED-5.1","The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector."]
[407,"D4.RM.Om.E.4","Automated reminders or ticklers are in place to identify when required third-party information needs to be obtained or analyzed.",247,"DM.ED-4.3","The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[408,"D4.RM.Om.Int.1","Third-party employee access to the institution's confidential data are tracked actively based on the principles of least privilege.",89,"PR.AC-4.1","The organization limits access privileges to the minimum necessary."]
[null,null,null,174,"DE.CM-6.3","The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider."]
[409,"D4.RM.Om.Int.2","Periodic on-site assessments of high-risk vendors are conducted to ensure appropriate security controls are in place.",261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,262,"DM.ED-7.2","The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[410,"D4.RM.Om.A.1","Third-party employee access to confidential data on third-party hosted systems is tracked actively via automated reports and alerts.",90,"PR.AC-4.2","The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements."]
[411,"D4.RM.Om.Inn.1","The institution is leading efforts to develop new auditable processes for ongoing monitoring of cybersecurity risks posed by third parties.",999,"None","None"]
[412,"D5.IR.Pl.B.1","The institution has documented how it will react and respond to cyber incidents.",134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
[null,null,null,184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,187,"RS.RP-1.1","The organization's response plans are in place and executed during or after an incident."]
[413,"D5.IR.Pl.B.2","Communication channels exist to provide employees a means for reporting information security events in a timely manner.",193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[414,"D5.IR.Pl.B.3","Roles and responsibilities for incident response team members are defined.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities."]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
[null,null,null,181,"DE.DP-1.1","The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[null,null,null,188,"RS.CO-1.1","The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority."]
[null,null,null,190,"RS.CO-1.3","The organization's personnel know their roles and responsibilities and order of operations when a response is needed."]
[415,"D5.IR.Pl.B.4","The response team includes individuals with a wide range of backgrounds and expertise, from many different areas within the institution (e.g., management, legal, public relations, as well as information technology).",999,"None","None"]
[416,"D5.IR.Pl.B.5","A formal backup and recovery plan exists for all critical business lines.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident."]
[null,null,null,127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience."]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
[null,null,null,219,"RC.RP-1.2","Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications."]
[417,"D5.IR.Pl.B.6","The institution plans to use business continuity, disaster recovery, and data backup programs to recover operations following an incident.",127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience."]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[418,"D5.IR.Pl.E.1","The remediation plan and process outlines the mitigating actions, resources, and time parameters.",128,"PR.IP-4.3","The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives."]
[null,null,null,129,"PR.IP-4.4","Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations."]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
[null,null,null,135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations."]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness."]
[null,null,null,212,"RS.MI-3.1","The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls."]
[null,null,null,220,"RC.RP-1.3","The recovery plan includes a minimum recovery time for the sector critical systems."]
[419,"D5.IR.Pl.E.2","The corporate disaster recovery, business continuity, and crisis management plans have integrated consideration of cyber incidents.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,208,"RS.AN-5.3","The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness."]
[420,"D5.IR.Pl.E.3","Alternative processes have been established to continue critical activity within a reasonable time period.",135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[null,null,null,219,"RC.RP-1.2","Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications."]
[null,null,null,220,"RC.RP-1.3","The recovery plan includes a minimum recovery time for the sector critical systems."]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications."]
[421,"D5.IR.Pl.E.4","Business impact analyses have been updated to include cybersecurity.",218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[422,"D5.IR.Pl.E.5","Due diligence has been performed on technical sources, consultants, or forensic service firms that could be called to assist the institution during or following an incident.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process."]
[null,null,null,261,"DM.ED-7.1","The organization has a formal program for third-party due diligence and monitoring."]
[423,"D5.IR.Pl.Int.1","A strategy is in place to coordinate and communicate with internal and external stakeholders during or following a cyber attack.",184,"DE.DP-4.1","The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises."]
[424,"D5.IR.Pl.Int.2","Plans are in place to re-route or substitute critical functions and/or services that may be affected by a successful attack on Internet-facing systems.",135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations."]
[null,null,null,205,"RS.AN-4.1","The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[null,null,null,219,"RC.RP-1.2","Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications."]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications."]
[null,null,null,276,"DM.BE-2.2","The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector."]
[425,"D5.IR.Pl.Int.3","A direct cooperative or contractual agreement(s) is in place with an incident response organization(s) or provider(s) to assist rapidly with mitigation efforts.",999,"None","None"]
[426,"D5.IR.Pl.Int.4","Lessons learned from real-life cyber incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan.",132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization."]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[427,"D5.IR.Pl.A.1","Methods for responding to and recovering from cyber incidents are tightly woven throughout the business units’ disaster recovery, business continuity, and crisis management plans.",218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program."]
[null,null,null,267,"DM.RS-1.3","The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data)."]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications."]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc."]
[null,null,null,272,"DM.RS-2.5","When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems."]
[428,"D5.IR.Pl.A.2","Multiple systems, programs, or processes are implemented into a comprehensive cyber resilience program to sustain, minimize, and recover operations from an array of potentially disruptive and destructive cyber incidents.",134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[null,null,null,265,"DM.RS-1.1","The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program."]
[null,null,null,267,"DM.RS-1.3","The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data)."]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises."]
[null,null,null,269,"DM.RS-2.2","The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications."]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc."]
[null,null,null,272,"DM.RS-2.5","When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems."]
[null,null,null,277,"DM.BE-3.1","Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations)."]
[429,"D5.IR.Pl.A.3","A process is in place to continuously improve the resilience plan.",185,"DE.DP-4.2","The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders."]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience."]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization."]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[430,"D5.IR.Pl.Inn.1","The incident response plan is designed to ensure recovery from disruption of services, assurance of data integrity, and recovery of lost or corrupted data following a cybersecurity incident.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident."]
[null,null,null,128,"PR.IP-4.3","The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives."]
[null,null,null,129,"PR.IP-4.4","Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations."]
[null,null,null,134,"PR.IP-9.1","The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
[null,null,null,135,"PR.IP-9.2","The organization defines objectives for resumption of critical operations."]
[null,null,null,136,"PR.IP-10.1","The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients."]
[null,null,null,187,"RS.RP-1.1","The organization's response plans are in place and executed during or after an incident."]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[431,"D5.IR.Pl.Inn.2","The incident response process includes detailed actions and rule- based triggers for automated response.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[432,"D5.IR.Te.B.1","Scenarios are used to improve incident detection and response.",186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[433,"D5.IR.Te.B.2","Business continuity testing involves collaboration with critical third parties.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[null,null,null,264,"DM.ED-7.4","A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed."]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises."]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc."]
[434,"D5.IR.Te.B.3","Systems, applications, and data recovery is tested at least annually.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident."]
[null,null,null,127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience."]
[null,null,null,137,"PR.IP-10.2","The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis."]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[435,"D5.IR.Te.E.1","Recovery scenarios include plans to recover from data destruction and impacts to data integrity, data loss, and system and data availability.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident."]
[null,null,null,128,"PR.IP-4.3","The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives."]
[null,null,null,129,"PR.IP-4.4","Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations."]
[436,"D5.IR.Te.E.2","Widely reported events are used to evaluate and improve the institution's response.",186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[437,"D5.IR.Te.E.3","Information backups are tested periodically to verify they are accessible and readable.",126,"PR.IP-4.1","The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident."]
[null,null,null,127,"PR.IP-4.2","The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience."]
[null,null,null,137,"PR.IP-10.2","The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis."]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[438,"D5.IR.Te.Int.1","Cyber-attack scenarios are analyzed to determine potential impact to critical business processes.",202,"RS.AN-2.1","The organization uses cyber-attack scenarios to determine potential impact to critical business processes."]
[439,"D5.IR.Te.Int.2","The institution participates in sector-specific cyber exercises or scenarios (e.g., FS-ISAC Cyber Attack (against) Payment Processors (CAPP)).",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,198,"RS.CO-5.1","The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc."]
[440,"D5.IR.Te.Int.3","Resilience testing is based on analysis and identification of realistic and highly likely threats as well as new and emerging threats facing the institution.",136,"PR.IP-10.1","The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients."]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[441,"D5.IR.Te.Int.4","The critical online systems and processes are tested to withstand stresses for extended periods (e.g., DDoS).",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,154,"PR.PT-5.1","The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations."]
[442,"D5.IR.Te.Int.5","The results of cyber event exercises are used to improve the incident response plan and automated triggers.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,185,"DE.DP-4.2","The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders."]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience."]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[443,"D5.IR.Te.A.1","Resilience testing is comprehensive and coordinated across all critical business functions.",138,"PR.IP-10.3","The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results."]
[null,null,null,139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[444,"D5.IR.Te.A.2","The institution validates that it is able to recover from cyber events similar to by known sophisticated attacks at other organizations.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization."]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[445,"D5.IR.Te.A.3","Incident response testing evaluates the institution from an attacker's perspective to determine how the institution or its assets at critical third parties may be targeted.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[null,null,null,258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[446,"D5.IR.Te.A.4","The institution corrects root causes for problems discovered during cybersecurity resilience testing.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,215,"RS.IM-1.2","The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience."]
[447,"D5.IR.Te.A.5","Cybersecurity incident scenarios involving significant financial loss are used to stress test the institution's risk management.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,202,"RS.AN-2.1","The organization uses cyber-attack scenarios to determine potential impact to critical business processes."]
[448,"D5.IR.Te.Inn.1","The institution tests the ability to shift business processes or functions between different processing centers or technology systems for cyber incidents without interruption to business or loss of productivity or data.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,154,"PR.PT-5.1","The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations."]
[null,null,null,277,"DM.BE-3.1","Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations)."]
[449,"D5.IR.Te.Inn.2","The institution has validated that it is able to remediate systems damaged by zero-day attacks to maintain current recovery time objectives.",999,"None","None"]
[450,"D5.IR.Te.Inn.3","The institution is leading the development of more realistic test environments.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[451,"D5.IR.Te.Inn.4","Cyber incident scenarios are used to stress test potential financial losses across the sector.",139,"PR.IP-10.4","The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes."]
[null,null,null,270,"DM.RS-2.3","The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc."]
[null,null,null,275,"DM.BE-2.1","The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders."]
[452,"D5.DR.De.B.1","Alert parameters are set for detecting information security incidents that prompt mitigating actions.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[453,"D5.DR.De.B.2","System performance reports contain information that can be used as a risk indicator to detect information security incidents.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[454,"D5.DR.De.B.3","Tools and processes are in place to detect, alert, and trigger the incident response program.",158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery."]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[455,"D5.DR.De.E.1","The institution has processes to detect and alert the incident response team when potential insider activity manifests that could lead to data theft or destruction.",115,"PR.DS-5.1","The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented."]
[456,"D5.DR.De.Int.1","The incident response program is triggered when anomalous behaviors and attack patterns or signatures are detected.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,167,"DE.CM-3.2","The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[457,"D5.DR.De.Int.2","The institution has the ability to discover infiltration, before the attacker traverses across systems, establishes a foothold, steals information, or causes damage to data and systems.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[458,"D5.DR.De.Int.3","Incidents are detected in real time through automated processes that include instant alerts to appropriate personnel who can respond.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[459,"D5.DR.De.Int.4","Network and system alerts are correlated across business units to better detect and prevent multifaceted attacks (e.g., simultaneous DDoS attack and account takeover).",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[460,"D5.DR.De.Int.5","Incident detection processes are capable of correlating events across the enterprise.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[461,"D5.DR.De.A.1","Sophisticated and adaptive technologies are deployed that can detect and alert the incident response team of specific tasks when threat indicators across the enterprise indicate potential external and internal threats.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,166,"DE.CM-3.1","The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,200,"RS.CO-5.3","The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[462,"D5.DR.De.A.2","Automated tools are implemented to provide specialized security monitoring based on the risk of the assets to detect and alert incident response teams in real time.",160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,null,null,162,"DE.CM-1.2","The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,276,"DM.BE-2.2","The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector."]
[463,"D5.DR.De.Inn.1","The institution is able to detect and block zero-day attempts and inform management and the incident response team in real time.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,160,"DE.AE-5.1","The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[464,"D5.DR.Re.B.1","Appropriate steps are taken to contain and control an incident to prevent further unauthorized access to or use of customer information.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner."]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate."]
[null,null,null,211,"RS.MI-2.1","The organization mitigates cybersecurity incidents in a timely manner."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[465,"D5.DR.Re.E.1","The incident response plan is designed to prioritize incidents, enabling a rapid response for significant cybersecurity incidents or vulnerabilities.",205,"RS.AN-4.1","The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[null,null,null,276,"DM.BE-2.2","The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector."]
[466,"D5.DR.Re.E.2","A process is in place to help contain incidents and restore operations with minimal service disruption.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner."]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate."]
[null,null,null,211,"RS.MI-2.1","The organization mitigates cybersecurity incidents in a timely manner."]
[null,null,null,218,"RC.RP-1.1","The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[467,"D5.DR.Re.E.3","Containment and mitigation strategies are developed for multiple incident types (e.g., DDoS, malware).",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner."]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate."]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[468,"D5.DR.Re.E.4","Procedures include containment strategies and notifying potentially impacted third parties.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner."]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate."]
[469,"D5.DR.Re.E.5","Processes are in place to trigger the incident response program when an incident occurs at a third party.",258,"DM.ED-6.5","Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident;\n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[null,null,null,268,"DM.RS-2.1","The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises."]
[470,"D5.DR.Re.E.6","Records are generated to support incident investigation and mitigation.",203,"RS.AN-2.2","The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,null,204,"RS.AN-3.1","The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process."]
[471,"D5.DR.Re.E.7","The institution calls upon third parties, as needed, to provide mitigation services",999,"None","None"]
[472,"D5.DR.Re.E.8","Analysis of events is used to improve the institution's security measures and policies.",27,"GV.PL-2.3","The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[null,null,null,132,"PR.IP-7.1","A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[null,null,null,186,"DE.DP-5.1","The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[null,null,null,216,"RS.IM-1.3","The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization."]
[null,null,null,217,"RS.IM-2.1","The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[null,null,null,224,"RC.IM-1.1","The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[null,null,null,225,"RC.IM-2.1","The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[473,"D5.DR.Re.Int.1","Analysis of security incidents is performed in the early stages of an intrusion to minimize the impact of the incident.",156,"DE.AE-2.1","The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,null,163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery."]
[null,null,null,191,"RS.CO-2.1","The organization's incident response plan describes how to appropriately document and report cyber events and related incident response activities."]
[null,null,null,201,"RS.AN-1.1","Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[null,null,null,207,"RS.AN-5.2","The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond."]
[474,"D5.DR.Re.Int.2","Any changes to systems/applications or to access entitlements necessary for incident management are reviewed by management for formal approval before implementation.",125,"PR.IP-3.1","The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change."]
[475,"D5.DR.Re.Int.3","Processes are in place to ensure assets affected by a security incident that cannot be returned to operational status are quarantined, removed, disposed of, and/or replaced.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,null,209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner."]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate."]
[null,null,null,212,"RS.MI-3.1","The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls."]
[null,null,null,213,"RS.MI-3.2","Vulnerabilities identified as a result of a cybersecurity incident are mitigated or documented by the organization as accepted risks and monitored."]
[476,"D5.DR.Re.Int.4","Processes are in place to ensure that restored assets are appropriately reconfigured and thoroughly tested before being placed back into operation.",113,"PR.DS-3.1","The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,null,212,"RS.MI-3.1","The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls."]
[477,"D5.DR.Re.A.1","The incident management function collaborates effectively with the cyber threat intelligence function during an incident.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[478,"D5.DR.Re.A.2","Links between threat intelligence, network operations, and incident response allow for proactive response to potential incidents.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,158,"DE.AE-3.2","The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,null,214,"RS.IM-1.1","The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[479,"D5.DR.Re.A.3","Technical measures apply defense-in-depth techniques such as deep- packet inspection and black holing for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns and/or DDoS attacks.",163,"DE.CM-1.3","The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery."]
[null,null,null,164,"DE.CM-1.4","The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks."]
[480,"D5.DR.Re.Inn.1","The institution’s risk management of significant cyber incidents results in limited to no disruptions to critical services.",209,"RS.MI-1.1","The organization contains cybersecurity incidents in a timely manner."]
[null,null,null,210,"RS.MI-1.2","The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate."]
[null,null,null,211,"RS.MI-2.1","The organization mitigates cybersecurity incidents in a timely manner."]
[481,"D5.DR.Re.Inn.2","The technology infrastructure has been engineered to limit the effects of a cyber attack on the production environment from migrating to the backup environment (e.g., air-gapped environment and processes).",999,"None","None"]
[482,"D5.ER.Es.B.1","A process exists to contact personnel who are responsible for analyzing and responding to an incident.",190,"RS.CO-1.3","The organization's personnel know their roles and responsibilities and order of operations when a response is needed."]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[483,"D5.ER.Es.B.2","Procedures exist to notify customers, regulators, and law enforcement as required or necessary when the institution becomes aware of an incident involving the unauthorized access to or use of sensitive customer information.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate."]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate."]
[484,"D5.ER.Es.B.3","The institution prepares an annual report of security incidents or violations for the board or an appropriate board committee.",34,"GV.RR-2.3","The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization."]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program."]
[null,null,null,194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
[485,"D5.ER.Es.B.4","Incidents are classified, logged, and tracked.",157,"DE.AE-3.1","The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[486,"D5.ER.Es.E.1","Criteria have been established for escalating cyber incidents or vulnerabilities to the board and senior management based on the potential impact and criticality of the risk.",81,"ID.RA-6.1","The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk."]
[null,null,null,193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,229,"RC.CO-3.1","The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders."]
[487,"D5.ER.Es.E.2","Regulators, law enforcement, and service providers, as appropriate, are notified when the institution is aware of any unauthorized access to systems or a cyber incident occurs that could result in degradation of services.",192,"RS.CO-2.2","In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,226,"RC.CO-1.1","The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate."]
[null,null,null,227,"RC.CO-1.2","The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate."]
[488,"D5.ER.Es.E.3","Tracked cyber incidents are correlated for trend analysis and reporting.",999,"None","None"]
[489,"D5.ER.Es.Int.1","Employees that are essential to mitigate the risk (e.g., fraud, business resilience) know their role in incident escalation.",68,"ID.AM-6.1","Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities."]
[null,null,null,108,"PR.AT-5.1","The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
[null,null,null,190,"RS.CO-1.3","The organization's personnel know their roles and responsibilities and order of operations when a response is needed."]
[490,"D5.ER.Es.Int.2","A communication plan is used to notify other organizations, including third parties, of incidents that may affect them or their customers.",194,"RS.CO-2.4","The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
[null,null,null,195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,196,"RS.CO-3.2","In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[491,"D5.ER.Es.Int.3","An external communication plan is used for notifying media regarding incidents when applicable.",195,"RS.CO-3.1","Information is shared consistent with response plans."]
[null,null,null,197,"RS.CO-4.1","The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,null,228,"RC.CO-2.1","Actionable and effective mitigation techniques are taken and communicated appropriately to restore and improve the organization's reputation after an incident."]
[492,"D5.ER.Es.A.1","The institution has established quantitative and qualitative metrics for the cybersecurity incident response process.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics."]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program."]
[493,"D5.ER.Es.A.2","Detailed metrics, dashboards, and/or scorecards outlining cyber incidents and events are provided to management and are part of the board meeting package.",38,"GV.SP-2.1","The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics."]
[null,null,null,39,"GV.SP-2.2","The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program."]
[494,"D5.ER.Es.Inn.1","A mechanism is in place to provide instantaneous notification of incidents to management and essential employees through multiple communication channels with tracking and verification of receipt.",193,"RS.CO-2.3","The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[998,"None","None",44,"GV.IR-1.4","Individuals responsible for independent risk management and oversight are independent of business line management, including senior leadership."]
[null,null,null,80,"ID.RA-5.6","The organization determines ways to aggregate cyber risk to assess the organization's residual cyber risk."]
[null,null,null,104,"PR.AT-3.2","Cybersecurity training provided through a third-party service provider or affiliate should be consistent with the organization's cybersecurity policy and program."]
[null,null,null,114,"PR.DS-4.1","The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment."]
[null,null,null,118,"PR.DS-8.1","The organization uses integrity checking mechanisms to verify hardware integrity, as practicable."]
[null,null,null,182,"DE.DP-2.1","The organization's monitoring and detection processes comply with all applicable requirements."]
[null,null,null,221,"RC.RP-1.4","The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date."]
[null,null,null,222,"RC.RP-1.5","The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps."]
[null,null,null,223,"RC.RP-1.6","The recovery plan includes plans to come back for both traditional and highly available (e.g., cloud) infrastructure."]
[null,null,null,230,"DM.ID-1.1","The organization has integrated its internal dependency management strategy into the overall strategic risk management plan."]
[null,null,null,231,"DM.ID-1.2","The organization monitors the effectiveness of its internal dependency management strategy."]
[null,null,null,232,"DM.ID-1.3","The organization ensures appropriate oversight of and compliance with the internal dependency management strategy implementation."]

{"sheet":"Mapping to FFIEC BCM Booklet","index":7,"n_rows":554,"n_cols":7,"rows_kept":554,"cut":false,"hidden":false,"merged":[[5,0,5,4],[5,5,5,6]]}
[]
["Proprietary"]
[]
["Mapping to the FFIEC Business Continuity Management IT Handbook and Examiner's Work Program"]
[]
["FFIEC Business Continuity Management Booklet/Examiner's Workprogram",null,null,null,null,"FSP Diagnostic Statement"]
["Objective #","Objective","Exam statement #","Booklet Clause","Exam statement","FSP Diagnostic Statement","Type of mapping"]
[1,"Determine the appropriate scope and objectives for the examination.","1.a","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\na.\tRegulatory reports of examination.","GV.AU-1.4: An independent audit function assesses compliance with applicable laws and regulations.","Partial"]
[1,"Determine the appropriate scope and objectives for the examination.","1.b","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\nb.\tInternal and external audit reports.","GV.AU-3.3: An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","1.c","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\nc. Reports by independent risk management.","GV.IR-3.1: An independent risk management function reports to the appropriate governing authority (e.g., the Board or one of its committees) and to the appropriate risk management officer within the organization on the implementation of the cyber risk management framework throughout the organization.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","1.d","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\nd. Business continuity tests.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","1.d","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\nd. Business continuity tests.","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","1.e","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\ne. Regulatory, audit, and business continuity reports on third-party service providers.","DM.ED-7.4: A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","1.e","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\ne. Regulatory, audit, and business continuity reports on third-party service providers.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","1.e","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\ne. Regulatory, audit, and business continuity reports on third-party service providers.","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","1.e","N/A","1.\tReview past reports for outstanding issues or previous problems. Consider the following:\ne. Regulatory, audit, and business continuity reports on third-party service providers.","DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","2.a","N/A","2. Review management’s response to issues identified during or subsequent to the last examination. Consider the following:\na. Adequacy and timing of corrective action.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","2.b","N/A","2. Review management’s response to issues identified during or subsequent to the last examination. Consider the following:\nb. Resolution of root causes rather than symptoms.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","2.c","N/A","2. Review management’s response to issues identified during or subsequent to the last examination. Consider the following:\nc. Status of uncorrected issues.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","2.d","N/A","2. Review management’s response to issues identified during or subsequent to the last examination. Consider the following:\nd. Retesting to validate corrective action.","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","Partial"]
[1,"Determine the appropriate scope and objectives for the examination.","3.a","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\na. Products or services delivered to either internal or external users.","DM.ED-5.3: The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.a","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\na. Products or services delivered to either internal or external users.","ID.AM-1.1: The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.a","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\na. Products or services delivered to either internal or external users.","ID.AM-2.1: The organization maintains a current and complete inventory of software platforms and business applications.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.b","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nb. Network topology or diagram, including changes to configuration or components and all internal and external connections.","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.b","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nb. Network topology or diagram, including changes to configuration or components and all internal and external connections.","DE.AE-1.1: The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows. ","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.b","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nb. Network topology or diagram, including changes to configuration or components and all internal and external connections.","ID.AM-4.1: The organization maintains an inventory of external information systems. ","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.c","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nc. Hardware and software inventories.","ID.AM-2.1: The organization maintains a current and complete inventory of software platforms and business applications.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.c","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nc. Hardware and software inventories.","ID.AM-1.1: The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.d","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nd. Loss, addition, or change in duties of key personnel.","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.d","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nd. Loss, addition, or change in duties of key personnel.","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.e","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\ne. Third-party service providers and software vendor listings.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.f","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nf. Changes to internal business processes.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.f","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\nf. Changes to internal business processes.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.g","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\ng. Changes based on industry changes or threat intelligence.","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","3.g","N/A","3. Interview management and review responses to pre-examination information requests to identify changes to technology infrastructure or new products and services that could affect business resilience. Consider the following:\ng. Changes based on industry changes or threat intelligence.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","4.a","N/A","4. Review newly identified threats and vulnerabilities to the continuity of operations. Consider the following:\na. Technology and security vulnerabilities.","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","4.b","N/A","4. Review newly identified threats and vulnerabilities to the continuity of operations. Consider the following:\nb. Internally identified threats.","ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","4.b","N/A","4. Review newly identified threats and vulnerabilities to the continuity of operations. Consider the following:\nb. Internally identified threats.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","4.b","N/A","4. Review newly identified threats and vulnerabilities to the continuity of operations. Consider the following:\nb. Internally identified threats.","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","4.c","N/A","4. Review newly identified threats and vulnerabilities to the continuity of operations. Consider the following:\nc. Externally identified threats (e.g., cybersecurity alerts, pandemic alerts, or emergency warnings published by information-sharing organizations and government agencies).","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","4.c","N/A","4. Review newly identified threats and vulnerabilities to the continuity of operations. Consider the following:\nc. Externally identified threats (e.g., cybersecurity alerts, pandemic alerts, or emergency warnings published by information-sharing organizations and government agencies).","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[1,"Determine the appropriate scope and objectives for the examination.","4.c","N/A","4. Review newly identified threats and vulnerabilities to the continuity of operations. Consider the following:\nc. Externally identified threats (e.g., cybersecurity alerts, pandemic alerts, or emergency warnings published by information-sharing organizations and government agencies).","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","1.a","II.A, “Board and Senior Management Responsibilities”","1.\tDetermine whether business continuity policies and critical business procedures are:\na. \tUp-to-date and reflective of the current business environment.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","1.b","II.A, “Board and Senior Management Responsibilities”","1.\tDetermine whether business continuity policies and critical business procedures are:\nb. Communicated effectively throughout the entity.","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","1.b","II.A, “Board and Senior Management Responsibilities”","1.\tDetermine whether business continuity policies and critical business procedures are:\nb. Communicated effectively throughout the entity.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","1.b","II.A, “Board and Senior Management Responsibilities”","1.\tDetermine whether business continuity policies and critical business procedures are:\nb. Communicated effectively throughout the entity.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","1.c","II.A, “Board and Senior Management Responsibilities”","1.\tDetermine whether business continuity policies and critical business procedures are:\nc. Available during adverse events.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","1.d","II.A, “Board and Senior Management Responsibilities”","1.\tDetermine whether business continuity policies and critical business procedures are:\nd. Securely maintained.","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.a","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\na. Evaluating continuity risk.","DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.b","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\nb. Setting short- and long-term continuity objectives.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.c","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\nc. Adopting appropriate policies and procedures.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.c","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\nc. Adopting appropriate policies and procedures.","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.c","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\nc. Adopting appropriate policies and procedures.","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.d","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\nd. Evaluating continuity performance.","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.d","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\nd. Evaluating continuity performance.","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","2.e","II.A, “Board and Senior Management Responsibilities”","2. Determine whether the board and senior management provide leadership when overseeing business continuity, including:\ne. Adjusting programs and operations in response to test results and actual events.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.a","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\na. Assessing continuity risk.","ID.RA-5.4: The organization's business units assess, on an ongoing basis, the cyber risks associated with the activities of the business unit.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.a","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\na. Assessing continuity risk.","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.a","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\na. Assessing continuity risk.","ID.RA-6.1: The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.a","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\na. Assessing continuity risk.","ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.b","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\nb. Resilience planning.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.c","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\nc. Testing business continuity plans.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.c","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\nc. Testing business continuity plans.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.c","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\nc. Testing business continuity plans.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.c","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\nc. Testing business continuity plans.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.d","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\nd. Incorporating lessons learned from testing and events.","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.d","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\nd. Incorporating lessons learned from testing and events.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.e","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\ne. Considering resilience in business functions and the design of existing operations and new products and services.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.e","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\ne. Considering resilience in business functions and the design of existing operations and new products and services.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.e","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\ne. Considering resilience in business functions and the design of existing operations and new products and services.","GV.TE-1.2: The organization applies its cyber risk management framework to all technology projects.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","3.e","II.A, “Board and Senior Management Responsibilities”","3. Determine whether management strengthens resilience through the following:\ne. Considering resilience in business functions and the design of existing operations and new products and services.","PR.PT-5.1: The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.a","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\na. Assigning business continuity responsibility and accountability.","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.a","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\na. Assigning business continuity responsibility and accountability.","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.a","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\na. Assigning business continuity responsibility and accountability.","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.b","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nb. Allocating resources to business continuity (e.g., personnel, time, budget, and training).","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.b","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nb. Allocating resources to business continuity (e.g., personnel, time, budget, and training).","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.b","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nb. Allocating resources to business continuity (e.g., personnel, time, budget, and training).","GV.RR-2.4: The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.c","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nc. Aligning BCM with business strategy and risk appetite.","DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.c","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nc. Aligning BCM with business strategy and risk appetite.","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.c","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nc. Aligning BCM with business strategy and risk appetite.","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.c","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nc. Aligning BCM with business strategy and risk appetite.","GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.d","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nd. Understanding business continuity risks and adopting appropriate policies and plans to manage events.","GV.RM-1.2: The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.  ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.d","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nd. Understanding business continuity risks and adopting appropriate policies and plans to manage events.","GV.RM-2.3: The cyber risk management strategy articulates how the organization would maintain an acceptable level of residual cyber risk set by the appropriate governing authority (e.g., the Board or one of its committees).","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.d","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nd. Understanding business continuity risks and adopting appropriate policies and plans to manage events.","GV.RM-3.2: The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.  ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.e","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\ne. Understanding business continuity operating results and performance.","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.e","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\ne. Understanding business continuity operating results and performance.","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.f","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\nf. Providing a credible challenge to management responsible for the business continuity process (e.g., the board minutes provide evidence of active discussions).","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.g","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\ng. Establishing a provision for management intervention if timeliness for corrective action is not met.","GV.IR-1.2: An independent risk management function has sufficient independence, stature, authority, resources, and access to the appropriate governing body (e.g., the Board or one of its committees), including reporting lines, to ensure consistency with the organization's cyber risk management framework.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.g","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\ng. Establishing a provision for management intervention if timeliness for corrective action is not met.","GV.IR-3.1: An independent risk management function reports to the appropriate governing authority (e.g., the Board or one of its committees) and to the appropriate risk management officer within the organization on the implementation of the cyber risk management framework throughout the organization.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.g","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\ng. Establishing a provision for management intervention if timeliness for corrective action is not met.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","4.g","II.A, “Board and Senior Management Responsibilities”","4. Determine whether board oversight includes the following:\ng. Establishing a provision for management intervention if timeliness for corrective action is not met.","GV.AU-3.3: An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.a","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\na. Defining business continuity roles, responsibilities, and succession plans.","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Partial"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.a","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\na. Defining business continuity roles, responsibilities, and succession plans.","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). ","Partial"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.b","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nb. Allocating knowledgeable personnel and sufficient financial resources.","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.b","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nb. Allocating knowledgeable personnel and sufficient financial resources.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.c","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nc. Validating that personnel understand their business continuity roles.","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.d","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nd. Establishing measurable goals against which business continuity performance is assessed.","GV.SP-2.3: The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.e","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ne. Designing and implementing a business continuity exercise strategy.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.e","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ne. Designing and implementing a business continuity exercise strategy.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.e","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ne. Designing and implementing a business continuity exercise strategy.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.e","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ne. Designing and implementing a business continuity exercise strategy.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.e","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ne. Designing and implementing a business continuity exercise strategy.","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.f","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nf. Confirming that tests, training, and exercises are comprehensive and consistent with the exercise strategy.","GV.IR-1.2: An independent risk management function has sufficient independence, stature, authority, resources, and access to the appropriate governing body (e.g., the Board or one of its committees), including reporting lines, to ensure consistency with the organization's cyber risk management framework.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.f","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nf. Confirming that tests, training, and exercises are comprehensive and consistent with the exercise strategy.","GV.IR-3.1: An independent risk management function reports to the appropriate governing authority (e.g., the Board or one of its committees) and to the appropriate risk management officer within the organization on the implementation of the cyber risk management framework throughout the organization.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.g","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ng. Resolving weaknesses identified in tests, training, and exercises.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.g","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ng. Resolving weaknesses identified in tests, training, and exercises.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.g","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ng. Resolving weaknesses identified in tests, training, and exercises.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.g","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ng. Resolving weaknesses identified in tests, training, and exercises.","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.h","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nh. Meeting regularly to discuss policy changes, training, and testing plans.","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.h","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nh. Meeting regularly to discuss policy changes, training, and testing plans.","GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.h","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nh. Meeting regularly to discuss policy changes, training, and testing plans.","GV.PL-3.3: The organization implements and maintains a documented policy or policies that address customer data privacy, and is approved by a designated officer or the organization’s appropriate governing body (e.g., the Board or one of its committees).","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.h","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nh. Meeting regularly to discuss policy changes, training, and testing plans.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.i","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\ni. Assessing and updating business continuity strategies and plans to reflect the current business conditions and operating environment for continuous improvement.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.j","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nj. Aligning plans between business units across the enterprise.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[2,"Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.","5.k","II.A, “Board and Senior Management Responsibilities”","5. Determine whether management oversight of business continuity includes the following:\nk. Coordinating plans and responses with external entities.","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",1,"II.B, “Audit”","1. Determine whether the board and senior management have engaged audit (or an independent review) to validate the design effectiveness of the business continuity program and whether controls are operating effectively.","GV.AU-1.1: The organization has an independent audit function. ","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",1,"II.B, “Audit”","1. Determine whether the board and senior management have engaged audit (or an independent review) to validate the design effectiveness of the business continuity program and whether controls are operating effectively.","GV.AU-1.2: The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",2,"II.B, “Audit”","2. Determine whether audit reports to the board and provides an assessment of management’s ability to manage and control risks related to continuity and resilience.","GV.AU-3.3: An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",3,"II.B, “Audit”","3. Determine whether audit leverages SOC reports and other external artifacts from third-party service providers, as appropriate.","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",3,"II.B, “Audit”","3. Determine whether audit leverages SOC reports and other external artifacts from third-party service providers, as appropriate.","DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",4,"II.B, “Audit”","4. Determine whether the board or management validates that the auditor is qualified to carry out the review and is independent of the business continuity or related functions.","GV.AU-1.1: The organization has an independent audit function. ","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",4,"II.B, “Audit”","4. Determine whether the board or management validates that the auditor is qualified to carry out the review and is independent of the business continuity or related functions.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",4,"II.B, “Audit”","4. Determine whether the board or management validates that the auditor is qualified to carry out the review and is independent of the business continuity or related functions.","GV.AU-3.3: An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.a","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\na. The reasonableness and comprehensiveness of the BIA and business continuity risk assessment(s).","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.b","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\nb. The reliability, adequacy, and effectiveness of continuity and resilience controls.","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.c","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\nc. The effectiveness of risk mitigation efforts.","GV.AU-1.2: The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.c","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\nc. The effectiveness of risk mitigation efforts.","GV.AU-1.3: An independent audit function tests security controls and information security policies.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.d","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\nd. Whether test plans achieve their stated objectives based on reasonable assumptions.","GV.AU-1.3: An independent audit function tests security controls and information security policies.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.e","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\ne. Audit monitoring of exercises and tests, reviewing test plans and results, and verifying that any issues are identified and appropriately escalated.","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.e","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\ne. Audit monitoring of exercises and tests, reviewing test plans and results, and verifying that any issues are identified and appropriately escalated.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[3,"Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.","5.f","II.B, “Audit”","5. Evaluate the audit coverage of business continuity, whether through a general controls audit, during audits of business lines, or as a stand-alone business continuity audit. Audit coverage should include the following:\nf. Assessment of the business continuity program effectiveness.","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Partial"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","1.a","III.A, “Business Impact Analysis”","1. Determine the process through which management inventories business functions. Management may use the following artifacts to identify the functions:\na. Organizational charts.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","1.a","III.A, “Business Impact Analysis”","1. Determine the process through which management inventories business functions. Management may use the following artifacts to identify the functions:\na. Organizational charts.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","1.b","III.A, “Business Impact Analysis”","1. Determine the process through which management inventories business functions. Management may use the following artifacts to identify the functions:\nb. Work flows (also called process maps).","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","1.c","III.A, “Business Impact Analysis”","1. Determine the process through which management inventories business functions. Management may use the following artifacts to identify the functions:\nc. Interview notes.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","1.d","III.A, “Business Impact Analysis”","1. Determine the process through which management inventories business functions. Management may use the following artifacts to identify the functions:\nd. Network diagrams/topologies.","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","1.e","III.A, “Business Impact Analysis”","1. Determine the process through which management inventories business functions. Management may use the following artifacts to identify the functions:\ne. Data flow diagrams.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.a","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\na. People.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.a","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\na. People.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.a","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\na. People.","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.a","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\na. People.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.a","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\na. People.","PR.AC-7.1: The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.b","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nb. Hardware.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.c","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nc. Software.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.d","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nd. Cash reserves.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.d","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nd. Cash reserves.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.e","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\ne. Supporting activities (e.g., technology support, payroll, contracting).","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.e","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\ne. Supporting activities (e.g., technology support, payroll, contracting).","DM.ED-5.3: The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.f","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nf. Supporting software (e.g., email, office productivity suites). ","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.g","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\ng. Network connectivity.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.h","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nh. Communication lines.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.i","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\ni. Facilities.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.j","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nj. Utilities.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","2.k","III.A, “Business Impact Analysis”","2. Determine whether management inventoried the critical assets and infrastructure upon which business functions depend, including the identification of single points of failure. Critical assets and infrastructure may include the following:\nk. Infrastructure and services provided by third-party service providers.","DM.ED-5.3: The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.a","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\na. Internal systems and business functions, including services, production processes, hardware, software, and application programming interfaces, data, and vital records.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.a","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\na. Internal systems and business functions, including services, production processes, hardware, software, and application programming interfaces, data, and vital records.","DE.AE-1.1: The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows. ","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.b","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\nb. Third-party service providers, key suppliers, and business partners.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.c","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\nc. Telecommunications single points of failure.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Partial"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.c","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\nc. Telecommunications single points of failure.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Partial"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.d","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\nd. Power single points of failure.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows.","Partial"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.d","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\nd. Power single points of failure.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Partial"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","3.d","III.A, “Business Impact Analysis”","3. Determine whether the interdependency analysis includes the following:\nd. Power single points of failure.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Partial"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","4.a","III.A, “Business Impact Analysis”","4. Review the BIA to determine whether the prioritization of business functions is reasonable. Consider management’s ability to do the following:\na. Determine the operational and financial impacts of a disruption.","ID.RA-4.1: The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","4.a","III.A, “Business Impact Analysis”","4. Review the BIA to determine whether the prioritization of business functions is reasonable. Consider management’s ability to do the following:\na. Determine the operational and financial impacts of a disruption.","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","4.a","III.A, “Business Impact Analysis”","4. Review the BIA to determine whether the prioritization of business functions is reasonable. Consider management’s ability to do the following:\na. Determine the operational and financial impacts of a disruption.","DE.AE-4.1: The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","4.a","III.A, “Business Impact Analysis”","4. Review the BIA to determine whether the prioritization of business functions is reasonable. Consider management’s ability to do the following:\na. Determine the operational and financial impacts of a disruption.","RS.AN-2.1: The organization uses cyber-attack scenarios to determine potential impact to critical business processes.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","4.b","III.A, “Business Impact Analysis”","4. Review the BIA to determine whether the prioritization of business functions is reasonable. Consider management’s ability to do the following:\nb. Aggregate loss impacts and determine a rating scale to indicate impact severity.","DE.AE-4.1: The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","4.c","III.A, “Business Impact Analysis”","4. Review the BIA to determine whether the prioritization of business functions is reasonable. Consider management’s ability to do the following:\nc. Reconcile BIA and risk assessment results with prioritization and document whether the reconcilement is adequate.","ID.RA-4.1: The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","5.a","III.A, “Business Impact Analysis”","5. Determine whether the BIA produces sufficient information to estimate the following:\na. Recovery point objectives (RPO).","PR.IP-4.4: Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","5.b","III.A, “Business Impact Analysis”","5. Determine whether the BIA produces sufficient information to estimate the following:\nb. Recovery time objectives (RTO).","RC.RP-1.3: The recovery plan includes a minimum recovery time for the sector critical systems.","Full"]
[4,"Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.","5.c","III.A, “Business Impact Analysis”","5. Determine whether the BIA produces sufficient information to estimate the following:\nc. Maximum tolerable downtime (MTD).","PR.IP-4.4: Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.a","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\na. Natural: \nFlood, earthquake, hurricane, tornado, and other weather events.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.b","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\nb. Technological: \nTechnological: Malware, cyberattack, and hardware and software failure.\nOperational: Critical infrastructure disruption (e.g., transportation and water systems).","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.b","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\nb. Technological: \nTechnological: Malware, cyberattack, and hardware and software failure.\nOperational: Critical infrastructure disruption (e.g., transportation and water systems).","DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.b","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\nb. Technological: \nTechnological: Malware, cyberattack, and hardware and software failure.\nOperational: Critical infrastructure disruption (e.g., transportation and water systems).","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.b","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\nb. Technological: \nTechnological: Malware, cyberattack, and hardware and software failure.\nOperational: Critical infrastructure disruption (e.g., transportation and water systems).","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.b","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\nb. Technological: \nTechnological: Malware, cyberattack, and hardware and software failure.\nOperational: Critical infrastructure disruption (e.g., transportation and water systems).","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.c","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\nc. Adversarial or human-caused:\nPersonnel: Strike, pandemic, and malicious insider.\nSocial: Terrorism, vandalism, looting, riots, and protests.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","1.d","III.B, “Risk Assessment”","1. Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity. Examples of risks can include:\nd. Combination:\nFacility: Fire, power outage, and loss of access.\nGeographic-related: Proximity to railroad or highways used for transport of hazardous materials, proximity to airports, traffic difficulties, and other issues.\nThird-party: Services concentrated in a limited number of third-party service providers.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","2.a","III.B, “Risk Assessment”","2. Determine whether management identifies BCM risks and coordinates risk identification efforts throughout the entity to identify systemic threats.\na. Determine whether management identifies and inventories the following:\nInternal and external assets.\nTypes of threats and hazards.\nExisting controls.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","2.a","III.B, “Risk Assessment”","2. Determine whether management identifies BCM risks and coordinates risk identification efforts throughout the entity to identify systemic threats.\na. Determine whether management identifies and inventories the following:\nInternal and external assets.\nTypes of threats and hazards.\nExisting controls.","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","2.a","III.B, “Risk Assessment”","2. Determine whether management identifies BCM risks and coordinates risk identification efforts throughout the entity to identify systemic threats.\na. Determine whether management identifies and inventories the following:\nInternal and external assets.\nTypes of threats and hazards.\nExisting controls.","GV.RM-1.5: The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","2.b","III.B, “Risk Assessment”","2. Determine whether management identifies BCM risks and coordinates risk identification efforts throughout the entity to identify systemic threats.\nb. Verify that the risk assessment includes the identification of cybersecurity risks and results of information security risk assessments.","GV.RM-1.4: The cyber risk assessment process is consistent with the organization's policies and procedures and includes criteria for the evaluation and categorization of enterprise-specific cyber risks and threats.  ","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","2.c","III.B, “Risk Assessment”","2. Determine whether management identifies BCM risks and coordinates risk identification efforts throughout the entity to identify systemic threats.\nc. Assess whether management obtains information about hazards and threats from external sources.","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.","2.d","III.B, “Risk Assessment”","2. Determine whether management identifies BCM risks and coordinates risk identification efforts throughout the entity to identify systemic threats.\nd. Determine whether management considers threat intelligence in risk identification efforts.","ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",3,"III.B, “Risk Assessment”","3. Ascertain whether management identifies interconnectivity points between the entity and its third-party service providers, as well as interconnectivity between other entities and their third-party service providers (i.e., supply chain).","DM.ED-2.5: The organization's dependency management process identifies third-party relationships that are in place, including those relationships that were established without formal approval.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",3,"III.B, “Risk Assessment”","3. Ascertain whether management identifies interconnectivity points between the entity and its third-party service providers, as well as interconnectivity between other entities and their third-party service providers (i.e., supply chain).","DM.ED-5.1: The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",3,"III.B, “Risk Assessment”","3. Ascertain whether management identifies interconnectivity points between the entity and its third-party service providers, as well as interconnectivity between other entities and their third-party service providers (i.e., supply chain).","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",4,"III.B, “Risk Assessment”","4. Determine whether the risk assessment includes the impact and likelihood of potential disruptive events, including worst-case scenarios.","ID.RA-4.1: The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",4,"III.B, “Risk Assessment”","4. Determine whether the risk assessment includes the impact and likelihood of potential disruptive events, including worst-case scenarios.","RS.AN-2.1: The organization uses cyber-attack scenarios to determine potential impact to critical business processes.","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",5,"III.B, “Risk Assessment”","5. Determine whether management identifies and analyzes gaps between the entity's risk exposure and the risk appetite, and documents any controls implemented to mitigate the residual risk.","GV.RM-3.2: The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.  ","Full"]
[5,"Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",5,"III.B, “Risk Assessment”","5. Determine whether management identifies and analyzes gaps between the entity's risk exposure and the risk appetite, and documents any controls implemented to mitigate the residual risk.","GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","1.a","IV.A, “Resilience”","1. Verify that management has evaluated strategies and resource needs and allocates appropriate resources to achieve resilience:\na. Appropriate personnel and skillsets to carry out the functions.","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","1.b","IV.A, “Resilience”","1. Verify that management has evaluated strategies and resource needs and allocates appropriate resources to achieve resilience:\nb. Time to identify and implement solutions.","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","1.c","IV.A, “Resilience”","1. Verify that management has evaluated strategies and resource needs and allocates appropriate resources to achieve resilience:\nc. Budget to accomplish resilience goals and objectives.","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","2.a","IV.A, “Resilience”","2. Determine whether management has implemented physical resilience measures that:\na. Establish redundant communications between branches and data centers.","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","2.b","IV.A, “Resilience”","2. Determine whether management has implemented physical resilience measures that:\nb. Identify multiple power sources.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","2.b","IV.A, “Resilience”","2. Determine whether management has implemented physical resilience measures that:\nb. Identify multiple power sources.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","2.c","IV.A, “Resilience”","2. Determine whether management has implemented physical resilience measures that:\nc. Geographically diversify key entity locations.",null,"None"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.a","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\na. Maintain confidentiality, integrity, and availability for backup, replication, and production environments.","GV.SP-1.1: The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.a","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\na. Maintain confidentiality, integrity, and availability for backup, replication, and production environments.","PR.PT-5.1: The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.b","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\nb. Implement appropriate backups and sufficient documentation and retention periods for each iteration of data backup.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.c","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\nc. Periodically reassess backup and recovery strategies as technology and threats change.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.d","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\nd. Maintain an accessible, off-site repository of software, configuration settings, and related documentation.","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.e","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\ne. Establish procedures to recover critical networks and systems, including:\nBackup types (physical or virtual).\nBackup levels (full, incremental, or differential).\nUpdate and retention cycle frequencies.\nSoftware and hardware compatibility reviews.\nData transmission controls.\nData repository maintenance.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.e","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\ne. Establish procedures to recover critical networks and systems, including:\nBackup types (physical or virtual).\nBackup levels (full, incremental, or differential).\nUpdate and retention cycle frequencies.\nSoftware and hardware compatibility reviews.\nData transmission controls.\nData repository maintenance.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.f","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\nf. Protect offline data backups from destructive malware that may corrupt production and online backup versions of data.","DE.CM-4.1: The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","3.f","IV.A, “Resilience”","3. Determine whether management has implemented data and cyber resilience measures that:\nf. Protect offline data backups from destructive malware that may corrupt production and online backup versions of data.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","4.a","IV.A, “Resilience”","4. Determine whether management documented and implemented, as appropriate, the following resilience measures for personnel:\na. Staffing and skills needed to operate critical functions related to business continuity.","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","4.b","IV.A, “Resilience”","4. Determine whether management documented and implemented, as appropriate, the following resilience measures for personnel:\nb. Lodging arrangements for displaced employees and their families.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","4.c","IV.A, “Resilience”","4. Determine whether management documented and implemented, as appropriate, the following resilience measures for personnel:\nc. Basic necessities and services for displaced employees, including water, food, clothing, childcare, and transportation.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","4.d","IV.A, “Resilience”","4. Determine whether management documented and implemented, as appropriate, the following resilience measures for personnel:\nd. On-site medical support and mobile command centers.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","4.e","IV.A, “Resilience”","4. Determine whether management documented and implemented, as appropriate, the following resilience measures for personnel:\ne. Secure telecommunication options if employees work from an alternate location.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","4.f","IV.A, “Resilience”","4. Determine whether management documented and implemented, as appropriate, the following resilience measures for personnel:\nf. Designated emergency personnel, including critical business process-level employees (i.e., those necessary to ensure all critical business operations function appropriately).","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.a","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\na. Considered disruptive events that threaten the operational resilience and viability of the entity's third-party service provider.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.a","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\na. Considered disruptive events that threaten the operational resilience and viability of the entity's third-party service provider.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.b","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nb. Assessed the entity's immediate or short-term space, systems, and personnel capacity to assume or transfer failed operations.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises.","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.b","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nb. Assessed the entity's immediate or short-term space, systems, and personnel capacity to assume or transfer failed operations.","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.b","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nb. Assessed the entity's immediate or short-term space, systems, and personnel capacity to assume or transfer failed operations.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.c","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nc. Assessed critical third-party service providers' susceptibility to multiple event scenarios.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.c","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nc. Assessed critical third-party service providers' susceptibility to multiple event scenarios.","DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.c","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nc. Assessed critical third-party service providers' susceptibility to multiple event scenarios.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.c","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nc. Assessed critical third-party service providers' susceptibility to multiple event scenarios.","DM.ED-4.3: The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.d","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nd. Reviewed third-party service provider's resilience capabilities, including available test and SOC reports.","DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.d","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nd. Reviewed third-party service provider's resilience capabilities, including available test and SOC reports.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.d","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nd. Reviewed third-party service provider's resilience capabilities, including available test and SOC reports.","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.d","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nd. Reviewed third-party service provider's resilience capabilities, including available test and SOC reports.","DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.e","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\ne. Verified that SLAs with third-party service providers align with the entity's recovery objectives.","DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.f","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nf. Established plans for the resilience of third-party service providers supporting critical operations.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","5.f","IV.A, “Resilience”","5. Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers:\nf. Established plans for the resilience of third-party service providers supporting critical operations.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.a","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\na. Identifying and mitigating single points of failure across the entity's infrastructure.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.a","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\na. Identifying and mitigating single points of failure across the entity's infrastructure.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.b","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nb. Developing and maintaining a plan to address an outage in the telecommunications lines with its primary third-party service providers.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.b","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nb. Developing and maintaining a plan to address an outage in the telecommunications lines with its primary third-party service providers.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.c","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nc. Establishing redundant telecommunications links with each of the entity's third-party service providers through a contractual arrangement that allows either party to switch its connection to an alternate communication path.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.c","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nc. Establishing redundant telecommunications links with each of the entity's third-party service providers through a contractual arrangement that allows either party to switch its connection to an alternate communication path.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.d","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nd. Reviewing the entity's third-party service providers' plans and determining whether critical services can be restored within time frames acceptable to the entity.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.d","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nd. Reviewing the entity's third-party service providers' plans and determining whether critical services can be restored within time frames acceptable to the entity.","DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.d","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nd. Reviewing the entity's third-party service providers' plans and determining whether critical services can be restored within time frames acceptable to the entity.","DM.ED-7.4: A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.e","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\ne. Developing guidelines, commensurate with the entity's size, complexity, and risk profile, to diversify connections to mitigate the risk of a telecommunications failure.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.f","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nf. Assessing the communications technology that bridges the transmission distance between the telecommunications service provider and the entity for single points of failure.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.f","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nf. Assessing the communications technology that bridges the transmission distance between the telecommunications service provider and the entity for single points of failure.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.g","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\ng. Monitoring relationships with telecommunications providers to manage risks.","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.h","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\nh. Evaluating communications and resilience needs to ensure branch communications.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.i","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\ni. Inquiring about the physical paths used by telecommunications providers and verifying that system redundancies have been properly implemented.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","6.i","IV.A, “Resilience”","6. Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications:\ni. Inquiring about the physical paths used by telecommunications providers and verifying that system redundancies have been properly implemented.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.a","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\na. Alternate energy sources (e.g., generators and multiple power grids).","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.a","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\na. Alternate energy sources (e.g., generators and multiple power grids).","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.b","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\nb. Fuel requirements, both for fuel on-hand and contracts with suppliers for deliveries during events.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.b","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\nb. Fuel requirements, both for fuel on-hand and contracts with suppliers for deliveries during events.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.c","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\nc. Continued maintenance of generators.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.c","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\nc. Continued maintenance of generators.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.d","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\nd. Testing of generators.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.","7.d","IV.A, “Resilience”","7. Determine whether management considers the following as part of the entity’s power resilience strategies:\nd. Testing of generators.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Partial"]
[6,"Determine whether the entity’s risk management strategies are designed to achieve resilience.",8,"IV.A, “Resilience”","8. Verify that BCM activities align with the entity’s change management process.",null,"None"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.a","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\na. Regulatory agencies (federal and state).","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.a","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\na. Regulatory agencies (federal and state).","RC.CO-1.2: The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.b","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\nb. Emergency responders.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.b","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\nb. Emergency responders.","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.c","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\nc. Law enforcement.","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.c","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\nc. Law enforcement.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.d","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\nd. Financial sector trade associations.","RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.d","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\nd. Financial sector trade associations.","RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.e","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\ne. Information-sharing entities (e.g., FS-ISAC).","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","Full"]
[7,"Determine whether the entity’s BCM includes communication protocols.","1.e","IV.B, “Communications”","1. Determine whether management considers, plans for, and prepares multiple mechanisms to communicate with personnel and other stakeholders while maintaining appropriate controls to safeguard customer information. Other stakeholders could include:\ne. Information-sharing entities (e.g., FS-ISAC).","RS.CO-5.2: The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.a","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\na. Roles, responsibilities, and required skills for entity personnel and third-party service providers.","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.a","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\na. Roles, responsibilities, and required skills for entity personnel and third-party service providers.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.a","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\na. Roles, responsibilities, and required skills for entity personnel and third-party service providers.","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.a","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\na. Roles, responsibilities, and required skills for entity personnel and third-party service providers.","DM.ID-2.1: Roles and responsibilities for internal dependency management are defined and assigned.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.a","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\na. Roles, responsibilities, and required skills for entity personnel and third-party service providers.","DM.ED-3.1: Roles and responsibilities for external dependency management are defined and assigned.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.b","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nb. Solutions to various types of foreseeable disruptions, including those emanating from cyber threats.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.c","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nc. Escalation thresholds.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.d","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nd. Immediate steps to protect personnel and customers and minimize damage.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.d","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nd. Immediate steps to protect personnel and customers and minimize damage.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.d","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nd. Immediate steps to protect personnel and customers and minimize damage.","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.e","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\ne. Prioritization and procedures to recover functions, services, and processes.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.f","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nf. Critical information protection (e.g., physical, electronic, hybrid, and use of off-site storage).","PR.IP-5.1: Physical and environmental security policies are implemented and managed. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.f","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nf. Critical information protection (e.g., physical, electronic, hybrid, and use of off-site storage).","PR.DS-1.1: Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.f","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nf. Critical information protection (e.g., physical, electronic, hybrid, and use of off-site storage).","PR.DS-2.1: Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.f","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nf. Critical information protection (e.g., physical, electronic, hybrid, and use of off-site storage).","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.g","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\ng. Logistical arrangements (e.g., housing, transportation, or food) for personnel at the recovery locations.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.g","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\ng. Logistical arrangements (e.g., housing, transportation, or food) for personnel at the recovery locations.","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.h","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nh. Network equipment, connectivity, and communication needs, including entity-owned and personal mobile devices.","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.h","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nh. Network equipment, connectivity, and communication needs, including entity-owned and personal mobile devices.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.h","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nh. Network equipment, connectivity, and communication needs, including entity-owned and personal mobile devices.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.h","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nh. Network equipment, connectivity, and communication needs, including entity-owned and personal mobile devices.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.i","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\ni. Personnel at alternate sites, including arrangements for those permanently located at the alternate facility.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.i","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\ni. Personnel at alternate sites, including arrangements for those permanently located at the alternate facility.","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.j","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nj. Scope and frequency of testing.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.j","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nj. Scope and frequency of testing.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.j","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nj. Scope and frequency of testing.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","1.k","V, “Business Continuity Plan”","1. Verify that management implemented a comprehensive BCP that is reflective of the entity’s risk environment. The BCP should outline the following:\nk. Resumption of a normalized state for business processes.","RC.RP-1.1: The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.a","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\na. Determine whether management verified the third-party service provider’s qualifications and expertise.","DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.a","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\na. Determine whether management verified the third-party service provider’s qualifications and expertise.","DM.ED-4.2: The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.a","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\na. Determine whether management verified the third-party service provider’s qualifications and expertise.","DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.b","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nb. Verify that entity management worked with the third-party service provider to design executable and viable strategies.","DM.ED-1.3: The organization ensures appropriate oversight and compliance with the external dependency strategy implementation.","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.b","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nb. Verify that entity management worked with the third-party service provider to design executable and viable strategies.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.b","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nb. Verify that entity management worked with the third-party service provider to design executable and viable strategies.","DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.b","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nb. Verify that entity management worked with the third-party service provider to design executable and viable strategies.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Partial"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.c","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nc. Verify that the plan reflects the entity’s current products, business processes, and third-party service providers.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.c","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nc. Verify that the plan reflects the entity’s current products, business processes, and third-party service providers.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.d","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nd. Determine whether roles and responsibilities reflect the entity’s current organizational structure. ","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","2.d","V, “Business Continuity Plan”","2. If management outsources the BCP’s development, verify that management maintains oversight and ownership of the BCP.\nd. Determine whether roles and responsibilities reflect the entity’s current organizational structure. ","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","3.a","V, “Business Continuity Plan”","3. Determine whether the BCP includes event management procedures that detail reasonably foreseeable event types, and those procedures include threshold metrics and response methods.\na. Verify that procedures explain how to report an event to management and the situations that warrant notification.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","3.a","V, “Business Continuity Plan”","3. Determine whether the BCP includes event management procedures that detail reasonably foreseeable event types, and those procedures include threshold metrics and response methods.\na. Verify that procedures explain how to report an event to management and the situations that warrant notification.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","3.b","V, “Business Continuity Plan”","3. Determine whether the BCP includes event management procedures that detail reasonably foreseeable event types, and those procedures include threshold metrics and response methods.\nb. Determine whether management (either an individual or team) has implemented procedures to communicate with both internal and external stakeholders.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","3.b","V, “Business Continuity Plan”","3. Determine whether the BCP includes event management procedures that detail reasonably foreseeable event types, and those procedures include threshold metrics and response methods.\nb. Determine whether management (either an individual or team) has implemented procedures to communicate with both internal and external stakeholders.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","3.c","V, “Business Continuity Plan”","3. Determine whether the BCP includes event management procedures that detail reasonably foreseeable event types, and those procedures include threshold metrics and response methods.\nc. Verify that event management processes include event response procedures that are appropriate to the event.","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.a","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\na. Manual steps for critical functions, as applicable.","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.a","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\na. Manual steps for critical functions, as applicable.","DM.ED-4.5: The organization establishes contingencies to address circumstances that might put a vendor out of business or severely impact delivery of services to the organization, sector-critical systems, or the financial sector as a whole.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.a","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\na. Manual steps for critical functions, as applicable.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.a","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\na. Manual steps for critical functions, as applicable.","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.b","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\nb. Alternate identity verification methods.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.c","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\nc. Fraud identification and suspicious activity reporting.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.d","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\nd. Other procedures as applicable. Examples may include:\nAddressing customer service requests during downtime.\nTracking daily transactions.\nReconciling general ledger accounts.\nDocumenting operational tasks.\nPosting entries after system recovery.\nMaintaining backup records to provide customer account information (account numbers, customer names, addresses, account status, and account balances).","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","4.d","V, “Business Continuity Plan”","4. Assess management’s protocols for operations continuity and system recovery. Verify that procedures are clear, concise, accessible, and can be implemented in an emergency. Verify the BCP includes procedures for the following:\nd. Other procedures as applicable. Examples may include:\nAddressing customer service requests during downtime.\nTracking daily transactions.\nReconciling general ledger accounts.\nDocumenting operational tasks.\nPosting entries after system recovery.\nMaintaining backup records to provide customer account information (account numbers, customer names, addresses, account status, and account balances).","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","5.a","V, “Business Continuity Plan”","5. Verify that the BCP lists alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel.\na. Verify that the BCP includes site relocation for short-, medium-, and long-term scenarios.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","5.a","V, “Business Continuity Plan”","5. Verify that the BCP lists alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel.\na. Verify that the BCP includes site relocation for short-, medium-, and long-term scenarios.","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","5.b","V, “Business Continuity Plan”","5. Verify that the BCP lists alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel.\nb. Determine whether management considers scalability.","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","5.c","V, “Business Continuity Plan”","5. Verify that the BCP lists alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel.\nc. Verify that recovery alternatives can accommodate the services and processing capabilities affecting critical operations, including:\nCore processing.\nCheck processing and imaging.\nCommercial cash management.\nMailing, faxing, and printing.\nCustomer identification.\nData center activities.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.",6,"V, “Business Continuity Plan”","6. Verify that the BCP includes procedures for coordination with the first responders and local and state government agencies, when appropriate.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.",7,"V, “Business Continuity Plan”","7. Verify that the BCP includes procedures to establish an alternate physical location(s) where personnel and customers can go to conduct business, if appropriate. ","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","8.a","V, “Business Continuity Plan”","8. Determine whether the BCP addresses alternate arrangements in the event payment systems fail (e.g., ATMs, funds transfers, electronic banking, remote deposit capture, mobile capabilities).\na. Determine whether the BCP addresses processes for retrieving and transmitting transactions when payment systems are disrupted (e.g., manual procedures for calling in or faxing wire or automated clearing house requests to correspondent banks; mitigating strategies for web-based systems; or third-party software used to perform transactions).","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","8.a","V, “Business Continuity Plan”","8. Determine whether the BCP addresses alternate arrangements in the event payment systems fail (e.g., ATMs, funds transfers, electronic banking, remote deposit capture, mobile capabilities).\na. Determine whether the BCP addresses processes for retrieving and transmitting transactions when payment systems are disrupted (e.g., manual procedures for calling in or faxing wire or automated clearing house requests to correspondent banks; mitigating strategies for web-based systems; or third-party software used to perform transactions).","RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","8.b","V, “Business Continuity Plan”","8. Determine whether the BCP addresses alternate arrangements in the event payment systems fail (e.g., ATMs, funds transfers, electronic banking, remote deposit capture, mobile capabilities).\nb. Determine whether management verifies that redundant electronic payment systems and equipment (e.g., tokens and routers) are included at recovery sites for activation and that documentation is maintained for timely posting of entries when systems are recovered.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","8.c","V, “Business Continuity Plan”","8. Determine whether the BCP addresses alternate arrangements in the event payment systems fail (e.g., ATMs, funds transfers, electronic banking, remote deposit capture, mobile capabilities).\nc. Determine whether instant issue cards are utilized and card company security procedures are implemented to limit potential fraud.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","8.c","V, “Business Continuity Plan”","8. Determine whether the BCP addresses alternate arrangements in the event payment systems fail (e.g., ATMs, funds transfers, electronic banking, remote deposit capture, mobile capabilities).\nc. Determine whether instant issue cards are utilized and card company security procedures are implemented to limit potential fraud.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.a","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\na. Pre-established cash delivery arrangements.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.a","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\na. Pre-established cash delivery arrangements.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.b","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\nb. Plans for increases in branch traffic when ATMs are unavailable.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.c","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\nc. Plans for the entity's operational cash needs.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.c","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\nc. Plans for the entity's operational cash needs.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.d","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\nd. Temporary purchase authority guidelines.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.d","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\nd. Temporary purchase authority guidelines.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.e","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\ne. Expense reimbursement options for personnel","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.e","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\ne. Expense reimbursement options for personnel","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.f","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\nf. Higher-limit credit cards or separate checking accounts with designated individuals who can sign checks in emergency situations.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","9.f","V, “Business Continuity Plan”","9. Verify that the BCP addresses the entity's cash management requirements. Procedures may include:\nf. Higher-limit credit cards or separate checking accounts with designated individuals who can sign checks in emergency situations.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","10.a","V, “Business Continuity Plan”","10. Determine whether management established an incident response process. As part of incident management planning, determine whether management does the following:\na. Aligns incident response procedures with other related processes (e.g., cybersecurity, network operations, and physical security).","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","10.b","V, “Business Continuity Plan”","10. Determine whether management established an incident response process. As part of incident management planning, determine whether management does the following:\nb. Considers incident response procedures during the development of the business continuity strategy.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","10.c","V, “Business Continuity Plan”","10. Determine whether management established an incident response process. As part of incident management planning, determine whether management does the following:\nc. Leverages routine processes (e.g., vulnerability management and network monitoring) to anticipate potential incidents, including cyber incidents.","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","11.a","V, “Business Continuity Plan”","11. Verify that management developed a coordinated disaster recovery strategy for data centers, networks, servers, storage, service monitoring, user support, and related software. Verify that procedures address the following:\na. Security controls and protocols, including physical and logical.","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","11.b","V, “Business Continuity Plan”","11. Verify that management developed a coordinated disaster recovery strategy for data centers, networks, servers, storage, service monitoring, user support, and related software. Verify that procedures address the following:\nb. Procedures for restoring backlogged activity or lost transactions to identify how transaction records will be brought current within expected recovery time frames.","RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","11.b","V, “Business Continuity Plan”","11. Verify that management developed a coordinated disaster recovery strategy for data centers, networks, servers, storage, service monitoring, user support, and related software. Verify that procedures address the following:\nb. Procedures for restoring backlogged activity or lost transactions to identify how transaction records will be brought current within expected recovery time frames.","PR.IP-4.3: The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","11.c","V, “Business Continuity Plan”","11. Verify that management developed a coordinated disaster recovery strategy for data centers, networks, servers, storage, service monitoring, user support, and related software. Verify that procedures address the following:\nc. Instructions to access the repository of critical information when the primary facility is unavailable.","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.a","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\na. Senior management for leadership.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.a","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\na. Senior management for leadership.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.b","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\nb. Facilities management for safety and physical security.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.c","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\nc. Human resources for personnel issues and travel.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.d","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\nd. Media relations for managing communications.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.e","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\ne. Finance and accounting for funds disbursement and financial decisions, including unanticipated expenses.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.f","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\nf. Legal and compliance for legal and regulatory concerns.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","12.g","V, “Business Continuity Plan”","12. Verify whether management designates key personnel from applicable departments to act during a crisis or emergency situation. Key personnel may include:\ng. IT, including information security, and operations for specific tactical responses.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","13.a","V, “Business Continuity Plan”","13. Determine whether management established a crisis or emergency management process. Verify whether the BCP addresses the following:\na. Coordination with regulatory agencies, local and state officials, law enforcement, and first responders. ","RC.CO-1.2: The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","13.b","V, “Business Continuity Plan”","13. Determine whether management established a crisis or emergency management process. Verify whether the BCP addresses the following:\nb. Disruptions not confined to a single event, facility, or geographic area.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","13.c","V, “Business Continuity Plan”","13. Determine whether management established a crisis or emergency management process. Verify whether the BCP addresses the following:\nc. Simultaneous disruptions of telecommunications and electronic messaging, including between the entity and third-party service providers.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","13.c","V, “Business Continuity Plan”","13. Determine whether management established a crisis or emergency management process. Verify whether the BCP addresses the following:\nc. Simultaneous disruptions of telecommunications and electronic messaging, including between the entity and third-party service providers.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[8,"Assess the appropriateness of the entity’s enterprise-wide BCP.","13.d","V, “Business Continuity Plan”","13. Determine whether management established a crisis or emergency management process. Verify whether the BCP addresses the following:\nd. Crisis or emergency management communication protocols, including the designation of a spokesperson(s) to communicate with the news media, as appropriate.","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","1.a","VI, “Training”","1. Verify that the training program aligns with the entity's BCM strategy. Determine whether management does the following:\na. Inventories the current skillsets for BCM and identifies and addresses any training gaps.","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","Partial"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","1.b","VI, “Training”","1. Verify that the training program aligns with the entity's BCM strategy. Determine whether management does the following:\nb. Establishes goals and objectives for supporting the BCM program as part of the entity's performance management process.","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","1.b","VI, “Training”","1. Verify that the training program aligns with the entity's BCM strategy. Determine whether management does the following:\nb. Establishes goals and objectives for supporting the BCM program as part of the entity's performance management process.","PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","1.c","VI, “Training”","1. Verify that the training program aligns with the entity's BCM strategy. Determine whether management does the following:\nc. Implements a training program to educate stakeholders about the BCM goals and objectives. Elements may include:\nExercises.\nCurrent risks.\nFuture risks.\nRecent failures.\nNew programs/technologies.\nOrganizational changes.\nPrevious (exercise) lessons learned.","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","1.c","VI, “Training”","1. Verify that the training program aligns with the entity's BCM strategy. Determine whether management does the following:\nc. Implements a training program to educate stakeholders about the BCM goals and objectives. Elements may include:\nExercises.\nCurrent risks.\nFuture risks.\nRecent failures.\nNew programs/technologies.\nOrganizational changes.\nPrevious (exercise) lessons learned.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","1.c","VI, “Training”","1. Verify that the training program aligns with the entity's BCM strategy. Determine whether management does the following:\nc. Implements a training program to educate stakeholders about the BCM goals and objectives. Elements may include:\nExercises.\nCurrent risks.\nFuture risks.\nRecent failures.\nNew programs/technologies.\nOrganizational changes.\nPrevious (exercise) lessons learned.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","2.a","VI, “Training”","2. Assess whether management tailors training to the target audience, based on the audience's needs. The target audience could include:\na. Board members.","PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","2.b","VI, “Training”","2. Assess whether management tailors training to the target audience, based on the audience's needs. The target audience could include:\nb. Senior management.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","2.c","VI, “Training”","2. Assess whether management tailors training to the target audience, based on the audience's needs. The target audience could include:\nc. Business process owners.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","2.d","VI, “Training”","2. Assess whether management tailors training to the target audience, based on the audience's needs. The target audience could include:\nd. Frontline personnel.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.","2.e","VI, “Training”","2. Assess whether management tailors training to the target audience, based on the audience's needs. The target audience could include:\ne. Contract personnel, as applicable.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.",3,"VI, “Training”","3. Validate that management incorporates significant business continuity concepts, interdependencies, disruption impacts, and operations resilience into the training program.","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ","Full"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.",3,"VI, “Training”","3. Validate that management incorporates significant business continuity concepts, interdependencies, disruption impacts, and operations resilience into the training program.","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","Partial"]
[9,"Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.",4,"VI, “Training”","4. Verify that the BCM training program, including board training, is updated as significant changes occur.","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",1,"VII, “Exercises and Tests”","1. Determine whether management implemented a comprehensive exercise and testing program, objectives, and plans to validate the entity’s ability to restore critical business functions.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",2,"VII, “Exercises and Tests”","2. Verify that the program is appropriate for the entity's risk profile. Assess whether the entity's consolidated exercise and test schedule is reflective of exercise and test objectives and the overall exercise and test universe.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",2,"VII, “Exercises and Tests”","2. Verify that the program is appropriate for the entity's risk profile. Assess whether the entity's consolidated exercise and test schedule is reflective of exercise and test objectives and the overall exercise and test universe.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",2,"VII, “Exercises and Tests”","2. Verify that the program is appropriate for the entity's risk profile. Assess whether the entity's consolidated exercise and test schedule is reflective of exercise and test objectives and the overall exercise and test universe.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",3,"VII, “Exercises and Tests”","3. Determine whether management covers all of the functions in the exercise and test universe according to its established timeframes (e.g., all processes are covered annually or every three years).","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",4,"VII, “Exercises and Tests”","4. Determine whether management has designated personnel with the authority to control the exercise or test and confirm exercise and test milestones are met.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",5,"VII, “Exercises and Tests”","5. Verify that business line management retains ownership for testing its specific business processes and coordinates with personnel involved in the enterprise-wide BCM process and support areas.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",5,"VII, “Exercises and Tests”","5. Verify that business line management retains ownership for testing its specific business processes and coordinates with personnel involved in the enterprise-wide BCM process and support areas.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",6,"VII, “Exercises and Tests”","6. Verify that exercises and tests occur at appropriate intervals, or when significant changes affect the entity’s operating environment.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.a","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\na. A policy that includes strategies and expectations for exercise and test planning.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.a","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\na. A policy that includes strategies and expectations for exercise and test planning.","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.b","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\nb. Roles and responsibilities for implementation.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.c","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\nc. Sufficient personnel to perform the exercise or test, provide oversight, and document the results.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.d","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\nd. Precautions to safeguard production data, such as performing a backup before performing a test in a test environment, or testing during non-peak hours.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.e","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\ne. Provisions for emergency stops and concluding exercises and tests.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.f","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\nf. Verification of continuity and resilience process assumptions and the ability to process a sufficient volume of work during adverse operating conditions.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.g","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\ng. Activities commensurate with the importance of the business process.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.h","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\nh. Entity's processes commensurate with their significance to critical financial markets.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.i","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\ni. Comparison of exercise and test results against the BCP to identify gaps between the exercise or test process and recovery guidelines, with revisions incorporated where appropriate.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","7.j","VII, “Exercises and Tests”","7. Verify that management developed a process that is sufficiently robust to confirm the effectiveness of the entity's business continuity program. Therefore, the exercise program should incorporate the following:\nj. Independent review of business continuity program and exercises and tests (internal and external).","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.a","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\na. Key roles and responsibilities.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.a","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\na. Key roles and responsibilities.","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.a","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\na. Key roles and responsibilities.","RS.CO-1.3: The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.b","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\nb. Minimum frequency, scope, and reporting.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.c","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\nc. Documentation expectations.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.d","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\nd. Processes for correcting deficiencies identified during exercises or tests."," RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.d","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\nd. Processes for correcting deficiencies identified during exercises or tests.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.d","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\nd. Processes for correcting deficiencies identified during exercises or tests.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.e","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\ne. Communication and connectivity between the entity and third-party service providers.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","8.f","VII, “Exercises and Tests”","8. Determine whether the exercise and test policy is appropriate and includes the following:\nf. Participation with critical third-party service providers to confirm that entity personnel understand integration with all related recovery processes.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","9.a","VII, “Exercises and Tests”","9. Determine whether the exercise and test strategies allow management to demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities. Strategies may include the following:\na. Expectations for individual business lines and use of exercise and testing methodologies and scenarios.","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","9.b","VII, “Exercises and Tests”","9. Determine whether the exercise and test strategies allow management to demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities. Strategies may include the following:\nb. Internal and external dependencies, including activities outsourced to domestic and foreign-based third-party service providers.","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","9.c","VII, “Exercises and Tests”","9. Determine whether the exercise and test strategies allow management to demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities. Strategies may include the following:\nc. Multi-year plan(s) to execute the specific depth and breadth of exercises and tests, which use different methodologies and scenarios over time.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","9.d","VII, “Exercises and Tests”","9. Determine whether the exercise and test strategies allow management to demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities. Strategies may include the following:\nd. Expectations for testing internal and external recovery dependencies.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","9.d","VII, “Exercises and Tests”","9. Determine whether the exercise and test strategies allow management to demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities. Strategies may include the following:\nd. Expectations for testing internal and external recovery dependencies.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","9.e","VII, “Exercises and Tests”","9. Determine whether the exercise and test strategies allow management to demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities. Strategies may include the following:\ne. Assumptions, methodologies, and exercises used to develop the test strategies.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","9.f","VII, “Exercises and Tests”","9. Determine whether the exercise and test strategies allow management to demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities. Strategies may include the following:\nf. Transaction processing and functional testing to assess the recoverability of infrastructure, capacity, and data integrity.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",10,"VII, “Exercises and Tests”","10. Verify that exercise and test objectives include resilience, system monitoring, and the recovery of business processes and critical system components.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","11.a","VII, “Exercises and Tests”","11. Verify that exercises and associated tests accomplish the following objectives:\na. Build confidence that resilience and recovery strategies meet business requirements.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","11.b","VII, “Exercises and Tests”","11. Verify that exercises and associated tests accomplish the following objectives:\nb. Demonstrate that critical services can be recovered within agreed upon recovery objectives (RTOs, RPOs, and MTDs) and customer SLAs.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","11.c","VII, “Exercises and Tests”","11. Verify that exercises and associated tests accomplish the following objectives:\nc. Establish that critical services can be restored in the event of an incident at the recovery location.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","11.d","VII, “Exercises and Tests”","11. Verify that exercises and associated tests accomplish the following objectives:\nd. Familiarize staff with recovery processes.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","11.e","VII, “Exercises and Tests”","11. Verify that exercises and associated tests accomplish the following objectives:\ne. Verify that personnel are adequately trained and knowledgeable of recovery plans and procedures.","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","11.f","VII, “Exercises and Tests”","11. Verify that exercises and associated tests accomplish the following objectives:\nf. Confirm that exercise and test plans remain compatible with the BCP and the entity's infrastructure.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","11.g","VII, “Exercises and Tests”","11. Verify that exercises and associated tests accomplish the following objectives:\ng. Identify any gaps between business continuity procedures and objectives.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.a","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\na. Identification of roles and responsibilities for participants, support personnel, and observers. ","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.b","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\nb. Metrics to assess whether objectives are met.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.c","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\nc. A consolidated exercise and test schedule that encompasses all objectives.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.d","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\nd. Specific descriptions of objectives and methods.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.e","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\ne. Roles and responsibilities for all test participants, including support personnel.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.f","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\nf. Identification of decision makers and succession plans.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.g","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\ng. Exercise and test locations to be utilized.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.h","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\nh. Escalation procedures and the ability to adjust for simulated scenarios.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","12.i","VII, “Exercises and Tests”","12. Determine whether management established exercise and test plans, commensurate with the nature, scale, and complexity of the recovery objectives that address the objectives and expectations of the exercise or test and outline the scenario and any assumptions or constraints that may exist. Verify whether exercise and test plans include the following:\ni. Contact information.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","13.a","VII, “Exercises and Tests”","13. Determine whether management developed reasonably foreseeable threat scenarios that simulate disruptions in business functions and the ability to meet both business requirements and customer expectations. Management should:\na. Identify and document assumptions used in developing each scenario.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","13.b","VII, “Exercises and Tests”","13. Determine whether management developed reasonably foreseeable threat scenarios that simulate disruptions in business functions and the ability to meet both business requirements and customer expectations. Management should:\nb. Develop scenarios that include threats that could affect third-party service providers, including communication processes with applicable stakeholders.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","13.b","VII, “Exercises and Tests”","13. Determine whether management developed reasonably foreseeable threat scenarios that simulate disruptions in business functions and the ability to meet both business requirements and customer expectations. Management should:\nb. Develop scenarios that include threats that could affect third-party service providers, including communication processes with applicable stakeholders.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","13.c","VII, “Exercises and Tests”","13. Determine whether management developed reasonably foreseeable threat scenarios that simulate disruptions in business functions and the ability to meet both business requirements and customer expectations. Management should:\nc. Develop exercises that demonstrate not only the ability to failover to an alternate site but also validate recovery objectives.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","13.d","VII, “Exercises and Tests”","13. Determine whether management developed reasonably foreseeable threat scenarios that simulate disruptions in business functions and the ability to meet both business requirements and customer expectations. Management should:\nd. Create scenarios that include only the data and systems that would be available for recovery.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","14.a","VII, “Exercises and Tests”","14. Verify that exercise and test scripts document the procedures for executing the exercise or test, which may include:\na. Applications, business processes, systems, or facilities reviewed.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","14.b","VII, “Exercises and Tests”","14. Verify that exercise and test scripts document the procedures for executing the exercise or test, which may include:\nb. Sequential steps for employees or external parties to perform.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","14.c","VII, “Exercises and Tests”","14. Verify that exercise and test scripts document the procedures for executing the exercise or test, which may include:\nc. Procedures to guide manual work-around processes.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","14.d","VII, “Exercises and Tests”","14. Verify that exercise and test scripts document the procedures for executing the exercise or test, which may include:\nd. A detailed schedule for completion.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","14.e","VII, “Exercises and Tests”","14. Verify that exercise and test scripts document the procedures for executing the exercise or test, which may include:\ne. Methods for participants to record results, quantifiable metrics, and any issues.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","15.a","VII, “Exercises and Tests”","15. Assess whether exercise and test methods are commensurate with the size and complexity of the entity and the criticality of the function to the entity. Verify that exercises and tests are designed to do following:\na. Validate personnel knowledge and skills, including backup responsibilities.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","15.b","VII, “Exercises and Tests”","15. Assess whether exercise and test methods are commensurate with the size and complexity of the entity and the criticality of the function to the entity. Verify that exercises and tests are designed to do following:\nb. Operate and perform duties (e.g., daily, quarterly, annually) from an alternate site. ","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","15.c","VII, “Exercises and Tests”","15. Assess whether exercise and test methods are commensurate with the size and complexity of the entity and the criticality of the function to the entity. Verify that exercises and tests are designed to do following:\nc. Process transactions and assess system functionality.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","15.d","VII, “Exercises and Tests”","15. Assess whether exercise and test methods are commensurate with the size and complexity of the entity and the criticality of the function to the entity. Verify that exercises and tests are designed to do following:\nd. Test the viability of both full and incremental backups.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","15.e","VII, “Exercises and Tests”","15. Assess whether exercise and test methods are commensurate with the size and complexity of the entity and the criticality of the function to the entity. Verify that exercises and tests are designed to do following:\ne. Test network connectivity and interdependencies, including those with critical third-party service providers.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.a","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\na. Engaging personnel from all business units to participate and interact with internal and external management response teams.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.a","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\na. Engaging personnel from all business units to participate and interact with internal and external management response teams.","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.b","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\nb. Validating that the crisis/emergency management process is operating as designed.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.b","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\nb. Validating that the crisis/emergency management process is operating as designed.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.c","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\nc. Verifying personnel knowledge and skills.","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.d","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\nd. Validating management response and decision-making capability.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.e","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\ne. Demonstrating coordination among participants and decision makers.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.f","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\nf. Validating communication protocols.","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.g","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\ng. Conducting activities at alternate locations or facilities.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.h","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\nh. Processing data using backup media or alternative methods.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.i","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\ni. Completing actual transactional volumes or an illustrative subset.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","16.j","VII, “Exercises and Tests”","16. If management performs full-scale exercises, verify whether the exercise includes the following, where appropriate:\nj. Performing recovery exercises over a sufficient length of time to allow issues to unfold as they would in a crisis.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","17.a","VII, “Exercises and Tests”","17. If management performs limited-scale exercises, verify whether the exercise includes the following, where appropriate:\na. Implementing a plan appropriate to the scenario.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","17.b","VII, “Exercises and Tests”","17. If management performs limited-scale exercises, verify whether the exercise includes the following, where appropriate:\nb. Verifying personnel knowledge and skills. ","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","17.c","VII, “Exercises and Tests”","17. If management performs limited-scale exercises, verify whether the exercise includes the following, where appropriate:\nc. Validating management response and decision-making capability.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","17.d","VII, “Exercises and Tests”","17. If management performs limited-scale exercises, verify whether the exercise includes the following, where appropriate:\nd. Executing on-the-scene coordination and decision-making roles.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","17.e","VII, “Exercises and Tests”","17. If management performs limited-scale exercises, verify whether the exercise includes the following, where appropriate:\ne. Verifying whether participants can connect to alternate system(s).","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","17.f","VII, “Exercises and Tests”","17. If management performs limited-scale exercises, verify whether the exercise includes the following, where appropriate:\nf. Conducting activities at alternate locations or facilities.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","17.g","VII, “Exercises and Tests”","17. If management performs limited-scale exercises, verify whether the exercise includes the following, where appropriate:\ng. Testing communication and remote access capability (e.g., switching to alternate equipment or telecommuting).","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.a","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\na. Engaging operational and support personnel who are responsible for implementing the BCP.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.b","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\nb. Practicing and validating specific functional response capabilities.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.c","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\nc. Demonstrating knowledge and skills, as well as team interaction and decision-making capabilities.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.c","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\nc. Demonstrating knowledge and skills, as well as team interaction and decision-making capabilities.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.d","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\nd. Role playing with simulated responses, evaluating critical steps, recognizing difficulties, and resolving problems.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.e","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\ne. Clarifying critical plan elements, as well as problems noted during exercises.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.f","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\nf. Creating action plans to correct issues.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","18.f","VII, “Exercises and Tests”","18. If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other. (By themselves, tabletop exercises are likely insufficient to validate recovery capabilities because they are limited to a discussion-based analysis of policies and procedures.) Tabletop exercises may include the following:\nf. Creating action plans to correct issues.","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.a","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\na. Validating RPOs, RTOs, and MTDs.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.b","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\nb. Demonstrating recoverability at peak volumes.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.c","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\nc. Confirming that systems can support critical business processes (e.g., transfer to alternate sites, increased workloads, manual workarounds, and communication).","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.d","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\nd. Integrating technologies that support critical business activities, including data replication, recovery, and off-site storage.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.e","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\ne. Testing backup data to assess integrity and availability.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.f","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\nf. Certifying facility controls (e.g., environmental, backup power, and physical security).","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.g","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\ng. Verifying workspace restoration (e.g., network connectivity and communications).","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","19.h","VII, “Exercises and Tests”","19. Verify that management clearly defines the characteristics of a successful test, which may include the following:\nh. Ensuring that personnel are familiar with and are able to execute their responsibilities.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",20,"VII, “Exercises and Tests”","20. Determine whether the right to perform testing or participate in exercises and tests with third parties is described in the contract governing the entity’s relationship with the third-party service provider.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","21.a","VII, “Exercises and Tests”","21. Determine whether exercises and tests with third-party service providers are included in the entity's enterprise exercise and test program based on the risk prioritization of the third-party service provider and the criticality of the services provided to the entity. Assess the following:\na. The process to rank third-party service providers based on criticality, risk, and testing scope.","DM.ED-5.4: The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","21.b","VII, “Exercises and Tests”","21. Determine whether exercises and tests with third-party service providers are included in the entity's enterprise exercise and test program based on the risk prioritization of the third-party service provider and the criticality of the services provided to the entity. Assess the following:\nb. Coordinated exercises and tests that reasonably validate the abilities of both the entity and the third-party service provider to recover, restore, resume, and maintain operations after disruptions consistent with business and contractual requirements.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","21.c","VII, “Exercises and Tests”","21. Determine whether exercises and tests with third-party service providers are included in the entity's enterprise exercise and test program based on the risk prioritization of the third-party service provider and the criticality of the services provided to the entity. Assess the following:\nc. Evidence that exercises and tests of critical service providers include reasonably foreseeable significant disruptive events.","DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","21.d","VII, “Exercises and Tests”","21. Determine whether exercises and tests with third-party service providers are included in the entity's enterprise exercise and test program based on the risk prioritization of the third-party service provider and the criticality of the services provided to the entity. Assess the following:\nd. Documentation of the scope, execution, and results of exercises and tests in which the entity is unable to directly participate.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","22.a","VII, “Exercises and Tests”","22. Determine whether the entity participates in its critical third-party service providers' exercise and test program(s) at reasonable intervals. Assess the execution of the exercises and tests and whether they included the following:\na. End-to-end and, when appropriate, full-scale exercises.","DM.ED-7.4: A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","22.b","VII, “Exercises and Tests”","22. Determine whether the entity participates in its critical third-party service providers' exercise and test program(s) at reasonable intervals. Assess the execution of the exercises and tests and whether they included the following:\nb. Transaction processing and functional testing.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","22.c","VII, “Exercises and Tests”","22. Determine whether the entity participates in its critical third-party service providers' exercise and test program(s) at reasonable intervals. Assess the execution of the exercises and tests and whether they included the following:\nc. Network connectivity and interdependencies to include those with critical fourth parties.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","22.d","VII, “Exercises and Tests”","22. Determine whether the entity participates in its critical third-party service providers' exercise and test program(s) at reasonable intervals. Assess the execution of the exercises and tests and whether they included the following:\nd. Bidirectional operations between the entity's and its third-party service provider's primary and alternate locations and systems.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","22.d","VII, “Exercises and Tests”","22. Determine whether the entity participates in its critical third-party service providers' exercise and test program(s) at reasonable intervals. Assess the execution of the exercises and tests and whether they included the following:\nd. Bidirectional operations between the entity's and its third-party service provider's primary and alternate locations and systems.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","22.e","VII, “Exercises and Tests”","22. Determine whether the entity participates in its critical third-party service providers' exercise and test program(s) at reasonable intervals. Assess the execution of the exercises and tests and whether they included the following:\ne. Supply chain considerations.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","23.a","VII, “Exercises and Tests”","23. Determine whether testing scenarios with critical third-party service providers consider the following:\na. An outage or disruption of the service provider.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","23.b","VII, “Exercises and Tests”","23. Determine whether testing scenarios with critical third-party service providers consider the following:\nb. An outage or disruption at the entity.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","23.c","VII, “Exercises and Tests”","23. Determine whether testing scenarios with critical third-party service providers consider the following:\nc. Incident response plans.","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","23.d","VII, “Exercises and Tests”","23. Determine whether testing scenarios with critical third-party service providers consider the following:\nd. Crisis management plans.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","23.e","VII, “Exercises and Tests”","23. Determine whether testing scenarios with critical third-party service providers consider the following:\ne. Communication processes with third-party service providers and other stakeholders.","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","23.f","VII, “Exercises and Tests”","23. Determine whether testing scenarios with critical third-party service providers consider the following:\nf. Cyber events.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","23.g","VII, “Exercises and Tests”","23. Determine whether testing scenarios with critical third-party service providers consider the following:\ng. Returning to normal operations.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","24.a","VII, “Exercises and Tests”","24. Determine whether the tests validate the core or significant firm's backup arrangements to confirm the following:\na. Backup sites are able to support typical payment and settlement volumes for an extended period.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","24.b","VII, “Exercises and Tests”","24. Determine whether the tests validate the core or significant firm's backup arrangements to confirm the following:\nb. Backup sites are fully independent of the critical infrastructure components that support the primary sites.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","24.c","VII, “Exercises and Tests”","24. Determine whether the tests validate the core or significant firm's backup arrangements to confirm the following:\nc. Trained employees are located at the backup sites at the time of disruption.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","24.d","VII, “Exercises and Tests”","24. Determine whether the tests validate the core or significant firm's backup arrangements to confirm the following:\nd. Backup site employees are independent of the staff located at the primary site at the time of disruption.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","24.e","VII, “Exercises and Tests”","24. Determine whether the tests validate the core or significant firm's backup arrangements to confirm the following:\ne. Backup site employees are able to recover clearing and settlement of open transactions within the time frames addressed in the BCM processes and applicable industry standards.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","25.a","VII, “Exercises and Tests”","25. Determine whether the exercise and test assumptions are appropriate for core and significant firms and consider the following:\na. Primary data centers and operations facilities that are completely inoperable without notice.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","25.b","VII, “Exercises and Tests”","25. Determine whether the exercise and test assumptions are appropriate for core and significant firms and consider the following:\nb. Whether personnel at primary sites, who are located at both data centers and operations facilities, are unavailable for an extended period.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","25.c","VII, “Exercises and Tests”","25. Determine whether the exercise and test assumptions are appropriate for core and significant firms and consider the following:\nc. Whether other organizations are also affected, causing effects that have the potential to cascade from one organization across to the entire financial services sector.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","25.d","VII, “Exercises and Tests”","25. Determine whether the exercise and test assumptions are appropriate for core and significant firms and consider the following:\nd. Infrastructure (e.g., power, telecommunications, transportation) that is disrupted.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","25.e","VII, “Exercises and Tests”","25. Determine whether the exercise and test assumptions are appropriate for core and significant firms and consider the following:\ne. Whether data recovery or reconstruction to restart payment and settlement functions can be completed within the time frames defined by the BCM process and applicable industry standards.","RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","25.f","VII, “Exercises and Tests”","25. Determine whether the exercise and test assumptions are appropriate for core and significant firms and consider the following:\nf. Whether continuity arrangements continue to operate until all pending transactions are closed.","RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date.","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",26,"VII, “Exercises and Tests”","26. Determine whether the core firm’s testing strategy includes plans to test the ability of significant firms that clear or settle transactions to recover critical clearing and settlement activities from geographically dispersed backup sites within a reasonable time frame.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","27.a","VII, “Exercises and Tests”","27. Determine whether the significant firm has an external exercise and test strategy that addresses key interdependencies, such as exercises and tests with third-party market providers and key customers, and determine the following:\na. Whether external exercise and test strategies include the significant firm's backup sites to the core firm's backup sites.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","27.b","VII, “Exercises and Tests”","27. Determine whether the significant firm has an external exercise and test strategy that addresses key interdependencies, such as exercises and tests with third-party market providers and key customers, and determine the following:\nb. Whether the significant firm participates in industry (e.g., U.S. Department of the Treasury's Hamilton Series and FS-ISAC's CAPS exercises) or cross-market tests sponsored by core firms, markets, or trade associations. Tests should incorporate verifying the connectivity from alternate sites and include transaction, settlement, and payment processes, to the extent practical.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","28.a","VII, “Exercises and Tests”","28. Determine whether the exercise and test program is sufficient to demonstrate the entity's ability to meet its continuity objectives and whether the results demonstrate the readiness of personnel to achieve the entity's recovery and resumption objectives. Determine whether management accomplishes the following:\na. Coordinate the execution of its exercise and test program to fully exercise its business continuity planning process.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","28.b","VII, “Exercises and Tests”","28. Determine whether the exercise and test program is sufficient to demonstrate the entity's ability to meet its continuity objectives and whether the results demonstrate the readiness of personnel to achieve the entity's recovery and resumption objectives. Determine whether management accomplishes the following:\nb. Analyze and compare results against stated objectives.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","28.c","VII, “Exercises and Tests”","28. Determine whether the exercise and test program is sufficient to demonstrate the entity's ability to meet its continuity objectives and whether the results demonstrate the readiness of personnel to achieve the entity's recovery and resumption objectives. Determine whether management accomplishes the following:\nc. Raise issues with appropriate personnel and assign responsibility for resolution.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","28.d","VII, “Exercises and Tests”","28. Determine whether the exercise and test program is sufficient to demonstrate the entity's ability to meet its continuity objectives and whether the results demonstrate the readiness of personnel to achieve the entity's recovery and resumption objectives. Determine whether management accomplishes the following:\nd. Escalate issues that cannot be resolved in a timely manner to the appropriate level of management.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","28.e","VII, “Exercises and Tests”","28. Determine whether the exercise and test program is sufficient to demonstrate the entity's ability to meet its continuity objectives and whether the results demonstrate the readiness of personnel to achieve the entity's recovery and resumption objectives. Determine whether management accomplishes the following:\ne. Prioritize and track issues through final resolution.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","28.f","VII, “Exercises and Tests”","28. Determine whether the exercise and test program is sufficient to demonstrate the entity's ability to meet its continuity objectives and whether the results demonstrate the readiness of personnel to achieve the entity's recovery and resumption objectives. Determine whether management accomplishes the following:\nf. Analyze results and issues to determine whether problems can be traced to a common source.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.","28.g","VII, “Exercises and Tests”","28. Determine whether the exercise and test program is sufficient to demonstrate the entity's ability to meet its continuity objectives and whether the results demonstrate the readiness of personnel to achieve the entity's recovery and resumption objectives. Determine whether management accomplishes the following:\ng. Document recommendations for future exercise and tests.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",29,"VII, “Exercises and Tests”","29. Verify that corrective actions have been implemented and that retesting occurs in a timely fashion to address deficiencies in meeting the entity’s objectives.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","Full"]
[10,"Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",30,"VII, “Exercises and Tests”","30. Verify that test results are used to update the business continuity processes, enhance future testing, and evaluate whether risk mitigation strategies should be adjusted.","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.a","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\na. Changes in enterprise strategies.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.b","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\nb. New or reconfigured products, services, or infrastructure.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.c","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\nc. Changes in products and services offered by third-party service providers.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.d","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\nd. Deficiencies identified in third-party service provider BCM processes.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.e","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\ne. New legislation, regulatory requirements, or resilience practices.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.e","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\ne. New legislation, regulatory requirements, or resilience practices.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.f","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\nf. Results of operational metric analysis (e.g., key risk indications, key performance indicators).","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.g","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\ng. Early warning indicators that may identify potential continuity events, crises, or incidents (e.g., frequency and severity of storms, heightened cyber attack activity, or increases in customer service calls).","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Partial"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.g","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\ng. Early warning indicators that may identify potential continuity events, crises, or incidents (e.g., frequency and severity of storms, heightened cyber attack activity, or increases in customer service calls).","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event. ","Partial"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.g","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\ng. Early warning indicators that may identify potential continuity events, crises, or incidents (e.g., frequency and severity of storms, heightened cyber attack activity, or increases in customer service calls).","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","Partial"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.h","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\nh. Variances between budgeted and actual BCM expenses.",null,"None"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.i","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\ni. Results from exercises and tests and lessons learned.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.i","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\ni. Results from exercises and tests and lessons learned.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.j","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\nj. Changes in the threat landscape (e.g., new capabilities, intent of threat actors).","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","1.k","VIII, “Maintenance and Improvement”","1. Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers that prompt maintenance and improvement of the BCM may include the following:\nk. Recommendations (e.g., from audits, vulnerability assessments, and penetration tests, including those involving the use of advanced cybersecurity analysis and assessments).","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","2.a","VIII, “Maintenance and Improvement”","2. Determine whether management has documented, analyzed, and reviewed lessons learned from adverse events. Documented procedures for incorporating lessons learned may include:\na. Identifying the failure(s).","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","2.a","VIII, “Maintenance and Improvement”","2. Determine whether management has documented, analyzed, and reviewed lessons learned from adverse events. Documented procedures for incorporating lessons learned may include:\na. Identifying the failure(s).","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","2.b","VIII, “Maintenance and Improvement”","2. Determine whether management has documented, analyzed, and reviewed lessons learned from adverse events. Documented procedures for incorporating lessons learned may include:\nb. Determining the cause(s).","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","2.c","VIII, “Maintenance and Improvement”","2. Determine whether management has documented, analyzed, and reviewed lessons learned from adverse events. Documented procedures for incorporating lessons learned may include:\nc. Evaluating potential solutions.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","2.d","VIII, “Maintenance and Improvement”","2. Determine whether management has documented, analyzed, and reviewed lessons learned from adverse events. Documented procedures for incorporating lessons learned may include:\nd. Implementing corrective actions as appropriate.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.","2.e","VIII, “Maintenance and Improvement”","2. Determine whether management has documented, analyzed, and reviewed lessons learned from adverse events. Documented procedures for incorporating lessons learned may include:\ne. Recording and reviewing corrective actions taken.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.",3,"VIII, “Maintenance and Improvement”","3. Verify that management documents, tracks, and resolves any changes when updating the BCP and the exercise and testing program(s). Furthermore, verify that management maintains appropriate version control of key BCM documents.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.",3,"VIII, “Maintenance and Improvement”","3. Verify that management documents, tracks, and resolves any changes when updating the BCP and the exercise and testing program(s). Furthermore, verify that management maintains appropriate version control of key BCM documents.","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[11,"Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.",4,"VIII, “Maintenance and Improvement”","4. Determine whether management maintains backup copies of relevant BCM documentation in the event that the primary repository becomes inaccessible","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","Full"]
[12,"Objective 12: Determine whether the board has established expectations for BCM reporting.","1.a","IX, “Board Reporting”","1. Review board minutes to determine whether management periodically reports to the board on the status of BCM.\na. Determine whether reports include a written BCM presentation, including the BIA, risk assessment, BCP, exercise and test results, and identified issues.",null,"N/A"]
[12,"Objective 12: Determine whether the board has established expectations for BCM reporting.","1.b","IX, “Board Reporting”","1. Review board minutes to determine whether management periodically reports to the board on the status of BCM.\nb. Determine whether management provides the board with regular strategy updates based on changes in personnel, roles and responsibilities, and business operations.","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","Full"]
[12,"Objective 12: Determine whether the board has established expectations for BCM reporting.","1.b","IX, “Board Reporting”","1. Review board minutes to determine whether management periodically reports to the board on the status of BCM.\nb. Determine whether management provides the board with regular strategy updates based on changes in personnel, roles and responsibilities, and business operations.","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","Full"]
[12,"Objective 12: Determine whether the board has established expectations for BCM reporting.","1.c","IX, “Board Reporting”","1. Review board minutes to determine whether management periodically reports to the board on the status of BCM.\nc. Verify that management documents the reasons (e.g., cost and service level) for choosing recovery alternatives and why they are appropriate based on the entity's risk profile and complexity.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","Full"]
[12,"Objective 12: Determine whether the board has established expectations for BCM reporting.","1.d","IX, “Board Reporting”","1. Review board minutes to determine whether management periodically reports to the board on the status of BCM.\nd. Assess whether the board provides a credible challenge to management, when appropriate.","GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","Full"]
[12,"Objective 12: Determine whether the board has established expectations for BCM reporting.","1.d","IX, “Board Reporting”","1. Review board minutes to determine whether management periodically reports to the board on the status of BCM.\nd. Assess whether the board provides a credible challenge to management, when appropriate.","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","Full"]
[13,"Discuss corrective action and communicate findings.","1.a","N/A","1. Review preliminary conclusions with the examiner-in-charge regarding the following:\na. Apparent violations of laws and regulations.",null,"N/A"]
[13,"Discuss corrective action and communicate findings.","1.b","N/A","1. Review preliminary conclusions with the examiner-in-charge regarding the following:\nb. Significant issues warranting inclusion in the report of examination.",null,"N/A"]
[13,"Discuss corrective action and communicate findings.","1.c","N/A","1. Review preliminary conclusions with the examiner-in-charge regarding the following:\nc. Proposed Uniform Rating System for IT (URSIT) management component rating and the potential impact of the examiner's conclusions on composite or other URSIT component ratings.",null,"N/A"]
[13,"Discuss corrective action and communicate findings.","1.d","N/A","1. Review preliminary conclusions with the examiner-in-charge regarding the following:\nd. Potential impact of the examiner's conclusions on the entity's risk assessment(s).",null,"N/A"]
[13,"Discuss corrective action and communicate findings.",2,"N/A","2. Discuss findings with management and obtain proposed corrective action for significant deficiencies.",null,"N/A"]
[13,"Discuss corrective action and communicate findings.",3,"N/A","3. Document conclusions in a memorandum to the examiner-in-charge that provides report-ready comments for all relevant sections of the report of examination and clarifying guidance to future examiners.",null,"N/A"]
[13,"Discuss corrective action and communicate findings.",4,"N/A","4. Organize work papers to show clear support for significant findings by examination objective.",null,"N/A"]

{"sheet":"Mapping to NYDFS","index":8,"n_rows":176,"n_cols":4,"rows_kept":176,"cut":false,"hidden":false,"merged":[[55,1,73,1],[55,3,73,3],[6,1,26,1],[6,3,26,3],[27,3,54,3],[27,1,54,1],[140,3,142,3],[140,1,142,1],[74,1,76,1],[74,3,76,3],[77,3,84,3],[77,1,84,1],[86,1,95,1],[86,3,95,3],[96,3,106,3],[96,1,106,1],[107,1,115,1],[116,3,139,3],[116,1,139,1],[107,3,115,3],[144,1,154,1],[144,3,154,3],[155,3,160,3],[155,1,160,1],[170,3,175,3],[170,1,175,1],[161,3,169,3],[161,1,169,1]]}
[]
["Proprietary"]
[]
["Mapping to the New York Department of Financial Services Reg 500 et seq."]
[]
["NYDFS Part 500 Section Title","NYDFS Part 500 Section Requirements","CRI Cyber Profile Diagnostic Statements","NYDFS 500/CRI Cyber Profile Gaps"]
["Section 500.02 Cybersecurity Program","(a)Cybersecurity Program. Each Covered Entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity’s Information Systems.\n\n(b)The cybersecurity program shall be based on the Covered Entity’s Risk Assessment and designed to perform the following core cybersecurity functions:\n\n(1)identify and assess internal and external cybersecurity risks that may threaten the security or integrity of Nonpublic Information stored on the Covered Entity’s Information Systems;\n(2) use defensive infrastructure and the implementation of policies and procedures to protect the Covered Entity’s Information Systems, and the Nonpublic Information stored on those Information Systems, from unauthorized access, use or other malicious acts;\n(3) detect Cybersecurity Events;\n(4) respond to identified or detected Cybersecurity Events to mitigate any negative effects;\n(5)recover from Cybersecurity Events and restore normal operations and services; and\n(6) fulfill applicable regulatory reporting obligations.\n\n(c) A Covered Entity may meet the requirement(s) of this Part by adopting the relevant and applicable provisions of a cybersecurity program maintained by an Affiliate, provided that such provisions satisfy the requirements of this Part, as applicable to the Covered Entity.\n\n(d)All documentation and information relevant to the Covered Entity’s cybersecurity program shall be made available to the superintendent upon request.","GV.SF-1.3: The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them. ","No Gaps Identified"]
["Section 500.02 Cybersecurity Program",null,"GV.PL-3.1: The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations."]
["Section 500.02 Cybersecurity Program",null,"GV.PL-3.2: The organization's cybersecurity policies are consistent with its privacy and civil liberty obligations."]
["Section 500.02 Cybersecurity Program",null,"GV.PL-3.3: The organization implements and maintains a documented policy or policies that address customer data privacy, and is approved by a designated officer or the organization’s appropriate governing body (e.g., the Board or one of its committees)."]
["Section 500.02 Cybersecurity Program",null,"GV.SP-1.1: The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite."]
["Section 500.02 Cybersecurity Program",null,"GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
["Section 500.02 Cybersecurity Program",null,"ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.\n"]
[null,null,"ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
["Section 500.02 Cybersecurity Program",null,"GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
["Section 500.02 Cybersecurity Program",null,"PR.PT-3.1: The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
["Section 500.02 Cybersecurity Program",null,"DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
["Section 500.02 Cybersecurity Program",null,"RS.CO-3.1: Information is shared consistent with response plans.  "]
["Section 500.02 Cybersecurity Program",null,"RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
["Section 500.02 Cybersecurity Program",null,"RS.RP-1.1: The organization's response plans are in place and executed during or after an incident."]
["Section 500.02 Cybersecurity Program",null,"RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders."]
["Section 500.02 Cybersecurity Program",null,"RC.RP-1.1: The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
["Section 500.02 Cybersecurity Program",null,"DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations."]
["Section 500.02 Cybersecurity Program",null,"DM.ED-2.2: The organization's dependency management policies, plans, and procedures are regularly updated."]
["Section 500.02 Cybersecurity Program",null,"DM.ED-2.3: The organization's dependency management policies, plans, and procedures have been reviewed and approved by appropriate organizational stakeholders."]
["Section 500.02 Cybersecurity Program",null,"DM.ED-2.4: Dependency management processes may allow the organization to the adopt  security program(s) of its \"affiliate(s)\" as long as such program provides an appropriate level of control and assurance."]
["Section 500.02 Cybersecurity Program",null,"DM.ED-2.5: The organization's dependency management process identifies third-party relationships that are in place, including those relationships that were established without formal approval."]
["Section 500.03 Cybersecurity Policy","Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations:\n(a)information security;\n(b)data governance and classification;\n(c)asset inventory and device management;\n(d)access controls and identity management;\n(e)business continuity and disaster recovery planning and resources;\n(f)systems operations and availability concerns;\n(g)systems and network security;\n(h)systems and network monitoring;\n(i)systems and application development and quality assurance;\n(j)physical security and environmental controls;\n(k)customer data privacy;\n(l)vendor and Third Party Service Provider management;\n(m)risk assessment; and\n(n) incident response.","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","The applicable CRI Cyber Profile Diagnostic Statements are at a higher level of abstraction and do not identify the areas of NYDFS 500.03 (a) through (n) explicitly, but Covered Entities are required to have such policies as outlined in 500.03.  \n\nAdherence to these specific requirements might be found by the Examples of Effective Evidence described in the CRI Diagnostic Statement Workbook."]
["Section 500.03 Cybersecurity Policy",null,"GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures."]
["Section 500.03 Cybersecurity Policy",null,"GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy."]
["Section 500.03 Cybersecurity Policy",null,"GV.PL-3.2: The organization's cybersecurity policies are consistent with its privacy and civil liberty obligations."]
["Section 500.03 Cybersecurity Policy",null,"GV.PL-3.3: The organization implements and maintains a documented policy or policies that address customer data privacy, and is approved by a designated officer or the organization’s appropriate governing body (e.g., the Board or one of its committees)."]
["Section 500.03 Cybersecurity Policy",null,"GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
["Section 500.03 Cybersecurity Policy",null,"ID.AM-5.1: The organization implements and maintains a written risk-based policy or policies on data governance and classification, approved by a Senior Officer or the organization's governing body (e.g., the Board or one of its committees).  "]
["Section 500.03 Cybersecurity Policy",null,"ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.\n"]
["Section 500.03 Cybersecurity Policy",null,"ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.\n"]
["Section 500.03 Cybersecurity Policy",null,"ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
["Section 500.03 Cybersecurity Policy",null,"ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization."]
["Section 500.03 Cybersecurity Policy",null,"ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.\n"]
["Section 500.03 Cybersecurity Policy",null,"ID.RA-5.4: The organization's business units assess, on an ongoing basis, the cyber risks associated with the activities of the business unit."]
["Section 500.03 Cybersecurity Policy",null,"ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units."]
["Section 500.03 Cybersecurity Policy",null,"PR.AC-2.1: The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms)."]
["Section 500.03 Cybersecurity Policy",null,"PR.AC-3.1: Remote access is actively managed and restricted to necessary systems."]
["Section 500.03 Cybersecurity Policy",null,"PR.AC-4.1: The organization limits access privileges to the minimum necessary."]
["Section 500.03 Cybersecurity Policy",null,"PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
["Section 500.03 Cybersecurity Policy",null,"PR.DS-1.1: Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
["Section 500.03 Cybersecurity Policy",null,"PR.DS-2.1: Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
["Section 500.03 Cybersecurity Policy",null,"PR.DS-4.1: The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment."]
["Section 500.03 Cybersecurity Policy",null,"PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
["Section 500.03 Cybersecurity Policy",null,"PR.IP-2.2: The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications."]
["Section 500.03 Cybersecurity Policy",null,"PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment."]
["Section 500.03 Cybersecurity Policy",null,"PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
["Section 500.03 Cybersecurity Policy",null,"DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
["Section 500.03 Cybersecurity Policy",null,"DM.ED-4.1: The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees)."]
["Section 500.03 Cybersecurity Policy",null,"DM.ED-4.2: The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate."]
["Section 500.04 Chief Information Security Officer","(a)Chief Information Security Officer. Each Covered Entity shall designate a qualified individual responsible for overseeing and implementing the Covered Entity’s cybersecurity program and enforcing its cybersecurity policy (for purposes of this Part, “Chief Information Security Officer” or “CISO”). The CISO may be employed by the Covered Entity, one of its Affiliates or a Third Party Service Provider. To the extent this requirement is met using a Third Party Service Provider or an Affiliate, the Covered Entity shall:\n(1) retain responsibility for compliance with this Part;\n(2) designate a senior member of the Covered Entity’s personnel responsible for direction and oversight of the Third Party Service Provider; and\n(3) require the Third Party Service Provider to maintain a cybersecurity program that protects the Covered Entity in accordance with the requirements of this Part.\n\n(b) Report. The CISO of each Covered Entity shall report in writing at least annually to the Covered Entity’s board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a Senior Officer of the Covered Entity responsible for the Covered Entity’s cybersecurity program. The CISO shall report on the Covered Entity’s cybersecurity program and material cybersecurity risks. The CISO shall consider to the extent applicable:\n(1) the confidentiality of Nonpublic Information and the integrity and security of the Covered Entity’s Information Systems;\n(2) the Covered Entity’s cybersecurity policies and procedures;\n(3) material cybersecurity risks to the Covered Entity;\n(4) overall effectiveness of the Covered Entity’s cybersecurity program; and\n(5) material Cybersecurity Events involving the Covered Entity during the time period addressed by the report.","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO).","The Profile generally covers most of the requirements in this section. However, Part 500.04 includes more granular detail on an entity's oversight of cybersecurity programs and Third Party Service Providers--notably, it requires the report to be in writing and annually, and that the individauls be \"qualified\". Please refer to the Diagnostic Statement Workbook, which provides greater detail on examples of effective evidence. "]
["Section 500.04 Chief Information Security Officer",null,"GV.RR-2.3: The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.  "]
["Section 500.04 Chief Information Security Officer",null,"ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities."]
["Section 500.04 Chief Information Security Officer",null,"GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners."]
["Section 500.04 Chief Information Security Officer",null,"GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile."]
["Section 500.04 Chief Information Security Officer",null,"GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks."]
["Section 500.04 Chief Information Security Officer",null,"GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-4.2: The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-6.2: The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-6.3: Minimum cybersecurity requirements for third-parties include how the organization will monitor security of its external dependencies to ensure that requirements are continually satisfied."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-6.4: Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-6.6: Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements."]
["Section 500.04 Chief Information Security Officer",null,"DM.ED-6.7: Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination."]
["Section 500.04 Chief Information Security Officer",null,"PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate."]
["Section 500.04 Chief Information Security Officer",null,"PR.AT-3.2: Cybersecurity training provided through a third-party service provider or affiliate should be consistent with the organization's cybersecurity policy and program."]
["Section 500.04 Chief Information Security Officer",null,"PR.AT-3.3: Cybersecurity training covers topics designed to minimize risks to or from interconnected parties."]
["Section 500.05 Penetration Testing and Vulnerability Assessments","The cybersecurity program for each Covered Entity shall include monitoring and testing, developed in accordance with the Covered Entity’s Risk Assessment, designed to assess the effectiveness of the Covered Entity’s cybersecurity program. The monitoring and testing shall include continuous monitoring or periodic Penetration Testing and vulnerability assessments. Absent effective continuous monitoring, or other systems to detect, on an ongoing basis, changes in Information Systems that may create or indicate vulnerabilities, Covered Entities shall conduct:\n(a) annual Penetration Testing of the Covered Entity’s Information Systems determined each given year based on relevant identified risks in accordance with the Risk Assessment; and\n(b)bi-annual vulnerability assessments, including any systematic scans or reviews of Information Systems reasonably designed to identify publicly known cybersecurity vulnerabilities in the Covered Entity’s Information Systems based on the Risk Assessment.","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","The Profile requires penetration testing and vulnerability assessments, but Section 500.05 is more specific, requiring: annual penetration testing and biannual vulnerability assessments for entity's without effective continuous monitoring.  Please refer to the Diagnostic Statement Workbook, which provides greater detail on examples of effective evidence. "]
["Section 500.05 Penetration Testing and Vulnerability Assessments",null,"DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers."]
["Section 500.05 Penetration Testing and Vulnerability Assessments",null,"DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. "]
["Section 500.06 Audit Trail","(a) Each Covered Entity shall securely maintain systems that, to the extent applicable and based on its Risk Assessment:\n(1) are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity; and\n(2) include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity.\n(b) Each Covered Entity shall maintain records required by section 500.06(a)(1) of this Part for not fewer than five years and shall maintain records required by section 500.06(a)(2) of this Part for not fewer than three years.","PR.DS-6.1: The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable. ","No Gaps Identified"]
["Section 500.06 Audit Trail",null,"PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. "]
["Section 500.06 Audit Trail",null,"PR.PT-1.1: The organization's audit trails are designed to detect cybersecurity events that may materially harm normal operations of the organization."]
["Section 500.06 Audit Trail",null,"PR.PT-1.2: The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time."]
["Section 500.06 Audit Trail",null,"RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date."]
["Section 500.06 Audit Trail",null,"DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  "]
["Section 500.06 Audit Trail",null,"DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. "]
["Section 500.06 Audit Trail",null,"DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations)."]
["Section 500.07 Access Privileges","As part of its cybersecurity program, based on the Covered Entity’s Risk Assessment each Covered Entity shall limit user access privileges to Information Systems that provide access to Nonpublic Information and shall periodically review such access privileges.","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","No Gaps Identified"]
["Section 500.08 Application Security","(a)Each Covered Entity’s cybersecurity program shall include written procedures, guidelines and standards designed to ensure the use of secure development practices for in-house developed applications utilized by the Covered Entity, and procedures for evaluating, assessing or testing the security of externally developed applications utilized by the Covered Entity within the context of the Covered Entity’s technology environment.\n\n(b)All such procedures, guidelines and standards shall be periodically reviewed, assessed and updated as necessary by the CISO (or a qualified designee) of the Covered Entity.","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","No Gaps Identified"]
["Section 500.08 Application Security",null,"GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures."]
["Section 500.08 Application Security",null,"GV.PL-2.1: The cybersecurity policy is supported by the organization's risk management program."]
["Section 500.08 Application Security",null,"GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy."]
["Section 500.08 Application Security",null,"GV.TE-1.1: The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception."]
["Section 500.08 Application Security",null,"GV.TE-1.2: The organization applies its cyber risk management framework to all technology projects."]
["Section 500.08 Application Security",null,"GV.TE-2.1: The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure."]
["Section 500.08 Application Security",null,"PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
["Section 500.08 Application Security",null,"PR.IP-2.2: The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications."]
["Section 500.08 Application Security",null,"PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment."]
["Section 500.09 Risk Assessment","(a)Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.\n\n(b)The Risk Assessment shall be carried out in accordance with written policies and procedures and shall be documented. Such policies and procedures shall include:\n(1)criteria for the evaluation and categorization of identified cybersecurity risks or threats facing the Covered Entity;\n(2)criteria for the assessment of the confidentiality, integrity, security and availability of the Covered Entity’s Information Systems and Nonpublic Information, including the adequacy of existing controls in the context of identified risks; and\n(3)requirements describing how identified risks will be mitigated or accepted based on the Risk Assessment and how the cybersecurity program will address the risks.","GV.RM-1.3/ID.RM-1(Enhancement): As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","No Gaps Identified"]
["Section 500.09 Risk Assessment",null,"GV.PL-2.1: The cybersecurity policy is supported by the organization's risk management program."]
["Section 500.09 Risk Assessment",null,"GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy."]
["Section 500.09 Risk Assessment",null,"GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
["Section 500.09 Risk Assessment",null,"ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit."]
["Section 500.09 Risk Assessment",null,"ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats."]
["Section 500.09 Risk Assessment",null,"ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
["Section 500.09 Risk Assessment",null,"ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization."]
["Section 500.09 Risk Assessment",null,"ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
["Section 500.09 Risk Assessment",null,"ID.RA-5.4: The organization's business units assess, on an ongoing basis, the cyber risks associated with the activities of the business unit."]
["Section 500.09 Risk Assessment",null,"ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units."]
["Section 500.10 Cybersecurity Personnel and Intelligence","(a)Cybersecurity Personnel and Intelligence. In addition to the requirements set forth in section 500.04(a) of this Part, each Covered Entity shall:\n(1)utilize qualified cybersecurity personnel of the Covered Entity, an Affiliate or a Third Party Service Provider sufficient to manage the Covered Entity’s cybersecurity risks and to perform or oversee the performance of the core cybersecurity functions specified in section 500.02(b)(1)-(6) of this Part;\n(2)provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks; and\n(3)verify that key cybersecurity personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures.\n\n(b)A Covered Entity may choose to utilize an Affiliate or qualified Third Party Service Provider to assist in complying with the requirements set forth in this Part, subject to the requirements set forth in section 500.11 of this Part.","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","No Gaps Identified"]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment."]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures."]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate."]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"PR.AT-3.2: Cybersecurity training provided through a third-party service provider or affiliate should be consistent with the organization's cybersecurity policy and program."]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"PR.AT-3.3: Cybersecurity training covers topics designed to minimize risks to or from interconnected parties."]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
["Section 500.10 Cybersecurity Personnel and Intelligence",null,"DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
["Section 500.11 Third Party Service Provider Security Policy","(a) Third Party Service Provider Policy. Each Covered Entity shall implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third Party Service Providers. Such policies and procedures shall be based on the Risk Assessment of the Covered Entity and shall address to the extent applicable:\n(1) the identification and risk assessment of Third Party Service Providers;\n(2)minimum cybersecurity practices required to be met by such Third Party Service Providers in order for them to do business with the Covered Entity;\n(3)due diligence processes used to evaluate the adequacy of cybersecurity practices of such Third Party Service Providers; and\n(4)periodic assessment of such Third Party Service Providers based on the risk they present and the continued adequacy of their cybersecurity practices.\n\n(b)Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:\n(1)the Third Party Service Provider’s policies and procedures for access controls, including its use of Multi-Factor Authentication as required by section 500.12 of this Part, to limit access to relevant Information Systems and Nonpublic Information;\n(2) the Third Party Service Provider’s policies and procedures for use of encryption as required by section 500.15 of this Part to protect Nonpublic Information in transit and at rest;\n(3)notice to be provided to the Covered Entity in the event of a Cybersecurity Event directly impacting the Covered Entity’s Information Systems or the Covered Entity’s Nonpublic Information being held by the Third Party Service Provider; and\n(4)representations and warranties addressing the Third Party Service Provider’s cybersecurity policies and procedures that relate to the security of the Covered Entity’s Information Systems or Nonpublic Information.\n\n(c)Limited Exception. An agent, employee, representative or designee of a Covered Entity who is itself a Covered Entity need not develop its own Third Party Information Security Policy pursuant to this section if the agent, employee, representative or designee follows the policy of the Covered Entity that is required to comply with this Part.","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","No Gaps Identified"]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-1.3: The organization ensures appropriate oversight and compliance with the external dependency strategy implementation."]
["Section 500.11 Third Party Service Provider Security Policy",null,"PR.DS-1.2: Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control. "]
["Section 500.11 Third Party Service Provider Security Policy",null,"PR.PT-3.1: The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
["Section 500.11 Third Party Service Provider Security Policy",null,"PR.AC-3.2: The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations."]
["Section 500.11 Third Party Service Provider Security Policy",null,"PR.AC-7.1: The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm."]
["Section 500.11 Third Party Service Provider Security Policy",null,"PR.AC-7.2: Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
["Section 500.11 Third Party Service Provider Security Policy",null,"PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
["Section 500.11 Third Party Service Provider Security Policy",null,"PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. "]
["Section 500.11 Third Party Service Provider Security Policy",null,"DE.CM-6.1: The organization authorizes and monitors all third-party connections."]
["Section 500.11 Third Party Service Provider Security Policy",null,"RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
["Section 500.11 Third Party Service Provider Security Policy",null,"RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
["Section 500.11 Third Party Service Provider Security Policy",null,"RS.CO-3.1: Information is shared consistent with response plans."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-6.2: The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-6.3: Minimum cybersecurity requirements for third-parties include how the organization will monitor security of its external dependencies to ensure that requirements are continually satisfied."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-6.4: Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-6.6: Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-6.7: Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-7.3: A process is in place to confirm that the organization's third-party service providers conduct due diligence of their own third-parties (e.g., subcontractors)."]
["Section 500.11 Third Party Service Provider Security Policy",null,"DM.ED-7.4: A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed."]
["Section 500.12 Multi-Factor Authentication","(a)Multi-Factor Authentication. Based on its Risk Assessment, each Covered Entity shall use effective controls, which may include Multi-Factor Authentication or Risk-Based Authentication, to protect against unauthorized access to Nonpublic Information or Information Systems.\n\n(b)Multi-Factor Authentication shall be utilized for any individual accessing the Covered Entity’s internal networks from an external network, unless the Covered Entity’s CISO has approved in writing the use of reasonably equivalent or more secure access controls.","PR.AC-3.2: The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations.","The requirements in Section 500.12 are more specific than the Profile.   Section 500.12(b) requires an entity to have MFA regardless of risk considerations when accessing the internal networks from an external network.  However, the CISO can have a “reasonably equivalent or more secure access control”, but it needs to be approved in writing. Please refer to the Diagnostic Statement Workbook, which provides greater detail on examples of effective evidence.   "]
["Section 500.12 Multi-Factor Authentication",null,"PR.AC-7.1: The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm."]
["Section 500.12 Multi-Factor Authentication",null,"PR.AC-7.2: Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
["Section 500.13 Limitations on Data Retention","As part of its cybersecurity program, each Covered Entity shall include policies and procedures for the secure disposal on a periodic basis of any Nonpublic Information identified in section 500.01(g)(2)-(3) of this Part that is no longer necessary for business operations or for other legitimate business purposes of the Covered Entity, except where such information is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably feasible due to the manner in which the information is maintained.","PR.IP-6.1: Data is maintained, stored, retained and destroyed according to the organization's data retention policy.","No Gaps Identified"]
["Section 500.14 Training and Monitoring","As part of its cybersecurity program, each Covered Entity shall:\n(a)implement risk-based policies, procedures and controls designed to monitor the activity of Authorized Users and detect unauthorized access or use of, or tampering with, Nonpublic Information by such Authorized Users; and\n\n(b)provide regular cybersecurity awareness training for all personnel that is updated to reflect risks identified by the Covered Entity in its Risk Assessment.","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","No Gaps Identified"]
["Section 500.14 Training and Monitoring",null,"PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures."]
["Section 500.14 Training and Monitoring",null,"PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate."]
["Section 500.14 Training and Monitoring",null,"PR.AT-3.2: Cybersecurity training provided through a third-party service provider or affiliate should be consistent with the organization's cybersecurity policy and program."]
["Section 500.14 Training and Monitoring",null,"PR.AT-3.3: Cybersecurity training covers topics designed to minimize risks to or from interconnected parties."]
["Section 500.14 Training and Monitoring",null,"PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example."]
["Section 500.14 Training and Monitoring",null,"PR.AT-4.2: Where the organization's governing authority (e.g., the Board or one of its committees) does not have adequate cybersecurity expertise, they should have direct access to the senior officer responsible for cybersecurity to discuss cybersecurity related matters."]
["Section 500.14 Training and Monitoring",null,"PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
["Section 500.14 Training and Monitoring",null,"DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.\n"]
["Section 500.14 Training and Monitoring",null,"DE.CM-3.2: The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.\n"]
["Section 500.14 Training and Monitoring",null,"DE.CM-7.2: The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers."]
["Section 500.15 Encryption of Nonpublic Information","(a)As part of its cybersecurity program, based on its Risk Assessment, each Covered Entity shall implement controls, including encryption, to protect Nonpublic Information held or transmitted by the Covered Entity both in transit over external networks and at rest.\n(1)To the extent a Covered Entity determines that encryption of Nonpublic Information in transit over external networks is infeasible, the Covered Entity may instead secure such Nonpublic Information using effective alternative compensating controls reviewed and approved by the Covered Entity’s CISO.\n(2)To the extent a Covered Entity determines that encryption of Nonpublic Information at rest is infeasible, the Covered Entity may instead secure such Nonpublic Information using effective alternative compensating controls reviewed and approved by the Covered Entity’s CISO.\n\n(b)To the extent that a Covered Entity is utilizing compensating controls under (a) above, the feasibility of encryption and effectiveness of the compensating controls shall be reviewed by the CISO at least annually.","GV.RM-1.5: The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls.","No Gaps Identified"]
["Section 500.15 Encryption of Nonpublic Information",null,"GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
["Section 500.15 Encryption of Nonpublic Information",null,"PR.DS-1.2: Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control."]
["Section 500.15 Encryption of Nonpublic Information",null,"PR.DS-2.2: Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control."]
["Section 500.15 Encryption of Nonpublic Information",null,"PR.IP-7.1:  A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
["Section 500.15 Encryption of Nonpublic Information",null,"DM.ED-4.3: The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
["Section 500.16 Incident Response Plan","(a)As part of its cybersecurity program, each Covered Entity shall establish a written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event materially affecting the confidentiality, integrity or availability of the Covered Entity’s Information Systems or the continuing functionality of any aspect of the Covered Entity’s business or operations.\n\n(b) Such incident response plan shall address the following areas:\n(1)the internal processes for responding to a Cybersecurity Event;\n(2)the goals of the incident response plan;\n(3)the definition of clear roles, responsibilities and levels of decision-making authority;\n(4)external and internal communications and information sharing;\n(5)identification of requirements for the remediation of any identified weaknesses in Information Systems and associated controls;\n(6)documentation and reporting regarding Cybersecurity Events and related incident response activities; and\n(7) the evaluation and revision as necessary of the incident response plan following a Cybersecurity Event.","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","No Gaps identified"]
["Section 500.16 Incident Response Plan",null,"RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority."]
["Section 500.16 Incident Response Plan",null,"RS.CO-2.1: The organization's incident response plan describes how to appropriately document and report cyber events and related incident response activities."]
["Section 500.16 Incident Response Plan",null,"RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
["Section 500.16 Incident Response Plan",null,"RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
["Section 500.16 Incident Response Plan",null,"RS.CO-3.1: Information is shared consistent with response plans. "]
["Section 500.16 Incident Response Plan",null,"RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
["Section 500.16 Incident Response Plan",null,"RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber-attack scenarios.\n(4) Operationally and technically plausible future cyber-attacks; and\n(5) New technological developments."]
["Section 500.16 Incident Response Plan",null,"RS.MI-3.1: The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls.\n"]
["Section 500.17 Notices to Superintendent","(a)Notice of Cybersecurity Event. Each Covered Entity shall notify the superintendent as promptly as possible but in no event later than 72 hours from a determination that a Cybersecurity Event has occurred that is either of the following:\n(1)Cybersecurity Events impacting the Covered Entity of which notice is required to be provided to any government body, self-regulatory agency or any other supervisory body; or\n(2)Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operation(s) of the Covered Entity.\n\n(b)Annually each Covered Entity shall submit to the superintendent a written statement covering the prior calendar year. This statement shall be submitted by February 15 in such form set forth as Appendix A, certifying that the Covered Entity is in compliance with the requirements set forth in this Part. Each Covered Entity shall maintain for examination by the Department all records, schedules and data supporting this certificate for a period of five years. To the extent a Covered Entity has identified areas, systems or processes that require material improvement, updating or redesign, the Covered Entity shall document the identification and the remedial efforts planned and underway to address such areas, systems or processes. Such documentation must be available for inspection by the superintendent.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","No Gaps Identified"]
["Section 500.17 Notices to Superintendent",null,"RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
["Section 500.17 Notices to Superintendent",null,"DE.DP-2.1: The organization's monitoring and detection processes comply with all applicable requirements."]
["Section 500.17 Notices to Superintendent",null,"GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile."]
["Section 500.17 Notices to Superintendent",null,"GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks."]
["Section 500.17 Notices to Superintendent",null,"RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders."]

{"sheet":"Mapping to ECB","index":9,"n_rows":637,"n_cols":13,"rows_kept":637,"cut":false,"hidden":false,"merged":[[5,1,5,9],[5,10,5,12]]}
[]
[null,"Proprietary"]
[]
[null,"Mapping to the European Central Bank's \"Cyber resilience oversight expectations for financial market infrastructures\""]
[]
[null,"ECB CROE Statements",null,null,null,null,null,null,null,null,"FSP Diagnostic Statement"]
["Mapping #","Topic ID","Topic","Sub-topic","Sub-topic ID","Maturity level","Heading","Statement ID","ID","Statement","FSP Diagnostic Statement","FSP ID","Mapping Type"]
[1,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework",{"$f":"LEFT(D8,FIND(\" \",D8)-1)","v":"2.1.2.1"},"Evolving","Cyber resilience strategy",1,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E8,\"-\",H8)","v":"ECB CROE 2.1.2.1-1"},"The FMI should establish an internal, cross-disciplinary steering committee comprised of senior management and appropriate staff (employees and/or contractors) from multiple business units (e.g. business, finance, risk management, internal audit, operations, cybersecurity, information technology (IT), communications, legal and human resources, some of which may be external), to collectively develop a cyber resilience strategy and framework. The steering committee should provide multiple views and perspectives to ensure that the cyber resilience strategy and framework is holistic and focuses on all elements related to people, processes and technology. Among other things, the steering committee should:","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.",{"$f":"LEFT(K8,FIND(\":\",K8)-1)","v":"GV.SF-1.2"},"Full"]
[2,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.a","ECB CROE 2.1.2.1-1.a","(a) evaluate and prioritise internal and external stakeholders’ needs and expectations, deciding on the overall requirements from cyber resilience;","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","DM.BE-3.1","Full"]
[3,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.a","ECB CROE 2.1.2.1-1.a","(a) evaluate and prioritise internal and external stakeholders’ needs and expectations, deciding on the overall requirements from cyber resilience;","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[4,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.b","ECB CROE 2.1.2.1-1.b","(b) provide direction to senior management on what cyber resilience should achieve;","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","DM.RS-1.3","Full"]
[5,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.b","ECB CROE 2.1.2.1-1.b","(b) provide direction to senior management on what cyber resilience should achieve;","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[6,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.c","ECB CROE 2.1.2.1-1.c","(c) define who makes cyber resilience decisions and how those decisions should be made;","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[7,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.d","ECB CROE 2.1.2.1-1.d","(d) consider the FMI’s risk landscape and risk tolerance when defining how cyber risks should be addressed;","GV.RM-2.1: The organization has established a cyber risk tolerance consistent with its risk appetite, and integrated it into technology or operational risk management, as appropriate.","GV.RM-2.1","Full"]
[8,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.e","ECB CROE 2.1.2.1-1.e","(e) evaluate how the different business units are impacted and can work together in an integrated manner to achieve enterprise-wide outcomes;","ID.RA-5.4: The organization's business units assess, on an ongoing basis, the cyber risks associated with the activities of the business unit.","ID.RA-5.4","Full"]
[9,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.e","ECB CROE 2.1.2.1-1.e","(e) evaluate how the different business units are impacted and can work together in an integrated manner to achieve enterprise-wide outcomes;","ID.RA-4.1: The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited.","ID.RA-4.1","Full"]
[10,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","1.f","ECB CROE 2.1.2.1-1.f","(f) consider how to monitor the performance and outcomes of cyber resilience and intervene if necessary to ensure that the specified direction is followed.","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. ","GV.SP-2.1","Full"]
[11,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy",2,"ECB CROE 2.1.2.1-2","Based on the above reflections, the FMI should document its cyber resilience strategy. The FMI should ensure that the following aspects are considered and included in the strategy.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[12,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy",2,"ECB CROE 2.1.2.1-2","Based on the above reflections, the FMI should document its cyber resilience strategy. The FMI should ensure that the following aspects are considered and included in the strategy.","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[13,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.a","ECB CROE 2.1.2.1-2.a","(a) The importance of cyber resilience to the FMI and its key stakeholders.","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[14,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.b","ECB CROE 2.1.2.1-2.b","(b) Internal and external stakeholders’ high-level requirements, so that these can be taken into account when defining cyber resilience governance and goals for cyber resilience management. Some common categories of stakeholders that may be considered include: owners and investors, customers and clients, suppliers, employees, legal and regulatory authorities, and competitors and industry bodies.","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","DM.BE-3.1","Full"]
[15,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.c","ECB CROE 2.1.2.1-2.c","(c) The FMI’s vision and mission in relation to cyber resilience.","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[16,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.d","ECB CROE 2.1.2.1-2.d","(d) The cyber resilience objectives that the FMI will work towards, which should include ensuring the ongoing efficiency, effectiveness and economic viability of its services to its users and maintaining and promoting the FMI’s ability to anticipate, withstand, contain and recover from cyber attacks.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[17,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.e","ECB CROE 2.1.2.1-2.e","(e) The FMI’s cyber risk appetite, to ensure that it remains consistent with the FMI’s risk tolerance, as well as with the FMI’s overall business objectives and corporate strategy.","GV.RM-2.1: The organization has established a cyber risk tolerance consistent with its risk appetite, and integrated it into technology or operational risk management, as appropriate.","GV.RM-2.1","Full"]
[18,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.f","ECB CROE 2.1.2.1-2.f","(f) Clear and credible cyber maturity targets and a roadmap or implementation plan with change delivery and planning of capabilities relating to people, processes and technology at pace with threats and proportionate to the FMI’s size and criticality. The strategy should clearly set out how this roadmap or implementation plan will be delivered and how the Board should track and monitor delivery.","GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","GV.SP-1.2","Full"]
[19,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.f","ECB CROE 2.1.2.1-2.f","(f) Clear and credible cyber maturity targets and a roadmap or implementation plan with change delivery and planning of capabilities relating to people, processes and technology at pace with threats and proportionate to the FMI’s size and criticality. The strategy should clearly set out how this roadmap or implementation plan will be delivered and how the Board should track and monitor delivery.","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[20,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.f","ECB CROE 2.1.2.1-2.f","(f) Clear and credible cyber maturity targets and a roadmap or implementation plan with change delivery and planning of capabilities relating to people, processes and technology at pace with threats and proportionate to the FMI’s size and criticality. The strategy should clearly set out how this roadmap or implementation plan will be delivered and how the Board should track and monitor delivery.","GV.SP-2.3: The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","GV.SP-2.3","Full"]
[21,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.g","ECB CROE 2.1.2.1-2.g","(g) The high-level scope of technology and assets which will be used to manage cyber resilience.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","ID.AM-3.1","Full"]
[22,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.f","ECB CROE 2.1.2.1-2.f","(h) The interactions with other participants, FMIs and third parties, on areas such as information sharing.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[23,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.h","ECB CROE 2.1.2.1-2.h","(i) The governance necessary to enable cyber resilience to be designed, transitioned, operated and improved.","GV.SP-1.1: The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite.","GV.SP-1.1","Full"]
[24,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.h","ECB CROE 2.1.2.1-2.h","(i) The governance necessary to enable cyber resilience to be designed, transitioned, operated and improved.","GV.RR-2.1: The organization has designated a Cybersecurity Officer (e.g., CISO) who is responsible and accountable for developing cybersecurity strategy, overseeing and implementing its cybersecurity program and enforcing its cybersecurity policy.","GV.RR-2.1","Full"]
[25,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.j","ECB CROE 2.1.2.1-2.j","(j) How cyber resilience initiatives will be delivered, managed and funded, including the budgeting process and organisational capabilities.","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). ","GV.RR-2.2","Full"]
[26,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.k","ECB CROE 2.1.2.1-2.k","(k) How cyber resilience will be integrated into all aspects of the FMI, which includes people, processes, technology and new business initiatives.","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[27,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy","2.k","ECB CROE 2.1.2.1-2.k","(k) How cyber resilience will be integrated into all aspects of the FMI, which includes people, processes, technology and new business initiatives.","GV.RM-1.2: The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.  ","GV.RM-1.2","Full"]
[28,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy",3,"ECB CROE 2.1.2.1-3","The FMI should ensure that the cyber resilience strategy is aligned to its corporate strategy and other relevant strategies (e.g. enterprise risk management, operational risk and IT).","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[29,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy",4,"ECB CROE 2.1.2.1-4","The FMI’s Board should approve the cyber resilience strategy, and should ensure that it is regularly reviewed and updated according to the FMI’s threat landscape. ","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[30,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy",4,"ECB CROE 2.1.2.1-4","The FMI’s Board should approve the cyber resilience strategy, and should ensure that it is regularly reviewed and updated according to the FMI’s threat landscape. ","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[31,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy",5,"ECB CROE 2.1.2.1-5","The Board should be kept regularly informed of the FMI’s cyber risk and ensure consistency with the FMI’s risk tolerance and appetite, so that it can achieve the FMI’s overall business objectives and corporate strategy. ","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","GV.SF-3.1","Full"]
[32,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience strategy",5,"ECB CROE 2.1.2.1-5","The Board should be kept regularly informed of the FMI’s cyber risk and ensure consistency with the FMI’s risk tolerance and appetite, so that it can achieve the FMI’s overall business objectives and corporate strategy. ","GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks.","GV.SF-3.2","Full"]
[33,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",6,"ECB CROE 2.1.2.1-6","The FMI should have a cyber resilience framework that clearly sets out how it determines its cyber resilience objectives and risk tolerance, as well as how it effectively identifies, mitigates, and manages its cyber risks to support its objectives. ","GV.RM-2.2: The cyber risk management strategy articulates how the organization intends to address its inherent cyber risk (before mitigating controls or other factors are taken into consideration).","GV.RM-2.2","Full"]
[34,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",6,"ECB CROE 2.1.2.1-6","The FMI should have a cyber resilience framework that clearly sets out how it determines its cyber resilience objectives and risk tolerance, as well as how it effectively identifies, mitigates, and manages its cyber risks to support its objectives. ","GV.RM-2.3: The cyber risk management strategy articulates how the organization would maintain an acceptable level of residual cyber risk set by the appropriate governing authority (e.g., the Board or one of its committees).","GV.RM-2.3","Full"]
[35,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",6,"ECB CROE 2.1.2.1-6","The FMI should have a cyber resilience framework that clearly sets out how it determines its cyber resilience objectives and risk tolerance, as well as how it effectively identifies, mitigates, and manages its cyber risks to support its objectives. ","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","GV.RM-1.1","Full"]
[36,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",7,"ECB CROE 2.1.2.1-7","The FMI’s cyber resilience framework should systematically incorporate the requirements (i.e. policies, procedures and controls) related to governance, identification, protection, detection, response and recovery, testing, situational awareness, and learning and evolving. ","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[37,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",7,"ECB CROE 2.1.2.1-7","The FMI’s cyber resilience framework should systematically incorporate the requirements (i.e. policies, procedures and controls) related to governance, identification, protection, detection, response and recovery, testing, situational awareness, and learning and evolving. ","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","GV.PL-1.1","Full"]
[38,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",8,"ECB CROE 2.1.2.1-8","The FMI should use leading international, national and industry-level standards, guidelines or recommendations (e.g. NIST, COBIT 5 and ISO/IEC 27000, etc.), reflecting current industry best practices in managing cyber threats, as a benchmark for designing its cyber resilience framework and incorporating the most effective cyber resilience solutions. ","GV.SF-2.1: The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","GV.SF-2.1","Full"]
[39,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",9,"ECB CROE 2.1.2.1-9","At the broader level, the FMI’s cyber resilience framework should be consistent with its enterprise risk management framework. ","GV.RM-3.1: The cyber risk management framework is integrated into the enterprise risk management framework.","GV.RM-3.1","Full"]
[40,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",10,"ECB CROE 2.1.2.1-10","The FMI’s Board should endorse this cyber resilience framework, ensuring it is aligned with the FMI’s formulated cyber resilience strategy, review it at least annually and update it when needed to ensure that it remains relevant. ","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[41,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",10,"ECB CROE 2.1.2.1-10","The FMI’s Board should endorse this cyber resilience framework, ensuring it is aligned with the FMI’s formulated cyber resilience strategy, review it at least annually and update it when needed to ensure that it remains relevant. ","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","GV.SF-3.1","Full"]
[42,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","Evolving","Cyber resilience framework",11,"ECB CROE 2.1.2.1-11","The FMI’s cyber resilience framework should clearly define the roles and responsibilities, including accountability for decision-making within the organisation, for identifying, mitigating and managing cyber risk. ","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[43,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",12,"ECB CROE 2.1.2.1-12","The FMI should use maturity models and define relevant metrics to assess and measure the adequacy and effectiveness of and adherence to its cyber resilience framework through independent compliance programmes and audits carried out by qualified staff on a regular basis.","GV.IR-1.1: The organization's enterprise-wide cyber risk management framework includes an independent risk management function that provides assurance that the cyber risk management framework is implemented as intended.","GV.IR-1.1","Full"]
[44,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",12,"ECB CROE 2.1.2.1-12","The FMI should use maturity models and define relevant metrics to assess and measure the adequacy and effectiveness of and adherence to its cyber resilience framework through independent compliance programmes and audits carried out by qualified staff on a regular basis.","GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","GV.IR-2.2","Full"]
[45,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",12,"ECB CROE 2.1.2.1-12","The FMI should use maturity models and define relevant metrics to assess and measure the adequacy and effectiveness of and adherence to its cyber resilience framework through independent compliance programmes and audits carried out by qualified staff on a regular basis.","GV.AU-1.3: An independent audit function tests security controls and information security policies.","GV.AU-1.3","Full"]
[46,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",12,"ECB CROE 2.1.2.1-12","The FMI should use maturity models and define relevant metrics to assess and measure the adequacy and effectiveness of and adherence to its cyber resilience framework through independent compliance programmes and audits carried out by qualified staff on a regular basis.","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. ","GV.SP-2.1","Full"]
[47,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",13,"ECB CROE 2.1.2.1-13","The FMI should ensure that, as part of its formal process to review and update its cyber resilience strategy and framework (including all policies, procedures and controls), a number of factors are considered, such as: ","GV.PL-2.3: The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.PL-2.3","Full"]
[48,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",13,"ECB CROE 2.1.2.1-13","The FMI should ensure that, as part of its formal process to review and update its cyber resilience strategy and framework (including all policies, procedures and controls), a number of factors are considered, such as: ","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[49,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.a","ECB CROE 2.1.2.1-13.a","(a) the current and evolving cyber threats (e.g. those associated with the supply chain, use of cloud services, social networking, mobile applications and the internet of things, etc.); ","GV.PL-2.3: The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.PL-2.3","Full"]
[50,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.a","ECB CROE 2.1.2.1-13.a","(a) the current and evolving cyber threats (e.g. those associated with the supply chain, use of cloud services, social networking, mobile applications and the internet of things, etc.); ","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[51,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.a","ECB CROE 2.1.2.1-13.a","(a) the current and evolving cyber threats (e.g. those associated with the supply chain, use of cloud services, social networking, mobile applications and the internet of things, etc.); ","ID.RA-3.2: The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past. ","ID.RA-3.2","Full"]
[52,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.b","ECB CROE 2.1.2.1-13.b","(b) threat intelligence on threat actors and new tactics, techniques and procedures which may specifically impact the FMI; ","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","ID.RA-5.2","Full"]
[53,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.b","ECB CROE 2.1.2.1-13.b","(b) threat intelligence on threat actors and new tactics, techniques and procedures which may specifically impact the FMI; ","ID.RA-3.3: The organization regularly reviews and updates results of its cyber threat analysis.","ID.RA-3.3","Full"]
[54,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.c","ECB CROE 2.1.2.1-13.c","(c) the results of risk assessments of the FMI’s critical functions, key roles, processes, information assets, third-party service providers and interconnections; ","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[55,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.d","ECB CROE 2.1.2.1-13.d","(d) actual cyber incidents that have impacted the FMI directly or external cyber incidents from the ecosystem; ","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[56,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.d","ECB CROE 2.1.2.1-13.d","(d) actual cyber incidents that have impacted the FMI directly or external cyber incidents from the ecosystem; ","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RS.IM-2.1","Full"]
[57,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.d","ECB CROE 2.1.2.1-13.d","(d) actual cyber incidents that have impacted the FMI directly or external cyber incidents from the ecosystem; ","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RC.IM-2.1","Full"]
[58,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.e","ECB CROE 2.1.2.1-13.e","(e) lessons learned from audits and tests on the cyber resilience framework;","GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","GV.IR-2.2","Full"]
[59,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.e","ECB CROE 2.1.2.1-13.e","(e) lessons learned from audits and tests on the cyber resilience framework;","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[60,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.e","ECB CROE 2.1.2.1-13.e","(e) lessons learned from audits and tests on the cyber resilience framework;","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","RS.IM-1.2","Full"]
[61,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.f","ECB CROE 2.1.2.1-13.f","(f) the FMI’s performance against the relevant metrics and maturity models;","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[62,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.g","ECB CROE 2.1.2.1-13.g","(g) new business developments and future strategic objectives.","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RS.IM-2.1","Full"]
[63,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.g","ECB CROE 2.1.2.1-13.g","(g) new business developments and future strategic objectives.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RC.IM-2.1","Full"]
[64,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework","13.g","ECB CROE 2.1.2.1-13.g","(g) new business developments and future strategic objectives.","ID.RA-5.4: The organization's business units assess, on an ongoing basis, the cyber risks associated with the activities of the business unit.","ID.RA-5.4","Full"]
[65,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework",{"$f":"LEFT(D72,FIND(\" \",D72)-1)","v":"2.1.2.1"},"ADVANCING","Cyber resilience strategy and framework",14,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E72,\"-\",H72)","v":"ECB CROE 2.1.2.1-14"},"The FMI’s cyber resilience strategy and framework should consider how the FMI would continuously review and proactively identify, mitigate and manage the cyber risks that it bears from and poses to its participants, other FMIs, vendors, vendor products and its service providers, which are collectively referred to as an FMI’s ecosystem. ","GV.SF-1.3: The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them. ",{"$f":"LEFT(K72,FIND(\":\",K72)-1)","v":"GV.SF-1.3"},"Full"]
[66,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",14,"ECB CROE 2.1.2.1-14","The FMI’s cyber resilience strategy and framework should consider how the FMI would continuously review and proactively identify, mitigate and manage the cyber risks that it bears from and poses to its participants, other FMIs, vendors, vendor products and its service providers, which are collectively referred to as an FMI’s ecosystem. ","GV.SF-1.4: The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry.","GV.SF-1.4","Full"]
[67,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",14,"ECB CROE 2.1.2.1-14","The FMI’s cyber resilience strategy and framework should consider how the FMI would continuously review and proactively identify, mitigate and manage the cyber risks that it bears from and poses to its participants, other FMIs, vendors, vendor products and its service providers, which are collectively referred to as an FMI’s ecosystem. ","DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","DM.RS-1.2","Full"]
[68,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","ADVANCING","Cyber resilience strategy and framework",14,"ECB CROE 2.1.2.1-14","The FMI’s cyber resilience strategy and framework should consider how the FMI would continuously review and proactively identify, mitigate and manage the cyber risks that it bears from and poses to its participants, other FMIs, vendors, vendor products and its service providers, which are collectively referred to as an FMI’s ecosystem. ","DM.BE-2.1: The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","DM.BE-2.1","Full"]
[69,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","INNOVATING","Cyber resilience strategy and framework",15,"ECB CROE 2.1.2.1-15","The cyber resilience strategy should outline the FMI’s future state of cyber resilience, in terms of maturity and/or risk, with short and long-term perspectives, and senior management should continuously improve and adapt the existing cyber resilience strategy and framework as the desired maturity level and/or risk landscape changes. ","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[70,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","INNOVATING","Cyber resilience strategy and framework",16,"ECB CROE 2.1.2.1-16","The FMI should establish the appropriate structures, processes and relationships with the key stakeholders in the ecosystem to continuously and proactively enhance the ecosystem’s cyber resilience and promote financial stability objectives as a whole. ","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","ID.RA-2.1","Full"]
[71,2.1,"Governance","2.1.2.1 Cyber resilience strategy and framework","2.1.2.1","INNOVATING","Cyber resilience strategy and framework",16,"ECB CROE 2.1.2.1-16","The FMI should establish the appropriate structures, processes and relationships with the key stakeholders in the ecosystem to continuously and proactively enhance the ecosystem’s cyber resilience and promote financial stability objectives as a whole. ","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1","Full"]
[72,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",17,"ECB CROE 2.1.2.2-17","The FMI’s Board should be responsible for approving the cyber resilience strategy and framework, setting the FMI’s risk tolerance for cyber risks and closely overseeing the FMI's implementation of its cyber resilience framework and the policies, procedures and controls that support it.","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[73,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",18,"ECB CROE 2.1.2.2-18","In order to carry out the aforementioned responsibilities, the FMI’s Board should ensure that it collectively possesses the appropriate balance of skills, knowledge and experience to understand and assess the cyber risks facing the FMI. It should also be sufficiently informed and capable of credibly challenging the recommendations and decisions of designated senior management. Although the Board should collectively increase its skills and knowledge on cybersecurity, it can also access specific expertise through a Board member with adequate experience, or through experienced staff and/or external independent organisation(s) reporting to and advising the Board. ","PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","PR.AT-4.1","Full"]
[74,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",18,"ECB CROE 2.1.2.2-18","In order to carry out the aforementioned responsibilities, the FMI’s Board should ensure that it collectively possesses the appropriate balance of skills, knowledge and experience to understand and assess the cyber risks facing the FMI. It should also be sufficiently informed and capable of credibly challenging the recommendations and decisions of designated senior management. Although the Board should collectively increase its skills and knowledge on cybersecurity, it can also access specific expertise through a Board member with adequate experience, or through experienced staff and/or external independent organisation(s) reporting to and advising the Board. ","PR.AT-4.2: Where the organization's governing authority (e.g., the Board or one of its committees) does not have adequate cybersecurity expertise, they should have direct access to the senior officer responsible for cybersecurity to discuss cybersecurity related matters.","PR.AT-4.2","Full"]
[75,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",19,"ECB CROE 2.1.2.2-19","The Board and senior management should ensure that a senior executive (e.g. the CISO) is responsible and accountable for implementing the cyber resilience strategy and framework at the enterprise level. The Senior Executive should be independent, possess the appropriate balance of skills, knowledge and experience, and have sufficient resources and direct access to the Board. For further clarification on the possible roles and responsibilities of such a senior executive, see Annex 3. ","GV.RR-2.3: The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.  ","GV.RR-2.3","Full"]
[76,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",19,"ECB CROE 2.1.2.2-19","The Board and senior management should ensure that a senior executive (e.g. the CISO) is responsible and accountable for implementing the cyber resilience strategy and framework at the enterprise level. The Senior Executive should be independent, possess the appropriate balance of skills, knowledge and experience, and have sufficient resources and direct access to the Board. For further clarification on the possible roles and responsibilities of such a senior executive, see Annex 3. ","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","GV.SF-1.2","Full"]
[77,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",19,"ECB CROE 2.1.2.2-19","The Board and senior management should ensure that a senior executive (e.g. the CISO) is responsible and accountable for implementing the cyber resilience strategy and framework at the enterprise level. The Senior Executive should be independent, possess the appropriate balance of skills, knowledge and experience, and have sufficient resources and direct access to the Board. For further clarification on the possible roles and responsibilities of such a senior executive, see Annex 3. ","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). ","GV.RR-2.2","Full"]
[78,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",20,"ECB CROE 2.1.2.2-20","The Board and senior management should ensure that staff (including senior management) who are responsible for cyber activities have suitable skills, knowledge and experience, and are sufficiently informed and empowered to make timely decisions. ","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","PR.AT-2.2","Full"]
[79,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",20,"ECB CROE 2.1.2.2-20","The Board and senior management should ensure that staff (including senior management) who are responsible for cyber activities have suitable skills, knowledge and experience, and are sufficiently informed and empowered to make timely decisions. ","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[80,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",21,"ECB CROE 2.1.2.2-21","The Board and senior management should ensure that cyber risk, implementation of the cyber resilience framework and any associated issues appear regularly on the Board’s meeting agenda. Boards should have adequate access to cybersecurity expertise (whether internal or external), and discussions about cyber risk management should be given adequate time on the Board’s meeting agenda. ","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[81,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",21,"ECB CROE 2.1.2.2-21","The Board and senior management should ensure that cyber risk, implementation of the cyber resilience framework and any associated issues appear regularly on the Board’s meeting agenda. Boards should have adequate access to cybersecurity expertise (whether internal or external), and discussions about cyber risk management should be given adequate time on the Board’s meeting agenda. ","GV.IR-3.1: An independent risk management function reports to the appropriate governing authority (e.g., the Board or one of its committees) and to the appropriate risk management officer within the organization on the implementation of the cyber risk management framework throughout the organization.","GV.IR-3.1","Full"]
[82,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",22,"ECB CROE 2.1.2.2-22","Senior management should regularly provide a written report to the Board on the overall status of its cyber resilience programme and keys risks and issues. ","GV.RR-2.3: The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.  ","GV.RR-2.3","Full"]
[83,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Board and management responsibilities",23,"ECB CROE 2.1.2.2-23","As part of the Board’s updates, senior management should provide their budgeting and forecasting activities plan for ongoing and future resource needs to ensure cyber resilience objectives are continually achieved. ","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","GV.SF-3.3","Full"]
[84,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Culture",24,"ECB CROE 2.1.2.2-24","The Board and senior management should cultivate a strong level of awareness of and commitment to cyber resilience. To that end, an FMI’s Board and senior management should promote a culture that recognises that staff at all levels have important responsibilities for ensuring the FMI’s cyber resilience, and lead by example. ","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[85,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Culture",25,"ECB CROE 2.1.2.2-25","The Board and senior management should ensure that behavioural and cultural change is nurtured and conveyed through leadership and vision, with clear and effective messages such as cyber resilience is everyone’s duty. This could be executed throughout the FMI, possibly built into charters, vision statements and mandates from senior management, or through cyber awareness campaigns. ","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ","PR.AT-1.2","Full"]
[86,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Culture",26,"ECB CROE 2.1.2.2-26","Senior management should ensure that situational awareness materials are made available to relevant employees when prompted by highly visible cyber incidents, changes to the threat landscape and the impacts of these threats to the FMI, or by regulatory alerts. For example, the FMI could send internal emails about cyber events or post articles on its intranet site. ","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","PR.AT-2.2","Full"]
[87,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",27,"ECB CROE 2.1.2.2-27","Senior management should ensure that it has a programme for continuing cyber resilience training and skills development for all staff. This training programme should include the Board members and senior management and should be conducted at least annually. The annual cyber resilience training should include incident response, current cyber threats (e.g. threats, threat actors and vulnerabilities), tactics and techniques (e.g. phishing, spear phishing, social engineering and mobile security) and emerging issues, according to staff members’ levels of responsibility and the risks associated with their respective roles. ","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","PR.AT-1.3","Full"]
[88,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",27,"ECB CROE 2.1.2.2-27","Senior management should ensure that it has a programme for continuing cyber resilience training and skills development for all staff. This training programme should include the Board members and senior management and should be conducted at least annually. The annual cyber resilience training should include incident response, current cyber threats (e.g. threats, threat actors and vulnerabilities), tactics and techniques (e.g. phishing, spear phishing, social engineering and mobile security) and emerging issues, according to staff members’ levels of responsibility and the risks associated with their respective roles. ","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","PR.AT-2.3","Full"]
[89,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",27,"ECB CROE 2.1.2.2-27","Senior management should ensure that it has a programme for continuing cyber resilience training and skills development for all staff. This training programme should include the Board members and senior management and should be conducted at least annually. The annual cyber resilience training should include incident response, current cyber threats (e.g. threats, threat actors and vulnerabilities), tactics and techniques (e.g. phishing, spear phishing, social engineering and mobile security) and emerging issues, according to staff members’ levels of responsibility and the risks associated with their respective roles. ","PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","PR.AT-4.1","Full"]
[90,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",28,"ECB CROE 2.1.2.2-28","Senior management should ensure that employees and contractors with privileged account permissions and/or access to sensitive assets and information, receive additional cyber resilience training commensurate with their levels of responsibility, and that business units are provided with cyber resilience training relevant to their criticality to the business. ","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[91,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",29,"ECB CROE 2.1.2.2-29","In order to implement the cyber resilience strategy and framework, senior management should ensure that it identifies the competencies, skills and resources required. Senior management could adopt well-known skills frameworks, such as the European e-Competence Framework (e-CF) or the Skills Framework for the Information Age (SFIA) to determine its organisational needs. ","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Partial"]
[92,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",29,"ECB CROE 2.1.2.2-29","In order to implement the cyber resilience strategy and framework, senior management should ensure that it identifies the competencies, skills and resources required. Senior management could adopt well-known skills frameworks, such as the European e-Competence Framework (e-CF) or the Skills Framework for the Information Age (SFIA) to determine its organisational needs. ","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). ","GV.RR-2.2","Partial"]
[93,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",30,"ECB CROE 2.1.2.2-30","Senior management should continuously review the skills, competencies and training requirements to ensure that it has the right set of skills as technologies and risks evolve. ","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[94,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",30,"ECB CROE 2.1.2.2-30","Senior management should continuously review the skills, competencies and training requirements to ensure that it has the right set of skills as technologies and risks evolve. ","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","PR.AT-2.2","Full"]
[95,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","EVOLVING","Skills and accountability",30,"ECB CROE 2.1.2.2-30","Senior management should continuously review the skills, competencies and training requirements to ensure that it has the right set of skills as technologies and risks evolve. ","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ","PR.AT-1.2","Full"]
[96,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Board and management responsibilities",31,"ECB CROE 2.1.2.2-31","The FMI should ensure that the Board members’ and senior managements’ understanding of their roles and responsibilities with regard to cyber resilience is regularly assessed, including their knowledge of cyber risks. ","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","PR.AT-2.3","Full"]
[97,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Board and management responsibilities",32,"ECB CROE 2.1.2.2-32","The Board should ensure that senior management regularly conducts a cyber resilience self-assessment5, which evaluates the FMI’s cyber maturity. The Board should review the self-assessment and take appropriate decisions to improve the effectiveness of cyber activities and integration with the corporate strategy across the FMI. ","GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","GV.IR-2.2","Full"]
[98,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Board and management responsibilities",33,"ECB CROE 2.1.2.2-33","The Board should review and approve senior management's prioritisation and resource allocation decisions based on the results of the cyber (self-) assessments, performance against key performance indicators (KPIs) and their evolution against their target state of maturity, and the FMI's overall business objectives. ","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[99,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Board and management responsibilities",33,"ECB CROE 2.1.2.2-33","The Board should review and approve senior management's prioritisation and resource allocation decisions based on the results of the cyber (self-) assessments, performance against key performance indicators (KPIs) and their evolution against their target state of maturity, and the FMI's overall business objectives. ","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[100,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",34,"ECB CROE 2.1.2.2-34","Senior management should establish and sustain incentives (e.g. staff recognition awards) to ensure behaviours are consistent with the intended cyber risk culture. ","GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","GV.PL-1.2","Full"]
[101,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",34,"ECB CROE 2.1.2.2-34","Senior management should establish and sustain incentives (e.g. staff recognition awards) to ensure behaviours are consistent with the intended cyber risk culture. ","PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example.","PR.AT-4.1","Full"]
[102,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",35,"ECB CROE 2.1.2.2-35","Senior management should produce a formal cyber Code of Conduct, which can be incorporated into the FMI’s enterprise Code of Conduct, and ensure that all employees comply with it. ","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","GV.SF-1.2","Full"]
[103,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",35,"ECB CROE 2.1.2.2-35","Senior management should produce a formal cyber Code of Conduct, which can be incorporated into the FMI’s enterprise Code of Conduct, and ensure that all employees comply with it. ","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[104,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",35,"ECB CROE 2.1.2.2-35","Senior management should produce a formal cyber Code of Conduct, which can be incorporated into the FMI’s enterprise Code of Conduct, and ensure that all employees comply with it. ","GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","GV.PL-1.2","Full"]
[105,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",35,"ECB CROE 2.1.2.2-35","Senior management should produce a formal cyber Code of Conduct, which can be incorporated into the FMI’s enterprise Code of Conduct, and ensure that all employees comply with it. ","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[106,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",36,"ECB CROE 2.1.2.2-36","Senior management should validate the effectiveness of its cyber resilience training programme (e.g. social engineering or phishing tests) and assess whether training and awareness programmes positively influence behaviour. Based on the lessons learned from its training programme, the FMI should improve the employee awareness programmes. ","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","PR.AT-2.3","Full"]
[107,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",36,"ECB CROE 2.1.2.2-36","Senior management should validate the effectiveness of its cyber resilience training programme (e.g. social engineering or phishing tests) and assess whether training and awareness programmes positively influence behaviour. Based on the lessons learned from its training programme, the FMI should improve the employee awareness programmes. ","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","PR.AT-1.3","Full"]
[108,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Culture",37,"ECB CROE 2.1.2.2-37","Senior management should develop key performance metrics (e.g. KPIs) and key risk metrics (e.g. key risk indicators (KRIs)) and markers (both quantitative and qualitative) and ensure supporting data are routinely collected at the senior management level to monitor, measure and report on the implementation, effectiveness, consistency and persistence of cyber activities. ","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. ","GV.SP-2.1","Full"]
[109,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Skills and accountability",38,"ECB CROE 2.1.2.2-38","Senior management should embed a programme for talent recruitment, retention and succession planning for the staff, and ensure such staff are aligned to cyber activities and deployed effectively across the FMI. ","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[110,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Skills and accountability",38,"ECB CROE 2.1.2.2-38","Senior management should embed a programme for talent recruitment, retention and succession planning for the staff, and ensure such staff are aligned to cyber activities and deployed effectively across the FMI. ","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","GV.SF-3.3","Full"]
[111,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Skills and accountability",39,"ECB CROE 2.1.2.2-39","Senior management should ensure that there are well-defined plans for the succession of high-risk staff (e.g. senior management, system administrators, software developers and critical system operators, etc.), and the recruitment requirements for key cyber roles include suitable cyber skills, knowledge and experience in alignment with defined succession plans. ","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[112,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Skills and accountability",39,"ECB CROE 2.1.2.2-39","Senior management should ensure that there are well-defined plans for the succession of high-risk staff (e.g. senior management, system administrators, software developers and critical system operators, etc.), and the recruitment requirements for key cyber roles include suitable cyber skills, knowledge and experience in alignment with defined succession plans. ","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","GV.SF-3.3","Full"]
[113,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","ADVANCING","Skills and accountability",40,"ECB CROE 2.1.2.2-40","Senior management should ensure that staff performance plans are tied to compliance with cyber resilience policies and standards in order to hold employees accountable. ","GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","GV.PL-1.2","Full"]
[114,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Board and management responsibilities",41,"ECB CROE 2.1.2.2-41","The FMI should appoint a dedicated cyber expert to the Board.","PR.AT-4.2: Where the organization's governing authority (e.g., the Board or one of its committees) does not have adequate cybersecurity expertise, they should have direct access to the senior officer responsible for cybersecurity to discuss cybersecurity related matters.","PR.AT-4.2","Partial"]
[115,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Board and management responsibilities",42,"ECB CROE 2.1.2.2-42","The standard Board meeting package should include reports and metrics that cover areas such as suspicious cybersecurity events (e.g. increased network behaviour and unusual user activity), cyber incidents and threat intelligence trends for the ecosystem to facilitate discussions on how the FMI should respond accordingly. ","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[116,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Board and management responsibilities",43,"ECB CROE 2.1.2.2-43","The Board and senior management should proactively enhance its strategic goals, objectives and tactical plans, as needed, to support cyber activities and improvements across the ecosystem, making use of any available sector-defined requirements and coordinated initiatives, and clearly communicate this to the relevant stakeholders. ","DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector.","DM.RS-1.2","Full"]
[117,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Board and management responsibilities",43,"ECB CROE 2.1.2.2-43","The Board and senior management should proactively enhance its strategic goals, objectives and tactical plans, as needed, to support cyber activities and improvements across the ecosystem, making use of any available sector-defined requirements and coordinated initiatives, and clearly communicate this to the relevant stakeholders. ","DM.BE-1.1: The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector.  ","DM.BE-1.1","Full"]
[118,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Board and management responsibilities",43,"ECB CROE 2.1.2.2-43","The Board and senior management should proactively enhance its strategic goals, objectives and tactical plans, as needed, to support cyber activities and improvements across the ecosystem, making use of any available sector-defined requirements and coordinated initiatives, and clearly communicate this to the relevant stakeholders. ","DM.BE-2.1: The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders.","DM.BE-2.1","Full"]
[119,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Culture",44,"ECB CROE 2.1.2.2-44","Senior management should cooperate proactively with other stakeholders to promote a cyber resilience culture across the ecosystem. ","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","ID.RA-2.1","Full"]
[120,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Skills and accountability",45,"ECB CROE 2.1.2.2-45","Senior management should regularly benchmark its cyber resilience capabilities against the market to identify its gaps in terms of governance, skills, resources and tools, treating these gaps as cyber risks and addressing them accordingly. ","GV.SP-2.3: The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","GV.SP-2.3","Full"]
[121,2.1,"Governance","2.1.2.2 Role of the Board and senior management","2.1.2.2","INNOVATING","Skills and accountability",46,"ECB CROE 2.1.2.2-46","Senior management should actively foster partnerships with industry associations and cybersecurity practitioners to develop solutions for future cyber resilience needs, which will be useful to the FMI and the ecosystem as a whole. ","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1","Full"]
[122,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,1,"ECB CROE 2.2.2-1","The FMI should identify and document all its critical functions, key roles, processes and information assets that support those functions, and update this information on a regular basis. ","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","ID.AM-3.1","Full"]
[123,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,1,"ECB CROE 2.2.2-1","The FMI should identify and document all its critical functions, key roles, processes and information assets that support those functions, and update this information on a regular basis. ","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","ID.AM-5.2","Full"]
[124,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,2,"ECB CROE 2.2.2-2","The FMI should identify and document all processes that are dependent on third-party service providers and identify its interconnections, and update this information on a regular basis. ","ID.AM-4.1: The organization maintains an inventory of external information systems. ","ID.AM-4.1","Full"]
[125,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,2,"ECB CROE 2.2.2-2","The FMI should identify and document all processes that are dependent on third-party service providers and identify its interconnections, and update this information on a regular basis. ","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","DM.ED-5.2","Full"]
[126,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,3,"ECB CROE 2.2.2-3","The FMI should maintain an up-to-date inventory of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections. It should integrate identification efforts with other relevant processes, such as acquisition and change management, in order to facilitate a regular review of its inventory. ","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","ID.AM-3.1","Full"]
[127,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,3,"ECB CROE 2.2.2-3","The FMI should maintain an up-to-date inventory of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections. It should integrate identification efforts with other relevant processes, such as acquisition and change management, in order to facilitate a regular review of its inventory. ","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","DM.ED-5.2","Full"]
[128,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,3,"ECB CROE 2.2.2-3","The FMI should maintain an up-to-date inventory of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections. It should integrate identification efforts with other relevant processes, such as acquisition and change management, in order to facilitate a regular review of its inventory. ","ID.AM-4.1: The organization maintains an inventory of external information systems. ","ID.AM-4.1","Full"]
[129,2.2000000000000002,"Identification","2.2.2 Expectations",{"$f":"LEFT(D136,FIND(\" \",D136)-1)","v":"2.2.2"},"EVOLVING",null,3,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E136,\"-\",H136)","v":"ECB CROE 2.2.2-3"},"The FMI should maintain an up-to-date inventory of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections. It should integrate identification efforts with other relevant processes, such as acquisition and change management, in order to facilitate a regular review of its inventory. ","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.",{"$f":"LEFT(K136,FIND(\":\",K136)-1)","v":"ID.AM-3.3"},"Full"]
[130,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,3,"ECB CROE 2.2.2-3","The FMI should maintain an up-to-date inventory of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections. It should integrate identification efforts with other relevant processes, such as acquisition and change management, in order to facilitate a regular review of its inventory. ","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","ID.AM-6.1","Full"]
[131,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,4,"ECB CROE 2.2.2-4","The FMI should have an enterprise risk management framework to identify risks and conduct risk assessments on a regular basis and of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections to determine, classify and document their level of criticality. ","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[132,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,4,"ECB CROE 2.2.2-4","The FMI should have an enterprise risk management framework to identify risks and conduct risk assessments on a regular basis and of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections to determine, classify and document their level of criticality. ","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","ID.AM-5.2","Full"]
[133,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,4,"ECB CROE 2.2.2-4","The FMI should have an enterprise risk management framework to identify risks and conduct risk assessments on a regular basis and of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections to determine, classify and document their level of criticality. ","ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units. ","ID.RA-6.2","Full"]
[134,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,4,"ECB CROE 2.2.2-4","The FMI should have an enterprise risk management framework to identify risks and conduct risk assessments on a regular basis and of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections to determine, classify and document their level of criticality. ","DM.ED-5.3: The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.","DM.ED-5.3","Full"]
[135,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,4,"ECB CROE 2.2.2-4","The FMI should have an enterprise risk management framework to identify risks and conduct risk assessments on a regular basis and of all the critical functions, key roles, processes, information assets, third-party service providers and interconnections to determine, classify and document their level of criticality. ","DM.ED-5.4: The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","DM.ED-5.4","Full"]
[136,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,5,"ECB CROE 2.2.2-5","The FMI should create and maintain a simplified network map of network resources with an associated plan addressing IPs which locate routing and security devices and servers supporting the FMI's critical functions, and which identify links with the outside world. ","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","ID.AM-3.3","Full"]
[137,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,6,"ECB CROE 2.2.2-6","The FMI should conduct risk assessments before deploying new and/or updated technologies, products, services and connections to identify potential threats and vulnerabilities. It should also update its risk assessment in case new information affecting cybersecurity risks is identified (e.g. a new threat, vulnerability, adverse test result, hardware change, software change or configuration change). The results of the risk assessments should feed into the cyber resilience strategy and framework. ","GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.RM-1.3","Full"]
[138,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,6,"ECB CROE 2.2.2-6","The FMI should conduct risk assessments before deploying new and/or updated technologies, products, services and connections to identify potential threats and vulnerabilities. It should also update its risk assessment in case new information affecting cybersecurity risks is identified (e.g. a new threat, vulnerability, adverse test result, hardware change, software change or configuration change). The results of the risk assessments should feed into the cyber resilience strategy and framework. ","GV.TE-1.1: The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception.","GV.TE-1.1","Full"]
[139,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,6,"ECB CROE 2.2.2-6","The FMI should conduct risk assessments before deploying new and/or updated technologies, products, services and connections to identify potential threats and vulnerabilities. It should also update its risk assessment in case new information affecting cybersecurity risks is identified (e.g. a new threat, vulnerability, adverse test result, hardware change, software change or configuration change). The results of the risk assessments should feed into the cyber resilience strategy and framework. ","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","ID.RA-1.1","Full"]
[140,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,7,"ECB CROE 2.2.2-7","The FMI should have and maintain a fully comprehensive inventory of all individual and system accounts (especially including privileged and remote access accounts) so that they can be aware of the access rights to information assets and their supporting systems. The FMI should review and update this inventory on a regular basis. ","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[141,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","EVOLVING",null,7,"ECB CROE 2.2.2-7","The FMI should have and maintain a fully comprehensive inventory of all individual and system accounts (especially including privileged and remote access accounts) so that they can be aware of the access rights to information assets and their supporting systems. The FMI should review and update this inventory on a regular basis. ","PR.AC-4.3: The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use.","PR.AC-4.3","Full"]
[142,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,8,"ECB CROE 2.2.2-8","The FMI should use automated tools (e.g. a centralised asset inventory management (AIM) tool) that enable it to support the identification and classification of the critical functions, processes, information assets and interconnections. The FMI should ensure that the inventory is updated accurately and that these changes are shared with the relevant staff in in a timely manner. ","ID.AM-1.1: The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","ID.AM-1.1","Full"]
[143,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,8,"ECB CROE 2.2.2-8","The FMI should use automated tools (e.g. a centralised asset inventory management (AIM) tool) that enable it to support the identification and classification of the critical functions, processes, information assets and interconnections. The FMI should ensure that the inventory is updated accurately and that these changes are shared with the relevant staff in in a timely manner. ","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","ID.AM-5.2","Full"]
[144,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,8,"ECB CROE 2.2.2-8","The FMI should use automated tools (e.g. a centralised asset inventory management (AIM) tool) that enable it to support the identification and classification of the critical functions, processes, information assets and interconnections. The FMI should ensure that the inventory is updated accurately and that these changes are shared with the relevant staff in in a timely manner. ","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","DM.RS-2.2","Full"]
[145,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,9,"ECB CROE 2.2.2-9","The FMI should use automated tools (e.g. a centralised identity and access management (IAM) tool) that enable it to support the identification and classification process of roles, user profiles and individual and system credentials, and ensure that these are updated accurately and that relevant staff are informed of the changes in a timely manner. ","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[146,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,10,"ECB CROE 2.2.2-10","The FMI should also maintain up-to-date and complete maps of network resources, interconnections and dependencies, and data flows with other information assets, including the connections to business partners, internet-facing services, cloud services and any other third-party systems. It should use these maps to undertake risk assessments of key dependencies and apply appropriate risk controls, when necessary. ","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","ID.AM-3.3","Full"]
[147,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,10,"ECB CROE 2.2.2-10","The FMI should also maintain up-to-date and complete maps of network resources, interconnections and dependencies, and data flows with other information assets, including the connections to business partners, internet-facing services, cloud services and any other third-party systems. It should use these maps to undertake risk assessments of key dependencies and apply appropriate risk controls, when necessary. ","DM.ED-5.1: The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","DM.ED-5.1","Full"]
[148,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,10,"ECB CROE 2.2.2-10","The FMI should also maintain up-to-date and complete maps of network resources, interconnections and dependencies, and data flows with other information assets, including the connections to business partners, internet-facing services, cloud services and any other third-party systems. It should use these maps to undertake risk assessments of key dependencies and apply appropriate risk controls, when necessary. ","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","DM.ED-5.2","Full"]
[149,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,10,"ECB CROE 2.2.2-10","The FMI should also maintain up-to-date and complete maps of network resources, interconnections and dependencies, and data flows with other information assets, including the connections to business partners, internet-facing services, cloud services and any other third-party systems. It should use these maps to undertake risk assessments of key dependencies and apply appropriate risk controls, when necessary. ","DM.ED-5.3: The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality.","DM.ED-5.3","Full"]
[150,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,10,"ECB CROE 2.2.2-10","The FMI should also maintain up-to-date and complete maps of network resources, interconnections and dependencies, and data flows with other information assets, including the connections to business partners, internet-facing services, cloud services and any other third-party systems. It should use these maps to undertake risk assessments of key dependencies and apply appropriate risk controls, when necessary. ","DM.ED-5.4: The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","DM.ED-5.4","Full"]
[151,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,11,"ECB CROE 2.2.2-11","The FMI should update its inventory to address new, relocated, repurposed and sunset information assets, on a regular basis or when these changes occur. ","ID.RA-5.5: The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","ID.RA-5.5","Full"]
[152,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","ADVANCING",null,11,"ECB CROE 2.2.2-11","The FMI should update its inventory to address new, relocated, repurposed and sunset information assets, on a regular basis or when these changes occur. ","PR.DS-3.1: The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","PR.DS-3.1","Full"]
[153,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","INNOVATING",null,12,"ECB CROE 2.2.2-12","The FMI should use automated feeds from above (e.g. from AIM and IAM tools), in order to identify emerging risks, update its risk assessments in a timely manner and take the necessary mitigating actions in line with the FMI’s risk tolerance. ","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","DE.AE-2.1","Full"]
[154,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","INNOVATING",null,12,"ECB CROE 2.2.2-12","The FMI should use automated feeds from above (e.g. from AIM and IAM tools), in order to identify emerging risks, update its risk assessments in a timely manner and take the necessary mitigating actions in line with the FMI’s risk tolerance. ","DE.AE-3.1: The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","DE.AE-3.1","Full"]
[155,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","INNOVATING",null,12,"ECB CROE 2.2.2-12","The FMI should use automated feeds from above (e.g. from AIM and IAM tools), in order to identify emerging risks, update its risk assessments in a timely manner and take the necessary mitigating actions in line with the FMI’s risk tolerance. ","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","DE.DP-5.1","Full"]
[156,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","INNOVATING",null,12,"ECB CROE 2.2.2-12","The FMI should use automated feeds from above (e.g. from AIM and IAM tools), in order to identify emerging risks, update its risk assessments in a timely manner and take the necessary mitigating actions in line with the FMI’s risk tolerance. ","GV.RM-3.2: The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.","GV.RM-3.2","Full"]
[157,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","INNOVATING",null,13,"ECB CROE 2.2.2-13","The FMI should identify the cyber risks that it bears from or poses to entities in its ecosystem and coordinate with relevant entities, as appropriate. This may involve identifying common vulnerabilities and threats, and taking appropriate measures collectively to address such risks, with the objective of improving the ecosystem’s overall resilience. ","GV.SF-1.4: The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry.","GV.SF-1.4","Full"]
[158,2.2000000000000002,"Identification","2.2.2 Expectations","2.2.2","INNOVATING",null,13,"ECB CROE 2.2.2-13","The FMI should identify the cyber risks that it bears from or poses to entities in its ecosystem and coordinate with relevant entities, as appropriate. This may involve identifying common vulnerabilities and threats, and taking appropriate measures collectively to address such risks, with the objective of improving the ecosystem’s overall resilience. ","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[159,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",1,"ECB CROE 2.3.2.1-1","The FMI should implement a comprehensive and appropriate set of security controls that will allow it to achieve the security objectives needed to meet its business requirements. The FMI should implement these controls based on the identification of its critical functions, key roles, processes, information assets, third-party service providers and interconnections, as per the risk assessment in the identification phase. The security objectives may include ensuring: ","GV.PL-2.1: The cybersecurity policy is supported by the organization's risk management program.","GV.PL-2.1","Full"]
[160,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design","1.a","ECB CROE 2.3.2.1-1.a","(a) the continuity and availability of its information systems;","PR.DS-4.1: The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment.","PR.DS-4.1","Full"]
[161,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design","1.b","ECB CROE 2.3.2.1-1.b","(b) the integrity of the information stored in its information systems, while both in use and transit; ","PR.DS-1.1: Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","PR.DS-1.1","Full"]
[162,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design","1.b","ECB CROE 2.3.2.1-1.b","(b) the integrity of the information stored in its information systems, while both in use and transit; ","PR.DS-6.1: The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable. ","PR.DS-6.1","Full"]
[163,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design","1.b","ECB CROE 2.3.2.1-1.b","(b) the integrity of the information stored in its information systems, while both in use and transit; ","PR.DS-2.1: Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","PR.DS-2.1","Full"]
[164,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design","1.c","ECB CROE 2.3.2.1-1.c","(c) the protection, integrity, confidentiality and availability of data while at rest, in use and in transit; ","GV.SP-1.1: The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite.","GV.SP-1.1","Full"]
[165,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design","1.d","ECB CROE 2.3.2.1-1.d","(d) conformity to applicable laws, regulation and standards.","GV.PL-3.1: The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations.","GV.PL-3.1","Full"]
[166,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",2,"ECB CROE 2.3.2.1-2","The FMI should develop its security controls in order to address cybersecurity and related physical security and people security. The controls should be designed according to the threat landscape, prioritised in accordance with the risks facing the FMI (risk-based security controls) and aligned to its business objectives. ","GV.RM-1.5: The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls.","GV.RM-1.5","Full"]
[167,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",3,"ECB CROE 2.3.2.1-3","The FMI should assess the effectiveness of its security controls regularly in order to adapt them to its evolving threat landscape. They should be monitored and audited regularly to ensure that they remain effective and have been applied to all assets where they might be needed. ","GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","GV.SP-1.2","Full"]
[168,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",3,"ECB CROE 2.3.2.1-3","The FMI should assess the effectiveness of its security controls regularly in order to adapt them to its evolving threat landscape. They should be monitored and audited regularly to ensure that they remain effective and have been applied to all assets where they might be needed. ","GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","GV.IR-2.2","Full"]
[169,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",4,"ECB CROE 2.3.2.1-4","When designing, developing and acquiring its systems and processes, the FMI should capture security requirements alongside system and process requirements in order to identify the security controls necessary for protecting its systems, processes and data, at the earliest possible stage. ","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Full"]
[170,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",4,"ECB CROE 2.3.2.1-4","When designing, developing and acquiring its systems and processes, the FMI should capture security requirements alongside system and process requirements in order to identify the security controls necessary for protecting its systems, processes and data, at the earliest possible stage. ","PR.IP-2.2: The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications.","PR.IP-2.2","Full"]
[171,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",4,"ECB CROE 2.3.2.1-4","When designing, developing and acquiring its systems and processes, the FMI should capture security requirements alongside system and process requirements in order to identify the security controls necessary for protecting its systems, processes and data, at the earliest possible stage. ","PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment.","PR.IP-2.3","Full"]
[172,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Control implementation and design",5,"ECB CROE 2.3.2.1-5","The FMI should apply a defence-in-depth strategy in line with a risk-based approach, i.e. it should implement multiple independent security controls so that if one control fails or a vulnerability is exploited, alternative controls will be able to protect targeted assets and/or processes. ","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","PR.PT-4.1","Full"]
[173,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Control implementation and design",6,"ECB CROE 2.3.2.1-6","The FMI should develop and implement a bespoke information security management system (ISMS), which could be based on a combination of well-recognised international standards (e.g. ISO 27001, ISO 20000-1 and ISO 27103, etc.), in order to establish, implement, operate, continuously monitor, review, maintain and improve a comprehensive cybersecurity control framework. ","GV.SF-2.1: The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","GV.SF-2.1","Full"]
[174,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Control implementation and design",7,"ECB CROE 2.3.2.1-7","The FMI should consider cyber resilience at the earliest stage of system design, development and acquisition, as well as throughout the system development life cycle, so that vulnerabilities in software and hardware are minimised and security controls are incorporated into systems and processes from their inception. It should adopt a bespoke system development life cycle (SDLC) methodology that embeds the resilience-by-design approach when designing, building, acquiring or modifying its systems, processes and products. At each stage of the SDLC, the FMI should manage its cyber risk and integrate resilience based on risk analysis results. ","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Full"]
[175,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Control implementation and design",7,"ECB CROE 2.3.2.1-7","The FMI should consider cyber resilience at the earliest stage of system design, development and acquisition, as well as throughout the system development life cycle, so that vulnerabilities in software and hardware are minimised and security controls are incorporated into systems and processes from their inception. It should adopt a bespoke system development life cycle (SDLC) methodology that embeds the resilience-by-design approach when designing, building, acquiring or modifying its systems, processes and products. At each stage of the SDLC, the FMI should manage its cyber risk and integrate resilience based on risk analysis results. ","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[176,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Control implementation and design",8,"ECB CROE 2.3.2.1-8","The FMI should frequently review its ISMS, using certification, audits or other relevant forms of assurance. ","GV.AU-1.3: An independent audit function tests security controls and information security policies.","GV.AU-1.3","Full"]
[177,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Control implementation and design",9,"ECB CROE 2.3.2.1-9","The FMI should develop processes and procedures and explore potential technologies to constantly adjust and refine its security countermeasures (controls). This will help it to ensure it is protected against known and emerging threats, based on knowledge and best practices obtained from other FMIs across the ecosystem and through the use of threat intelligence. ","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","GV.SF-3.3","Full"]
[178,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Control implementation and design",9,"ECB CROE 2.3.2.1-9","The FMI should develop processes and procedures and explore potential technologies to constantly adjust and refine its security countermeasures (controls). This will help it to ensure it is protected against known and emerging threats, based on knowledge and best practices obtained from other FMIs across the ecosystem and through the use of threat intelligence. ","GV.PL-2.3: The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.PL-2.3","Full"]
[179,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Control implementation and design",9,"ECB CROE 2.3.2.1-9","The FMI should develop processes and procedures and explore potential technologies to constantly adjust and refine its security countermeasures (controls). This will help it to ensure it is protected against known and emerging threats, based on knowledge and best practices obtained from other FMIs across the ecosystem and through the use of threat intelligence. ","GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","GV.SP-1.2","Full"]
[180,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Control implementation and design",9,"ECB CROE 2.3.2.1-9","The FMI should develop processes and procedures and explore potential technologies to constantly adjust and refine its security countermeasures (controls). This will help it to ensure it is protected against known and emerging threats, based on knowledge and best practices obtained from other FMIs across the ecosystem and through the use of threat intelligence. ","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[181,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",10,"ECB CROE 2.3.2.1-10","The FMI should establish a secure boundary that protects its network infrastructure (using tools such as a router, firewall, intrusion prevention system (IPS) or intrusion detection system (IDS), virtual private network (VPN), demilitarised zone (DMZ) or proxies etc.). The boundary should identify trusted and untrusted zones according to the risk profile and criticality of information assets contained within each zone, and appropriate access requirements should be implemented within and between each security zone according to the principle of least privilege. ","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","PR.PT-4.1","Full"]
[182,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",10,"ECB CROE 2.3.2.1-10","The FMI should establish a secure boundary that protects its network infrastructure (using tools such as a router, firewall, intrusion prevention system (IPS) or intrusion detection system (IDS), virtual private network (VPN), demilitarised zone (DMZ) or proxies etc.). The boundary should identify trusted and untrusted zones according to the risk profile and criticality of information assets contained within each zone, and appropriate access requirements should be implemented within and between each security zone according to the principle of least privilege. ","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","DE.AE-2.1","Full"]
[183,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",10,"ECB CROE 2.3.2.1-10","The FMI should establish a secure boundary that protects its network infrastructure (using tools such as a router, firewall, intrusion prevention system (IPS) or intrusion detection system (IDS), virtual private network (VPN), demilitarised zone (DMZ) or proxies etc.). The boundary should identify trusted and untrusted zones according to the risk profile and criticality of information assets contained within each zone, and appropriate access requirements should be implemented within and between each security zone according to the principle of least privilege. ","PR.AC-5.2: The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","PR.AC-5.2","Full"]
[184,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",11,"ECB CROE 2.3.2.1-11","The FMI should seek to use a separate and dedicated network for information system administration. At a minimum, the FMI should prohibit direct internet access from devices or servers used for information system administration whenever possible. ","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","PR.PT-4.1","Full"]
[185,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",11,"ECB CROE 2.3.2.1-11","The FMI should seek to use a separate and dedicated network for information system administration. At a minimum, the FMI should prohibit direct internet access from devices or servers used for information system administration whenever possible. ","PR.AC-5.2: The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","PR.AC-5.2","Full"]
[186,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",12,"ECB CROE 2.3.2.1-12","The FMI should establish a baseline system and security configurations for information systems and system components, including devices used for accessing the FMI network remotely, to help the configuration to and security reinforcement of those systems and components to be applied consistently. These baselines should be documented, formally reviewed and regularly updated to adapt them to the FMI’s evolving threat landscape. ","PR.IP-1.1: The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","PR.IP-1.1","Full"]
[187,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",13,"ECB CROE 2.3.2.1-13","The FMI should reinforce its network infrastructure and information systems using recognised industry security standards. Changes to system configurations should be strictly controlled and monitored and programmes that can alter or override system configuration should be restricted. This should also be applicable to devices and environments used for accessing the FMI network remotely. ","PR.IP-1.3: The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified.","PR.IP-1.3","Full"]
[188,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",13,"ECB CROE 2.3.2.1-13","The FMI should reinforce its network infrastructure and information systems using recognised industry security standards. Changes to system configurations should be strictly controlled and monitored and programmes that can alter or override system configuration should be restricted. This should also be applicable to devices and environments used for accessing the FMI network remotely. ","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[189,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",13,"ECB CROE 2.3.2.1-13","The FMI should reinforce its network infrastructure and information systems using recognised industry security standards. Changes to system configurations should be strictly controlled and monitored and programmes that can alter or override system configuration should be restricted. This should also be applicable to devices and environments used for accessing the FMI network remotely. ","PR.IP-1.2: The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","PR.IP-1.2","Full"]
[190,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",14,"ECB CROE 2.3.2.1-14","The FMI should seek to use secure network protocols (e.g. Secure Shell and protocols relying on transport layer security (TLS) or equivalent), when appropriate, in order to guarantee the confidentiality and integrity of information exchanged within its network and beyond, including remote connections. ","PR.DS-2.2: Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.  ","PR.DS-2.2","Full"]
[191,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",15,"ECB CROE 2.3.2.1-15","The FMI should define and implement procedures that limit, lock and terminate system and remote sessions after a predefined period of inactivity and predefined conditions are met. ","PR.AC-3.1: Remote access is actively managed and restricted to necessary systems.","PR.AC-3.1","Full"]
[192,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",15,"ECB CROE 2.3.2.1-15","The FMI should define and implement procedures that limit, lock and terminate system and remote sessions after a predefined period of inactivity and predefined conditions are met. ","PR.MA-2.1: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.","PR.MA-2.1","Full"]
[193,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets",{"$f":"LEFT(D200,FIND(\" \",D200)-1)","v":"2.3.2.1"},"EVOLVING","Network and infrastructure management",16,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E200,\"-\",H200)","v":"ECB CROE 2.3.2.1-16"},"The FMI should deploy a broad range of technologies and tools to detect and block actual and attempted attacks or intrusions. The FMI may use intrusion detection or prevention systems, end point security solutions (e.g. antivirus, a firewall, or a host intrusion detection system (HIDS) or host intrusion prevention system (HIPS)) or any other relevant solutions (e.g. an access gateway or a jump box), in particular on devices and in environments used for accessing the FMI network remotely. ","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.",{"$f":"LEFT(K200,FIND(\":\",K200)-1)","v":"DE.AE-2.1"},"Full"]
[194,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",17,"ECB CROE 2.3.2.1-17","The FMI should implement controls that manage or prevent non-controlled devices to connect to its internal network from inside or outside the premises to ensure that activities in these zones are logged and monitored for inappropriate use or attempts to access business systems. The FMI’s infrastructure should be scanned regularly to detect rogue devices and access points. ","PR.AC-5.2: The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks).","PR.AC-5.2","Full"]
[195,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",17,"ECB CROE 2.3.2.1-17","The FMI should implement controls that manage or prevent non-controlled devices to connect to its internal network from inside or outside the premises to ensure that activities in these zones are logged and monitored for inappropriate use or attempts to access business systems. The FMI’s infrastructure should be scanned regularly to detect rogue devices and access points. ","DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","DE.CM-3.1","Full"]
[196,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",17,"ECB CROE 2.3.2.1-17","The FMI should implement controls that manage or prevent non-controlled devices to connect to its internal network from inside or outside the premises to ensure that activities in these zones are logged and monitored for inappropriate use or attempts to access business systems. The FMI’s infrastructure should be scanned regularly to detect rogue devices and access points. ","DE.CM-6.3: The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","DE.CM-6.3","Full"]
[197,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",18,"ECB CROE 2.3.2.1-18","The FMI should scan its legacy technologies regularly to identify potential vulnerabilities and seek upgrade opportunities. Controls and additional defence layers should be implemented and tested in order to protect unsupported or vulnerable systems. ","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","PR.IP-12.1","Partial"]
[198,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Network and infrastructure management",19,"ECB CROE 2.3.2.1-19","The FMI should have policies and controls that prevent users from installing unauthorised applications. Procedures should be in place to manage the installation of applications. ","DE.CM-7.1: The organization implements appropriate controls to prevent use of unsupported and unauthorized software. ","DE.CM-7.1","Full"]
[199,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",20,"ECB CROE 2.3.2.1-20","The FMI should implement a defence-in-depth security architecture, based on the network and data flow diagrams that identify hardware, software and network components, internal and external connections, and type of information exchanged between systems. As required in the identification phase, the FMI should maintain current and complete network and data flow diagrams. ","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","ID.AM-3.3","Full"]
[200,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",20,"ECB CROE 2.3.2.1-20","The FMI should implement a defence-in-depth security architecture, based on the network and data flow diagrams that identify hardware, software and network components, internal and external connections, and type of information exchanged between systems. As required in the identification phase, the FMI should maintain current and complete network and data flow diagrams. ","DE.AE-1.1: The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows. ","DE.AE-1.1","Full"]
[201,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",21,"ECB CROE 2.3.2.1-21","The FMI should segment its network infrastructure with security policies appropriate to its use and commensurate to its risk score, which define proper access policy to systems and applications. Sensitive traffic between systems and zones should be segregated using network management. ","PR.AC-5.1: Networks and systems are segmented to maintain appropriate security.","PR.AC-5.1","Full"]
[202,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",21,"ECB CROE 2.3.2.1-21","The FMI should segment its network infrastructure with security policies appropriate to its use and commensurate to its risk score, which define proper access policy to systems and applications. Sensitive traffic between systems and zones should be segregated using network management. ","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.).","PR.PT-4.1","Full"]
[203,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",22,"ECB CROE 2.3.2.1-22","The FMI’s IT environments and functions should be adequately separated with different security levels and controls implemented. ","PR.AC-5.1: Networks and systems are segmented to maintain appropriate security.","PR.AC-5.1","Full"]
[204,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",22,"ECB CROE 2.3.2.1-22","The FMI’s IT environments and functions should be adequately separated with different security levels and controls implemented. ","PR.DS-7.1: The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment.","PR.DS-7.1","Full"]
[205,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",23,"ECB CROE 2.3.2.1-23","The FMI should implement technical measures to prevent the execution of unauthorised code on institution-owned or managed devices, network infrastructure and system components. ","DE.CM-7.1: The organization implements appropriate controls to prevent use of unsupported and unauthorized software. ","DE.CM-7.1","Full"]
[206,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",24,"ECB CROE 2.3.2.1-24","The FMI should consider implementing technical measures (e.g. network access control (NAC) solutions) in order to prevent unauthorised devices from being connecting successfully. ","DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","DE.CM-3.1","Full"]
[207,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Network and infrastructure management",25,"ECB CROE 2.3.2.1-25","The FMI should employ automated mechanisms to help maintain an up-to-date, complete, accurate and readily available baseline of system and security configurations for the information system and system components. These mechanisms might include hardware and software inventory tools, configuration management tools and network management tools. ","PR.DS-3.1: The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","PR.DS-3.1","Full"]
[208,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Network and infrastructure management",26,"ECB CROE 2.3.2.1-26","The FMI should implement automated mechanisms that can isolate affected information assets in the case of an adverse event. ","PR.PT-5.1: The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","PR.PT-5.1","Full"]
[209,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Network and infrastructure management",26,"ECB CROE 2.3.2.1-26","The FMI should implement automated mechanisms that can isolate affected information assets in the case of an adverse event. ","DE.CM-1.3: The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery. ","DE.CM-1.3","Full"]
[210,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Network and infrastructure management",27,"ECB CROE 2.3.2.1-27","In the context of a defence-in-depth strategy, the FMI should seek to implement cyber deception capabilities and techniques that enable it to lure the attacker and trap it in a controlled environment where all activities can be contained and analysed, allowing the FMI to gain vital threat intelligence that will help to improve its protection controls. ","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[211,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",28,"ECB CROE 2.3.2.1-28","The FMI should identify and restrict physical and logical access to its system resources to the minimum required for legitimate and approved work activities, according to the principle of least privilege. ","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Full"]
[212,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",28,"ECB CROE 2.3.2.1-28","The FMI should identify and restrict physical and logical access to its system resources to the minimum required for legitimate and approved work activities, according to the principle of least privilege. ","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","PR.AC-4.1","Full"]
[213,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",29,"ECB CROE 2.3.2.1-29","The FMI should establish policies, procedures and controls that address access privileges and how that access should be administered. The information system access should be evaluated regularly to identify unneeded access or privileges. Physical, logical and/or remote access to critical systems should be restricted and logged and unauthorised access should be blocked. Administration rights on systems should be strictly limited to operational needs. Procedures should be in place for a periodic review of all access rights. ","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Full"]
[214,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",29,"ECB CROE 2.3.2.1-29","The FMI should establish policies, procedures and controls that address access privileges and how that access should be administered. The information system access should be evaluated regularly to identify unneeded access or privileges. Physical, logical and/or remote access to critical systems should be restricted and logged and unauthorised access should be blocked. Administration rights on systems should be strictly limited to operational needs. Procedures should be in place for a periodic review of all access rights. ","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[215,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",30,"ECB CROE 2.3.2.1-30","The FMI should establish and administer user accounts in accordance with a role-based access control (RBAC) scheme that organises allowed information system access rights and privileges into roles. Role assignments should be reviewed regularly by appropriate staff (e.g. management and system owners, etc.) in order to take appropriate action when privileged role assignments are no longer appropriate. ","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Partial"]
[216,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",30,"ECB CROE 2.3.2.1-30","The FMI should establish and administer user accounts in accordance with a role-based access control (RBAC) scheme that organises allowed information system access rights and privileges into roles. Role assignments should be reviewed regularly by appropriate staff (e.g. management and system owners, etc.) in order to take appropriate action when privileged role assignments are no longer appropriate. ","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. ","PR.AC-4.2","Partial"]
[217,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",30,"ECB CROE 2.3.2.1-30","The FMI should establish and administer user accounts in accordance with a role-based access control (RBAC) scheme that organises allowed information system access rights and privileges into roles. Role assignments should be reviewed regularly by appropriate staff (e.g. management and system owners, etc.) in order to take appropriate action when privileged role assignments are no longer appropriate. ","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","PR.AC-4.1","Partial"]
[218,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",31,"ECB CROE 2.3.2.1-31","The FMI should establish processes to manage the creation, modification or deletion of user access rights. Such actions should be submitted to and approved by appropriate staff, and should be recorded for review if necessary. ","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[219,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",32,"ECB CROE 2.3.2.1-32","The FMI should implement specific procedures to allocate privileged access on a need-to-use or an event-by-event basis. Administrators should have two types of accounts: one for general purpose and one to carry out their administrative tasks. The use of privileged accounts should be tightly monitored and controlled. The use of generic accounts for administration purpose should be strictly limited and traced. Whenever possible, user and administrator accounts should be nominative and clearly identifiable (e.g. using dedicated taxonomy for usernames, which ensures that the positions and roles are not apparent). ","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. ","PR.AC-4.2","Full"]
[220,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",32,"ECB CROE 2.3.2.1-32","The FMI should implement specific procedures to allocate privileged access on a need-to-use or an event-by-event basis. Administrators should have two types of accounts: one for general purpose and one to carry out their administrative tasks. The use of privileged accounts should be tightly monitored and controlled. The use of generic accounts for administration purpose should be strictly limited and traced. Whenever possible, user and administrator accounts should be nominative and clearly identifiable (e.g. using dedicated taxonomy for usernames, which ensures that the positions and roles are not apparent). ","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","PR.AC-4.1","Full"]
[221,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",33,"ECB CROE 2.3.2.1-33","The FMI should have a dedicated policy that covers all the characteristics of its authentication mechanisms (e.g. password, smart cards and biometrics, etc.) and is in line with relevant standards (e.g. NIST-800-63). Default authentication settings (e.g. passwords and unnecessary default accounts) should be deactivated, changed or removed before systems, software and/or services go live. ","PR.AC-7.2: Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","PR.AC-7.2","Full"]
[222,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",33,"ECB CROE 2.3.2.1-33","The FMI should have a dedicated policy that covers all the characteristics of its authentication mechanisms (e.g. password, smart cards and biometrics, etc.) and is in line with relevant standards (e.g. NIST-800-63). Default authentication settings (e.g. passwords and unnecessary default accounts) should be deactivated, changed or removed before systems, software and/or services go live. ","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[223,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",34,"ECB CROE 2.3.2.1-34","The FMI should develop appropriate controls (e.g. encryption, authentication and access control) to protect data at rest, in use and in transit. The controls should be commensurate to the criticality and the sensitivity of the data held, used or being transmitted, as per the risk assessment conducted in the identification phase. ","PR.DS-1.2: Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.  ","PR.DS-1.2","Full"]
[224,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",34,"ECB CROE 2.3.2.1-34","The FMI should develop appropriate controls (e.g. encryption, authentication and access control) to protect data at rest, in use and in transit. The controls should be commensurate to the criticality and the sensitivity of the data held, used or being transmitted, as per the risk assessment conducted in the identification phase. ","PR.DS-1.1: Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","PR.DS-1.1","Full"]
[225,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",34,"ECB CROE 2.3.2.1-34","The FMI should develop appropriate controls (e.g. encryption, authentication and access control) to protect data at rest, in use and in transit. The controls should be commensurate to the criticality and the sensitivity of the data held, used or being transmitted, as per the risk assessment conducted in the identification phase. ","PR.DS-2.2: Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.  ","PR.DS-2.2","Full"]
[226,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",34,"ECB CROE 2.3.2.1-34","The FMI should develop appropriate controls (e.g. encryption, authentication and access control) to protect data at rest, in use and in transit. The controls should be commensurate to the criticality and the sensitivity of the data held, used or being transmitted, as per the risk assessment conducted in the identification phase. ","PR.DS-2.1: Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy.","PR.DS-2.1","Full"]
[227,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",35,"ECB CROE 2.3.2.1-35","The FMI should have dedicated controls to prevent unauthorised access to cryptographic keys. Dedicated policy and procedures should be defined for the management of and access to cryptographic materials. ","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","PR.AC-4.2","Full"]
[228,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Logical and physical security management",35,"ECB CROE 2.3.2.1-35","The FMI should have dedicated controls to prevent unauthorised access to cryptographic keys. Dedicated policy and procedures should be defined for the management of and access to cryptographic materials. ","PR.AC-6.1: The organization authenticates identity and validates the authorization level of a user before granting access to its systems. ","PR.AC-6.1","Full"]
[229,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Logical and physical security management",36,"ECB CROE 2.3.2.1-36","The FMI should implement controls to prevent unauthorised privileged escalation (e.g. technical controls that trigger automated notification to appropriate staff in the case of changes to user access profiles). ","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. ","PR.AC-4.2","Full"]
[230,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Logical and physical security management",36,"ECB CROE 2.3.2.1-36","The FMI should implement controls to prevent unauthorised privileged escalation (e.g. technical controls that trigger automated notification to appropriate staff in the case of changes to user access profiles). ","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[231,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Logical and physical security management",37,"ECB CROE 2.3.2.1-37","The FMI should encrypt data as a result of its data classification and risk assessment processes. The FMI should also use encryption and general cryptographic controls in line with recognised standards and processes, which cover aspects such as algorithm, key length and key generation, etc. ","PR.DS-1.2: Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.  ","PR.DS-1.2","Full"]
[232,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Logical and physical security management",38,"ECB CROE 2.3.2.1-38","The FMI should implement automated mechanisms to support the management of information system access accounts. This might include implementing security controls embedded in the information system, allowing it to automatically disable and/or remove inactive, temporary and emergency accounts after a predefined period of time. ","PR.AC-4.3: The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use.","PR.AC-4.3","Full"]
[233,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Logical and physical security management",39,"ECB CROE 2.3.2.1-39","The FMI should establish strong governance on identity and access management enforced by the use of dedicated tools such as Identity and Access Management (IAM), in an integrated way, ensuring all systems update each other consistently. ","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Full"]
[234,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Logical and physical security management",39,"ECB CROE 2.3.2.1-39","The FMI should establish strong governance on identity and access management enforced by the use of dedicated tools such as Identity and Access Management (IAM), in an integrated way, ensuring all systems update each other consistently. ","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[235,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Logical and physical security management",40,"ECB CROE 2.3.2.1-40","The FMI should seek to use an attribute-based access control (ABAC) paradigm that allows it to manage access to its IT environment contextually and dynamically. ","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements.","PR.AC-4.2","Full"]
[236,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Logical and physical security management",40,"ECB CROE 2.3.2.1-40","The FMI should seek to use an attribute-based access control (ABAC) paradigm that allows it to manage access to its IT environment contextually and dynamically. ","PR.AC-6.1: The organization authenticates identity and validates the authorization level of a user before granting access to its systems.","PR.AC-6.1","Full"]
[237,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Logical and physical security management",41,"ECB CROE 2.3.2.1-41","The FMI should employ automated mechanisms that allow account creation, modification, enabling, disabling and removal actions to be monitored and audited continuously, in order to notify appropriate staff when potential malicious behaviour or damage is detected. The FMI should implement adaptive access controls to prevent potential malicious behaviour or damage. ","DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","DE.CM-3.1","Full"]
[238,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",42,"ECB CROE 2.3.2.1-42","The FMI should have policies, procedures and controls in place for change management, which should include criteria for prioritising and classifying the changes (e.g. normal vs. emergency change). Prior to any change, the FMI should ensure that the change request is:","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[239,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management","42.a","ECB CROE 2.3.2.1-42.a","(a) reviewed to ensure that it meets FMI business needs;","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Full"]
[240,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management","42.b","ECB CROE 2.3.2.1-42.b","(b) categorised and assessed for identifying potential risks and to ensure that it will not negatively impact confidentiality, integrity and availability, as well as the FMI’s systems and data;","PR.AC-7.1: The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm.","PR.AC-7.1","Full"]
[241,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management","42.c","ECB CROE 2.3.2.1-42.c","(c) approved before it is implemented by the appropriate level of management.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Partial"]
[242,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management","42.c","ECB CROE 2.3.2.1-42.c","(c) approved before it is implemented by the appropriate level of management.","GV.TE-1.2: The organization applies its cyber risk management framework to all technology projects.","GV.TE-1.2","Partial"]
[243,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",43,"ECB CROE 2.3.2.1-43","The FMI should ensure that the cybersecurity team is involved throughout the life cycle of the change management process, as appropriate.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[244,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",44,"ECB CROE 2.3.2.1-44","The FMI should put necessary procedures in place (e.g. code review and unit testing, etc.), guaranteeing that changes are implemented correctly and efficiently. The FMI should employ best practices when implementing changes.","PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment.","PR.IP-2.3","Full"]
[245,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",44,"ECB CROE 2.3.2.1-44","The FMI should put necessary procedures in place (e.g. code review and unit testing, etc.), guaranteeing that changes are implemented correctly and efficiently. The FMI should employ best practices when implementing changes.","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[246,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",45,"ECB CROE 2.3.2.1-45","The FMI should test, validate and document changes to the information system before implementing them into production (this might include integration tests, non-regression tests and user acceptance tests, etc.). The changes to information systems include, but are not limited to, modifying hardware, software or firmware components and system and security configuration settings. The FMI should ensure that processes are in place to schedule change implementation and communicate to those impacted prior to implementation, including consulting them when necessary.","PR.DS-7.1: The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment.","PR.DS-7.1","Full"]
[247,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",45,"ECB CROE 2.3.2.1-45","The FMI should test, validate and document changes to the information system before implementing them into production (this might include integration tests, non-regression tests and user acceptance tests, etc.). The changes to information systems include, but are not limited to, modifying hardware, software or firmware components and system and security configuration settings. The FMI should ensure that processes are in place to schedule change implementation and communicate to those impacted prior to implementation, including consulting them when necessary.","PR.DS-8.1: The organization uses integrity checking mechanisms to verify hardware integrity, as practicable.","PR.DS-8.1","Full"]
[248,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",45,"ECB CROE 2.3.2.1-45","The FMI should test, validate and document changes to the information system before implementing them into production (this might include integration tests, non-regression tests and user acceptance tests, etc.). The changes to information systems include, but are not limited to, modifying hardware, software or firmware components and system and security configuration settings. The FMI should ensure that processes are in place to schedule change implementation and communicate to those impacted prior to implementation, including consulting them when necessary.","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Full"]
[249,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",46,"ECB CROE 2.3.2.1-46","The FMI should have processes to identify, assess and approve genuine emergency changes. Post-implementation reviews should be conducted to validate that emergency procedures were appropriately followed and to determine the impact of the emergency change.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[250,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",47,"ECB CROE 2.3.2.1-47","The FMI should have a comprehensive patch management policy and processes that include: maintaining current knowledge of available patches; identifying appropriate patches for particular systems and analysing impacts if installed; assuring that patches are installed properly (e.g. by applying the four-eyes principle) and tested prior to and monitored after installation; and documenting all associated procedures, such as specific configurations required. The policies, procedures and controls must make use of the information AIM process described in the identification phase that provides information on the installed programs and binaries.","PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment.","PR.IP-2.3","Full"]
[251,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",47,"ECB CROE 2.3.2.1-47","The FMI should have a comprehensive patch management policy and processes that include: maintaining current knowledge of available patches; identifying appropriate patches for particular systems and analysing impacts if installed; assuring that patches are installed properly (e.g. by applying the four-eyes principle) and tested prior to and monitored after installation; and documenting all associated procedures, such as specific configurations required. The policies, procedures and controls must make use of the information AIM process described in the identification phase that provides information on the installed programs and binaries.","PR.IP-12.4: The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","PR.IP-12.4","Full"]
[252,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",47,"ECB CROE 2.3.2.1-47","The FMI should have a comprehensive patch management policy and processes that include: maintaining current knowledge of available patches; identifying appropriate patches for particular systems and analysing impacts if installed; assuring that patches are installed properly (e.g. by applying the four-eyes principle) and tested prior to and monitored after installation; and documenting all associated procedures, such as specific configurations required. The policies, procedures and controls must make use of the information AIM process described in the identification phase that provides information on the installed programs and binaries.","DE.CM-5.1: The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.).","DE.CM-5.1","Full"]
[253,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",48,"ECB CROE 2.3.2.1-48","The FMI should consider using standardised configuration of IT resources to facilitate its patch management process.","PR.IP-1.1: The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","PR.IP-1.1","Full"]
[254,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",49,"ECB CROE 2.3.2.1-49","The FMI should ensure that the installations of new patches have prior approval from the appropriate level of management.","PR.IP-12.4: The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","PR.IP-12.4","Full"]
[255,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",50,"ECB CROE 2.3.2.1-50","The FMI should have in place necessary procedures for recovering quickly when changes or patches fail. Any changes to the production environment must have an associated fall-back plan, when applicable.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","PR.IP-4.2","Full"]
[256,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","EVOLVING","Change and patch management",51,"ECB CROE 2.3.2.1-51","The FMI should have policies and procedures to prohibit changes and patch installation to the information system that have not been pre-approved.","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[257,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets",{"$f":"LEFT(D264,FIND(\" \",D264)-1)","v":"2.3.2.1"},"ADVANCING","Change and patch management",52,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E264,\"-\",H264)","v":"ECB CROE 2.3.2.1-52"},"The FMI should establish its change management process based on well-established and industry-recognised standards and best practices (e.g. the information technology infrastructure library).","GV.SF-2.1: The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.",{"$f":"LEFT(K264,FIND(\":\",K264)-1)","v":"GV.SF-2.1"},"Full"]
[258,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Change and patch management",52,"ECB CROE 2.3.2.1-52","The FMI should establish its change management process based on well-established and industry-recognised standards and best practices (e.g. the information technology infrastructure library).","PR.IP-1.1: The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","PR.IP-1.1","Full"]
[259,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Change and patch management",53,"ECB CROE 2.3.2.1-53","The FMI should consider automating its patch management process when possible to guarantee that all its systems remain consistently up to date.","GV.TE-2.1: The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure.","GV.TE-2.1","Full"]
[260,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Change and patch management",54,"ECB CROE 2.3.2.1-54","The FMI should consider building a segregated or separate environment that mirrors the production environment, allowing rapid testing and changes and patches to be implemented, and providing for rapid fall-back when needed.","PR.PT-5.1: The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","PR.PT-5.1","Full"]
[261,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","ADVANCING","Change and patch management",54,"ECB CROE 2.3.2.1-54","The FMI should consider building a segregated or separate environment that mirrors the production environment, allowing rapid testing and changes and patches to be implemented, and providing for rapid fall-back when needed.","PR.DS-7.1: The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment.","PR.DS-7.1","Full"]
[262,2.2999999999999998,"Protection","2.3.2.1 Protection of processes and assets","2.3.2.1","INNOVATING","Change and patch management",55,"ECB CROE 2.3.2.1-55","The FMI should implement automated mechanisms to prohibit changes and patches from being installed on the information system that have not been pre-approved.","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[263,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",56,"ECB CROE 2.3.2.2-56","The FMI should embed cybersecurity at each stage of the employment life cycle, specifying security-related actions required during the induction of each employee and their ongoing management, and upon the termination of their employment.","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","PR.AT-5.1","Full"]
[264,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",56,"ECB CROE 2.3.2.2-56","The FMI should embed cybersecurity at each stage of the employment life cycle, specifying security-related actions required during the induction of each employee and their ongoing management, and upon the termination of their employment.","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[265,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",56,"ECB CROE 2.3.2.2-56","The FMI should embed cybersecurity at each stage of the employment life cycle, specifying security-related actions required during the induction of each employee and their ongoing management, and upon the termination of their employment.","PR.IP-11.3: The organization establishes processes and controls to mitigate cyber risks related to employment termination, as permitted by law.","PR.IP-11.3","Full"]
[266,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security","56.a","ECB CROE 2.3.2.2-56.a","(a) Prior to employment, the FMI should carry out background security checks on all candidates (employees and/or contractors) commensurate to their future role and depending on the criticality of the assets and information they might have access to in order to fulfil their duty. Responsibilities for cybersecurity should be clearly stated in the contractual agreement.","PR.IP-11.1: The organization conducts background/screening checks on all new employees, as permitted by law.","PR.IP-11.1","Full"]
[267,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security","56.b","ECB CROE 2.3.2.2-56.b","(b) During employment, the FMI should ensure that employees and contractors comply with established policies, procedures and controls. When an employee is changing responsibilities, the FMI should ensure that all access rights that are related to his/her previous position and are not necessary for his/her new responsibilities are revoked in due time. Employees in sensitive positions (e.g. those who change to roles requiring privileged access to critical systems or who become high-risk staff) should be pre-screened.","PR.IP-11.2: The organization conducts background/screening checks on all staff at regular intervals throughout their employment, commensurate with staff’s access to critical systems or a change in role, as permitted by law.","PR.IP-11.2","Full"]
[268,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security","56.c","ECB CROE 2.3.2.2-56.c","(c) The FMI should establish procedures to revoke all departing employees’ access rights from the information assets in a timely manner. Upon termination of employment, staff should be required to return all assets that belong to the FMI, including important documentation (e.g. related to business processes, technical procedures and contact details), equipment, software and authentication hardware, etc.","PR.IP-11.3: The organization establishes processes and controls to mitigate cyber risks related to employment termination, as permitted by law.","PR.IP-11.3","Full"]
[269,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",57,"ECB CROE 2.3.2.2-57","The FMI should establish policies, procedures and controls for granting or revoking employees physical and logical access to its systems based on job responsibilities, principles of least privilege and segregation of duties. Procedures for regularly reviewing such access should be in place.","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Full"]
[270,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",57,"ECB CROE 2.3.2.2-57","The FMI should establish policies, procedures and controls for granting or revoking employees physical and logical access to its systems based on job responsibilities, principles of least privilege and segregation of duties. Procedures for regularly reviewing such access should be in place.","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[271,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",57,"ECB CROE 2.3.2.2-57","The FMI should establish policies, procedures and controls for granting or revoking employees physical and logical access to its systems based on job responsibilities, principles of least privilege and segregation of duties. Procedures for regularly reviewing such access should be in place.","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","PR.AC-4.1","Full"]
[272,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",58,"ECB CROE 2.3.2.2-58","The FMI should establish capabilities, including people, processes and technologies to monitor privileged users’ activity and access to critical systems in order to identify and deter anomalous behaviour and notify appropriate staff.","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. ","PR.AC-4.2","Full"]
[273,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Human resources security",58,"ECB CROE 2.3.2.2-58","The FMI should establish capabilities, including people, processes and technologies to monitor privileged users’ activity and access to critical systems in order to identify and deter anomalous behaviour and notify appropriate staff.","DE.CM-3.2: The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","DE.CM-3.2","Full"]
[274,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Human resources security",59,"ECB CROE 2.3.2.2-59","The FMI should implement mechanisms that trigger automatic notifications to be sent to staff in charge of granting or revoking access to the information system upon change to employment status.","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[275,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Human resources security",60,"ECB CROE 2.3.2.2-60","The FMI should implement automatic mechanisms to grant or revoke staff access to its information system upon change to employment status.","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[276,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","INNOVATING","Human resources security",61,"ECB CROE 2.3.2.2-61","The FMI should monitor and analyse pattern behaviour (e.g. network use patterns, work hours and known devices, etc.) to identify anomalous activities and evaluate the implementation of innovative solutions (e.g. data analytics, machine learning and artificial intelligence, etc.) to support detection and response to insider threat activity in real time.","DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","DE.CM-3.1","Full"]
[277,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",62,"ECB CROE 2.3.2.2-62","The FMI should ensure that its employees have a good understanding of the cyber risk they might face when conducting their jobs and that they understand their roles and responsibilities in protecting the FMI’s assets.","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities.","PR.AT-5.1","Full"]
[278,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",62,"ECB CROE 2.3.2.2-62","The FMI should ensure that its employees have a good understanding of the cyber risk they might face when conducting their jobs and that they understand their roles and responsibilities in protecting the FMI’s assets.","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ","PR.AT-1.2","Full"]
[279,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",63,"ECB CROE 2.3.2.2-63","On a regular basis, at least once a year, the FMI should provide its entire staff (employees and/or contractors) with training to support cybersecurity policy compliance and the incident reporting process. This training should include elements aimed at maintaining appropriate awareness of cyber-related risks and good practices for dealing with potential cyber incidents, including how to report unusual activity. Cybersecurity awareness training should be part of the onboarding programme for new staff.","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ","PR.AT-1.2","Full"]
[280,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",63,"ECB CROE 2.3.2.2-63","On a regular basis, at least once a year, the FMI should provide its entire staff (employees and/or contractors) with training to support cybersecurity policy compliance and the incident reporting process. This training should include elements aimed at maintaining appropriate awareness of cyber-related risks and good practices for dealing with potential cyber incidents, including how to report unusual activity. Cybersecurity awareness training should be part of the onboarding programme for new staff.","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[281,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",64,"ECB CROE 2.3.2.2-64","The FMI should ensure that high-risk staff receive dedicated security awareness training that is relevant to their responsibilities.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[282,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",65,"ECB CROE 2.3.2.2-65","Prior to going into service operations, staff operating new systems should receive appropriate user training and be familiar with the operating procedures.","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[283,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",65,"ECB CROE 2.3.2.2-65","Prior to going into service operations, staff operating new systems should receive appropriate user training and be familiar with the operating procedures.","PR.AC-1.2: User access authorization is limited to individuals who are appropriately trained and monitored.","PR.AC-1.2","Full"]
[284,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Security awareness and training",65,"ECB CROE 2.3.2.2-65","Prior to going into service operations, staff operating new systems should receive appropriate user training and be familiar with the operating procedures.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[285,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Security awareness and training",66,"ECB CROE 2.3.2.2-66","The FMI should validate the effectiveness of its training (e.g. social engineering or phishing tests), assess whether the training and awareness positively influence behaviour and ensure that staff comply with the cybersecurity policy and incident reporting process.","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","PR.AT-2.3","Full"]
[286,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Security awareness and training",66,"ECB CROE 2.3.2.2-66","The FMI should validate the effectiveness of its training (e.g. social engineering or phishing tests), assess whether the training and awareness positively influence behaviour and ensure that staff comply with the cybersecurity policy and incident reporting process.","GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","GV.PL-1.2","Full"]
[287,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Security awareness and training",66,"ECB CROE 2.3.2.2-66","The FMI should validate the effectiveness of its training (e.g. social engineering or phishing tests), assess whether the training and awareness positively influence behaviour and ensure that staff comply with the cybersecurity policy and incident reporting process.","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[288,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","INNOVATING","Security awareness and training",67,"ECB CROE 2.3.2.2-67","The FMI’s senior management should ensure its cultural awareness of cyber risk improves continuously across the organisation and its ecosystem. Training programmes should be updated regularly to take the evolving threat landscape of the ecosystem into account.","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","PR.AT-1.3","Full"]
[289,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",68,"ECB CROE 2.3.2.2-68","The FMI should maintain and regularly update an inventory of its participants and third-party service providers, and ensure that its cyber resilience framework addresses its interconnections with the aforementioned entities from a cyber risk perspective.","DM.ED-1.1: The organization has integrated its external dependency management strategy into the overall cyber risk management plan.","DM.ED-1.1","Full"]
[290,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",68,"ECB CROE 2.3.2.2-68","The FMI should maintain and regularly update an inventory of its participants and third-party service providers, and ensure that its cyber resilience framework addresses its interconnections with the aforementioned entities from a cyber risk perspective.","DM.ED-2.5: The organization's dependency management process identifies third-party relationships that are in place, including those relationships that were established without formal approval.","DM.ED-2.5","Full"]
[291,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",68,"ECB CROE 2.3.2.2-68","The FMI should maintain and regularly update an inventory of its participants and third-party service providers, and ensure that its cyber resilience framework addresses its interconnections with the aforementioned entities from a cyber risk perspective.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","DM.ED-5.2","Full"]
[292,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",69,"ECB CROE 2.3.2.2-69","The FMI’s third-party risk assessment should be carried out regularly, taking into account the evolution of its threat landscape. The FMI should, using a risk-based approach, ensure that the provision of outsourced services are accorded the appropriate level of cyber resilience.","DM.ED-4.1: The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees).","DM.ED-4.1","Full"]
[293,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",69,"ECB CROE 2.3.2.2-69","The FMI’s third-party risk assessment should be carried out regularly, taking into account the evolution of its threat landscape. The FMI should, using a risk-based approach, ensure that the provision of outsourced services are accorded the appropriate level of cyber resilience.","DM.ED-4.2: The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate.","DM.ED-4.2","Full"]
[294,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",69,"ECB CROE 2.3.2.2-69","The FMI’s third-party risk assessment should be carried out regularly, taking into account the evolution of its threat landscape. The FMI should, using a risk-based approach, ensure that the provision of outsourced services are accorded the appropriate level of cyber resilience.","DM.ED-4.3: The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","DM.ED-4.3","Full"]
[295,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",70,"ECB CROE 2.3.2.2-70","The FMI should assess the third-party service provider’s security capabilities at least through third-party self-assessment (e.g. self-assessment against Annex F7). Provision of settlement services to ancillary systems by overseen entities is not considered to be third-party service provision.","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.","DM.ED-7.1","Full"]
[296,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","EVOLVING","Supplier and third-party security management",70,"ECB CROE 2.3.2.2-70","The FMI should assess the third-party service provider’s security capabilities at least through third-party self-assessment (e.g. self-assessment against Annex F7). Provision of settlement services to ancillary systems by overseen entities is not considered to be third-party service provision.","DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented.","DM.ED-7.2","Full"]
[297,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Supplier and third-party security management",71,"ECB CROE 2.3.2.2-71","The FMI should design security controls that detect and prevent intrusions from third-party connections.","DE.CM-6.1: The organization authorizes and monitors all third-party connections.","DE.CM-6.1","Full"]
[298,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Supplier and third-party security management",71,"ECB CROE 2.3.2.2-71","The FMI should design security controls that detect and prevent intrusions from third-party connections.","DE.CM-6.3: The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","DE.CM-6.3","Full"]
[299,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Supplier and third-party security management",71,"ECB CROE 2.3.2.2-71","The FMI should design security controls that detect and prevent intrusions from third-party connections.","DE.CM-6.2: The organization collaborates with third-party service providers to maintain and improve the security of external connections.","DE.CM-6.2","Full"]
[300,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Supplier and third-party security management",72,"ECB CROE 2.3.2.2-72","The FMI should ensure that there are appropriate procedures in place to isolate or block its third-party connections (in a timely manner) if there is a cyber attack and/or a risk of contagion.","RS.MI-1.2: The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate.","RS.MI-1.2","Full"]
[301,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Supplier and third-party security management",73,"ECB CROE 2.3.2.2-73","The independent audit function should validate the FMI’s third-party relationship management and outsourcing.","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps.","GV.AU-3.1","Full"]
[302,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Supplier and third-party security management",73,"ECB CROE 2.3.2.2-73","The independent audit function should validate the FMI’s third-party relationship management and outsourcing.","DM.ED-3.2: Responsibilities for ongoing independent oversight (external) of third-party access are defined and assigned.","DM.ED-3.2","Full"]
[303,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","ADVANCING","Supplier and third-party security management",74,"ECB CROE 2.3.2.2-74","The FMI should obtain assurance of the third-party service provider’s cyber resilience capabilities, and may use tools such as certification, external audits (e.g. ISAE 3402), summaries of test reports, service level agreements (SLAs) and KPIs, etc.","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.","DM.ED-7.1","Full"]
[304,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","INNOVATING","Supplier and third-party security management",75,"ECB CROE 2.3.2.2-75","The FMI should work closely with its third-party service providers and other FMIs in the ecosystem to maintain and improve the security of interconnections and end point security. For example, the FMI could conduct response and recovery tests with its third-party service providers and other FMIs.","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","DE.DP-4.2","Full"]
[305,2.2999999999999998,"Protection","2.3.2.2 People management","2.3.2.2","INNOVATING","Supplier and third-party security management",75,"ECB CROE 2.3.2.2-75","The FMI should work closely with its third-party service providers and other FMIs in the ecosystem to maintain and improve the security of interconnections and end point security. For example, the FMI could conduct response and recovery tests with its third-party service providers and other FMIs.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[306,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,1,"ECB CROE 2.4.2-1","Based on the risk assessment performed in the identification phase, the FMI should define, consider and document the baseline profile of system activities to help detect deviation from the baseline (e.g. anomalous activities and events).","DE.AE-1.1: The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows. ","DE.AE-1.1","Full"]
[307,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,2,"ECB CROE 2.4.2-2","The FMI should develop the appropriate capabilities, including the people, processes and technology, to monitor and detect anomalous activities and events, by setting appropriate criteria, parameters and triggers to enable alerts.","DE.AE-3.1: The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","DE.AE-3.1","Full"]
[308,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,2,"ECB CROE 2.4.2-2","The FMI should develop the appropriate capabilities, including the people, processes and technology, to monitor and detect anomalous activities and events, by setting appropriate criteria, parameters and triggers to enable alerts.","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[309,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,2,"ECB CROE 2.4.2-2","The FMI should develop the appropriate capabilities, including the people, processes and technology, to monitor and detect anomalous activities and events, by setting appropriate criteria, parameters and triggers to enable alerts.","DE.CM-2.1: The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.","DE.CM-2.1","Full"]
[310,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,3,"ECB CROE 2.4.2-3","The FMI should have capabilities in place to monitor user activity, exceptions and cybersecurity events.","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[311,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,4,"ECB CROE 2.4.2-4","The FMI should have capabilities in place to monitor connections, external service providers, devices and software.","DE.CM-6.1: The organization authorizes and monitors all third-party connections.","DE.CM-6.1","Full"]
[312,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,4,"ECB CROE 2.4.2-4","The FMI should have capabilities in place to monitor connections, external service providers, devices and software.","DE.CM-7.2: The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers.","DE.CM-7.2","Full"]
[313,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,5,"ECB CROE 2.4.2-5","The FMI should analyse the information collected and use it to further enhance its detection and monitoring capabilities and incident response process.","RS.AN-1.1: Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","RS.AN-1.1","Full"]
[314,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,5,"ECB CROE 2.4.2-5","The FMI should analyse the information collected and use it to further enhance its detection and monitoring capabilities and incident response process.","DE.AE-3.1: The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","DE.AE-3.1","Full"]
[315,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,5,"ECB CROE 2.4.2-5","The FMI should analyse the information collected and use it to further enhance its detection and monitoring capabilities and incident response process.","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[316,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,6,"ECB CROE 2.4.2-6","The FMI should ensure that its detection capabilities, baseline profile of system activities and the criteria, parameters and triggers are periodically reviewed, tested and updated appropriately, in a controlled and authorised manner.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[317,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,6,"ECB CROE 2.4.2-6","The FMI should ensure that its detection capabilities, baseline profile of system activities and the criteria, parameters and triggers are periodically reviewed, tested and updated appropriately, in a controlled and authorised manner.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","PR.IP-10.2","Full"]
[318,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,6,"ECB CROE 2.4.2-6","The FMI should ensure that its detection capabilities, baseline profile of system activities and the criteria, parameters and triggers are periodically reviewed, tested and updated appropriately, in a controlled and authorised manner.","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","DE.DP-3.1","Full"]
[319,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,6,"ECB CROE 2.4.2-6","The FMI should ensure that its detection capabilities, baseline profile of system activities and the criteria, parameters and triggers are periodically reviewed, tested and updated appropriately, in a controlled and authorised manner.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[320,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,7,"ECB CROE 2.4.2-7","The FMI should ensure that its relevant staff (employees and/or contractors) are trained to be able to identify and report anomalous activity and events.","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ","PR.AT-1.2","Full"]
[321,2.4,"Detection","2.4.2 Expectations",{"$f":"LEFT(D328,FIND(\" \",D328)-1)","v":"2.4.2"},"EVOLVING",null,7,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E328,\"-\",H328)","v":"ECB CROE 2.4.2-7"},"The FMI should ensure that its relevant staff (employees and/or contractors) are trained to be able to identify and report anomalous activity and events.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ",{"$f":"LEFT(K328,FIND(\":\",K328)-1)","v":"PR.AT-2.2"},"Full"]
[322,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,8,"ECB CROE 2.4.2-8","The FMI should build multilayered detection controls covering people, processes and technology which support attack detection and isolation of infected points.","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[323,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,9,"ECB CROE 2.4.2-9","The FMI should ensure that its detection capabilities are informed by threat or vulnerability information, which can be collected from different sources and providers, as set out in the chapter on situational awareness.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[324,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,9,"ECB CROE 2.4.2-9","The FMI should ensure that its detection capabilities are informed by threat or vulnerability information, which can be collected from different sources and providers, as set out in the chapter on situational awareness.","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","ID.RA-5.2","Full"]
[325,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,9,"ECB CROE 2.4.2-9","The FMI should ensure that its detection capabilities are informed by threat or vulnerability information, which can be collected from different sources and providers, as set out in the chapter on situational awareness.","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[326,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,10,"ECB CROE 2.4.2-10","The FMI should define alert thresholds for its monitoring and detection systems in order to trigger and facilitate the incident response process.","DE.AE-5.1: The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","DE.AE-5.1","Full"]
[327,2.4,"Detection","2.4.2 Expectations","2.4.2","EVOLVING",null,11,"ECB CROE 2.4.2-11","The FMI's monitoring and detection capabilities should support information collection for the forensic investigation. To facilitate forensic investigation, the FMI should ensure that its logs are backed up at a secure location with controls in place to mitigate the risk of alteration.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[328,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,12,"ECB CROE 2.4.2-12","The FMI should develop and implement automated mechanisms (e.g. a security information and event management (SIEM) system), which correlates all the network and system alerts and any other anomalous activity across its business units in order to detect multifaceted attacks (e.g. simultaneous account takeover or a distributed denial of service (DDoS) attack).","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[329,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,13,"ECB CROE 2.4.2-13","The FMI should have a process to collect, centralise and correlate event information from multiple sources and log analysis to continuously monitor the IT environment (e.g. databases, servers and end points, etc.) and detect anomalous activities and events. This should include information on anomalous activity and other network and system alerts across business units. This capability could be achieved through a security operations centre (SOC) or equivalent.","DE.AE-3.1: The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment.","DE.AE-3.1","Full"]
[330,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,13,"ECB CROE 2.4.2-13","The FMI should have a process to collect, centralise and correlate event information from multiple sources and log analysis to continuously monitor the IT environment (e.g. databases, servers and end points, etc.) and detect anomalous activities and events. This should include information on anomalous activity and other network and system alerts across business units. This capability could be achieved through a security operations centre (SOC) or equivalent.","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[331,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,13,"ECB CROE 2.4.2-13","The FMI should have a process to collect, centralise and correlate event information from multiple sources and log analysis to continuously monitor the IT environment (e.g. databases, servers and end points, etc.) and detect anomalous activities and events. This should include information on anomalous activity and other network and system alerts across business units. This capability could be achieved through a security operations centre (SOC) or equivalent.","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[332,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,14,"ECB CROE 2.4.2-14","The FMI should have processes in place to monitor activities that are not in line with its security policy and might lead to data theft, integrity compromise or destruction.","DE.CM-7.2: The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers.","DE.CM-7.2","Full"]
[333,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,14,"ECB CROE 2.4.2-14","The FMI should have processes in place to monitor activities that are not in line with its security policy and might lead to data theft, integrity compromise or destruction.","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[334,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,15,"ECB CROE 2.4.2-15","The FMI's monitoring and detection capabilities should allow the appropriate staff who can respond to be alerted automatically.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","DE.DP-4.1","Full"]
[335,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,16,"ECB CROE 2.4.2-16","The FMI should have the capabilities, in collaboration with other stakeholders, to detect cyber events and adapt its security controls swiftly. Such events may include attempted infiltration, movement of an attacker across systems, exploitation of vulnerabilities, unlawful access to systems and exfiltration of information or data.","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","DE.AE-2.1","Full"]
[336,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,17,"ECB CROE 2.4.2-17","The FMI should continuously monitor connections among information assets and cyber risk levels throughout the information assets’ life cycles, and store and analyse these data. The information gathered this way should enable the FMI to support timely responses to cyber threats (including insider threats) or vulnerabilities and investigation of anomalous activities.","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[337,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,17,"ECB CROE 2.4.2-17","The FMI should continuously monitor connections among information assets and cyber risk levels throughout the information assets’ life cycles, and store and analyse these data. The information gathered this way should enable the FMI to support timely responses to cyber threats (including insider threats) or vulnerabilities and investigation of anomalous activities.","ID.RA-5.5: The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","ID.RA-5.5","Full"]
[338,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,18,"ECB CROE 2.4.2-18","The FMI should continuously monitor and inspect the network traffic, including remote connections, and end point configuration and activity to identify potential vulnerabilities or anomalous events in a timely manner.","DE.CM-1.3: The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery. ","DE.CM-1.3","Full"]
[339,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,18,"ECB CROE 2.4.2-18","The FMI should continuously monitor and inspect the network traffic, including remote connections, and end point configuration and activity to identify potential vulnerabilities or anomalous events in a timely manner.","DE.CM-1.4: The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks.","DE.CM-1.4","Full"]
[340,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,19,"ECB CROE 2.4.2-19","The FMI should compare the network traffic and the end point configuration with the expected traffic and configuration baseline profile and data flows.","DE.AE-1.1: The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows. ","DE.AE-1.1","Full"]
[341,2.4,"Detection","2.4.2 Expectations","2.4.2","ADVANCING",null,19,"ECB CROE 2.4.2-19","The FMI should compare the network traffic and the end point configuration with the expected traffic and configuration baseline profile and data flows.","DE.CM-2.1: The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems.","DE.CM-2.1","Full"]
[342,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,20,"ECB CROE 2.4.2-20","The FMI should use multiple external sources of intelligence, correlated log analysis, alerts, traffic flows, and geopolitical events to predict potential future attacks and attack trends, and proactively take the appropriate measures to improve its cyber resilience capabilities.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[343,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","DE.AE-2.1","Full"]
[344,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","ID.RA-5.2","Full"]
[345,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","ID.RA-5.3","Full"]
[346,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[347,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","DE.DP-5.1","Full"]
[348,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","DE.CM-8.1","Full"]
[349,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","PR.IP-12.1","Full"]
[350,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,21,"ECB CROE 2.4.2-21","The FMI should develop threat detection capabilities which can detect both known and unknown threats, with a proactive identification of vulnerabilities, state-of-the art threat detection and correlation between vulnerabilities and threats.","PR.IP-12.2: The organization establishes a process to prioritize and remedy issues identified through vulnerability scanning.","PR.IP-12.2","Full"]
[351,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,22,"ECB CROE 2.4.2-22","The FMI should seek to continuously explore new technologies and techniques inhibiting lateral movement (e.g. deception mechanisms) which trigger alerts and inform the FMI of potential malicious activity when accessed. For example, the FMI could create and place fictitious sensitive data with alerting tags attached to them.","PR.AC-5.1: Networks and systems are segmented to maintain appropriate security.","PR.AC-5.1","Partial"]
[352,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,22,"ECB CROE 2.4.2-22","The FMI should seek to continuously explore new technologies and techniques inhibiting lateral movement (e.g. deception mechanisms) which trigger alerts and inform the FMI of potential malicious activity when accessed. For example, the FMI could create and place fictitious sensitive data with alerting tags attached to them.","DE.CM-1.3: The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery. ","DE.CM-1.3","Partial"]
[353,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,22,"ECB CROE 2.4.2-22","The FMI should seek to continuously explore new technologies and techniques inhibiting lateral movement (e.g. deception mechanisms) which trigger alerts and inform the FMI of potential malicious activity when accessed. For example, the FMI could create and place fictitious sensitive data with alerting tags attached to them.","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","DE.DP-5.1","Partial"]
[354,2.4,"Detection","2.4.2 Expectations","2.4.2","INNOVATING",null,22,"ECB CROE 2.4.2-22","The FMI should seek to continuously explore new technologies and techniques inhibiting lateral movement (e.g. deception mechanisms) which trigger alerts and inform the FMI of potential malicious activity when accessed. For example, the FMI could create and place fictitious sensitive data with alerting tags attached to them.","DE.AE-5.1: The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","DE.AE-5.1","Partial"]
[355,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,1,"ECB CROE 2.5.2.1-1","The FMI should – based on the identification of its critical functions, key roles, processes, information assets, third-party service providers and interconnections – plan for how to operate in a diminished capacity or how to safely restore services over time, based on services' relative priorities, and with accurate data. In order to make the best decisions about its recovery objectives following a cyber incident, the FMI must first define its recovery point objectives (RPOs) and its recovery time objectives (RTOs), commensurate to its business needs and systemic role in the ecosystem.","RC.RP-1.1: The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","RC.RP-1.1","Full"]
[356,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,1,"ECB CROE 2.5.2.1-1","The FMI should – based on the identification of its critical functions, key roles, processes, information assets, third-party service providers and interconnections – plan for how to operate in a diminished capacity or how to safely restore services over time, based on services' relative priorities, and with accurate data. In order to make the best decisions about its recovery objectives following a cyber incident, the FMI must first define its recovery point objectives (RPOs) and its recovery time objectives (RTOs), commensurate to its business needs and systemic role in the ecosystem.","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","RC.RP-1.2","Full"]
[357,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,1,"ECB CROE 2.5.2.1-1","The FMI should – based on the identification of its critical functions, key roles, processes, information assets, third-party service providers and interconnections – plan for how to operate in a diminished capacity or how to safely restore services over time, based on services' relative priorities, and with accurate data. In order to make the best decisions about its recovery objectives following a cyber incident, the FMI must first define its recovery point objectives (RPOs) and its recovery time objectives (RTOs), commensurate to its business needs and systemic role in the ecosystem.","RC.RP-1.3: The recovery plan includes a minimum recovery time for the sector critical systems.","RC.RP-1.3","Full"]
[358,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,1,"ECB CROE 2.5.2.1-1","The FMI should – based on the identification of its critical functions, key roles, processes, information assets, third-party service providers and interconnections – plan for how to operate in a diminished capacity or how to safely restore services over time, based on services' relative priorities, and with accurate data. In order to make the best decisions about its recovery objectives following a cyber incident, the FMI must first define its recovery point objectives (RPOs) and its recovery time objectives (RTOs), commensurate to its business needs and systemic role in the ecosystem.","PR.IP-4.4: Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.","PR.IP-4.4","Full"]
[359,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,2,"ECB CROE 2.5.2.1-2","Based on Expectation 1 above, the FMI should consider a range of different cyber scenarios, including extreme but plausible ones to which they may be exposed, and conduct business impact analyses to assess the potential impact such scenarios might have on the FMI. The FMI should review its range of scenarios and conduct the business impact analysis in line with the evolving threat landscape, on a regular basis.","RS.AN-2.1: The organization uses cyber-attack scenarios to determine potential impact to critical business processes.","RS.AN-2.1","Full"]
[360,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,3,"ECB CROE 2.5.2.1-3","The FMI should, based on the different cyber scenarios, develop a contingency plan that achieves recovery objectives, restoration priorities and determines the required capacities for continuous availability of the system. The plan should define roles and responsibilities, and set out options to reroute or substitute critical functions and/or services that may be affected for a significant period by a successful cyber attack.","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.","RC.RP-1.5","Full"]
[361,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,3,"ECB CROE 2.5.2.1-3","The FMI should, based on the different cyber scenarios, develop a contingency plan that achieves recovery objectives, restoration priorities and determines the required capacities for continuous availability of the system. The plan should define roles and responsibilities, and set out options to reroute or substitute critical functions and/or services that may be affected for a significant period by a successful cyber attack.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","DM.RS-1.3","Full"]
[362,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,3,"ECB CROE 2.5.2.1-3","The FMI should, based on the different cyber scenarios, develop a contingency plan that achieves recovery objectives, restoration priorities and determines the required capacities for continuous availability of the system. The plan should define roles and responsibilities, and set out options to reroute or substitute critical functions and/or services that may be affected for a significant period by a successful cyber attack.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","DM.RS-2.4","Full"]
[363,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,3,"ECB CROE 2.5.2.1-3","The FMI should, based on the different cyber scenarios, develop a contingency plan that achieves recovery objectives, restoration priorities and determines the required capacities for continuous availability of the system. The plan should define roles and responsibilities, and set out options to reroute or substitute critical functions and/or services that may be affected for a significant period by a successful cyber attack.","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","DM.BE-3.1","Full"]
[364,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,4,"ECB CROE 2.5.2.1-4","The FMI should develop comprehensive cyber incident response, resumption and recovery plans, to manage cybersecurity events or incidents in a way that limits damage and prioritises resumption and recovery actions in order to facilitate the processing of critical transactions, increases the confidence of external stakeholders, and reduces recovery time and costs. Such plans should define policies and procedures, as well as roles and responsibilities for escalating, responding to, and recovering from cybersecurity incidents. The FMI should ensure all relevant business units (including communications) are integrated into the plans.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[365,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,4,"ECB CROE 2.5.2.1-4","The FMI should develop comprehensive cyber incident response, resumption and recovery plans, to manage cybersecurity events or incidents in a way that limits damage and prioritises resumption and recovery actions in order to facilitate the processing of critical transactions, increases the confidence of external stakeholders, and reduces recovery time and costs. Such plans should define policies and procedures, as well as roles and responsibilities for escalating, responding to, and recovering from cybersecurity incidents. The FMI should ensure all relevant business units (including communications) are integrated into the plans.","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","RS.RP-1.1","Full"]
[366,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,4,"ECB CROE 2.5.2.1-4","The FMI should develop comprehensive cyber incident response, resumption and recovery plans, to manage cybersecurity events or incidents in a way that limits damage and prioritises resumption and recovery actions in order to facilitate the processing of critical transactions, increases the confidence of external stakeholders, and reduces recovery time and costs. Such plans should define policies and procedures, as well as roles and responsibilities for escalating, responding to, and recovering from cybersecurity incidents. The FMI should ensure all relevant business units (including communications) are integrated into the plans.","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","RS.CO-1.1","Full"]
[367,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,4,"ECB CROE 2.5.2.1-4","The FMI should develop comprehensive cyber incident response, resumption and recovery plans, to manage cybersecurity events or incidents in a way that limits damage and prioritises resumption and recovery actions in order to facilitate the processing of critical transactions, increases the confidence of external stakeholders, and reduces recovery time and costs. Such plans should define policies and procedures, as well as roles and responsibilities for escalating, responding to, and recovering from cybersecurity incidents. The FMI should ensure all relevant business units (including communications) are integrated into the plans.","RS.CO-1.3: The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","RS.CO-1.3","Full"]
[368,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,4,"ECB CROE 2.5.2.1-4","The FMI should develop comprehensive cyber incident response, resumption and recovery plans, to manage cybersecurity events or incidents in a way that limits damage and prioritises resumption and recovery actions in order to facilitate the processing of critical transactions, increases the confidence of external stakeholders, and reduces recovery time and costs. Such plans should define policies and procedures, as well as roles and responsibilities for escalating, responding to, and recovering from cybersecurity incidents. The FMI should ensure all relevant business units (including communications) are integrated into the plans.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[369,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,4,"ECB CROE 2.5.2.1-4","The FMI should develop comprehensive cyber incident response, resumption and recovery plans, to manage cybersecurity events or incidents in a way that limits damage and prioritises resumption and recovery actions in order to facilitate the processing of critical transactions, increases the confidence of external stakeholders, and reduces recovery time and costs. Such plans should define policies and procedures, as well as roles and responsibilities for escalating, responding to, and recovering from cybersecurity incidents. The FMI should ensure all relevant business units (including communications) are integrated into the plans.","RS.AN-4.1: The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise.","RS.AN-4.1","Full"]
[370,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,4,"ECB CROE 2.5.2.1-4","The FMI should develop comprehensive cyber incident response, resumption and recovery plans, to manage cybersecurity events or incidents in a way that limits damage and prioritises resumption and recovery actions in order to facilitate the processing of critical transactions, increases the confidence of external stakeholders, and reduces recovery time and costs. Such plans should define policies and procedures, as well as roles and responsibilities for escalating, responding to, and recovering from cybersecurity incidents. The FMI should ensure all relevant business units (including communications) are integrated into the plans.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","RS.CO-4.1","Full"]
[371,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,5,"ECB CROE 2.5.2.1-5","The FMI’s cyber incident response, resumption and recovery processes should be closely integrated with crisis management, business continuity, and disaster recovery planning and recovery operations.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[372,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,6,"ECB CROE 2.5.2.1-6","The FMI should ensure that its incident response team has the requisite skills and training to address cyber incidents.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","PR.AT-2.2","Full"]
[373,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,6,"ECB CROE 2.5.2.1-6","The FMI should ensure that its incident response team has the requisite skills and training to address cyber incidents.","RS.CO-1.3: The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","RS.CO-1.3","Full"]
[374,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,7,"ECB CROE 2.5.2.1-7","The FMI should define alert parameters and thresholds for detecting cybersecurity incidents, which trigger the incident management processes and procedures, which in turn include alerting and conveying information to the appropriate staff.","DE.AE-5.1: The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","DE.AE-5.1","Full"]
[375,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,7,"ECB CROE 2.5.2.1-7","The FMI should define alert parameters and thresholds for detecting cybersecurity incidents, which trigger the incident management processes and procedures, which in turn include alerting and conveying information to the appropriate staff.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","RS.CO-4.1","Full"]
[376,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,8,"ECB CROE 2.5.2.1-8","The FMI should regularly test its cyber contingency, response, resumption and recovery plans against a range of different plausible scenarios.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[377,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,8,"ECB CROE 2.5.2.1-8","The FMI should regularly test its cyber contingency, response, resumption and recovery plans against a range of different plausible scenarios.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","PR.IP-10.2","Full"]
[378,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,8,"ECB CROE 2.5.2.1-8","The FMI should regularly test its cyber contingency, response, resumption and recovery plans against a range of different plausible scenarios.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","PR.IP-10.4","Full"]
[379,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,9,"ECB CROE 2.5.2.1-9","The FMI should have processes and procedures in place for collating and reviewing information from its cybersecurity incidents and testing results in order to continuously improve its contingency, response, resumption and recovery plans.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[380,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,9,"ECB CROE 2.5.2.1-9","The FMI should have processes and procedures in place for collating and reviewing information from its cybersecurity incidents and testing results in order to continuously improve its contingency, response, resumption and recovery plans.","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RS.IM-2.1","Full"]
[381,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,10,"ECB CROE 2.5.2.1-10","The FMI should have processes and procedures in place to conduct an ex post root cause analysis of its cybersecurity incidents. The FMI should integrate its findings from the root cause analysis into its cyber response, resumption and recovery plans, as set out in Expectation 4 above.","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","RS.IM-1.1","Full"]
[382,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,10,"ECB CROE 2.5.2.1-10","The FMI should have processes and procedures in place to conduct an ex post root cause analysis of its cybersecurity incidents. The FMI should integrate its findings from the root cause analysis into its cyber response, resumption and recovery plans, as set out in Expectation 4 above.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","RS.IM-1.3","Full"]
[383,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","EVOLVING",null,10,"ECB CROE 2.5.2.1-10","The FMI should have processes and procedures in place to conduct an ex post root cause analysis of its cybersecurity incidents. The FMI should integrate its findings from the root cause analysis into its cyber response, resumption and recovery plans, as set out in Expectation 4 above.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[384,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,11,"ECB CROE 2.5.2.1-11","The FMI should design and test its systems and processes to enable critical operations to be resumed safely within two hours of a cyber disruption and to enable it to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, FMIs should undertake careful problem analysis and exercise judgement (in agreement with competent authorities and relevant stakeholders) when resuming operations so that risks to the FMI or its ecosystem do not escalate as a result, while taking into account the fact that completion of settlement by the end of day is crucial.","PR.IP-9.2: The organization defines objectives for resumption of critical operations.","PR.IP-9.2","Full"]
[385,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management",{"$f":"LEFT(D392,FIND(\" \",D392)-1)","v":"2.5.2.1"},"ADVANCING",null,11,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E392,\"-\",H392)","v":"ECB CROE 2.5.2.1-11"},"The FMI should design and test its systems and processes to enable critical operations to be resumed safely within two hours of a cyber disruption and to enable it to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, FMIs should undertake careful problem analysis and exercise judgement (in agreement with competent authorities and relevant stakeholders) when resuming operations so that risks to the FMI or its ecosystem do not escalate as a result, while taking into account the fact that completion of settlement by the end of day is crucial.","RS.AN-4.1: The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise.",{"$f":"LEFT(K392,FIND(\":\",K392)-1)","v":"RS.AN-4.1"},"Full"]
[386,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,11,"ECB CROE 2.5.2.1-11","The FMI should design and test its systems and processes to enable critical operations to be resumed safely within two hours of a cyber disruption and to enable it to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, FMIs should undertake careful problem analysis and exercise judgement (in agreement with competent authorities and relevant stakeholders) when resuming operations so that risks to the FMI or its ecosystem do not escalate as a result, while taking into account the fact that completion of settlement by the end of day is crucial.","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","RC.RP-1.2","Full"]
[387,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,11,"ECB CROE 2.5.2.1-11","The FMI should design and test its systems and processes to enable critical operations to be resumed safely within two hours of a cyber disruption and to enable it to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, FMIs should undertake careful problem analysis and exercise judgement (in agreement with competent authorities and relevant stakeholders) when resuming operations so that risks to the FMI or its ecosystem do not escalate as a result, while taking into account the fact that completion of settlement by the end of day is crucial.","RC.RP-1.3: The recovery plan includes a minimum recovery time for the sector critical systems.","RC.RP-1.3","Full"]
[388,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,11,"ECB CROE 2.5.2.1-11","The FMI should design and test its systems and processes to enable critical operations to be resumed safely within two hours of a cyber disruption and to enable it to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, FMIs should undertake careful problem analysis and exercise judgement (in agreement with competent authorities and relevant stakeholders) when resuming operations so that risks to the FMI or its ecosystem do not escalate as a result, while taking into account the fact that completion of settlement by the end of day is crucial.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","DM.RS-1.3","Full"]
[389,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,11,"ECB CROE 2.5.2.1-11","The FMI should design and test its systems and processes to enable critical operations to be resumed safely within two hours of a cyber disruption and to enable it to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, FMIs should undertake careful problem analysis and exercise judgement (in agreement with competent authorities and relevant stakeholders) when resuming operations so that risks to the FMI or its ecosystem do not escalate as a result, while taking into account the fact that completion of settlement by the end of day is crucial.","DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. ","DM.RS-2.2","Full"]
[390,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,11,"ECB CROE 2.5.2.1-11","The FMI should design and test its systems and processes to enable critical operations to be resumed safely within two hours of a cyber disruption and to enable it to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios. Notwithstanding this capability to resume critical operations within two hours, FMIs should undertake careful problem analysis and exercise judgement (in agreement with competent authorities and relevant stakeholders) when resuming operations so that risks to the FMI or its ecosystem do not escalate as a result, while taking into account the fact that completion of settlement by the end of day is crucial.","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","DM.BE-3.1","Full"]
[391,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,12,"ECB CROE 2.5.2.1-12","The FMI should plan for scenarios in which resumption within two hours cannot be achieved. The FMI should analyse critical functions, transactions and interdependencies to prioritise resumption and recovery actions, which may, depending on the design of the FMI, help critical transactions to be processed, for example, while remediation efforts continue. The FMI should also plan for situations in which critical people, processes or systems may be unavailable for significant periods – for example, by potentially reverting (where feasible, safe and practicable) to manual processing if automated systems are unavailable.","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","DM.RS-1.3","Full"]
[392,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,12,"ECB CROE 2.5.2.1-12","The FMI should plan for scenarios in which resumption within two hours cannot be achieved. The FMI should analyse critical functions, transactions and interdependencies to prioritise resumption and recovery actions, which may, depending on the design of the FMI, help critical transactions to be processed, for example, while remediation efforts continue. The FMI should also plan for situations in which critical people, processes or systems may be unavailable for significant periods – for example, by potentially reverting (where feasible, safe and practicable) to manual processing if automated systems are unavailable.","RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date.","RC.RP-1.4","Full"]
[393,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","RS.RP-1.1","Full"]
[394,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[395,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","RS.CO-3.2","Full"]
[396,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","RS.CO-4.1","Full"]
[397,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.CO-5.3: The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them.","RS.CO-5.3","Full"]
[398,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.AN-1.1: Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","RS.AN-1.1","Full"]
[399,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.AN-2.2: The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","RS.AN-2.2","Full"]
[400,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.MI-1.1: The organization contains cybersecurity incidents in a timely manner.  ","RS.MI-1.1","Full"]
[401,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RS.MI-2.1: The organization mitigates cybersecurity incidents in a timely manner.  ","RS.MI-2.1","Full"]
[402,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","RC.RP-1.1: The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","RC.RP-1.1","Full"]
[403,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,13,"ECB CROE 2.5.2.1-13","The FMI should implement an effective incident handling capability for cybersecurity incidents that includes preparation, detection and analysis, containment, eradication and recovery. Such capability should allow the FMI to perform, at an early stage, analysis of cybersecurity incidents upon their detection, with minimal service disruption. This capability might include direct cooperative or contractual agreements with incident response organisations or providers to assist rapidly with mitigation effort.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","DM.RS-2.1","Full"]
[404,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,14,"ECB CROE 2.5.2.1-14","The FMI should define and develop functional and security dependency maps of identified information assets supporting critical functions to understand and prioritise the order in which they should be restored.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","ID.AM-3.1","Full"]
[405,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,15,"ECB CROE 2.5.2.1-15","The FMI should be able to use lessons learned from real-life cyber attacks on the institution and its ecosystem to improve its contingency, response, resumption and recovery plans.","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","DE.DP-5.1","Full"]
[406,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,15,"ECB CROE 2.5.2.1-15","The FMI should be able to use lessons learned from real-life cyber attacks on the institution and its ecosystem to improve its contingency, response, resumption and recovery plans.","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","RS.IM-1.1","Full"]
[407,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,15,"ECB CROE 2.5.2.1-15","The FMI should be able to use lessons learned from real-life cyber attacks on the institution and its ecosystem to improve its contingency, response, resumption and recovery plans.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","RS.IM-1.3","Full"]
[408,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,16,"ECB CROE 2.5.2.1-16","The FMI should consult with relevant external stakeholders (e.g. main participants, service providers and other FMIs) within the ecosystem to further enhance its contingency, response, resumption and recovery plans.","RS.CO-5.2: The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","RS.CO-5.2","Full"]
[409,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,17,"ECB CROE 2.5.2.1-17","The FMI should continuously monitor, evaluate and consider technological developments and solutions in the market that may enhance its contingency, response, resumption and recovery capabilities.","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RS.IM-2.1","Full"]
[410,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","ADVANCING",null,17,"ECB CROE 2.5.2.1-17","The FMI should continuously monitor, evaluate and consider technological developments and solutions in the market that may enhance its contingency, response, resumption and recovery capabilities.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RC.IM-2.1","Full"]
[411,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,18,"ECB CROE 2.5.2.1-18","The FMI should implement processes to continuously improve its cyber response, resumption and recovery plans, taking into account cyber threat intelligence feeds, information sharing with its ecosystem and lessons learned from previous events.","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","RS.IM-1.1","Full"]
[412,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,18,"ECB CROE 2.5.2.1-18","The FMI should implement processes to continuously improve its cyber response, resumption and recovery plans, taking into account cyber threat intelligence feeds, information sharing with its ecosystem and lessons learned from previous events.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RC.IM-2.1","Full"]
[413,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,18,"ECB CROE 2.5.2.1-18","The FMI should implement processes to continuously improve its cyber response, resumption and recovery plans, taking into account cyber threat intelligence feeds, information sharing with its ecosystem and lessons learned from previous events.","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RS.IM-2.1","Full"]
[414,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,19,"ECB CROE 2.5.2.1-19","The FMI should consult, collaborate and coordinate with relevant external stakeholders (e.g. main participants, service providers and other FMIs) within the ecosystem to develop common contingency, response, resumption and recovery plans for cyber scenarios which may impact the ecosystem as a whole. The FMI should conduct regular scenario tests (e.g. industry-wide and FMI-specific simulation exercises) with the relevant external stakeholders.","RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","RS.CO-3.2","Full"]
[415,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,19,"ECB CROE 2.5.2.1-19","The FMI should consult, collaborate and coordinate with relevant external stakeholders (e.g. main participants, service providers and other FMIs) within the ecosystem to develop common contingency, response, resumption and recovery plans for cyber scenarios which may impact the ecosystem as a whole. The FMI should conduct regular scenario tests (e.g. industry-wide and FMI-specific simulation exercises) with the relevant external stakeholders.","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1","Full"]
[416,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,19,"ECB CROE 2.5.2.1-19","The FMI should consult, collaborate and coordinate with relevant external stakeholders (e.g. main participants, service providers and other FMIs) within the ecosystem to develop common contingency, response, resumption and recovery plans for cyber scenarios which may impact the ecosystem as a whole. The FMI should conduct regular scenario tests (e.g. industry-wide and FMI-specific simulation exercises) with the relevant external stakeholders.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[417,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,19,"ECB CROE 2.5.2.1-19","The FMI should consult, collaborate and coordinate with relevant external stakeholders (e.g. main participants, service providers and other FMIs) within the ecosystem to develop common contingency, response, resumption and recovery plans for cyber scenarios which may impact the ecosystem as a whole. The FMI should conduct regular scenario tests (e.g. industry-wide and FMI-specific simulation exercises) with the relevant external stakeholders.","DM.RS-2.5: When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems.","DM.RS-2.5","Full"]
[418,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,20,"ECB CROE 2.5.2.1-20","The FMI should implement a computer security incident response team (CSIRT), whether in-house or outsourced, that is responsible for responding to security incidents and intrusions, and coordinating activities among the relevant internal and external stakeholders. Such a team should have the authority to direct the FMI to make the changes necessary to recover from the incident.","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","RS.CO-1.1","Full"]
[419,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,20,"ECB CROE 2.5.2.1-20","The FMI should implement a computer security incident response team (CSIRT), whether in-house or outsourced, that is responsible for responding to security incidents and intrusions, and coordinating activities among the relevant internal and external stakeholders. Such a team should have the authority to direct the FMI to make the changes necessary to recover from the incident.","RS.CO-1.2: The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","RS.CO-1.2","Full"]
[420,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,20,"ECB CROE 2.5.2.1-20","The FMI should implement a computer security incident response team (CSIRT), whether in-house or outsourced, that is responsible for responding to security incidents and intrusions, and coordinating activities among the relevant internal and external stakeholders. Such a team should have the authority to direct the FMI to make the changes necessary to recover from the incident.","RS.CO-1.3: The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","RS.CO-1.3","Full"]
[421,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,21,"ECB CROE 2.5.2.1-21","The FMI should establish and implement processes to manage cybersecurity incidents and enable automated responses, triggered by predefined criteria, parameters and thresholds. For example, the FMI could develop configurable capability to isolate or disable automatically affected information systems if cyber attacks or security violations are detected.","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","DE.AE-2.1","Full"]
[422,2.5,"Response and recovery","2.5.2.1 Cyber resilience incident management","2.5.2.1","INNOVATING",null,21,"ECB CROE 2.5.2.1-21","The FMI should establish and implement processes to manage cybersecurity incidents and enable automated responses, triggered by predefined criteria, parameters and thresholds. For example, the FMI could develop configurable capability to isolate or disable automatically affected information systems if cyber attacks or security violations are detected.","DE.AE-5.1: The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected.","DE.AE-5.1","Full"]
[423,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","EVOLVING",null,22,"ECB CROE 2.5.2.2-22","The FMI should develop a formal backup policy specifying the minimum frequency and scope of data, based on data sensitivity and the frequency with which that new information is introduced.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","PR.IP-4.2","Full"]
[424,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","EVOLVING",null,22,"ECB CROE 2.5.2.2-22","The FMI should develop a formal backup policy specifying the minimum frequency and scope of data, based on data sensitivity and the frequency with which that new information is introduced.","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","GV.PL-1.1","Full"]
[425,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","EVOLVING",null,23,"ECB CROE 2.5.2.2-23","The FMI should develop backup and recovery methods and strategies to be able to restore system operations with minimum downtime and limited disruption.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","PR.IP-4.1","Full"]
[426,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","EVOLVING",null,24,"ECB CROE 2.5.2.2-24","The FMI should regularly back up all data necessary to replay participants' transactions.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","PR.IP-4.1","Full"]
[427,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","EVOLVING",null,25,"ECB CROE 2.5.2.2-25","Backups should be protected at rest and in transit to ensure the confidentiality, integrity and availability of data. Backups should be tested regularly to verify their availability and integrity.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","PR.IP-4.2","Full"]
[428,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","ADVANCING",null,26,"ECB CROE 2.5.2.2-26","The FMI should store backup copies at an alternate site with a different risk profile to the main site, and with transfer rates consistent with actual RPOs. The alternate site and backups should be safeguarded by stringent protective and detective controls.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","PR.IP-4.2","Full"]
[429,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","ADVANCING",null,26,"ECB CROE 2.5.2.2-26","The FMI should store backup copies at an alternate site with a different risk profile to the main site, and with transfer rates consistent with actual RPOs. The alternate site and backups should be safeguarded by stringent protective and detective controls.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[430,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","ADVANCING",null,26,"ECB CROE 2.5.2.2-26","The FMI should store backup copies at an alternate site with a different risk profile to the main site, and with transfer rates consistent with actual RPOs. The alternate site and backups should be safeguarded by stringent protective and detective controls.","RC.RP-1.6: The recovery plan includes plans to come back for both traditional and highly available (e.g., cloud) infrastructure.","RC.RP-1.6","Full"]
[431,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","ADVANCING",null,26,"ECB CROE 2.5.2.2-26","The FMI should store backup copies at an alternate site with a different risk profile to the main site, and with transfer rates consistent with actual RPOs. The alternate site and backups should be safeguarded by stringent protective and detective controls.","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","PR.IP-9.1","Full"]
[432,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","ADVANCING",null,27,"ECB CROE 2.5.2.2-27","The FMI's information systems should implement transaction recovery mechanisms for transaction-based systems, which might include transaction rollback and logging.","PR.IP-4.3: The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives. ","PR.IP-4.3","Full"]
[433,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","ADVANCING",null,28,"ECB CROE 2.5.2.2-28","The FMI should conduct frequent periodic reconciliation of participants’ positions, with the assistance of participants where needed.","PR.IP-4.3: The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives. ","PR.IP-4.3","Full"]
[434,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","ADVANCING",null,29,"ECB CROE 2.5.2.2-29","The FMI should develop capabilities to restore information system components within the actual RTOs using a predefined and standardised configuration of IT resources, the integrity of which is protected.","PR.IP-4.4: Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations.","PR.IP-4.4","Full"]
[435,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,30,"ECB CROE 2.5.2.2-30","The FMI's backup and recovery methods and strategies should be integrated into the FMI's system infrastructure at the development and/or acquisition phase.","GV.TE-1.2: The organization applies its cyber risk management framework to all technology projects.","GV.TE-1.2","Full"]
[436,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,30,"ECB CROE 2.5.2.2-30","The FMI's backup and recovery methods and strategies should be integrated into the FMI's system infrastructure at the development and/or acquisition phase.","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Full"]
[437,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,30,"ECB CROE 2.5.2.2-30","The FMI's backup and recovery methods and strategies should be integrated into the FMI's system infrastructure at the development and/or acquisition phase.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","DM.ED-6.5","Full"]
[438,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,31,"ECB CROE 2.5.2.2-31","The FMI should back up its information system by maintaining a redundant secondary system that is not located in the same place as the primary system and that can be activated without information being lost or operations disrupted.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","PR.IP-4.2","Full"]
[439,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,31,"ECB CROE 2.5.2.2-31","The FMI should back up its information system by maintaining a redundant secondary system that is not located in the same place as the primary system and that can be activated without information being lost or operations disrupted.","PR.PT-5.1: The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations.","PR.PT-5.1","Full"]
[440,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,31,"ECB CROE 2.5.2.2-31","The FMI should back up its information system by maintaining a redundant secondary system that is not located in the same place as the primary system and that can be activated without information being lost or operations disrupted.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[441,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,31,"ECB CROE 2.5.2.2-31","The FMI should back up its information system by maintaining a redundant secondary system that is not located in the same place as the primary system and that can be activated without information being lost or operations disrupted.","RC.RP-1.6: The recovery plan includes plans to come back for both traditional and highly available (e.g., cloud) infrastructure.","RC.RP-1.6","Full"]
[442,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,31,"ECB CROE 2.5.2.2-31","The FMI should back up its information system by maintaining a redundant secondary system that is not located in the same place as the primary system and that can be activated without information being lost or operations disrupted.","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","PR.IP-9.1","Full"]
[443,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,32,"ECB CROE 2.5.2.2-32","The FMI should consider having a data-sharing agreement with third parties and/or participants in order to obtain uncorrupted data from them for recovering its business operations in a timely manner and with accurate data.","DM.ED-6.4: Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted.","DM.ED-6.4","Full"]
[444,2.5,"Response and recovery","2.5.2.2 Data integrity","2.5.2.2","INNOVATING",null,32,"ECB CROE 2.5.2.2-32","The FMI should consider having a data-sharing agreement with third parties and/or participants in order to obtain uncorrupted data from them for recovering its business operations in a timely manner and with accurate data.","DM.ED-6.7: Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination.","DM.ED-6.7","Full"]
[445,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Contagion",33,"ECB CROE 2.5.2.3-33","The FMI should identify, document and regularly review systems and processes supporting its critical functions and/or operations that are dependent on external connectivity.","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","ID.AM-3.3","Full"]
[446,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Contagion",33,"ECB CROE 2.5.2.3-33","The FMI should identify, document and regularly review systems and processes supporting its critical functions and/or operations that are dependent on external connectivity.","DM.ED-5.1: The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","DM.ED-5.1","Full"]
[447,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Contagion",33,"ECB CROE 2.5.2.3-33","The FMI should identify, document and regularly review systems and processes supporting its critical functions and/or operations that are dependent on external connectivity.","ID.AM-4.1: The organization maintains an inventory of external information systems. ","ID.AM-4.1","Full"]
[448,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Contagion",34,"ECB CROE 2.5.2.3-34","The FMI should develop policies and procedures that define how it should work together with relevant interconnected entities to enable operations to be resumed (the first priority being its critical functions and services) as soon as it is safe and practicable to do so.","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","RC.RP-1.2","Full"]
[449,2.5,"Response and recovery","2.5.2.3 Communication and collaboration",{"$f":"LEFT(D456,FIND(\" \",D456)-1)","v":"2.5.2.3"},"EVOLVING","Contagion",34,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E456,\"-\",H456)","v":"ECB CROE 2.5.2.3-34"},"The FMI should develop policies and procedures that define how it should work together with relevant interconnected entities to enable operations to be resumed (the first priority being its critical functions and services) as soon as it is safe and practicable to do so.","DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.",{"$f":"LEFT(K456,FIND(\":\",K456)-1)","v":"DM.ED-2.1"},"Full"]
[450,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","ADVANCING","Contagion",35,"ECB CROE 2.5.2.3-35","The FMI should closely cooperate with its interconnected entities within the ecosystem, establishing rollback processes in order to restore all its services accurately and safely. Moreover, the FMI should test the effectiveness of these procedures regularly.","DE.CM-6.2: The organization collaborates with third-party service providers to maintain and improve the security of external connections.","DE.CM-6.2","Full"]
[451,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","ADVANCING","Contagion",35,"ECB CROE 2.5.2.3-35","The FMI should closely cooperate with its interconnected entities within the ecosystem, establishing rollback processes in order to restore all its services accurately and safely. Moreover, the FMI should test the effectiveness of these procedures regularly.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","DE.DP-4.1","Full"]
[452,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","INNOVATING","Contagion",36,"ECB CROE 2.5.2.3-36","The FMI should design its network connection infrastructure in a way that allows connections to be segmented or severed instantaneously to prevent contagion arising from cyber attacks.","PR.AC-5.1: Networks and systems are segmented to maintain appropriate security.","PR.AC-5.1","Full"]
[453,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",37,"ECB CROE 2.5.2.3-37","The FMI should identify and determine staff who are essential for mitigating the risk of a cyber incident, and make them aware of their roles and responsibilities regarding incident escalation.","RS.CO-1.3: The organization's personnel know their roles and responsibilities and order of operations when a response is needed.","RS.CO-1.3","Full"]
[454,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",38,"ECB CROE 2.5.2.3-38","The FMI's incident response plan should identify the internal and external stakeholders that must be notified, as well as the information that has to be shared and reported, and when this should take place.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","RS.CO-4.1","Full"]
[455,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",39,"ECB CROE 2.5.2.3-39","The FMI should establish criteria and procedures for escalating cyber incidents or vulnerabilities to the Board and senior management based on the potential impact and criticality of the risk.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[456,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",39,"ECB CROE 2.5.2.3-39","The FMI should establish criteria and procedures for escalating cyber incidents or vulnerabilities to the Board and senior management based on the potential impact and criticality of the risk.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","RS.CO-2.2","Full"]
[457,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",40,"ECB CROE 2.5.2.3-40","The FMI should have a communication plan and procedures in place to notify, as required or necessary, all relevant internal and external stakeholders (including oversight, regulatory authorities, media and customers) in a timely manner, when the institution becomes aware of a cyber incident. The FMI should notify the appropriate internal and external stakeholders when a cyber incident occurs.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","RS.CO-2.2","Full"]
[458,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",40,"ECB CROE 2.5.2.3-40","The FMI should have a communication plan and procedures in place to notify, as required or necessary, all relevant internal and external stakeholders (including oversight, regulatory authorities, media and customers) in a timely manner, when the institution becomes aware of a cyber incident. The FMI should notify the appropriate internal and external stakeholders when a cyber incident occurs.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","RS.CO-2.2","Full"]
[459,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",41,"ECB CROE 2.5.2.3-41","The FMI should have a policy and procedures to enable potential vulnerabilities to be disclosed responsibly. In particular, the FMI should prioritise disclosures that could help stakeholders to respond promptly and mitigate risk, which could benefit the ecosystem and broader financial stability.","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","RS.AN-5.1","Full"]
[460,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",41,"ECB CROE 2.5.2.3-41","The FMI should have a policy and procedures to enable potential vulnerabilities to be disclosed responsibly. In particular, the FMI should prioritise disclosures that could help stakeholders to respond promptly and mitigate risk, which could benefit the ecosystem and broader financial stability.","RS.AN-5.2: The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond.","RS.AN-5.2","Full"]
[461,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",42,"ECB CROE 2.5.2.3-42","The FMI should establish and regularly review information-sharing rules, agreements and modalities in order to control the publication and distribution of such information, and to prevent sensitive information that may have adverse consequences if disclosed improperly from being disseminated.","RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","RS.CO-2.4","Full"]
[462,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","EVOLVING","Crisis communication and responsible disclosure",42,"ECB CROE 2.5.2.3-42","The FMI should establish and regularly review information-sharing rules, agreements and modalities in order to control the publication and distribution of such information, and to prevent sensitive information that may have adverse consequences if disclosed improperly from being disseminated.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[463,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","ADVANCING","Crisis communication and responsible disclosure",43,"ECB CROE 2.5.2.3-43","After developing a range of cyber incident scenarios based on the incident criteria established in the evolving level, the FMI should develop appropriate incident response and communication plans and procedures to address the scenarios. These incident response and communication plans and procedures should take into consideration the legal and regulatory reporting requirements at a jurisdictional level.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[464,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","ADVANCING","Crisis communication and responsible disclosure",43,"ECB CROE 2.5.2.3-43","After developing a range of cyber incident scenarios based on the incident criteria established in the evolving level, the FMI should develop appropriate incident response and communication plans and procedures to address the scenarios. These incident response and communication plans and procedures should take into consideration the legal and regulatory reporting requirements at a jurisdictional level.","RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector.","RS.CO-2.4","Full"]
[465,2.5,"Response and recovery","2.5.2.3 Communication and collaboration","2.5.2.3","INNOVATING","Crisis communication and responsible disclosure",44,"ECB CROE 2.5.2.3-44","The FMI should develop mechanisms that instantaneously notify its senior management, relevant employees and relevant stakeholders (including oversight and regulatory authorities) of cyber incidents through appropriate communication channels with tracking and verification of receipt. Such mechanisms should be based on predefined criteria and informed by scenario-based planning and analysis, as well as prior experience.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[466,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,45,"ECB CROE 2.5.2.4-45","The FMI should identify the threat scenarios that might have a potential impact on its business and determine which pieces of digital evidence (e.g. types of logs) should be collected to facilitate forensic investigation.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[467,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,45,"ECB CROE 2.5.2.4-45","The FMI should identify the threat scenarios that might have a potential impact on its business and determine which pieces of digital evidence (e.g. types of logs) should be collected to facilitate forensic investigation.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[468,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,46,"ECB CROE 2.5.2.4-46","The FMI should identify and document the digital evidence available on its systems and its location, and understand how the evidence should be handled throughout its life cycle.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[469,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,46,"ECB CROE 2.5.2.4-46","The FMI should identify and document the digital evidence available on its systems and its location, and understand how the evidence should be handled throughout its life cycle.","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","RS.CO-1.1","Full"]
[470,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,47,"ECB CROE 2.5.2.4-47","Based on Expectations 45 and 46, the FMI should develop and implement a forensic readiness policy and the capability to support forensic investigation, which also outlines the relevant system logging policies that include the types of logs to be maintained and their retention periods. The FMI may outsource the conduct of forensic investigations to external specialists.","DE.CM-1.1: The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods.","DE.CM-1.1","Full"]
[471,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,47,"ECB CROE 2.5.2.4-47","Based on Expectations 45 and 46, the FMI should develop and implement a forensic readiness policy and the capability to support forensic investigation, which also outlines the relevant system logging policies that include the types of logs to be maintained and their retention periods. The FMI may outsource the conduct of forensic investigations to external specialists.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[472,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,47,"ECB CROE 2.5.2.4-47","Based on Expectations 45 and 46, the FMI should develop and implement a forensic readiness policy and the capability to support forensic investigation, which also outlines the relevant system logging policies that include the types of logs to be maintained and their retention periods. The FMI may outsource the conduct of forensic investigations to external specialists.","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","RS.CO-1.1","Full"]
[473,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,48,"ECB CROE 2.5.2.4-48","The FMI should establish procedures for securely collecting digital evidence in forensically acceptable manner and in accordance with the requirements defined in the forensic readiness policy, taking into account the requirements of the local jurisdiction. These procedures should describe how investigative staff should produce step-by-step documentation of all activities performed on digital evidence and their impact.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[474,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,48,"ECB CROE 2.5.2.4-48","The FMI should establish procedures for securely collecting digital evidence in forensically acceptable manner and in accordance with the requirements defined in the forensic readiness policy, taking into account the requirements of the local jurisdiction. These procedures should describe how investigative staff should produce step-by-step documentation of all activities performed on digital evidence and their impact.","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","RS.CO-1.1","Full"]
[475,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,48,"ECB CROE 2.5.2.4-48","The FMI should establish procedures for securely collecting digital evidence in forensically acceptable manner and in accordance with the requirements defined in the forensic readiness policy, taking into account the requirements of the local jurisdiction. These procedures should describe how investigative staff should produce step-by-step documentation of all activities performed on digital evidence and their impact.","DE.CM-1.1: The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods.","DE.CM-1.1","Full"]
[476,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,49,"ECB CROE 2.5.2.4-49","The FMI should establish policies for securely handling and storing the collected digital evidence, ensuring its authenticity and integrity. The FMI should develop procedures to demonstrate that the evidence’s integrity is preserved whenever it is accessed, used or moved (i.e. chain of custody).","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Partial"]
[477,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,50,"ECB CROE 2.5.2.4-50","The FMI should train its staff so that all those involved in an incident understand their responsibilities related to handling the digital evidence, ensuring it is not compromised and remains valid as per the requirements of the local jurisdiction.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[478,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,50,"ECB CROE 2.5.2.4-50","The FMI should train its staff so that all those involved in an incident understand their responsibilities related to handling the digital evidence, ensuring it is not compromised and remains valid as per the requirements of the local jurisdiction.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[479,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,51,"ECB CROE 2.5.2.4-51","The FMI should ensure that staff specifically involved in the forensic investigation have the appropriate degree of competence in handling the digital evidence, ensuring its authenticity and integrity is not compromised and remains valid as per the requirements of the local jurisdiction.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[480,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","EVOLVING",null,51,"ECB CROE 2.5.2.4-51","The FMI should ensure that staff specifically involved in the forensic investigation have the appropriate degree of competence in handling the digital evidence, ensuring its authenticity and integrity is not compromised and remains valid as per the requirements of the local jurisdiction.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[481,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","ADVANCING",null,52,"ECB CROE 2.5.2.4-52","The FMI should closely integrate plans for forensic readiness with plans for incident management and other related business planning activities.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[482,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","INNOVATING",null,53,"ECB CROE 2.5.2.4-53","The FMI should have a management review process that improves forensic readiness plans in accordance with experience and new knowledge.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[483,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","INNOVATING",null,53,"ECB CROE 2.5.2.4-53","The FMI should have a management review process that improves forensic readiness plans in accordance with experience and new knowledge.","GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","GV.IR-2.2","Full"]
[484,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","INNOVATING",null,53,"ECB CROE 2.5.2.4-53","The FMI should have a management review process that improves forensic readiness plans in accordance with experience and new knowledge.","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[485,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","INNOVATING",null,53,"ECB CROE 2.5.2.4-53","The FMI should have a management review process that improves forensic readiness plans in accordance with experience and new knowledge.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","RS.IM-1.3","Full"]
[486,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","INNOVATING",null,54,"ECB CROE 2.5.2.4-54","The FMI should take an open and collaborative approach with the ecosystem to improve lawful forensic investigation and incident handling methodologies and tools.","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[487,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","INNOVATING",null,54,"ECB CROE 2.5.2.4-54","The FMI should take an open and collaborative approach with the ecosystem to improve lawful forensic investigation and incident handling methodologies and tools.","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[488,2.5,"Response and recovery","2.5.2.4 Forensic readiness","2.5.2.4","INNOVATING",null,54,"ECB CROE 2.5.2.4-54","The FMI should take an open and collaborative approach with the ecosystem to improve lawful forensic investigation and incident handling methodologies and tools.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","DM.ED-6.5","Full"]
[489,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",1,"ECB CROE 2.6.2-1","The FMI should establish and maintain a comprehensive testing programme as an integral part of its cyber resilience framework. The testing programme should consist of a broad spectrum of methodologies, practices and tools for monitoring, assessing and evaluating the effectiveness of the core components of the cyber resilience framework.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[490,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",1,"ECB CROE 2.6.2-1","The FMI should establish and maintain a comprehensive testing programme as an integral part of its cyber resilience framework. The testing programme should consist of a broad spectrum of methodologies, practices and tools for monitoring, assessing and evaluating the effectiveness of the core components of the cyber resilience framework.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","PR.IP-10.2","Full"]
[491,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",1,"ECB CROE 2.6.2-1","The FMI should establish and maintain a comprehensive testing programme as an integral part of its cyber resilience framework. The testing programme should consist of a broad spectrum of methodologies, practices and tools for monitoring, assessing and evaluating the effectiveness of the core components of the cyber resilience framework.","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","DE.DP-3.1","Full"]
[492,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",2,"ECB CROE 2.6.2-2","The FMI should adopt a risk-based approach in developing the comprehensive testing programme. This should be reviewed and updated on a regular basis taking into due account the evolving landscape of threats and the criticality of information assets.","ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.","ID.RA-5.1","Full"]
[493,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",2,"ECB CROE 2.6.2-2","The FMI should adopt a risk-based approach in developing the comprehensive testing programme. This should be reviewed and updated on a regular basis taking into due account the evolving landscape of threats and the criticality of information assets.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","RS.IM-1.3","Full"]
[494,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",2,"ECB CROE 2.6.2-2","The FMI should adopt a risk-based approach in developing the comprehensive testing programme. This should be reviewed and updated on a regular basis taking into due account the evolving landscape of threats and the criticality of information assets.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[495,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",2,"ECB CROE 2.6.2-2","The FMI should adopt a risk-based approach in developing the comprehensive testing programme. This should be reviewed and updated on a regular basis taking into due account the evolving landscape of threats and the criticality of information assets.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","PR.IP-10.2","Full"]
[496,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",3,"ECB CROE 2.6.2-3","The FMI should develop appropriate capabilities and involve, if deemed necessary, all relevant internal stakeholders (including business lines and operational units) when implementing its testing programme.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","PR.IP-10.3","Full"]
[497,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",3,"ECB CROE 2.6.2-3","The FMI should develop appropriate capabilities and involve, if deemed necessary, all relevant internal stakeholders (including business lines and operational units) when implementing its testing programme.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","PR.IP-10.4","Full"]
[498,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",4,"ECB CROE 2.6.2-4","The FMI should ensure that the tests are undertaken by independent parties, whether internal or external.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[499,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",5,"ECB CROE 2.6.2-5","For continuous improvement of its cyber resilience posture, the FMI should establish policies and procedures to prioritise and remedy issues identified from the various tests and perform subsequent validation to assess whether gaps have been fully addressed.","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","RS.IM-1.2","Full"]
[500,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",5,"ECB CROE 2.6.2-5","For continuous improvement of its cyber resilience posture, the FMI should establish policies and procedures to prioritise and remedy issues identified from the various tests and perform subsequent validation to assess whether gaps have been fully addressed.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[501,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",6,"ECB CROE 2.6.2-6","The FMI’s Board and senior management should incorporate lessons learned from the test results.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","PR.IP-10.3","Full"]
[502,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",7,"ECB CROE 2.6.2-7","The FMI should test critical systems, applications and data recovery plans at least annually.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[503,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",7,"ECB CROE 2.6.2-7","The FMI should test critical systems, applications and data recovery plans at least annually.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[504,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",8,"ECB CROE 2.6.2-8","The FMI should test response, resumption and recovery plans, including governance and coordination, and crisis communication arrangements and practices, at least annually.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[505,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",8,"ECB CROE 2.6.2-8","The FMI should test response, resumption and recovery plans, including governance and coordination, and crisis communication arrangements and practices, at least annually.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","PR.IP-10.4","Full"]
[506,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","General:",9,"ECB CROE 2.6.2-9","The FMI should test the information backups periodically to verify they are accessible and readable.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","PR.IP-4.2","Full"]
[507,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",10,"ECB CROE 2.6.2-10","The FMI should develop a documented and regularly updated vulnerability management process in order to classify, prioritise and remedy potential weaknesses identified in vulnerability assessments and perform subsequent validation to assess whether gaps have been fully addressed.","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","PR.IP-12.1","Full"]
[508,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",10,"ECB CROE 2.6.2-10","The FMI should develop a documented and regularly updated vulnerability management process in order to classify, prioritise and remedy potential weaknesses identified in vulnerability assessments and perform subsequent validation to assess whether gaps have been fully addressed.","PR.IP-12.2: The organization establishes a process to prioritize and remedy issues identified through vulnerability scanning.","PR.IP-12.2","Full"]
[509,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",10,"ECB CROE 2.6.2-10","The FMI should develop a documented and regularly updated vulnerability management process in order to classify, prioritise and remedy potential weaknesses identified in vulnerability assessments and perform subsequent validation to assess whether gaps have been fully addressed.","RS.AN-5.3: The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.","RS.AN-5.3","Full"]
[510,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",11,"ECB CROE 2.6.2-11","The FMI’s vulnerability management process should help any type of exploitable weakness to be identified (technical, processual, organisational and emergent) in the critical functions, their supporting processes and information assets where they reside.","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","PR.IP-12.1","Full"]
[511,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",11,"ECB CROE 2.6.2-11","The FMI’s vulnerability management process should help any type of exploitable weakness to be identified (technical, processual, organisational and emergent) in the critical functions, their supporting processes and information assets where they reside.","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","ID.RA-1.1","Full"]
[512,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",12,"ECB CROE 2.6.2-12","The FMI should conduct vulnerability scanning for their external-facing services and the internal systems and networks on a regular basis.","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","DE.CM-8.1","Full"]
[513,2.6,"Testing","2.6.2 Expectations",{"$f":"LEFT(D520,FIND(\" \",D520)-1)","v":"2.6.2"},"EVOLVING","Vulnerability assessments:",13,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E520,\"-\",H520)","v":"ECB CROE 2.6.2-13"},"The FMI should perform vulnerability assessments before any deployment or redeployment of new or existing services supporting critical functions, applications and infrastructure components for fixing bugs and weaknesses, consistently with change and release management processes in place.","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.",{"$f":"LEFT(K520,FIND(\":\",K520)-1)","v":"PR.IP-2.1"},"Full"]
[514,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",13,"ECB CROE 2.6.2-13","The FMI should perform vulnerability assessments before any deployment or redeployment of new or existing services supporting critical functions, applications and infrastructure components for fixing bugs and weaknesses, consistently with change and release management processes in place.","PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment.","PR.IP-2.3","Full"]
[515,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Vulnerability assessments:",14,"ECB CROE 2.6.2-14","The FMI should periodically conduct vulnerability assessments on running services, applications and infrastructure components for compliance checks against regulations, policy and configurations, as well as for monitoring and evaluating the effectiveness of security controls to address the identified vulnerabilities.","RS.AN-5.3: The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness.","RS.AN-5.3","Full"]
[516,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Scenario-based testing:",15,"ECB CROE 2.6.2-15","The FMI should perform different scenario-based tests, including extreme but plausible scenarios, to evaluate and improve its incident detection capability, as well as response, resumption and recovery plans. Scenario-based tests can take the form of desktop exercises or simulations.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[517,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Scenario-based testing:",16,"ECB CROE 2.6.2-16","The FMI’s Board and senior management should be engaged in the scenario-based test, when appropriate.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","PR.IP-10.3","Full"]
[518,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Scenario-based testing:",17,"ECB CROE 2.6.2-17","To improve the FMI’s staff awareness and enhance the risk culture within the organisation, the scenario-based tests should include social engineering and phishing simulation.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[519,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Scenario-based testing:",18,"ECB CROE 2.6.2-18","The FMI should test of the extent to which internal skills, processes and procedures can adequately respond to extreme but plausible scenarios, with a view to achieving stronger operational resilience.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. ","PR.IP-10.4","Full"]
[520,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Scenario-based testing:",18,"ECB CROE 2.6.2-18","The FMI should test of the extent to which internal skills, processes and procedures can adequately respond to extreme but plausible scenarios, with a view to achieving stronger operational resilience.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[521,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Scenario-based testing:",18,"ECB CROE 2.6.2-18","The FMI should test of the extent to which internal skills, processes and procedures can adequately respond to extreme but plausible scenarios, with a view to achieving stronger operational resilience.","PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. ","PR.AT-2.3","Full"]
[522,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Penetration tests:",19,"ECB CROE 2.6.2-19","The FMI should conduct penetration tests on their external-facing services and the internal systems and networks to identify vulnerabilities in the adopted technology, organisation and operations regularly, or at least on an annual basis. Penetration tests should be conducted using a risk-based approach and, at the very least, in cases of major changes and new system deployment.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[523,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Penetration tests:",19,"ECB CROE 2.6.2-19","The FMI should conduct penetration tests on their external-facing services and the internal systems and networks to identify vulnerabilities in the adopted technology, organisation and operations regularly, or at least on an annual basis. Penetration tests should be conducted using a risk-based approach and, at the very least, in cases of major changes and new system deployment.","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","GV.RM-1.1","Full"]
[524,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Penetration tests:",20,"ECB CROE 2.6.2-20","The FMI should perform penetration tests, engaging all critical internal and external stakeholders in the penetration testing exercises: system owners, business continuity, and incident and crisis response teams.","PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results.","PR.IP-10.3","Full"]
[525,2.6,"Testing","2.6.2 Expectations","2.6.2","EVOLVING","Penetration tests:",20,"ECB CROE 2.6.2-20","The FMI should perform penetration tests, engaging all critical internal and external stakeholders in the penetration testing exercises: system owners, business continuity, and incident and crisis response teams.","PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes.","PR.IP-10.4","Full"]
[526,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","General:",21,"ECB CROE 2.6.2-21","The FMI should include testing practices as an integrated part of its enterprise risk management process with the aim of identifying, analysing and fixing cybersecurity vulnerabilities stemming from new products, services or interconnections.","GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.RM-1.3","Full"]
[527,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","General:",22,"ECB CROE 2.6.2-22","The FMI should develop capabilities to seek, analyse and use cyber threat intelligence to help inform and update its testing programme to ensure it is in line with the latest threat landscape, attackers’ modus operandi and vulnerabilities.","GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.RM-1.3","Full"]
[528,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","General:",23,"ECB CROE 2.6.2-23","The FMI should adopt best practices and automated tools to support the processes and procedures in place to fix technical and organisational weaknesses identified during the testing exercises and to check for compliance with approved policy and configurations.","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[529,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","General:",23,"ECB CROE 2.6.2-23","The FMI should adopt best practices and automated tools to support the processes and procedures in place to fix technical and organisational weaknesses identified during the testing exercises and to check for compliance with approved policy and configurations.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","GV.AU-3.2","Full"]
[530,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","General:",24,"ECB CROE 2.6.2-24","The FMI should perform security assessments and tests when applicable at all phases of the SDLC and at any level (business, application and technology) for the entire application portfolio, including mobile applications.","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Full"]
[531,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Vulnerability assessments:",25,"ECB CROE 2.6.2-25","The FMI should perform vulnerability scanning on an ongoing basis, rotating among environments in order to scan all environments throughout the year.","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","DE.CM-8.1","Full"]
[532,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Scenario-based testing:",26,"ECB CROE 2.6.2-26","The FMI should test its response, resumption and recovery plans against cyber attack scenarios which include data destruction, data integrity corruption, data loss, and system and data availability.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[533,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Scenario-based testing:",27,"ECB CROE 2.6.2-27","The FMI should use cybersecurity incident scenarios involving significant financial loss, as part of its stress testing process, to better understand potential spillovers and risk to its business model. The FMI should use such stress tests to further improve its risk management framework.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[534,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Penetration tests:",28,"ECB CROE 2.6.2-28","The FMI should design and perform penetration tests to simulate realistic attack techniques on systems, networks, applications and procedures.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[535,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Red team testing:",29,"ECB CROE 2.6.2-29","The FMI should conduct red team exercises to test critical functions for possible vulnerabilities and the effectiveness of an FMI’s mitigating controls, including its people, processes and technology.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[536,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Red team testing:",30,"ECB CROE 2.6.2-30","The FMI should perform red team exercises using reliable and valuable cyber threat intelligence, based on specific and plausible threat scenarios.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[537,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Red team testing:",31,"ECB CROE 2.6.2-31","The FMI should conduct independent red team exercises, utilising regulatory and industry frameworks (e.g. the European Framework for Threat-Intelligence Based Ethical Red teaming (TIBER-EU Framework)8).","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[538,2.6,"Testing","2.6.2 Expectations","2.6.2","ADVANCING","Red team testing:",32,"ECB CROE 2.6.2-32","The FMI should build its internal processes and capabilities to prepare for undertaking the independent red team exercise (e.g. establishing an internal white team, developing incident escalation procedures, following appropriate methodologies and establishing robust risk management controls), as set out in the TIBER-EU Framework, for example.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[539,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",33,"ECB CROE 2.6.2-33","The FMI should develop, monitor and analyse metrics to assess the performance and effectiveness of its testing programme. The FMI should use the analysis conducted to further improve its testing programme.","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[540,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",33,"ECB CROE 2.6.2-33","The FMI should develop, monitor and analyse metrics to assess the performance and effectiveness of its testing programme. The FMI should use the analysis conducted to further improve its testing programme.","GV.SP-2.3: The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time.","GV.SP-2.3","Full"]
[541,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",33,"ECB CROE 2.6.2-33","The FMI should develop, monitor and analyse metrics to assess the performance and effectiveness of its testing programme. The FMI should use the analysis conducted to further improve its testing programme.","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","DE.DP-5.1","Full"]
[542,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",34,"ECB CROE 2.6.2-34","The FMI should regularly conduct tests in collaboration with its peers, participants and third parties.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[543,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",35,"ECB CROE 2.6.2-35","The FMI should proactively engage in industry-wide exercises in order to test cooperation and coordination protocols and communication plans. These exercises should foster the FMI’s awareness on cross-sector cooperation and third-party risks.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[544,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",36,"ECB CROE 2.6.2-36","The FMI should promote and participate in cross-sector cyber testing exercises to assess the soundness and security of its value chain as a whole.","DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations.","DM.ED-2.1","Full"]
[545,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",36,"ECB CROE 2.6.2-36","The FMI should promote and participate in cross-sector cyber testing exercises to assess the soundness and security of its value chain as a whole.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","DM.ED-6.5","Full"]
[546,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",36,"ECB CROE 2.6.2-36","The FMI should promote and participate in cross-sector cyber testing exercises to assess the soundness and security of its value chain as a whole.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[547,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",36,"ECB CROE 2.6.2-36","The FMI should promote and participate in cross-sector cyber testing exercises to assess the soundness and security of its value chain as a whole.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[548,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",37,"ECB CROE 2.6.2-37","The FMI should test the cooperation arrangements in place with relevant external entities at least annually (e.g. third-party security service providers, law enforcement agencies, computer emergency response teams (CERTs) or information sharing and analysis centres (ISACs), etc.) in order to validate their effectiveness.","DM.ED-4.3: The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships.","DM.ED-4.3","Full"]
[549,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",37,"ECB CROE 2.6.2-37","The FMI should test the cooperation arrangements in place with relevant external entities at least annually (e.g. third-party security service providers, law enforcement agencies, computer emergency response teams (CERTs) or information sharing and analysis centres (ISACs), etc.) in order to validate their effectiveness.","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","DE.DP-4.2","Full"]
[550,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",38,"ECB CROE 2.6.2-38","The FMI should consider discussing relevant test conclusions with other stakeholders to boost the cyber resilience of its ecosystem and the financial sector as a whole, as far as possible and under specific information-sharing arrangements.","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1","Full"]
[551,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","General:",38,"ECB CROE 2.6.2-38","The FMI should consider discussing relevant test conclusions with other stakeholders to boost the cyber resilience of its ecosystem and the financial sector as a whole, as far as possible and under specific information-sharing arrangements.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[552,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Vulnerability assessments:",39,"ECB CROE 2.6.2-39","The FMI should develop and adopt a range of effective practices and tools (e.g. a Bug Bounty programme and static and dynamic code reviews, etc.) as part of its vulnerability management process, and have appropriate safeguards in place to manage them.","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","PR.IP-12.1","Full"]
[553,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Scenario-based testing:",40,"ECB CROE 2.6.2-40","The FMI should conduct scenario-based tests that cover breaches affecting multiple portions of the FMI's ecosystem in order to identify and analyse potential complexities, interdependencies and possible contagion both at business and operational level which should be taken into account in the FMI’s cyber resilience framework.","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1","Full"]
[554,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Scenario-based testing:",41,"ECB CROE 2.6.2-41","The FMI should collaborate with the ecosystem to develop cybersecurity incident scenarios involving significant financial loss and use them for stress tests to better understand potential spillovers and contagion risk to the ecosystem. The FMI should use such stress tests to further improve its cyber resilience posture, which contributes to improving the ecosystem’s resilience as a whole.","DM.ED-5.1: The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector.","DM.ED-5.1","Full"]
[555,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Scenario-based testing:",41,"ECB CROE 2.6.2-41","The FMI should collaborate with the ecosystem to develop cybersecurity incident scenarios involving significant financial loss and use them for stress tests to better understand potential spillovers and contagion risk to the ecosystem. The FMI should use such stress tests to further improve its cyber resilience posture, which contributes to improving the ecosystem’s resilience as a whole.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[556,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Scenario-based testing:",41,"ECB CROE 2.6.2-41","The FMI should collaborate with the ecosystem to develop cybersecurity incident scenarios involving significant financial loss and use them for stress tests to better understand potential spillovers and contagion risk to the ecosystem. The FMI should use such stress tests to further improve its cyber resilience posture, which contributes to improving the ecosystem’s resilience as a whole.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","DM.ED-6.5","Full"]
[557,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Scenario-based testing:",41,"ECB CROE 2.6.2-41","The FMI should collaborate with the ecosystem to develop cybersecurity incident scenarios involving significant financial loss and use them for stress tests to better understand potential spillovers and contagion risk to the ecosystem. The FMI should use such stress tests to further improve its cyber resilience posture, which contributes to improving the ecosystem’s resilience as a whole.","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","DM.RS-2.1","Full"]
[558,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Scenario-based testing:",41,"ECB CROE 2.6.2-41","The FMI should collaborate with the ecosystem to develop cybersecurity incident scenarios involving significant financial loss and use them for stress tests to better understand potential spillovers and contagion risk to the ecosystem. The FMI should use such stress tests to further improve its cyber resilience posture, which contributes to improving the ecosystem’s resilience as a whole.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[559,2.6,"Testing","2.6.2 Expectations","2.6.2","INNOVATING","Red team testing:",42,"ECB CROE 2.6.2-42","In addition to periodic independent and external red team exercises, the FMI should develop an internal red team capability with the appropriate methodologies, sophisticated tools and appropriately skilled staff. The internal red team should regularly conduct red team exercises and engage with the internal blue team to share its findings and make improvements to the FMI’s cyber resilience posture.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[560,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,1,"ECB CROE 2.7.2.1-1","The FMI should identify cyber threats that could materially affect its ability to perform or provide services as expected, or that could have a significant impact on its ability to meet its own obligations or have knock-on effects within its ecosystem.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[561,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,1,"ECB CROE 2.7.2.1-1","The FMI should identify cyber threats that could materially affect its ability to perform or provide services as expected, or that could have a significant impact on its ability to meet its own obligations or have knock-on effects within its ecosystem.","ID.RA-3.2: The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past. ","ID.RA-3.2","Full"]
[562,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,1,"ECB CROE 2.7.2.1-1","The FMI should identify cyber threats that could materially affect its ability to perform or provide services as expected, or that could have a significant impact on its ability to meet its own obligations or have knock-on effects within its ecosystem.","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","ID.RA-5.3","Full"]
[563,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,2,"ECB CROE 2.7.2.1-2","The FMI should have capabilities in place to gather cyber threat information from internal and external sources (e.g. application, system and network logs; security products such as firewalls and IDSs; trusted threat intelligence providers; and publicly available information).","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[564,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,2,"ECB CROE 2.7.2.1-2","The FMI should have capabilities in place to gather cyber threat information from internal and external sources (e.g. application, system and network logs; security products such as firewalls and IDSs; trusted threat intelligence providers; and publicly available information).","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","ID.RA-5.2","Full"]
[565,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,3,"ECB CROE 2.7.2.1-3","The FMI should belong or subscribe to a threat and vulnerability information-sharing source and/or ISAC that provides information on cyber threats and vulnerabilities. Cyber threat information gathered by the FMI should include analysis of tactics, techniques and procedures (TTPs) of real-life attackers, their modus operandi and information on geopolitical developments that may trigger cyber attacks on any entity within the FMI’s ecosystem.","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","ID.RA-5.2","Full"]
[566,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,3,"ECB CROE 2.7.2.1-3","The FMI should belong or subscribe to a threat and vulnerability information-sharing source and/or ISAC that provides information on cyber threats and vulnerabilities. Cyber threat information gathered by the FMI should include analysis of tactics, techniques and procedures (TTPs) of real-life attackers, their modus operandi and information on geopolitical developments that may trigger cyber attacks on any entity within the FMI’s ecosystem.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[567,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,3,"ECB CROE 2.7.2.1-3","The FMI should belong or subscribe to a threat and vulnerability information-sharing source and/or ISAC that provides information on cyber threats and vulnerabilities. Cyber threat information gathered by the FMI should include analysis of tactics, techniques and procedures (TTPs) of real-life attackers, their modus operandi and information on geopolitical developments that may trigger cyber attacks on any entity within the FMI’s ecosystem.","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","RS.AN-5.1","Full"]
[568,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,3,"ECB CROE 2.7.2.1-3","The FMI should belong or subscribe to a threat and vulnerability information-sharing source and/or ISAC that provides information on cyber threats and vulnerabilities. Cyber threat information gathered by the FMI should include analysis of tactics, techniques and procedures (TTPs) of real-life attackers, their modus operandi and information on geopolitical developments that may trigger cyber attacks on any entity within the FMI’s ecosystem.","RS.AN-5.2: The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond.","RS.AN-5.2","Full"]
[569,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,4,"ECB CROE 2.7.2.1-4","The FMI should have the capabilities to analyse the cyber threat information gathered from different sources, while taking into account the business and technical characteristics of the FMI, in order to:","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[570,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,"4.a","ECB CROE 2.7.2.1-4.a","determine the motivation and capabilities of threat actors (including their TTPs) and the extent to which the FMI is at risk of a targeted attack from them;","RS.AN-5.2: The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond.","RS.AN-5.2","Full"]
[571,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,"4.b","ECB CROE 2.7.2.1-4.b","assess the risk of technical vulnerabilities in operating systems, applications and other software, which could be exploited to perform attacks on the FMI;","RS.AN-5.2: The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond.","RS.AN-5.2","Full"]
[572,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,"4.c","ECB CROE 2.7.2.1-4.c","analyse cybersecurity incidents experienced by other organisations (where available), including types of incident and origin of attacks, target of attacks, preceding threat events and frequency of occurrence, and determine the potential risk these pose to the FMI.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[573,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,5,"ECB CROE 2.7.2.1-5","The FMI should analyse the information gathered above to produce relevant cyber threat intelligence, and continuously use it to assess and manage security threats and vulnerabilities for the purpose of implementing appropriate cybersecurity controls in its systems and, on a more general level, enhancing its cyber resilience framework and capabilities on an ongoing basis.","GV.PL-2.3: The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.PL-2.3","Full"]
[574,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,5,"ECB CROE 2.7.2.1-5","The FMI should analyse the information gathered above to produce relevant cyber threat intelligence, and continuously use it to assess and manage security threats and vulnerabilities for the purpose of implementing appropriate cybersecurity controls in its systems and, on a more general level, enhancing its cyber resilience framework and capabilities on an ongoing basis.","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","DE.DP-5.1","Full"]
[575,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,5,"ECB CROE 2.7.2.1-5","The FMI should analyse the information gathered above to produce relevant cyber threat intelligence, and continuously use it to assess and manage security threats and vulnerabilities for the purpose of implementing appropriate cybersecurity controls in its systems and, on a more general level, enhancing its cyber resilience framework and capabilities on an ongoing basis.","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","RS.IM-1.1","Full"]
[576,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,5,"ECB CROE 2.7.2.1-5","The FMI should analyse the information gathered above to produce relevant cyber threat intelligence, and continuously use it to assess and manage security threats and vulnerabilities for the purpose of implementing appropriate cybersecurity controls in its systems and, on a more general level, enhancing its cyber resilience framework and capabilities on an ongoing basis.","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RS.IM-2.1","Full"]
[577,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence",{"$f":"LEFT(D584,FIND(\" \",D584)-1)","v":"2.7.2.1"},"EVOLVING",null,5,{"$f":"_xlfn.CONCAT(\"ECB CROE \",E584,\"-\",H584)","v":"ECB CROE 2.7.2.1-5"},"The FMI should analyse the information gathered above to produce relevant cyber threat intelligence, and continuously use it to assess and manage security threats and vulnerabilities for the purpose of implementing appropriate cybersecurity controls in its systems and, on a more general level, enhancing its cyber resilience framework and capabilities on an ongoing basis.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.",{"$f":"LEFT(K584,FIND(\":\",K584)-1)","v":"RC.IM-2.1"},"Full"]
[578,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,6,"ECB CROE 2.7.2.1-6","The FMI should ensure that the gathering and analysis of cyber threat information and the production of cyber threat intelligence are reviewed and updated regularly.","ID.RA-3.3: The organization regularly reviews and updates results of its cyber threat analysis.","ID.RA-3.3","Full"]
[579,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,7,"ECB CROE 2.7.2.1-7","The FMI should ensure that cyber threat intelligence is made available to appropriate staff who are responsible for mitigating cyber risks at the strategic, tactical and operational levels within the FMI.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","DE.DP-4.1","Full"]
[580,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,7,"ECB CROE 2.7.2.1-7","The FMI should ensure that cyber threat intelligence is made available to appropriate staff who are responsible for mitigating cyber risks at the strategic, tactical and operational levels within the FMI.","RS.CO-1.2: The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization.","RS.CO-1.2","Full"]
[581,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","EVOLVING",null,8,"ECB CROE 2.7.2.1-8","The FMI should incorporate lessons learned from its analysis of the cyber threat information into the employee training and awareness programmes.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","PR.AT-2.2","Full"]
[582,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,9,"ECB CROE 2.7.2.1-9","The FMI should continuously use its cyber threat intelligence to anticipate, as much as possible, a cyber attacker's capabilities, intentions and modus operandi, and subsequently possible future attacks.","RS.AN-5.2: The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond.","RS.AN-5.2","Full"]
[583,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,10,"ECB CROE 2.7.2.1-10","The FMI should develop a cyber threat risk dashboard, which uses the cyber threat information and intelligence to outline, among other things:","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[584,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,10,"ECB CROE 2.7.2.1-10","The FMI should develop a cyber threat risk dashboard, which uses the cyber threat information and intelligence to outline, among other things:","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[585,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,10,"ECB CROE 2.7.2.1-10","The FMI should develop a cyber threat risk dashboard, which uses the cyber threat information and intelligence to outline, among other things:","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[586,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.a","ECB CROE 2.7.2.1-10.a","the most likely threat actors for the FMI;","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[587,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.a","ECB CROE 2.7.2.1-10.a","the most likely threat actors for the FMI;","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[588,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.b","ECB CROE 2.7.2.1-10.b","the TTPs that may be used by such threat actors;","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[589,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.c","ECB CROE 2.7.2.1-10.c","the likely vulnerabilities that may be exploited by such threat actors;","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[590,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.c","ECB CROE 2.7.2.1-10.c","the likely vulnerabilities that may be exploited by such threat actors;","ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization.","ID.RA-5.1","Full"]
[591,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.d","ECB CROE 2.7.2.1-10.d","the likelihood of attack from such threat actors and the impact on the confidentiality, integrity and availability of the FMI’s business processes and its reputation that could arise from such attacks;","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","ID.RA-5.3","Full"]
[592,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.e","ECB CROE 2.7.2.1-10.e","the impact of attacks already conducted by such threat actors on the ecosystem;","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","ID.RA-5.3","Full"]
[593,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,"10.f","ECB CROE 2.7.2.1-10.f","the risk mitigation measures in place to manage a potential attack.","ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units. ","ID.RA-6.2","Full"]
[594,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,11,"ECB CROE 2.7.2.1-11","The cyber threat risk dashboard should be continuously reviewed and updated in the light of new threats and vulnerabilities and discussed by the Board and senior management.","GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed.","GV.IR-2.2","Full"]
[595,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,11,"ECB CROE 2.7.2.1-11","The cyber threat risk dashboard should be continuously reviewed and updated in the light of new threats and vulnerabilities and discussed by the Board and senior management.","GV.IR-3.1: An independent risk management function reports to the appropriate governing authority (e.g., the Board or one of its committees) and to the appropriate risk management officer within the organization on the implementation of the cyber risk management framework throughout the organization.","GV.IR-3.1","Full"]
[596,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","ADVANCING",null,12,"ECB CROE 2.7.2.1-12","The FMI should include in its threat analysis those threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past. The FMI should review and update this analysis regularly.","ID.RA-3.2: The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past. ","ID.RA-3.2","Full"]
[597,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","INNOVATING",null,13,"ECB CROE 2.7.2.1-13","The FMI should ensure that the scope of cyber threat intelligence gathering includes the capability to gather and interpret information about relevant cyber threats arising from the FMI’s participants, service and utility providers and other FMIs, and to interpret this information in ways that allow the FMI to identify, assess and manage security threats and vulnerabilities for the purpose of implementing appropriate safeguards in its systems.","ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations.","ID.RA-5.2","Full"]
[598,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","INNOVATING",null,13,"ECB CROE 2.7.2.1-13","The FMI should ensure that the scope of cyber threat intelligence gathering includes the capability to gather and interpret information about relevant cyber threats arising from the FMI’s participants, service and utility providers and other FMIs, and to interpret this information in ways that allow the FMI to identify, assess and manage security threats and vulnerabilities for the purpose of implementing appropriate safeguards in its systems.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[599,2.7,"Situational awareness","2.7.2.1 Cyber threat intelligence","2.7.2.1","INNOVATING",null,14,"ECB CROE 2.7.2.1-14","The FMI should integrate and align its cyber threat intelligence process with its SOC. The FMI should use information gathered from its SOC to further enhance its cyber threat intelligence; and conversely, use its cyber threat intelligence to inform its SOC.","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","RS.AN-5.1","Full"]
[600,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,15,"ECB CROE 2.7.2.2-15","The FMI should define the goals and objectives of information sharing, in line with its business objectives and cyber resilience framework. At the very least, the objectives should include collecting and exchanging information in a timely manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other sector participants during and following a cyber attack.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[601,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,15,"ECB CROE 2.7.2.2-15","The FMI should define the goals and objectives of information sharing, in line with its business objectives and cyber resilience framework. At the very least, the objectives should include collecting and exchanging information in a timely manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other sector participants during and following a cyber attack.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","DE.DP-4.1","Full"]
[602,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,15,"ECB CROE 2.7.2.2-15","The FMI should define the goals and objectives of information sharing, in line with its business objectives and cyber resilience framework. At the very least, the objectives should include collecting and exchanging information in a timely manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other sector participants during and following a cyber attack.","RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","RS.CO-3.2","Full"]
[603,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,16,"ECB CROE 2.7.2.2-16","The FMI should define the scope of information-sharing activities by identifying the types of information available to be shared (e.g. attackers’ modus operandi, indicators of compromise, and threats and vulnerabilities, etc.), the circumstances under which sharing this information is permitted (e.g. in the case of a cyber incident), those with whom the information can and should be shared (e.g. the FMI’s direct stakeholders such as critical service providers, participants and other interconnected FMIs, etc.), and how information provided to the FMI and other sector participants will be acted upon.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[604,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,17,"ECB CROE 2.7.2.2-17","The FMI should establish and regularly review the information-sharing rules and agreements and implement procedures that allow information to be shared promptly and in line with the objectives and scope established above, while at the same time meeting its obligations to protect potentially sensitive data that may have adverse consequences if disclosed improperly.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[605,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,18,"ECB CROE 2.7.2.2-18","The FMI should establish trusted and safe channels of communication with its direct stakeholders for exchanging information.","RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","RS.CO-3.2","Full"]
[606,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,18,"ECB CROE 2.7.2.2-18","The FMI should establish trusted and safe channels of communication with its direct stakeholders for exchanging information.","RS.CO-5.2: The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","RS.CO-5.2","Full"]
[607,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","EVOLVING",null,19,"ECB CROE 2.7.2.2-19","The FMI should have in place a process to access and share information with external stakeholders in a timely manner, such as regulators, law enforcement or other organisations within the FMI’s ecosystem.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","RS.CO-2.2","Full"]
[608,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","ADVANCING",null,20,"ECB CROE 2.7.2.2-20","The FMI should participate actively in existing information-sharing groups and facilities, including cross-industry, cross-government and cross-border groups to gather, distribute and assess information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1","Full"]
[609,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","ADVANCING",null,20,"ECB CROE 2.7.2.2-20","The FMI should participate actively in existing information-sharing groups and facilities, including cross-industry, cross-government and cross-border groups to gather, distribute and assess information about cyber practices, cyber threats and early warning indicators relating to cyber threats.","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. ","ID.RA-2.1","Full"]
[610,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","ADVANCING",null,21,"ECB CROE 2.7.2.2-21","The FMI should establish and implement protocols for sharing information relating to threats, vulnerabilities and cyber incidents with employees, based on their specific roles and responsibilities.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","DE.DP-4.1","Full"]
[611,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","ADVANCING",null,22,"ECB CROE 2.7.2.2-22","The FMI should share information with relevant stakeholders in the ecosystem to achieve broader cyber resilience situational awareness, including promoting an understanding of each other’s approach to achieving cyber resilience.","RS.CO-5.2: The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced.","RS.CO-5.2","Full"]
[612,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","INNOVATING",null,23,"ECB CROE 2.7.2.2-23","The FMI should make use of threat intelligence capabilities that provide internal and external threat and vulnerability information, analyse this information, and disseminate it to the relevant stakeholders in the ecosystem promptly, so as to help stakeholders to respond quickly and mitigate risks.","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders.","DE.DP-4.1","Full"]
[613,2.7,"Situational awareness","2.7.2.2 Information sharing","2.7.2.2","INNOVATING",null,24,"ECB CROE 2.7.2.2-24","The FMI should participate in efforts to identify the gaps in current information-sharing mechanisms and seek to address them, in order to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents.","RS.CO-5.1","Full"]
[614,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,1,"ECB CROE 2.8.2.1-1","The FMI should have capabilities in place to gather information on common vulnerabilities, cyber threats, events and incidents occurring both within and outside the FMI.","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams).","RS.AN-5.1","Full"]
[615,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,1,"ECB CROE 2.8.2.1-1","The FMI should have capabilities in place to gather information on common vulnerabilities, cyber threats, events and incidents occurring both within and outside the FMI.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[616,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,2,"ECB CROE 2.8.2.1-2","The FMI should have the capabilities to analyse the information gathered and assess the potential impact on its cyber resilience framework.","ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed.","ID.RA-5.3","Full"]
[617,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,2,"ECB CROE 2.8.2.1-2","The FMI should have the capabilities to analyse the information gathered and assess the potential impact on its cyber resilience framework.","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","GV.SF-3.3","Full"]
[618,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,3,"ECB CROE 2.8.2.1-3","The FMI should distil and classify the lessons learned (e.g. strategic, tactical and operational), identify the key stakeholders to whom these apply, incorporate them to improve the FMI’s cyber resilience framework and capabilities, and convey them to each relevant stakeholder on an ongoing basis.","PR.IP-7.1:  A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment.","PR.IP-7.1","Full"]
[619,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,3,"ECB CROE 2.8.2.1-3","The FMI should distil and classify the lessons learned (e.g. strategic, tactical and operational), identify the key stakeholders to whom these apply, incorporate them to improve the FMI’s cyber resilience framework and capabilities, and convey them to each relevant stakeholder on an ongoing basis.","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","RS.IM-1.1","Full"]
[620,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,3,"ECB CROE 2.8.2.1-3","The FMI should distil and classify the lessons learned (e.g. strategic, tactical and operational), identify the key stakeholders to whom these apply, incorporate them to improve the FMI’s cyber resilience framework and capabilities, and convey them to each relevant stakeholder on an ongoing basis.","RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization.","RS.IM-1.3","Full"]
[621,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,3,"ECB CROE 2.8.2.1-3","The FMI should distil and classify the lessons learned (e.g. strategic, tactical and operational), identify the key stakeholders to whom these apply, incorporate them to improve the FMI’s cyber resilience framework and capabilities, and convey them to each relevant stakeholder on an ongoing basis.","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RS.IM-2.1","Full"]
[622,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,3,"ECB CROE 2.8.2.1-3","The FMI should distil and classify the lessons learned (e.g. strategic, tactical and operational), identify the key stakeholders to whom these apply, incorporate them to improve the FMI’s cyber resilience framework and capabilities, and convey them to each relevant stakeholder on an ongoing basis.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[623,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,3,"ECB CROE 2.8.2.1-3","The FMI should distil and classify the lessons learned (e.g. strategic, tactical and operational), identify the key stakeholders to whom these apply, incorporate them to improve the FMI’s cyber resilience framework and capabilities, and convey them to each relevant stakeholder on an ongoing basis.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RC.IM-2.1","Full"]
[624,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,4,"ECB CROE 2.8.2.1-4","Senior management should ensure that it has a programme for continuing cyber resilience training and skills development for all staff. This training programme should include the Board members and senior management and should be conducted at least annually. The annual cyber resilience training should include incident response, current cyber threats (e.g. phishing, spear phishing, social engineering and mobile security) and emerging issues. The FMI should ensure that the training programme equips staff to deal with cyber incidents, including how to report unusual activity.","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  ","PR.AT-1.2","Full"]
[625,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,4,"ECB CROE 2.8.2.1-4","Senior management should ensure that it has a programme for continuing cyber resilience training and skills development for all staff. This training programme should include the Board members and senior management and should be conducted at least annually. The annual cyber resilience training should include incident response, current cyber threats (e.g. phishing, spear phishing, social engineering and mobile security) and emerging issues. The FMI should ensure that the training programme equips staff to deal with cyber incidents, including how to report unusual activity.","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[626,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,5,"ECB CROE 2.8.2.1-5","The FMI should ensure that cybersecurity awareness materials are made available to staff when prompted by highly visible cyber events or by regulatory alerts.","PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. ","PR.AT-2.2","Full"]
[627,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,6,"ECB CROE 2.8.2.1-6","The FMI should incorporate lessons learned into the staff training, awareness programmes and materials, on an ongoing and dynamic basis. The FMI should utilise industry and authority initiatives related to awareness and training, where possible.","PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment.","PR.AT-1.3","Full"]
[628,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,6,"ECB CROE 2.8.2.1-6","The FMI should incorporate lessons learned into the staff training, awareness programmes and materials, on an ongoing and dynamic basis. The FMI should utilise industry and authority initiatives related to awareness and training, where possible.","GV.SF-2.1: The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","GV.SF-2.1","Full"]
[629,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,7,"ECB CROE 2.8.2.1-7","The FMI should set a range of indicators and develop management information to measure and monitor the effective implementation of the cyber resilience strategy and framework on a regular basis and its evolution over time. For example, relevant information and indicators could be: the percentage of the FMI’s staff that have received cybersecurity training; the percentage of incidents reported within the required timeframe per applicable incident category; the percentage of vulnerabilities mitigated within a defined time period after discovery; and yearly reports monitoring progress of indicators, etc..","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. ","GV.SP-2.1","Full"]
[630,2.8,"Learning and evolving","2.8.2.1 Cyber threat intelligence","2.8.2.1","EVOLVING",null,7,"ECB CROE 2.8.2.1-7","The FMI should set a range of indicators and develop management information to measure and monitor the effective implementation of the cyber resilience strategy and framework on a regular basis and its evolution over time. For example, relevant information and indicators could be: the percentage of the FMI’s staff that have received cybersecurity training; the percentage of incidents reported within the required timeframe per applicable incident category; the percentage of vulnerabilities mitigated within a defined time period after discovery; and yearly reports monitoring progress of indicators, etc..","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program. ","GV.SP-2.2","Full"]

{"sheet":"Mapping to EBA","index":10,"n_rows":246,"n_cols":11,"rows_kept":246,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Proprietary"]
[]
[null,"Mapping to the European Banking Authority's “EBA Guidelines on ICT and security risk management” "]
[]
["Mapping #","Topic ID","Topic","Sub-topic ID","Sub-topic","Statement ID","ID","Statement","FSP Diagnostic Statement","FSP ID","Mapping Type"]
[1,"3.2.","Governance and Strategy","3.2.1.","Governance",2,{"$f":"_xlfn.CONCAT(\"EBA GITSRM \",D7,F7)","v":"EBA GITSRM 3.2.1.2"},"The management body should ensure that financial institutions have adequate internal governance and internal control framework in place for their ICT and security risks. The management body should set clear roles and responsibilities for ICT functions, information security risk management, and business continuity, including those for the management body and its committees.","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.",{"$f":"LEFT(I7,FIND(\":\",I7)-1)","v":"GV.SF-1.2"},"Full"]
[2,"3.2.","Governance and Strategy","3.2.1.","Governance",3,"EBA GITSRM 3.2.1.3","The management body should ensure that the quantity and skills of financial institutions’ staff is adequate to support their ICT operational needs and their ICT and security risk management processes on an ongoing basis and to ensure the implementation of their ICT strategy. The management body should ensure that the allocated budget is appropriate to fulfil the above. Furthermore, financial institutions should ensure that all staff members, including key function holders, receive appropriate training on ICT and security risks, including on information security, on an annual basis, or more frequently if required (see also Section 3.4.7).","GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives.","GV.SF-3.3","Full"]
[3,"3.2.","Governance and Strategy","3.2.1.","Governance",3,"EBA GITSRM 3.2.1.3","The management body should ensure that the quantity and skills of financial institutions’ staff is adequate to support their ICT operational needs and their ICT and security risk management processes on an ongoing basis and to ensure the implementation of their ICT strategy. The management body should ensure that the allocated budget is appropriate to fulfil the above. Furthermore, financial institutions should ensure that all staff members, including key function holders, receive appropriate training on ICT and security risks, including on information security, on an annual basis, or more frequently if required (see also Section 3.4.7).","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","GV.SF-1.2","Full"]
[4,"3.2.","Governance and Strategy","3.2.1.","Governance",3,"EBA GITSRM 3.2.1.3","The management body should ensure that the quantity and skills of financial institutions’ staff is adequate to support their ICT operational needs and their ICT and security risk management processes on an ongoing basis and to ensure the implementation of their ICT strategy. The management body should ensure that the allocated budget is appropriate to fulfil the above. Furthermore, financial institutions should ensure that all staff members, including key function holders, receive appropriate training on ICT and security risks, including on information security, on an annual basis, or more frequently if required (see also Section 3.4.7).","GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). ","GV.RR-2.2","Full"]
[5,"3.2.","Governance and Strategy","3.2.1.","Governance",3,"EBA GITSRM 3.2.1.3","The management body should ensure that the quantity and skills of financial institutions’ staff is adequate to support their ICT operational needs and their ICT and security risk management processes on an ongoing basis and to ensure the implementation of their ICT strategy. The management body should ensure that the allocated budget is appropriate to fulfil the above. Furthermore, financial institutions should ensure that all staff members, including key function holders, receive appropriate training on ICT and security risks, including on information security, on an annual basis, or more frequently if required (see also Section 3.4.7).","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[6,"3.2.","Governance and Strategy","3.2.1.","Governance",4,"EBA GITSRM 3.2.1.4","The management body has overall accountability for setting, approving and overseeing the implementation of financial institutions ICT strategy as part of their overall business strategy as well as for the establishment of an effective risk management framework for ICT and security risks.","GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework.","GV.SF-1.2","Full"]
[7,"3.2.","Governance and Strategy","3.2.2.","Strategy",5,"EBA GITSRM 3.2.2.5","The ICT strategy should be aligned with financial institutions overall business strategy and should define:","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework.","GV.SF-1.1","Full"]
[8,"3.2.","Governance and Strategy","3.2.2.","Strategy","5.a","EBA GITSRM 3.2.2.5.a","how financial institutions ICT should evolve to effectively support and participate in their business strategy, including the evolution of the organisational structure, ICT system changes and key dependencies with third parties;","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[9,"3.2.","Governance and Strategy","3.2.2.","Strategy","5.b","EBA GITSRM 3.2.2.5.b","the planned strategy and evolution of the architecture of ICT, including third party dependencies;","GV.TE-1.1: The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception.","GV.TE-1.1","Full"]
[10,"3.2.","Governance and Strategy","3.2.2.","Strategy","5.b","EBA GITSRM 3.2.2.5.b","the planned strategy and evolution of the architecture of ICT, including third party dependencies;","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","DM.ID-1.1","Full"]
[11,"3.2.","Governance and Strategy","3.2.2.","Strategy","5.c","EBA GITSRM 3.2.2.5.c","clear information security objectives, focusing on ICT systems and ICT services, staff and processes.","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[12,"3.2.","Governance and Strategy","3.2.2.","Strategy",6,"EBA GITSRM 3.2.2.6","Financial institutions should establish sets of action plans that contain measures to be taken to achieve the objective of the ICT strategy. These should be communicated to all relevant staff (including contractors and third party providers where applicable and relevant). The action plans should be periodically reviewed to ensure their relevance and appropriateness. Financial institutions should also establish processes to monitor and measure the effectiveness of the implementation of their ICT strategy.","GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities.","GV.SF-1.5","Full"]
[13,"3.2.","Governance and Strategy","3.2.2.","Strategy",6,"EBA GITSRM 3.2.2.6","Financial institutions should establish sets of action plans that contain measures to be taken to achieve the objective of the ICT strategy. These should be communicated to all relevant staff (including contractors and third party providers where applicable and relevant). The action plans should be periodically reviewed to ensure their relevance and appropriateness. Financial institutions should also establish processes to monitor and measure the effectiveness of the implementation of their ICT strategy.","GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  ","GV.SP-2.2","Full"]
[14,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers",7,"EBA GITSRM 3.2.3.7","Without prejudice to the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) and Article 19 of PSD2, financial institutions should ensure the effectiveness of the risk-mitigating measures as defined by their risk management framework, including the measures set out in these guidelines, when operational functions of payment services and/or ICT services and ICT systems of any activity are outsourced, including to group entities, or when using third parties.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan..","DM.ID-1.1","Full"]
[15,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers",7,"EBA GITSRM 3.2.3.7","Without prejudice to the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) and Article 19 of PSD2, financial institutions should ensure the effectiveness of the risk-mitigating measures as defined by their risk management framework, including the measures set out in these guidelines, when operational functions of payment services and/or ICT services and ICT systems of any activity are outsourced, including to group entities, or when using third parties.","DM.ED-1.1: The organization has integrated its external dependency management strategy into the overall cyber risk management plan.","DM.ED-1.1","Full"]
[16,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers",8,"EBA GITSRM 3.2.3.8","To ensure continuity of ICT services and ICT systems, financial institutions should ensure that contracts and service level agreements (both for normal circumstances as well as in the event of service disruption see also Section 3.7.2) with providers (outsourcing providers, group entities, or third party providers) include the following:","DM.ED-4.2: The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate.","DM.ED-4.2","Full"]
[17,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers","8.a","EBA GITSRM 3.2.3.8.a","appropriate and proportionate information security-related objectives and measures including requirements such as minimum cybersecurity requirements; specifications of the financial institution s data life cycle; any requirements regarding data encryption, network security and security monitoring processes, and the location of data centres;","DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization.","DM.ED-6.1","Full"]
[18,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers","8.a","EBA GITSRM 3.2.3.8.a","appropriate and proportionate information security-related objectives and measures including requirements such as minimum cybersecurity requirements; specifications of the financial institution s data life cycle; any requirements regarding data encryption, network security and security monitoring processes, and the location of data centres;","DM.ED-6.2: The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship.","DM.ED-6.2","Full"]
[19,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers","8.a","EBA GITSRM 3.2.3.8.a","appropriate and proportionate information security-related objectives and measures including requirements such as minimum cybersecurity requirements; specifications of the financial institution s data life cycle; any requirements regarding data encryption, network security and security monitoring processes, and the location of data centres;","DM.ED-6.4: Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted.","DM.ED-6.4","Full"]
[20,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers","8.a","EBA GITSRM 3.2.3.8.a","appropriate and proportionate information security-related objectives and measures including requirements such as minimum cybersecurity requirements; specifications of the financial institution s data life cycle; any requirements regarding data encryption, network security and security monitoring processes, and the location of data centres;","DM.ED-6.7: Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination.","DM.ED-6.7","Full"]
[21,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers","8.b","EBA GITSRM 3.2.3.8.b","operational and security incident handling procedures including escalation and reporting.","DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place.","DM.ED-6.5","Full"]
[22,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers",9,"EBA GITSRM 3.2.3.9","Financial institutions should monitor and seek assurance on the level of compliance of these providers with the security objectives, measures and performance targets of the financial institution.","DM.ED-6.3: Minimum cybersecurity requirements for third-parties include how the organization will monitor security of its external dependencies to ensure that requirements are continually satisfied.","DM.ED-6.3","Full"]
[23,"3.2.","Governance and Strategy","3.2.3.","Use of third party providers",9,"EBA GITSRM 3.2.3.9","Financial institutions should monitor and seek assurance on the level of compliance of these providers with the security objectives, measures and performance targets of the financial institution.","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring.","DM.ED-7.1","Full"]
[24,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",10,"EBA GITSRM 3.3.1.10","Financial institutions should identify and manage their ICT and security risks. The ICT function(s) in charge of ICT systems, processes and security operations should have appropriate processes and controls in place to ensure that all risks are identified, analysed, measured, monitored, managed, reported and kept within the limits of the financial institution s risk appetite and that the projects and systems they deliver and the activities they perform are in compliance with external and internal requirements.","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","GV.RM-1.1","Full"]
[25,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",10,"EBA GITSRM 3.3.1.10","Financial institutions should identify and manage their ICT and security risks. The ICT function(s) in charge of ICT systems, processes and security operations should have appropriate processes and controls in place to ensure that all risks are identified, analysed, measured, monitored, managed, reported and kept within the limits of the financial institution s risk appetite and that the projects and systems they deliver and the activities they perform are in compliance with external and internal requirements.","GV.SF-2.1: The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines.","GV.SF-2.1","Full"]
[26,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",10,"EBA GITSRM 3.3.1.10","Financial institutions should identify and manage their ICT and security risks. The ICT function(s) in charge of ICT systems, processes and security operations should have appropriate processes and controls in place to ensure that all risks are identified, analysed, measured, monitored, managed, reported and kept within the limits of the financial institution s risk appetite and that the projects and systems they deliver and the activities they perform are in compliance with external and internal requirements.","GV.RM-1.2: The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.  ","GV.RM-1.2","Full"]
[27,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",11,"EBA GITSRM 3.3.1.11","Financial institutions should assign the responsibility for managing and overseeing ICT and security risks to a control function, adhering to the requirements of Section 19 of the EBA Guidelines on internal governance (EBA/GL/2017/11). Financial institutions should ensure the independence and objectivity of this control function by appropriately segregating it from ICT operations processes. This control function should be directly accountable to the management body and responsible for monitoring and controlling adherence to the ICT and security risk management framework. It should ensure that ICT and security risks are identified, measured, assessed, managed, monitored and reported. Financial institutions should ensure that this control function is not responsible for any internal audit. The internal audit function should, following a risk-based approach, have the capacity to independently review and provide objective assurance of the compliance of all ICT and securityrelated activities and units of a financial institution with the financial institution s policies and procedures and with external requirements, adhering to the requirements of Section 22 of the EBA Guidelines on internal governance (EBA/GL/2017/11).","GV.IR-1.2: An independent risk management function has sufficient independence, stature, authority, resources, and access to the appropriate governing body (e.g., the Board or one of its committees), including reporting lines, to ensure consistency with the organization's cyber risk management framework.","GV.IR-1.2","Full"]
[28,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",11,"EBA GITSRM 3.3.1.11","Financial institutions should assign the responsibility for managing and overseeing ICT and security risks to a control function, adhering to the requirements of Section 19 of the EBA Guidelines on internal governance (EBA/GL/2017/11). Financial institutions should ensure the independence and objectivity of this control function by appropriately segregating it from ICT operations processes. This control function should be directly accountable to the management body and responsible for monitoring and controlling adherence to the ICT and security risk management framework. It should ensure that ICT and security risks are identified, measured, assessed, managed, monitored and reported. Financial institutions should ensure that this control function is not responsible for any internal audit. The internal audit function should, following a risk-based approach, have the capacity to independently review and provide objective assurance of the compliance of all ICT and securityrelated activities and units of a financial institution with the financial institution s policies and procedures and with external requirements, adhering to the requirements of Section 22 of the EBA Guidelines on internal governance (EBA/GL/2017/11).","GV.AU-1.3: An independent audit function tests security controls and information security policies.","GV.AU-1.3","Full"]
[29,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",11,"EBA GITSRM 3.3.1.11","Financial institutions should assign the responsibility for managing and overseeing ICT and security risks to a control function, adhering to the requirements of Section 19 of the EBA Guidelines on internal governance (EBA/GL/2017/11). Financial institutions should ensure the independence and objectivity of this control function by appropriately segregating it from ICT operations processes. This control function should be directly accountable to the management body and responsible for monitoring and controlling adherence to the ICT and security risk management framework. It should ensure that ICT and security risks are identified, measured, assessed, managed, monitored and reported. Financial institutions should ensure that this control function is not responsible for any internal audit. The internal audit function should, following a risk-based approach, have the capacity to independently review and provide objective assurance of the compliance of all ICT and securityrelated activities and units of a financial institution with the financial institution s policies and procedures and with external requirements, adhering to the requirements of Section 22 of the EBA Guidelines on internal governance (EBA/GL/2017/11).","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","GV.RM-1.1","Full"]
[30,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",12,"EBA GITSRM 3.3.1.12","Financial institutions should define and assign key roles and responsibilities, and relevant reporting lines, for the ICT and security risk management framework to be effective. This framework should be fully integrated into, and aligned with, financial institutions overall risk management processes.","GV.RM-3.1: The cyber risk management framework is integrated into the enterprise risk management framework.","GV.RM-3.1","Full"]
[31,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",12,"EBA GITSRM 3.3.1.12","Financial institutions should define and assign key roles and responsibilities, and relevant reporting lines, for the ICT and security risk management framework to be effective. This framework should be fully integrated into, and aligned with, financial institutions overall risk management processes.","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[32,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",13,"EBA GITSRM 3.3.1.13","The ICT and security risk management framework should include processes in place to:","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","GV.RM-1.1","Full"]
[33,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives","13.a","EBA GITSRM 3.3.1.13.a","a) determine the risk appetite for ICT and security risks, in accordance with the risk appetite of the financial institution","GV.RM-2.1: The organization has established a cyber risk tolerance consistent with its risk appetite, and integrated it into technology or operational risk management, as appropriate.","GV.RM-2.1","Full"]
[34,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives","13.b","EBA GITSRM 3.3.1.13.b","b) identify and assess the ICT and security risks to which a financial institution is exposed;","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","GV.RM-1.1","Full"]
[35,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives","13.c","EBA GITSRM 3.3.1.13.c","c) define mitigation measures, including controls, to mitigate ICT and security risks;","GV.RM-1.5: The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls.","GV.RM-1.5","Full"]
[36,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives","13.d","EBA GITSRM 3.3.1.13.d","d) monitor the effectiveness of these measures as well as the number of reported incidents, including for PSPs the incidents reported in accordance with Article 96 of PSD2 affecting the ICT-related activities, and take action to correct the measures where necessary;","GV.RM-3.2: The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.  ","GV.RM-3.2","Full"]
[37,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives","13.e","EBA GITSRM 3.3.1.13.e","e) report to the management body on the ICT and security risks and controls;","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile.","GV.SF-3.1","Full"]
[38,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives","13.f","EBA GITSRM 3.3.1.13.f","f) identify and assess whether there are any ICT and security risks resulting from any major change in ICT system or ICT services, processes or procedures, and/or after any significant operational or security incident.","GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.RM-1.3","Full"]
[39,"3.3.","ICT and security risk management framework","3.3.1.","Organisation and objectives",14,"EBA GITSRM 3.3.1.14","Financial institutions should ensure that the ICT and security risk management framework is documented, and continuously improved, based on lessons learned during its implementation and monitoring. The ICT and security risk management framework should be approved and reviewed, at least once a year, by the management body.","GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.RM-1.3","Full"]
[40,"3.3.","ICT and security risk management framework","3.3.2.","Identification of functions, processes and assets",15,"EBA GITSRM 3.3.2.15","Financial institutions should identify, establish and maintain updated mapping of their business functions, roles and supporting processes to identify the importance of each and their interdependencies related to ICT and security risks.","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan.","DM.ID-1.1","Full"]
[41,"3.3.","ICT and security risk management framework","3.3.2.","Identification of functions, processes and assets",15,"EBA GITSRM 3.3.2.15","Financial institutions should identify, establish and maintain updated mapping of their business functions, roles and supporting processes to identify the importance of each and their interdependencies related to ICT and security risks.","DM.ID-2.1: Roles and responsibilities for internal dependency management are defined and assigned.","DM.ID-2.1","Full"]
[42,"3.3.","ICT and security risk management framework","3.3.2.","Identification of functions, processes and assets",16,"EBA GITSRM 3.3.2.16","In addition, financial institutions should identify, establish and maintain updated mapping of the information assets supporting their business functions and supporting processes, such as ICT systems, staff, contractors, third parties and dependencies on other internal and external systems and processes, to be able to, at least, manage the information assets that support their critical business functions and processes.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","ID.AM-3.1","Full"]
[43,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",17,"EBA GITSRM 3.3.3.17","Financial institutions should classify the identified business functions, supporting processes and information assets referred to in paragraphs 15 and 16 in terms of criticality.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","ID.AM-5.2","Full"]
[44,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",18,"EBA GITSRM 3.3.3.18","To define the criticality of these identified business functions, supporting processes and information assets, financial institutions should, at a minimum, consider the confidentiality, integrity and availability requirements. There should be clearly assigned accountability and responsibility for the information assets.","GV.SP-1.1: The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite.","GV.SP-1.1","Full"]
[45,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",19,"EBA GITSRM 3.3.3.19","Financial institutions should review the adequacy of the classification of the information assets and relevant documentation, when risk assessment is performed.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","ID.AM-5.2","Full"]
[46,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",19,"EBA GITSRM 3.3.3.19","Financial institutions should review the adequacy of the classification of the information assets and relevant documentation, when risk assessment is performed.","ID.AM-3.2: The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.","ID.AM-3.2","Full"]
[47,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",20,"EBA GITSRM 3.3.3.20","Financial institutions should identify the ICT and security risks that impact the identified and classified business functions, supporting processes and information assets, according to their criticality. This risk assessment should be carried out and documented annually or at shorter intervals if required. Such risk assessments should also be performed on any major changes in infrastructure, processes or procedures affecting the business functions, supporting processes or information assets, and consequently the current risk assessment of financial institutions should be updated.","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","ID.RA-1.1","Full"]
[48,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",20,"EBA GITSRM 3.3.3.20","Financial institutions should identify the ICT and security risks that impact the identified and classified business functions, supporting processes and information assets, according to their criticality. This risk assessment should be carried out and documented annually or at shorter intervals if required. Such risk assessments should also be performed on any major changes in infrastructure, processes or procedures affecting the business functions, supporting processes or information assets, and consequently the current risk assessment of financial institutions should be updated.","GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment).","GV.RM-1.3","Full"]
[49,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",21,"EBA GITSRM 3.3.3.21","Financial institutions should ensure that they continuously monitor threats and vulnerabilities relevant to their business processes, supporting functions and information assets and should regularly review the risk scenarios impacting them.","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm.","ID.RA-3.1","Full"]
[50,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",21,"EBA GITSRM 3.3.3.21","Financial institutions should ensure that they continuously monitor threats and vulnerabilities relevant to their business processes, supporting functions and information assets and should regularly review the risk scenarios impacting them.","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","PR.IP-12.1","Full"]
[51,"3.3.","ICT and security risk management framework","3.3.3.","Classification and risk assessment",21,"EBA GITSRM 3.3.3.21","Financial institutions should ensure that they continuously monitor threats and vulnerabilities relevant to their business processes, supporting functions and information assets and should regularly review the risk scenarios impacting them.","ID.RA-3.3: The organization regularly reviews and updates results of its cyber threat analysis.","ID.RA-3.3","Full"]
[52,"3.3.","ICT and security risk management framework","3.3.4.","Risk mitigation",22,"EBA GITSRM 3.3.4.22","Based on the risk assessments, financial institutions should determine which measures are required to mitigate identified ICT and security risks to acceptable levels and whether changes are necessary to the existing business processes, control measures, ICT systems and ICT services. A financial institution should consider the time required to implement these changes and the time to take appropriate interim mitigating measures to minimise ICT and security risks to stay within the financial institution s ICT and security risk appetite.","GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","GV.SP-1.2","Full"]
[53,"3.3.","ICT and security risk management framework","3.3.4.","Risk mitigation",23,"EBA GITSRM 3.3.4.23","Financial institutions should define and implement measures to mitigate identified ICT and security risks and to protect information assets in accordance with their classification.","GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees).","GV.SP-1.2","Full"]
[54,"3.3.","ICT and security risk management framework","3.3.4.","Risk mitigation",23,"EBA GITSRM 3.3.4.23","Financial institutions should define and implement measures to mitigate identified ICT and security risks and to protect information assets in accordance with their classification.","ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units. ","ID.RA-6.2","Full"]
[55,"3.3.","ICT and security risk management framework","3.3.5.","Reporting",24,"EBA GITSRM 3.3.5.24","Financial institutions should report risk assessment results to the management body in a clear and timely manner. Such reporting is without prejudice to the obligation of PSPs to provide competent authorities with an updated and comprehensive risk assessment, as laid down in Article 95(2) of Directive (EU) 2015/2366.","ID.RA-6.1: The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk.","ID.RA-6.1","Full"]
[56,"3.3.","ICT and security risk management framework","3.3.6.","Audit",25,"EBA GITSRM 3.3.6.25","A financial institution s governance, systems and processes for its ICT and security risks should be audited on a periodic basis by auditors with sufficient knowledge, skills and expertise in ICT and security risks and in payments (for PSPs) to provide independent assurance of their effectiveness to the management body. The auditors should be independent within or from the financial institution. The frequency and focus of such audits should be commensurate with the relevant ICT and security risks.","GV.AU-1.3: An independent audit function tests security controls and information security policies.","GV.AU-1.3","Full"]
[57,"3.3.","ICT and security risk management framework","3.3.6.","Audit",26,"EBA GITSRM 3.3.6.26","A financial institution s management body should approve the audit plan, including any ICT audits and any material modifications thereto. The audit plan and its execution, including the audit frequency, should reflect and be proportionate to the inherent ICT and security risks in the financial institution and should be updated regularly.","GV.AU-1.2: The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance.","GV.AU-1.2","Full"]
[58,"3.3.","ICT and security risk management framework","3.3.6.","Audit",26,"EBA GITSRM 3.3.6.26","A financial institution s management body should approve the audit plan, including any ICT audits and any material modifications thereto. The audit plan and its execution, including the audit frequency, should reflect and be proportionate to the inherent ICT and security risks in the financial institution and should be updated regularly.","GV.AU-3.3: An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization.","GV.AU-3.3","Full"]
[59,"3.3.","ICT and security risk management framework","3.3.6.","Audit",27,"EBA GITSRM 3.3.6.27","A formal follow-up process including provisions for the timely verification and remediation of critical ICT audit findings should be established.","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. ","GV.AU-3.2","Full"]
[60,"3.4.","Information security","3.4.1.","Information security policy",28,"EBA GITSRM 3.4.1.28","Financial institutions should develop and document an information security policy that should define the high-level principles and rules to protect the confidentiality, integrity and availability of financial institutions and their customers data and information. For PSPs this policy is identified in the security policy document to be adopted in accordance with Article 5(1)(j) of Directive (EU) 2015/2366. The information security policy should be in line with the financial institution s information security objectives and based on the relevant results of the risk assessment process. The policy should be approved by the management body.","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","GV.PL-1.1","Full"]
[61,"3.4.","Information security","3.4.1.","Information security policy",28,"EBA GITSRM 3.4.1.28","Financial institutions should develop and document an information security policy that should define the high-level principles and rules to protect the confidentiality, integrity and availability of financial institutions and their customers data and information. For PSPs this policy is identified in the security policy document to be adopted in accordance with Article 5(1)(j) of Directive (EU) 2015/2366. The information security policy should be in line with the financial institution s information security objectives and based on the relevant results of the risk assessment process. The policy should be approved by the management body.","GV.PL-3.3: The organization implements and maintains a documented policy or policies that address customer data privacy, and is approved by a designated officer or the organization’s appropriate governing body (e.g., the Board or one of its committees).","GV.PL-3.3","Full"]
[62,"3.4.","Information security","3.4.1.","Information security policy",28,"EBA GITSRM 3.4.1.28","Financial institutions should develop and document an information security policy that should define the high-level principles and rules to protect the confidentiality, integrity and availability of financial institutions and their customers data and information. For PSPs this policy is identified in the security policy document to be adopted in accordance with Article 5(1)(j) of Directive (EU) 2015/2366. The information security policy should be in line with the financial institution s information security objectives and based on the relevant results of the risk assessment process. The policy should be approved by the management body.","GV.PL-2.1: The cybersecurity policy is supported by the organization's risk management program.","GV.PL-2.1","Full"]
[63,"3.4.","Information security","3.4.1.","Information security policy",29,"EBA GITSRM 3.4.1.29","The policy should include a description of the main roles and responsibilities of information security management, and it should set out the requirements for staff and contractors, processes and technology in relation to information security, recognising that staff and contractors at all levels have responsibilities in ensuring financial institutions information security. The policy should ensure the confidentiality, integrity and availability of a financial institution s critical logical and physical assets, resources and sensitive data whether at rest, in transit or in use. The information security policy should be communicated to all staff and contractors of the financial institution.","GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures.","GV.PL-1.2","Full"]
[64,"3.4.","Information security","3.4.1.","Information security policy",30,"EBA GITSRM 3.4.1.30","Based on the information security policy, financial institutions should establish and implement security measures to mitigate the ICT and security risks that they are exposed to. These measures should include:","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[65,"3.4.","Information security","3.4.1.","Information security policy","30.a",{"$f":"_xlfn.CONCAT(\"EBA GITSRM \",D71,F71)","v":"EBA GITSRM 3.4.1.30.a"},"organisation and governance in accordance with paragraphs 10 and 11;","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.",{"$f":"LEFT(I71,FIND(\":\",I71)-1)","v":"GV.PL-2.2"},"Full"]
[66,"3.4.","Information security","3.4.1.","Information security policy","30.b","EBA GITSRM 3.4.1.30.b","logical security (Section 3.4.2);","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[67,"3.4.","Information security","3.4.1.","Information security policy","30.c","EBA GITSRM 3.4.1.30.c","physical security (Section 3.4.3);","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[68,"3.4.","Information security","3.4.1.","Information security policy","30.d","EBA GITSRM 3.4.1.30.d","ICT operations security (Section 3.4.4);","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[69,"3.4.","Information security","3.4.1.","Information security policy","30.e","EBA GITSRM 3.4.1.30.e","security monitoring (Section 3.4.5);","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[70,"3.4.","Information security","3.4.1.","Information security policy","30.f","EBA GITSRM 3.4.1.30.f","information security reviews, assessment and testing (Section 3.4.6);","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[71,"3.4.","Information security","3.4.1.","Information security policy","30.g","EBA GITSRM 3.4.1.30.g","information security training and awareness (Section 3.4.7).","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[72,"3.4.","Information security","3.4.2.","Logical security",31,"EBA GITSRM 3.4.2.31","Financial institutions should define, document and implement procedures for logical access control (identity and access management). These procedures should be implemented, enforced, monitored and periodically reviewed. The procedures should also include controls for monitoring anomalies. These procedures should, at a minimum, implement the following elements, where the term user also includes technical users:","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Full"]
[73,"3.4.","Information security","3.4.2.","Logical security",31,"EBA GITSRM 3.4.2.31","Financial institutions should define, document and implement procedures for logical access control (identity and access management). These procedures should be implemented, enforced, monitored and periodically reviewed. The procedures should also include controls for monitoring anomalies. These procedures should, at a minimum, implement the following elements, where the term user also includes technical users:","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[74,"3.4.","Information security","3.4.2.","Logical security","31.a","EBA GITSRM 3.4.2.31.a","Need to know, least privilege and segregation of duties: financial institutions should manage access rights to information assets and their supporting systems on a need-toknow basis, including for remote access. Users should be granted minimum access rights that are strictly required to execute their duties (principle of least privilege ), i.e. to prevent unjustified access to a large set of data or to prevent the allocation of combinations of access rights that may be used to circumvent controls (principle of segregation of duties ).","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized.","PR.AC-1.1","Full"]
[75,"3.4.","Information security","3.4.2.","Logical security","31.a","EBA GITSRM 3.4.2.31.a","Need to know, least privilege and segregation of duties: financial institutions should manage access rights to information assets and their supporting systems on a need-toknow basis, including for remote access. Users should be granted minimum access rights that are strictly required to execute their duties (principle of least privilege ), i.e. to prevent unjustified access to a large set of data or to prevent the allocation of combinations of access rights that may be used to circumvent controls (principle of segregation of duties ).","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","PR.AC-4.1","Full"]
[76,"3.4.","Information security","3.4.2.","Logical security","31.b","EBA GITSRM 3.4.2.31.b","User accountability: financial institutions should limit, as much as possible, the use of generic and shared user accounts and ensure that users can be identified for the actions performed in the ICT systems.","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[77,"3.4.","Information security","3.4.2.","Logical security","31.c","EBA GITSRM 3.4.2.31.c","Privileged access rights: financial institutions should implement strong controls over privileged system access by strictly limiting and closely supervising accounts with elevated system access entitlements (e.g. administrator accounts). In order to ensure secure communication and reduce risk, remote administrative access to critical ICT systems should be granted only on a need-to-know basis and when strong authentication solutions are used.","PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. ","PR.AC-4.2","Full"]
[78,"3.4.","Information security","3.4.2.","Logical security","31.d","EBA GITSRM 3.4.2.31.d","Logging of user activities: at a minimum, all activities by privileged users should be logged and monitored. Access logs should be secured to prevent unauthorised modification or deletion and retained for a period commensurate with the criticality of the identified business functions, supporting processes and information assets, in accordance with Section 3.3.3, without prejudice to the retention requirements set out in EU and national law. A financial institution should use this information to facilitate the identification and investigation of anomalous activities that have been detected in the provision of services.","DE.CM-3.2: The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented.","DE.CM-3.2","Full"]
[79,"3.4.","Information security","3.4.2.","Logical security","31.d","EBA GITSRM 3.4.2.31.d","Logging of user activities: at a minimum, all activities by privileged users should be logged and monitored. Access logs should be secured to prevent unauthorised modification or deletion and retained for a period commensurate with the criticality of the identified business functions, supporting processes and information assets, in accordance with Section 3.3.3, without prejudice to the retention requirements set out in EU and national law. A financial institution should use this information to facilitate the identification and investigation of anomalous activities that have been detected in the provision of services.","DE.CM-1.1: The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods.","DE.CM-1.1","Full"]
[80,"3.4.","Information security","3.4.2.","Logical security","31.e","EBA GITSRM 3.4.2.31.e","Access management: access rights should be granted, withdrawn or modified in a timely manner, according to predefined approval workflows that involve the business owner of the information being accessed (information asset owner). In the case of termination of employment, access rights should be promptly withdrawn.","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[81,"3.4.","Information security","3.4.2.","Logical security","31.f","EBA GITSRM 3.4.2.31.f","Access recertification: access rights should be periodically reviewed to ensure that users do not possess excessive privileges and that access rights are withdrawn when no longer required.","PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.).","PR.AC-1.3","Full"]
[82,"3.4.","Information security","3.4.2.","Logical security","31.g","EBA GITSRM 3.4.2.31.g","Authentication methods: financial institutions should enforce authentication methods that are sufficiently robust to adequately and effectively ensure that access control policies and procedures are complied with. Authentication methods should be commensurate with the criticality of ICT systems, information or the process being accessed. This should, at a minimum, include complex passwords or stronger authentication methods (such as two-factor authentication), based on relevant risk.","PR.AC-6.1: The organization authenticates identity and validates the authorization level of a user before granting access to its systems.","PR.AC-6.1","Full"]
[83,"3.4.","Information security","3.4.2.","Logical security","31.g","EBA GITSRM 3.4.2.31.g","Authentication methods: financial institutions should enforce authentication methods that are sufficiently robust to adequately and effectively ensure that access control policies and procedures are complied with. Authentication methods should be commensurate with the criticality of ICT systems, information or the process being accessed. This should, at a minimum, include complex passwords or stronger authentication methods (such as two-factor authentication), based on relevant risk.","PR.AC-7.2: Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","PR.AC-7.2","Full"]
[84,"3.4.","Information security","3.4.2.","Logical security",32,"EBA GITSRM 3.4.2.32","Electronic access by applications to data and ICT systems should be limited to a minimum required to provide the relevant service.","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","PR.AC-4.1","Full"]
[85,"3.4.","Information security","3.4.3.","Physical security",33,"EBA GITSRM 3.4.3.33","Financial institutions physical security measures should be defined, documented and implemented to protect their premises, data centres and sensitive areas from unauthorised access and from environmental hazards","PR.AC-2.1: The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms).","PR.AC-2.1","Full"]
[86,"3.4.","Information security","3.4.3.","Physical security",34,"EBA GITSRM 3.4.3.34","Physical access to ICT systems should be permitted to only authorised individuals. Authorisation should be assigned in accordance with the individual s tasks and responsibilities and limited to individuals who are appropriately trained and monitored. Physical access should be regularly reviewed to ensure that unnecessary access rights are promptly revoked when not required.","PR.AC-2.1: The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms).","PR.AC-2.1","Full"]
[87,"3.4.","Information security","3.4.3.","Physical security",34,"EBA GITSRM 3.4.3.34","Physical access to ICT systems should be permitted to only authorised individuals. Authorisation should be assigned in accordance with the individual s tasks and responsibilities and limited to individuals who are appropriately trained and monitored. Physical access should be regularly reviewed to ensure that unnecessary access rights are promptly revoked when not required.","PR.AC-4.1: The organization limits access privileges to the minimum necessary.","PR.AC-4.1","Full"]
[88,"3.4.","Information security","3.4.3.","Physical security",35,"EBA GITSRM 3.4.3.35","Adequate measures to protect from environmental hazards should be commensurate with the importance of the buildings and the criticality of the operations or ICT systems located in these buildings.","PR.IP-5.1: Physical and environmental security policies are implemented and managed. ","PR.IP-5.1","Full"]
[89,"3.4.","Information security","3.4.4.","ICT operations security",36,"EBA GITSRM 3.4.4.36","Financial institutions should implement procedures to prevent the occurrence of security issues in ICT systems and ICT services and should minimise their impact on ICT service delivery. These procedures should include the following measures:","DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events.","DE.CM-3.1","Full"]
[90,"3.4.","Information security","3.4.4.","ICT operations security","36.a","EBA GITSRM 3.4.4.36.a","identification of potential vulnerabilities, which should be evaluated and remediated by ensuring that software and firmware are up to date, including the software provided by financial institutions to their internal and external users, by deploying critical security patches or by implementing compensating controls;","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment.","PR.IP-12.1","Full"]
[91,"3.4.","Information security","3.4.4.","ICT operations security","36.a","EBA GITSRM 3.4.4.36.a","identification of potential vulnerabilities, which should be evaluated and remediated by ensuring that software and firmware are up to date, including the software provided by financial institutions to their internal and external users, by deploying critical security patches or by implementing compensating controls;","PR.IP-12.2: The organization establishes a process to prioritize and remedy issues identified through vulnerability scanning.","PR.IP-12.2","Full"]
[92,"3.4.","Information security","3.4.4.","ICT operations security","36.a","EBA GITSRM 3.4.4.36.a","identification of potential vulnerabilities, which should be evaluated and remediated by ensuring that software and firmware are up to date, including the software provided by financial institutions to their internal and external users, by deploying critical security patches or by implementing compensating controls;","PR.IP-12.4: The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","PR.IP-12.4","Full"]
[93,"3.4.","Information security","3.4.4.","ICT operations security","36.b","EBA GITSRM 3.4.4.36.b","implementation of secure configuration baselines of all network components;","PR.IP-1.1: The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","PR.IP-1.1","Full"]
[94,"3.4.","Information security","3.4.4.","ICT operations security","36.c","EBA GITSRM 3.4.4.36.c","implementation of network segmentation, data loss prevention systems and the encryption of network traffic (in accordance with the data classification);","PR.AC-5.1: Networks and systems are segmented to maintain appropriate security.","PR.AC-5.1","Full"]
[95,"3.4.","Information security","3.4.4.","ICT operations security","36.c","EBA GITSRM 3.4.4.36.c","implementation of network segmentation, data loss prevention systems and the encryption of network traffic (in accordance with the data classification);","PR.DS-5.1: The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor.","PR.DS-5.1","Full"]
[96,"3.4.","Information security","3.4.4.","ICT operations security","36.c","EBA GITSRM 3.4.4.36.c","implementation of network segmentation, data loss prevention systems and the encryption of network traffic (in accordance with the data classification);","PR.DS-2.2: Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.  ","PR.DS-2.2","Full"]
[97,"3.4.","Information security","3.4.4.","ICT operations security","36.d","EBA GITSRM 3.4.4.36.d","implementation of protection of endpoints including servers, workstations and mobile devices; financial institutions should evaluate whether endpoints meet the security standards defined by them before they are granted access to the corporate network;","PR.IP-1.2: The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources.","PR.IP-1.2","Full"]
[98,"3.4.","Information security","3.4.4.","ICT operations security","36.d","EBA GITSRM 3.4.4.36.d","implementation of protection of endpoints including servers, workstations and mobile devices; financial institutions should evaluate whether endpoints meet the security standards defined by them before they are granted access to the corporate network;","PR.AC-7.1: The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on: (1) The type of data being accessed (e.g., customer PII, public data); (2) The risk of the transaction (e.g., internal-to-internal, external-to-internal); (3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and (4) The potential for harm.","PR.AC-7.1","Full"]
[99,"3.4.","Information security","3.4.4.","ICT operations security","36.d","EBA GITSRM 3.4.4.36.d","implementation of protection of endpoints including servers, workstations and mobile devices; financial institutions should evaluate whether endpoints meet the security standards defined by them before they are granted access to the corporate network;","PR.IP-1.1: The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets.","PR.IP-1.1","Full"]
[100,"3.4.","Information security","3.4.4.","ICT operations security","36.e","EBA GITSRM 3.4.4.36.e","ensuring that mechanisms are in place to verify the integrity of software, firmware and data;","PR.DS-6.1: The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable. ","PR.DS-6.1","Full"]
[101,"3.4.","Information security","3.4.4.","ICT operations security","36.f","EBA GITSRM 3.4.4.36.f","encryption of data at rest and in transit (in accordance with the data classification).","PR.DS-1.2: Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.  ","PR.DS-1.2","Full"]
[102,"3.4.","Information security","3.4.4.","ICT operations security","36.f","EBA GITSRM 3.4.4.36.f","encryption of data at rest and in transit (in accordance with the data classification).","PR.DS-2.2: Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.  ","PR.DS-2.2","Full"]
[103,"3.4.","Information security","3.4.4.","ICT operations security",37,"EBA GITSRM 3.4.4.37","Furthermore, on an ongoing basis, financial institutions should determine whether changes in the existing operational environment influence the existing security measures or require adoption of additional measures to mitigate related risks appropriately. These changes should be part of the financial institutions formal change management process, which should ensure that changes are properly planned, tested, documented, authorised and deployed.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[104,"3.4.","Information security","3.4.5.","Security monitoring",38,"EBA GITSRM 3.4.5.38","Financial institutions should establish and implement policies and procedures to detect anomalous activities that may impact financial institutions information security and to respond to these events appropriately. As part of this continuous monitoring, financial institutions should implement appropriate and effective capabilities for detecting and reporting physical or logical intrusion as well as breaches of confidentiality, integrity and availability of the information assets. The continuous monitoring and detection processes should cover:","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[105,"3.4.","Information security","3.4.5.","Security monitoring",38,"EBA GITSRM 3.4.5.38","Financial institutions should establish and implement policies and procedures to detect anomalous activities that may impact financial institutions information security and to respond to these events appropriately. As part of this continuous monitoring, financial institutions should implement appropriate and effective capabilities for detecting and reporting physical or logical intrusion as well as breaches of confidentiality, integrity and availability of the information assets. The continuous monitoring and detection processes should cover:","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[106,"3.4.","Information security","3.4.5.","Security monitoring","38.a","EBA GITSRM 3.4.5.38.a","relevant internal and external factors, including business and ICT administrative functions;","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[107,"3.4.","Information security","3.4.5.","Security monitoring","38.b","EBA GITSRM 3.4.5.38.b","transactions to detect misuse of access by third parties or other entities and internal misuse of access;","DE.CM-6.3: The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider.","DE.CM-6.3","Full"]
[108,"3.4.","Information security","3.4.5.","Security monitoring","38.b","EBA GITSRM 3.4.5.38.b","transactions to detect misuse of access by third parties or other entities and internal misuse of access;","DE.CM-7.2: The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers.","DE.CM-7.2","Full"]
[109,"3.4.","Information security","3.4.5.","Security monitoring","38.c","EBA GITSRM 3.4.5.38.c","potential internal and external threats.","DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks.","DE.AE-3.2","Full"]
[110,"3.4.","Information security","3.4.5.","Security monitoring",39,"EBA GITSRM 3.4.5.39","Financial institutions should establish and implement processes and organisation structures to identify and constantly monitor security threats that could materially affect their abilities to provide services. Financial institutions should actively monitor technological developments to ensure that they are aware of security risks. Financial institutions should implement detective measures, for instance to identify possible information leakages, malicious code and other security threats, and publicly known vulnerabilities in software and hardware and should check for corresponding new security updates.","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[111,"3.4.","Information security","3.4.5.","Security monitoring",39,"EBA GITSRM 3.4.5.39","Financial institutions should establish and implement processes and organisation structures to identify and constantly monitor security threats that could materially affect their abilities to provide services. Financial institutions should actively monitor technological developments to ensure that they are aware of security risks. Financial institutions should implement detective measures, for instance to identify possible information leakages, malicious code and other security threats, and publicly known vulnerabilities in software and hardware and should check for corresponding new security updates.","DE.CM-4.1: The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems.","DE.CM-4.1","Full"]
[112,"3.4.","Information security","3.4.5.","Security monitoring",39,"EBA GITSRM 3.4.5.39","Financial institutions should establish and implement processes and organisation structures to identify and constantly monitor security threats that could materially affect their abilities to provide services. Financial institutions should actively monitor technological developments to ensure that they are aware of security risks. Financial institutions should implement detective measures, for instance to identify possible information leakages, malicious code and other security threats, and publicly known vulnerabilities in software and hardware and should check for corresponding new security updates.","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","DE.CM-8.1","Full"]
[113,"3.4.","Information security","3.4.5.","Security monitoring",40,"EBA GITSRM 3.4.5.40","The security monitoring process should also help a financial institution to understand the nature of operational or security incidents, to identify trends and to support the organisation s investigations.","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","DE.AE-2.1","Full"]
[114,"3.4.","Information security","3.4.5.","Security monitoring",40,"EBA GITSRM 3.4.5.40","The security monitoring process should also help a financial institution to understand the nature of operational or security incidents, to identify trends and to support the organisation s investigations.","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves.","DE.DP-5.1","Full"]
[115,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",41,"EBA GITSRM 3.4.6.41","Financial institutions should perform a variety of information security reviews, assessments and testing to ensure the effective identification of vulnerabilities in their ICT systems and ICT services. For instance, financial institutions may perform gap analysis against information security standards, compliance reviews, internal and external audits of the information systems, or physical security reviews. Furthermore, the institution should consider good practices such as source code reviews, vulnerability assessments, penetration tests and red team exercises.","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","DE.CM-8.1","Full"]
[116,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",41,"EBA GITSRM 3.4.6.41","Financial institutions should perform a variety of information security reviews, assessments and testing to ensure the effective identification of vulnerabilities in their ICT systems and ICT services. For instance, financial institutions may perform gap analysis against information security standards, compliance reviews, internal and external audits of the information systems, or physical security reviews. Furthermore, the institution should consider good practices such as source code reviews, vulnerability assessments, penetration tests and red team exercises.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[117,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",42,"EBA GITSRM 3.4.6.42","Financial institutions should establish and implement an information security testing framework that validates the robustness and effectiveness of their information security measures and ensure that this framework considers threats and vulnerabilities, identified through threat monitoring and ICT and security risk assessment process.","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls.","DE.DP-3.1","Full"]
[118,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",43,"EBA GITSRM 3.4.6.43","The information security testing framework should ensure that tests:","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[119,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing","43.a","EBA GITSRM 3.4.6.43.a","are carried out by independent testers with sufficient knowledge, skills and expertise in testing information security measures and who are not involved in the development of the information security measures;","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[120,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing","43.b","EBA GITSRM 3.4.6.43.b","include vulnerability scans and penetration tests (including threat-led penetration testing where necessary and appropriate) commensurate to the level of risk identified with the business processes and systems.","DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. ","DE.CM-8.2","Full"]
[121,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing","43.b","EBA GITSRM 3.4.6.43.b","include vulnerability scans and penetration tests (including threat-led penetration testing where necessary and appropriate) commensurate to the level of risk identified with the business processes and systems.","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers.","DE.CM-8.1","Full"]
[122,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",44,"EBA GITSRM 3.4.6.44","Financial institutions should perform ongoing and repeated tests of the security measures. For all critical ICT systems (paragraph 17), these tests should be performed at least on an annual basis and, for PSPs, they will be part of the comprehensive assessment of the security risks related to the payment services they provide, in accordance with Article 95(2) of PSD2. Noncritical systems should be tested regularly using a risk-based approach, but at least every 3 years.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[123,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",44,"EBA GITSRM 3.4.6.44","Financial institutions should perform ongoing and repeated tests of the security measures. For all critical ICT systems (paragraph 17), these tests should be performed at least on an annual basis and, for PSPs, they will be part of the comprehensive assessment of the security risks related to the payment services they provide, in accordance with Article 95(2) of PSD2. Noncritical systems should be tested regularly using a risk-based approach, but at least every 3 years.","PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis.","PR.IP-10.2","Full"]
[124,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",45,"EBA GITSRM 3.4.6.45","Financial institutions should ensure that tests of security measures are conducted in the event of changes to infrastructure, processes or procedures and if changes are made because of major operational or security incidents or due to the release of new or significantly changed internet-facing critical applications.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[125,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",46,"EBA GITSRM 3.4.6.46","Financial institutions should monitor and evaluate the results of the security tests and update their security measures accordingly without undue delays in the case of critical ICT systems","RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience.","RS.IM-1.2","Full"]
[126,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",47,"EBA GITSRM 3.4.6.47","For PSPs, the testing framework should also encompass the security measures relevant to (1) payment terminals and devices used for the provision of payment services, (2) payment terminals and devices used for authenticating the payment service users (PSU), and (3) devices and software provided by the PSP to the PSU to generate/receive an authentication code.","PR.AC-7.2: Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions.","PR.AC-7.2","Full"]
[127,"3.4.","Information security","3.4.6.","Information security reviews, assessment and testing",48,"EBA GITSRM 3.4.6.48","Based on the security threats observed and the changes made, testing should be performed to incorporate scenarios of relevant and known potential attacks.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[128,"3.4.","Information security","3.4.7.","Information security training and awareness",49,"EBA GITSRM 3.4.7.49","Financial institutions should establish a training programme, including periodic security awareness programmes, for all staff and contractors to ensure that they are trained to perform their duties and responsibilities consistent with the relevant security policies and procedures to reduce human error, theft, fraud, misuse or loss and how to address information securityrelated risks. Financial institutions should ensure that the training programme provides training for all staff members and contractors at least annually.","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law.","PR.AT-1.1","Full"]
[129,"3.4.","Information security","3.4.7.","Information security training and awareness",49,{"$f":"_xlfn.CONCAT(\"EBA GITSRM \",D135,F135)","v":"EBA GITSRM 3.4.7.49"},"Financial institutions should establish a training programme, including periodic security awareness programmes, for all staff and contractors to ensure that they are trained to perform their duties and responsibilities consistent with the relevant security policies and procedures to reduce human error, theft, fraud, misuse or loss and how to address information securityrelated risks. Financial institutions should ensure that the training programme provides training for all staff members and contractors at least annually.","PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate.",{"$f":"LEFT(I135,FIND(\":\",I135)-1)","v":"PR.AT-3.1"},"Full"]
[130,"3.5.","ICT operations management",null,null,50,"EBA GITSRM 50","Financial institutions should manage their ICT operations based on documented and implemented processes and procedures (which, for PSPs, include the security policy document in accordance with Article 5(1)(j) of PSD2) that are approved by the management body. This set of documents should define how financial institutions operate, monitor and control their ICT systems and services, including the documenting of critical ICT operations and should enable financial institutions to maintain up-to-date ICT asset inventory.","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees).","GV.PL-1.1","Full"]
[131,"3.5.","ICT operations management",null,null,50,"EBA GITSRM 50","Financial institutions should manage their ICT operations based on documented and implemented processes and procedures (which, for PSPs, include the security policy document in accordance with Article 5(1)(j) of PSD2) that are approved by the management body. This set of documents should define how financial institutions operate, monitor and control their ICT systems and services, including the documenting of critical ICT operations and should enable financial institutions to maintain up-to-date ICT asset inventory.","GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy.","GV.PL-2.2","Full"]
[132,"3.5.","ICT operations management",null,null,50,"EBA GITSRM 50","Financial institutions should manage their ICT operations based on documented and implemented processes and procedures (which, for PSPs, include the security policy document in accordance with Article 5(1)(j) of PSD2) that are approved by the management body. This set of documents should define how financial institutions operate, monitor and control their ICT systems and services, including the documenting of critical ICT operations and should enable financial institutions to maintain up-to-date ICT asset inventory.","ID.AM-1.1: The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","ID.AM-1.1","Full"]
[133,"3.5.","ICT operations management",null,null,50,"EBA GITSRM 50","Financial institutions should manage their ICT operations based on documented and implemented processes and procedures (which, for PSPs, include the security policy document in accordance with Article 5(1)(j) of PSD2) that are approved by the management body. This set of documents should define how financial institutions operate, monitor and control their ICT systems and services, including the documenting of critical ICT operations and should enable financial institutions to maintain up-to-date ICT asset inventory.","ID.AM-2.1: The organization maintains a current and complete inventory of software platforms and business applications.","ID.AM-2.1","Full"]
[134,"3.5.","ICT operations management",null,null,51,"EBA GITSRM 51","Financial institutions should ensure that performance of their ICT operations is aligned to their business requirements. Financial institutions should maintain and improve, when possible, efficiency of their ICT operations, including but not limited to the need to consider how to minimise potential errors arising from the execution of manual tasks.","PR.DS-4.1: The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment.","PR.DS-4.1","Full"]
[135,"3.5.","ICT operations management",null,null,52,"EBA GITSRM 52","Financial institutions should implement logging and monitoring procedures for critical ICT operations to allow the detection, analysis and correction of errors.","DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data).","DE.CM-1.2","Full"]
[136,"3.5.","ICT operations management",null,null,52,"EBA GITSRM 52","Financial institutions should implement logging and monitoring procedures for critical ICT operations to allow the detection, analysis and correction of errors.","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics.","DE.AE-2.1","Full"]
[137,"3.5.","ICT operations management",null,null,53,"EBA GITSRM 53","Financial institutions should maintain an up-to-date inventory of their ICT assets (including ICT systems, network devices, databases, etc.). The ICT asset inventory should store the configuration of the ICT assets and the links and interdependencies between the different ICT assets, to enable a proper configuration and change management process.","ID.AM-1.1: The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems.","ID.AM-1.1","Full"]
[138,"3.5.","ICT operations management",null,null,53,"EBA GITSRM 53","Financial institutions should maintain an up-to-date inventory of their ICT assets (including ICT systems, network devices, databases, etc.). The ICT asset inventory should store the configuration of the ICT assets and the links and interdependencies between the different ICT assets, to enable a proper configuration and change management process.","ID.AM-2.1: The organization maintains a current and complete inventory of software platforms and business applications.","ID.AM-2.1","Full"]
[139,"3.5.","ICT operations management",null,null,53,"EBA GITSRM 53","Financial institutions should maintain an up-to-date inventory of their ICT assets (including ICT systems, network devices, databases, etc.). The ICT asset inventory should store the configuration of the ICT assets and the links and interdependencies between the different ICT assets, to enable a proper configuration and change management process.","DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs.","DE.CM-7.3","Full"]
[140,"3.5.","ICT operations management",null,null,53,"EBA GITSRM 53","Financial institutions should maintain an up-to-date inventory of their ICT assets (including ICT systems, network devices, databases, etc.). The ICT asset inventory should store the configuration of the ICT assets and the links and interdependencies between the different ICT assets, to enable a proper configuration and change management process.","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. ","ID.AM-3.1","Full"]
[141,"3.5.","ICT operations management",null,null,53,"EBA GITSRM 53","Financial institutions should maintain an up-to-date inventory of their ICT assets (including ICT systems, network devices, databases, etc.). The ICT asset inventory should store the configuration of the ICT assets and the links and interdependencies between the different ICT assets, to enable a proper configuration and change management process.","D.AM-3.2: The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets.","D.AM-3.2","Full"]
[142,"3.5.","ICT operations management",null,null,53,"EBA GITSRM 53","Financial institutions should maintain an up-to-date inventory of their ICT assets (including ICT systems, network devices, databases, etc.). The ICT asset inventory should store the configuration of the ICT assets and the links and interdependencies between the different ICT assets, to enable a proper configuration and change management process.","ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources.","ID.AM-3.3","Full"]
[143,"3.5.","ICT operations management",null,null,54,"EBA GITSRM 54","The ICT asset inventory should be sufficiently detailed to enable the prompt identification of an ICT asset, its location, security classification and ownership. Interdependencies between assets should be documented to help in the response to security and operational incidents, including cyber-attacks.","PR.DS-3.1: The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","PR.DS-3.1","Full"]
[144,"3.5.","ICT operations management",null,null,54,"EBA GITSRM 54","The ICT asset inventory should be sufficiently detailed to enable the prompt identification of an ICT asset, its location, security classification and ownership. Interdependencies between assets should be documented to help in the response to security and operational incidents, including cyber-attacks.","ID.RA-5.5: The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","ID.RA-5.5","Full"]
[145,"3.5.","ICT operations management",null,null,55,"EBA GITSRM 55","Financial institutions should monitor and manage the life cycles of ICT assets, to ensure that they continue to meet and support business and risk management requirements. Financial institutions should monitor whether their ICT assets are supported by their external or internal vendors and developers and whether all relevant patches and upgrades are applied based on documented processes. The risks stemming from outdated or unsupported ICT assets should be assessed and mitigated.","PR.DS-3.1: The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes.","PR.DS-3.1","Full"]
[146,"3.5.","ICT operations management",null,null,55,"EBA GITSRM 55","Financial institutions should monitor and manage the life cycles of ICT assets, to ensure that they continue to meet and support business and risk management requirements. Financial institutions should monitor whether their ICT assets are supported by their external or internal vendors and developers and whether all relevant patches and upgrades are applied based on documented processes. The risks stemming from outdated or unsupported ICT assets should be assessed and mitigated.","DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions.","DM.ED-5.2","Full"]
[147,"3.5.","ICT operations management",null,null,55,"EBA GITSRM 55","Financial institutions should monitor and manage the life cycles of ICT assets, to ensure that they continue to meet and support business and risk management requirements. Financial institutions should monitor whether their ICT assets are supported by their external or internal vendors and developers and whether all relevant patches and upgrades are applied based on documented processes. The risks stemming from outdated or unsupported ICT assets should be assessed and mitigated.","ID.RA-5.5: The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets.","ID.RA-5.5","Full"]
[148,"3.5.","ICT operations management",null,null,55,"EBA GITSRM 55","Financial institutions should monitor and manage the life cycles of ICT assets, to ensure that they continue to meet and support business and risk management requirements. Financial institutions should monitor whether their ICT assets are supported by their external or internal vendors and developers and whether all relevant patches and upgrades are applied based on documented processes. The risks stemming from outdated or unsupported ICT assets should be assessed and mitigated.","PR.IP-12.4: The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame.","PR.IP-12.4","Full"]
[149,"3.5.","ICT operations management",null,null,56,"EBA GITSRM 56","Financial institutions should implement performance and capacity planning and monitoring processes to prevent, detect and respond to important performance issues of ICT systems and ICT capacity shortages in a timely manner.","PR.DS-4.1: The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment.","PR.DS-4.1","Full"]
[150,"3.5.","ICT operations management",null,null,57,"EBA GITSRM 57","Financial institutions should define and implement data and ICT systems backup and restoration procedures to ensure that they can be recovered as required. The scope and frequency of backups should be set out in line with business recovery requirements and the criticality of the data and the ICT systems and evaluated according to the performed risk assessment. Testing of the backup and restoration procedures should be undertaken on a periodic basis.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","PR.IP-4.1","Full"]
[151,"3.5.","ICT operations management",null,null,57,"EBA GITSRM 57","Financial institutions should define and implement data and ICT systems backup and restoration procedures to ensure that they can be recovered as required. The scope and frequency of backups should be set out in line with business recovery requirements and the criticality of the data and the ICT systems and evaluated according to the performed risk assessment. Testing of the backup and restoration procedures should be undertaken on a periodic basis.","PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience.","PR.IP-4.2","Full"]
[152,"3.5.","ICT operations management",null,null,58,"EBA GITSRM 58","Financial institutions should ensure that data and ICT system backups are stored securely and are sufficiently remote from the primary site so they are not exposed to the same risks.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","PR.IP-4.1","Partial"]
[153,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management",59,"EBA GITSRM 3.5.1.59","Financial institutions should establish and implement an incident and problem management process to monitor and log operational and security ICT incidents and to enable financial institutions to continue or resume, in a timely manner, critical business functions and processes when disruptions occur. Financial institutions should determine appropriate criteria and thresholds for classifying events as operational or security incidents, as set out in the Definitions section of these guidelines, as well as early warning indicators that should serve as alerts to enable early detection of these incidents. Such criteria and thresholds, for PSPs, are without prejudice to the classification of major incidents in accordance with Article 96 of PSD2 and the Guidelines on major incident reporting under PSD2 (EBA/GL/2017/10).","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","RS.RP-1.1","Full"]
[154,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management",60,"EBA GITSRM 3.5.1.60","To minimise the impact of adverse events and enable timely recovery, financial institutions should establish appropriate processes and organisational structures to ensure a consistent and integrated monitoring, handling and follow-up of operational and security incidents and to make sure that the root causes are identified and eliminated to prevent the occurrence of repeated incidents. The incident and problem management process should establish:","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","RS.RP-1.1","Full"]
[155,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management",60,"EBA GITSRM 3.5.1.60","To minimise the impact of adverse events and enable timely recovery, financial institutions should establish appropriate processes and organisational structures to ensure a consistent and integrated monitoring, handling and follow-up of operational and security incidents and to make sure that the root causes are identified and eliminated to prevent the occurrence of repeated incidents. The incident and problem management process should establish:","RS.AN-1.1: Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program.","RS.AN-1.1","Full"]
[156,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.a","EBA GITSRM 3.5.1.60.a","the procedures to identify, track, log, categorise and classify incidents according to a priority, based on business criticality;","RS.AN-4.1: The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise.","RS.AN-4.1","Full"]
[157,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.b","EBA GITSRM 3.5.1.60.b","the roles and responsibilities for different incident scenarios (e.g. errors, malfunctioning, cyber-attacks);","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority.","RS.CO-1.1","Full"]
[158,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.c","EBA GITSRM 3.5.1.60.c","problem management procedures to identify, analyse and solve the root cause behind one or more incidents a financial institution should analyse operational or security incidents likely to affect the financial institution that have been identified or have occurred within and/or outside the organisation and should consider key lessons learned from these analyses and update the security measures accordingly;","RS.AN-2.2: The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted.","RS.AN-2.2","Full"]
[159,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.c","EBA GITSRM 3.5.1.60.c","problem management procedures to identify, analyse and solve the root cause behind one or more incidents a financial institution should analyse operational or security incidents likely to affect the financial institution that have been identified or have occurred within and/or outside the organisation and should consider key lessons learned from these analyses and update the security measures accordingly;","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event.","RS.IM-1.1","Full"]
[160,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.c","EBA GITSRM 3.5.1.60.c","problem management procedures to identify, analyse and solve the root cause behind one or more incidents a financial institution should analyse operational or security incidents likely to affect the financial institution that have been identified or have occurred within and/or outside the organisation and should consider key lessons learned from these analyses and update the security measures accordingly;","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process.","RS.AN-3.1","Full"]
[161,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.d","EBA GITSRM 3.5.1.60.d","effective internal communication plans, including incident notification and escalation procedures also covering security-related customer complaints to ensure that:","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[162,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.d.i","EBA GITSRM 3.5.1.60.d.i","incidents with a potentially high adverse impact on critical ICT systems and ICT services are reported to the relevant senior management and ICT senior management;","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[163,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.d.ii","EBA GITSRM 3.5.1.60.d.ii","the management body is informed on an ad hoc basis in the event of significant incidents and, at least, informed of the impact, the response and the additional controls to be defined as a result of the incidents.","RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon.","RS.CO-2.3","Full"]
[164,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.e","EBA GITSRM 3.5.1.60.e","incident response procedures to mitigate the impacts related to the incidents and to ensure that the service becomes operational and secure in a timely manner;","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","RS.RP-1.1","Full"]
[165,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.f","EBA GITSRM 3.5.1.60.f","specific external communication plans for critical business functions and processes in order to:","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","RS.CO-4.1","Full"]
[166,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.f.i","EBA GITSRM 3.5.1.60.f.i","collaborate with relevant stakeholders to effectively respond to and recover from the incident;","RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels.","RS.CO-3.2","Full"]
[167,"3.5.","ICT operations management","3.5.1.","ICT incident and problem management","60.f.ii","EBA GITSRM 3.5.1.60.f.ii","provide timely information to external parties (e.g. customers, other market participants, the supervisory authority) as appropriate and in line with an applicable regulation.","RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies.","RS.CO-2.2","Full"]
[168,"3.6.","ICT project and change management","3.6.1.","ICT project management",61,"EBA GITSRM 3.6.1.61","A financial institution should implement a programme and/or a project governance process that defines roles, responsibilities and accountabilities to effectively support the implementation of the ICT strategy.","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners.","GV.RR-1.1","Full"]
[169,"3.6.","ICT project and change management","3.6.1.","ICT project management",62,"EBA GITSRM 3.6.1.62","A financial institution should appropriately monitor and mitigate risks deriving from their portfolio of ICT projects (programme management), considering also risks that may result from interdependencies between different projects and from dependencies of multiple projects on the same resources and/or expertise.","DM.BE-2.2: The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector.","DM.BE-2.2","Full"]
[170,"3.6.","ICT project and change management","3.6.1.","ICT project management",62,"EBA GITSRM 3.6.1.62","A financial institution should appropriately monitor and mitigate risks deriving from their portfolio of ICT projects (programme management), considering also risks that may result from interdependencies between different projects and from dependencies of multiple projects on the same resources and/or expertise.","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting.","GV.RM-1.1","Full"]
[171,"3.6.","ICT project and change management","3.6.1.","ICT project management",62,"EBA GITSRM 3.6.1.62","A financial institution should appropriately monitor and mitigate risks deriving from their portfolio of ICT projects (programme management), considering also risks that may result from interdependencies between different projects and from dependencies of multiple projects on the same resources and/or expertise.","GV.TE-1.2: The organization applies its cyber risk management framework to all technology projects.","GV.TE-1.2","Full"]
[172,"3.6.","ICT project and change management","3.6.1.","ICT project management",63,"EBA GITSRM 3.6.1.63","A financial institution should establish and implement an ICT project management policy that includes as a minimum:",null,{"$error":"#VALUE!"},"None"]
[173,"3.6.","ICT project and change management","3.6.1.","ICT project management","63.a","EBA GITSRM 3.6.1.63.a","project objectives;",null,{"$error":"#VALUE!"},"None"]
[174,"3.6.","ICT project and change management","3.6.1.","ICT project management","63.b","EBA GITSRM 3.6.1.63.b","roles and responsibilities;","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities.","ID.AM-6.1","Partial"]
[175,"3.6.","ICT project and change management","3.6.1.","ICT project management","63.c","EBA GITSRM 3.6.1.63.c","a project risk assessment;","PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment.","PR.IP-2.3","Partial"]
[176,"3.6.","ICT project and change management","3.6.1.","ICT project management","63.d","EBA GITSRM 3.6.1.63.d","a project plan, timeframe and steps;",null,{"$error":"#VALUE!"},"None"]
[177,"3.6.","ICT project and change management","3.6.1.","ICT project management","63.e","EBA GITSRM 3.6.1.63.e","key milestones;",null,{"$error":"#VALUE!"},"None"]
[178,"3.6.","ICT project and change management","3.6.1.","ICT project management","63.f","EBA GITSRM 3.6.1.63.f","change management requirements.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Partial"]
[179,"3.6.","ICT project and change management","3.6.1.","ICT project management",64,"EBA GITSRM 3.6.1.64","The ICT project management policy should ensure that information security requirements are analysed and approved by a function that is independent from the development function.","GV.AU-1.1: The organization has an independent audit function. ","GV.AU-1.1","Full"]
[180,"3.6.","ICT project and change management","3.6.1.","ICT project management",65,"EBA GITSRM 3.6.1.65","A financial institution should ensure that all areas impacted by an ICT project are represented in the project team and that the project team has the knowledge required to ensure secure and successful project implementation.","PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.","PR.AT-1.2","Partial"]
[181,"3.6.","ICT project and change management","3.6.1.","ICT project management",65,"EBA GITSRM 3.6.1.65","A financial institution should ensure that all areas impacted by an ICT project are represented in the project team and that the project team has the knowledge required to ensure secure and successful project implementation.","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Partial"]
[182,"3.6.","ICT project and change management","3.6.1.","ICT project management",66,"EBA GITSRM 3.6.1.66","The establishment and progress of ICT projects and their associated risks should be reported to the management body, individually or in aggregation, depending on the importance and size of the ICT projects, regularly and on an ad hoc basis as appropriate. Financial institutions should include project risk in their risk management framework.",null,{"$error":"#VALUE!"},"None"]
[183,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",67,"EBA GITSRM 3.6.2.67","Financial institutions should develop and implement a process governing the acquisition, development and maintenance of ICT systems. This process should be designed using a riskbased approach.","GV.TE-1.1: The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception.","GV.TE-1.1","Full"]
[184,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",68,"EBA GITSRM 3.6.2.68","A financial institution should ensure that, before any acquisition or development of ICT systems takes place, the functional and non-functional requirements (including information security requirements) are clearly defined and approved by the relevant business management.","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Full"]
[185,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",68,"EBA GITSRM 3.6.2.68","A financial institution should ensure that, before any acquisition or development of ICT systems takes place, the functional and non-functional requirements (including information security requirements) are clearly defined and approved by the relevant business management.","PR.IP-2.2: The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications.","PR.IP-2.2","Full"]
[186,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",69,"EBA GITSRM 3.6.2.69","A financial institution should ensure that measures are in place to mitigate the risk of unintentional alteration or intentional manipulation of the ICT systems during development and implementation in the production environment.","PR.IP-1.3: The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified.","PR.IP-1.3","Full"]
[187,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",70,"EBA GITSRM 3.6.2.70","Financial institutions should have a methodology in place for testing and approval of ICT systems prior to their first use. This methodology should consider the criticality of business processes and assets. The testing should ensure that new ICT systems perform as intended. They should also use test environments that adequately reflect the production environment .","PR.DS-7.1: The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment.","PR.DS-7.1","Full"]
[188,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",70,"EBA GITSRM 3.6.2.70","Financial institutions should have a methodology in place for testing and approval of ICT systems prior to their first use. This methodology should consider the criticality of business processes and assets. The testing should ensure that new ICT systems perform as intended. They should also use test environments that adequately reflect the production environment .","PR.IP-2.2: The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications.","PR.IP-2.2","Full"]
[189,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",70,"EBA GITSRM 3.6.2.70","Financial institutions should have a methodology in place for testing and approval of ICT systems prior to their first use. This methodology should consider the criticality of business processes and assets. The testing should ensure that new ICT systems perform as intended. They should also use test environments that adequately reflect the production environment .","PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment.","PR.IP-2.3","Full"]
[190,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",71,"EBA GITSRM 3.6.2.71","Financial institutions should test ICT systems, ICT services and information security measures to identify potential security weaknesses, violations and incidents.","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. ","PR.IP-4.1","Full"]
[191,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",71,"EBA GITSRM 3.6.2.71","Financial institutions should test ICT systems, ICT services and information security measures to identify potential security weaknesses, violations and incidents.","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit.","ID.RA-1.1","Full"]
[192,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",72,"EBA GITSRM 3.6.2.72","A financial institution should implement separate ICT environments to ensure adequate segregation of duties and to mitigate the impact of unverified changes to production systems. Specifically, a financial institution should ensure the segregation of production environments from development, testing and other non-production environments. A financial institution should ensure the integrity and confidentiality of production data in non-production environments. Access to production data is restricted to authorised users.","PR.DS-7.1: The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment.","PR.DS-7.1","Full"]
[193,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",73,{"$f":"_xlfn.CONCAT(\"EBA GITSRM \",D199,F199)","v":"EBA GITSRM 3.6.2.73"},"Financial institutions should implement measures to protect the integrity of the source codes of ICT systems that are developed in-house. They should also document the development, implementation, operation and/or configuration of the ICT systems comprehensively to reduce any unnecessary dependency on subject matter experts. The documentation of the ICT system should contain, where applicable, at least user documentation, technical system documentation and operating procedures.","PR.DS-6.1: The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable. ",{"$f":"LEFT(I199,FIND(\":\",I199)-1)","v":"PR.DS-6.1"},"Full"]
[194,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",73,"EBA GITSRM 3.6.2.73","Financial institutions should implement measures to protect the integrity of the source codes of ICT systems that are developed in-house. They should also document the development, implementation, operation and/or configuration of the ICT systems comprehensively to reduce any unnecessary dependency on subject matter experts. The documentation of the ICT system should contain, where applicable, at least user documentation, technical system documentation and operating procedures.","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development.","PR.IP-2.1","Full"]
[195,"3.6.","ICT project and change management","3.6.2.","ICT systems acquisition and development",74,"EBA GITSRM 3.6.2.74","A financial institution s processes for acquisition and development of ICT systems should also apply to ICT systems developed or managed by the business function s end users outside the ICT organisation (e.g. end user computing applications) using a risk-based approach. The financial institution should maintain a register of these applications that support critical business functions or processes.","ID.AM-2.1: The organization maintains a current and complete inventory of software platforms and business applications.","ID.AM-2.1","Full"]
[196,"3.6.","ICT project and change management","3.6.3.","ICT change management",75,"EBA GITSRM 3.6.3.75","Financial institutions should establish and implement an ICT change management process to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner. Financial institutions should handle the changes during emergencies (i.e. changes that must be introduced as soon as possible) following procedures that provide adequate safeguards.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[197,"3.6.","ICT project and change management","3.6.3.","ICT change management",76,"EBA GITSRM 3.6.3.76","Financial institutions should determine whether changes in the existing operational environment influence the existing security measures or require the adoption of additional measures to mitigate the risks involved. These changes should be in accordance with the financial institutions formal change management process.","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. ","PR.IP-3.1","Full"]
[198,"3.7.","Business continuity managemen",null,null,77,"EBA GITSRM 77","Financial institutions should establish a sound business continuity management (BCM) process to maximise their abilities to provide services on an ongoing basis and to limit losses in the event of severe business disruption in line with Article 85(2) of Directive 2013/36/EU and Title VI of the EBA Guidelines on internal governance (EBA/GL/2017/11).","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed.","PR.IP-9.1","Full"]
[199,"3.7.","Business continuity managemen",null,null,77,"EBA GITSRM 77","Financial institutions should establish a sound business continuity management (BCM) process to maximise their abilities to provide services on an ongoing basis and to limit losses in the event of severe business disruption in line with Article 85(2) of Directive 2013/36/EU and Title VI of the EBA Guidelines on internal governance (EBA/GL/2017/11).","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program.","DM.RS-1.1","Full"]
[200,"3.7.","Business continuity managemen",null,null,77,"EBA GITSRM 77","Financial institutions should establish a sound business continuity management (BCM) process to maximise their abilities to provide services on an ongoing basis and to limit losses in the event of severe business disruption in line with Article 85(2) of Directive 2013/36/EU and Title VI of the EBA Guidelines on internal governance (EBA/GL/2017/11).","DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  ","DM.RS-1.3","Full"]
[201,"3.7.","Business continuity managemen","3.7.1.","Business impact analysis",78,"EBA GITSRM 3.7.1.78","As part of sound business continuity management, financial institutions should conduct business impact analysis (BIA) by analysing their exposure to severe business disruptions and assessing their potential impacts (including on confidentiality, integrity and availability), quantitatively and qualitatively, using internal and/or external data (e.g. third party provider data relevant to a business process or publicly available data that may be relevant to the BIA) and scenario analysis. The BIA should also consider the criticality of the identified and classified business functions, supporting processes, third parties and information assets, and their interdependencies, in accordance with Section 3.3.3.","ID.RA-4.1: The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited.","ID.RA-4.1","Full"]
[202,"3.7.","Business continuity managemen","3.7.1.","Business impact analysis",79,"EBA GITSRM 3.7.1.79","Financial institutions should ensure that their ICT systems and ICT services are designed and aligned with their BIA, for example with redundancy of certain critical components to prevent disruptions caused by events impacting those components.","ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization.","ID.AM-5.2","Full"]
[203,"3.7.","Business continuity managemen","37.2.","Business continuity planning",80,"EBA GITSRM 37.2.80","Based on their BIAs, financial institutions should establish plans to ensure business continuity (business continuity plans, BCPs), which should be documented and approved by their management bodies. The plans should specifically consider risks that could adversely impact ICT systems and ICT services. The plans should support objectives to protect and, if necessary, re-establish the confidentiality, integrity and availability of their business functions, supporting processes and information assets. Financial institutions should coordinate with relevant internal and external stakeholders, as appropriate, during the establishment of these plans","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RC.IM-2.1","Full"]
[204,"3.7.","Business continuity managemen","37.2.","Business continuity planning",81,"EBA GITSRM 37.2.81","Financial institutions should put BCPs in place to ensure that they can react appropriately to potential failure scenarios and that they are able to recover the operations of their critical business activities after disruptions within a recovery time objective (RTO, the maximum time within which a system or process must be restored after an incident) and a recovery point objective (RPO, the maximum time period during which it is acceptable for data to be lost in the event of an incident). In cases of severe business disruption that trigger specific business continuity plans, financial institutions should prioritise business continuity actions using riskbased approach, which can be based on the risk assessments carried out under Section 3.3.3. For PSPs this may include, for example, facilitating the further processing of critical transactions while remediation efforts continue.","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","RC.RP-1.2","Full"]
[205,"3.7.","Business continuity managemen","37.2.","Business continuity planning",82,"EBA GITSRM 37.2.82","A financial institution should consider a range of different scenarios in its BCP, including extreme but plausible ones to which it might be exposed, including a cyber-attack scenario, and it should assess the potential impact that such scenarios might have. Based on these scenarios, a financial institution should describe how the continuity of ICT systems and services, as well as the financial institution s information security, are ensured.","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[206,"3.7.","Business continuity managemen","37.2.","Business continuity planning",82,"EBA GITSRM 37.2.82","A financial institution should consider a range of different scenarios in its BCP, including extreme but plausible ones to which it might be exposed, including a cyber-attack scenario, and it should assess the potential impact that such scenarios might have. Based on these scenarios, a financial institution should describe how the continuity of ICT systems and services, as well as the financial institution s information security, are ensured.","RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps.","RC.RP-1.5","Full"]
[207,"3.7.","Business continuity managemen","37.2.","Business continuity planning",82,"EBA GITSRM 37.2.82","A financial institution should consider a range of different scenarios in its BCP, including extreme but plausible ones to which it might be exposed, including a cyber-attack scenario, and it should assess the potential impact that such scenarios might have. Based on these scenarios, a financial institution should describe how the continuity of ICT systems and services, as well as the financial institution s information security, are ensured.","RC.RP-1.6: The recovery plan includes plans to come back for both traditional and highly available (e.g., cloud) infrastructure.","RC.RP-1.6","Full"]
[208,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",83,"EBA GITSRM 3.7.3.83","Based on the BIAs (paragraph 78) and plausible scenarios (paragraph 82), financial institutions should develop response and recovery plans. These plans should specify what conditions may prompt activation of the plans and what actions should be taken to ensure the availability, continuity and recovery of, at least, financial institutions critical ICT systems and ICT services. The response and recovery plans should aim to meet the recovery objectives of financial institutions operations.","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","DM.BE-3.1","Full"]
[209,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",83,"EBA GITSRM 3.7.3.83","Based on the BIAs (paragraph 78) and plausible scenarios (paragraph 82), financial institutions should develop response and recovery plans. These plans should specify what conditions may prompt activation of the plans and what actions should be taken to ensure the availability, continuity and recovery of, at least, financial institutions critical ICT systems and ICT services. The response and recovery plans should aim to meet the recovery objectives of financial institutions operations.","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","RS.RP-1.1","Full"]
[210,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",83,"EBA GITSRM 3.7.3.83","Based on the BIAs (paragraph 78) and plausible scenarios (paragraph 82), financial institutions should develop response and recovery plans. These plans should specify what conditions may prompt activation of the plans and what actions should be taken to ensure the availability, continuity and recovery of, at least, financial institutions critical ICT systems and ICT services. The response and recovery plans should aim to meet the recovery objectives of financial institutions operations.","RC.RP-1.1: The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations.","RC.RP-1.1","Full"]
[211,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",83,"EBA GITSRM 3.7.3.83","Based on the BIAs (paragraph 78) and plausible scenarios (paragraph 82), financial institutions should develop response and recovery plans. These plans should specify what conditions may prompt activation of the plans and what actions should be taken to ensure the availability, continuity and recovery of, at least, financial institutions critical ICT systems and ICT services. The response and recovery plans should aim to meet the recovery objectives of financial institutions operations.","RC.RP-1.3: The recovery plan includes a minimum recovery time for the sector critical systems.","RC.RP-1.3","Full"]
[212,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",83,"EBA GITSRM 3.7.3.83","Based on the BIAs (paragraph 78) and plausible scenarios (paragraph 82), financial institutions should develop response and recovery plans. These plans should specify what conditions may prompt activation of the plans and what actions should be taken to ensure the availability, continuity and recovery of, at least, financial institutions critical ICT systems and ICT services. The response and recovery plans should aim to meet the recovery objectives of financial institutions operations.","RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date.","RC.RP-1.4","Full"]
[213,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",84,"EBA GITSRM 3.7.3.84","The response and recovery plans should consider both short-term and long-term recovery options. The plans should:","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident.","RS.RP-1.1","Full"]
[214,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans","84.a","EBA GITSRM 3.7.3.84.a","focus on the recovery of the operations of critical business functions, supporting processes, information assets and their interdependencies to avoid adverse effects on the functioning of financial institutions and on the financial system, including on payment systems and on payment service users, and to ensure execution of pending payment transactions;","RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications.","RC.RP-1.2","Full"]
[215,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans","84.b","EBA GITSRM 3.7.3.84.b","be documented and made available to the business and support units and readily accessible in the event of an emergency;","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","RC.CO-3.1","Full"]
[216,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans","84.c","EBA GITSRM 3.7.3.84.c","be updated in line with lessons learned from incidents, tests, new risks identified and threats, and changed recovery objectives and priorities.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[217,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",85,"EBA GITSRM 3.7.3.85","The plans should also consider alternative options where recovery may not be feasible in the short term because of costs, risks, logistics or unforeseen circumstances.","DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  ","DM.RS-2.4","Full"]
[218,"3.7.","Business continuity managemen","3.7.3.","Response and recovery plans",86,"EBA GITSRM 3.7.3.86","Furthermore, as part of the response and recovery plans, a financial institution should consider and implement continuity measures to mitigate failures of third party providers, which are of key importance for a financial institution s ICT service continuity (in line with the provisions of the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) regarding business continuity plans).","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","DM.RS-2.1","Full"]
[219,"3.7.","Business continuity managemen","3.7.4.","Testing of plans",87,"EBA GITSRM 3.7.4.87","Financial institutions should test their BCPs periodically. In particular, they should ensure that the BCPs of their critical business functions, supporting processes, information assets and their interdependencies (including those provided by third parties, where applicable) are tested at least annually, in accordance with paragraph 89.","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[220,"3.7.","Business continuity managemen","3.7.4.","Testing of plans",88,"EBA GITSRM 3.7.4.88","BCPs should be updated at least annually, based on testing results, current threat intelligence and lessons learned from previous events. Any changes in recovery objectives (including RTOs and RPOs) and/or changes in business functions, supporting processes and information assets, should also be considered, where relevant, as a basis for updating the BCPs.","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization.","RC.IM-1.1","Full"]
[221,"3.7.","Business continuity managemen","3.7.4.","Testing of plans",89,"EBA GITSRM 3.7.4.89","Financial institutions testing of their BCPs should demonstrate that they are able to sustain the viability of their businesses until critical operations are re-established. In particular they should:","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","DM.BE-3.1","Full"]
[222,"3.7.","Business continuity managemen","3.7.4.","Testing of plans","89.a","EBA GITSRM 3.7.4.89.a","include testing of an adequate set of severe but plausible scenarios including those considered for the development of the BCPs (as well as testing of services provided by third parties, where applicable); this should include the switch-over of critical business functions, supporting processes and information assets to the disaster recovery environment and demonstrating that they can be run in this way for a sufficiently representative period of time and that normal functioning can be restored afterwards;","DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  ","DM.RS-2.3","Full"]
[223,"3.7.","Business continuity managemen","3.7.4.","Testing of plans","89.a","EBA GITSRM 3.7.4.89.a","include testing of an adequate set of severe but plausible scenarios including those considered for the development of the BCPs (as well as testing of services provided by third parties, where applicable); this should include the switch-over of critical business functions, supporting processes and information assets to the disaster recovery environment and demonstrating that they can be run in this way for a sufficiently representative period of time and that normal functioning can be restored afterwards;","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. ","DM.RS-2.1","Full"]
[224,"3.7.","Business continuity managemen","3.7.4.","Testing of plans","89.b","EBA GITSRM 3.7.4.89.b","be designed to challenge the assumptions on which BCPs rest, including governance arrangements and crisis communication plans; and","DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders.","DE.DP-4.2","Full"]
[225,"3.7.","Business continuity managemen","3.7.4.","Testing of plans","89.c","EBA GITSRM 3.7.4.89.c","include procedures to verify the ability of their staff and contractors, ICT systems and ICT services to respond adequately to the scenarios defined in paragraph 89(a).","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients.","PR.IP-10.1","Full"]
[226,"3.7.","Business continuity managemen","3.7.4.","Testing of plans","89.c","EBA GITSRM 3.7.4.89.c","include procedures to verify the ability of their staff and contractors, ICT systems and ICT services to respond adequately to the scenarios defined in paragraph 89(a).","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[227,"3.7.","Business continuity managemen","3.7.4.","Testing of plans","89.c","EBA GITSRM 3.7.4.89.c","include procedures to verify the ability of their staff and contractors, ICT systems and ICT services to respond adequately to the scenarios defined in paragraph 89(a).","RC.CO-3: Recovery activities are communicated to internal and external stakeholders as well as and executive and management teams.","RC.CO-3","Full"]
[228,"3.7.","Business continuity managemen","3.7.4.","Testing of plans",90,"EBA GITSRM 3.7.4.90","Test results should be documented and any identified deficiencies resulting from the tests should be analysed, addressed and reported to the management body.","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments.","RC.IM-2.1","Full"]
[229,"3.7.","Business continuity managemen","3.7.5.","Crisis communications",91,"EBA GITSRM 3.7.5.91","In the event of a disruption or emergency, and during the implementation of the BCPs, financial institutions should ensure that they have effective crisis communication measures in place so that all relevant internal and external stakeholders, including the competent authorities when required by national regulations, and also relevant providers (outsourcing providers, group entities, or third party providers) are informed in a timely and appropriate manner.","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders.","RC.CO-3.1","Full"]
[230,"3.7.","Business continuity managemen","3.7.5.","Crisis communications",91,"EBA GITSRM 3.7.5.91","In the event of a disruption or emergency, and during the implementation of the BCPs, financial institutions should ensure that they have effective crisis communication measures in place so that all relevant internal and external stakeholders, including the competent authorities when required by national regulations, and also relevant providers (outsourcing providers, group entities, or third party providers) are informed in a timely and appropriate manner.","RC.CO-1.2: The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate.","RC.CO-1.2","Full"]
[231,"3.7.","Business continuity managemen","3.7.5.","Crisis communications",91,"EBA GITSRM 3.7.5.91","In the event of a disruption or emergency, and during the implementation of the BCPs, financial institutions should ensure that they have effective crisis communication measures in place so that all relevant internal and external stakeholders, including the competent authorities when required by national regulations, and also relevant providers (outsourcing providers, group entities, or third party providers) are informed in a timely and appropriate manner.","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate.","RC.CO-1.1","Full"]
[232,3.8,"Payment service user relationship management",null,null,92,"EBA GITSRM 92","PSPs should establish and implement processes to enhance PSUs awareness of the security risks linked to the payment services by providing PSUs with assistance and guidance.","PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate.","PR.AT-3.1","Full"]
[233,3.8,"Payment service user relationship management",null,null,92,"EBA GITSRM 92","PSPs should establish and implement processes to enhance PSUs awareness of the security risks linked to the payment services by providing PSUs with assistance and guidance.","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities.","PR.AT-2.1","Full"]
[234,3.8,"Payment service user relationship management",null,null,93,"EBA GITSRM 93","The assistance and guidance offered to PSUs should be updated in the light of new threats and vulnerabilities, and changes should be communicated to the PSU.","PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate.","PR.AT-3.1","Full"]
[235,3.8,"Payment service user relationship management",null,null,93,"EBA GITSRM 93","The assistance and guidance offered to PSUs should be updated in the light of new threats and vulnerabilities, and changes should be communicated to the PSU.","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate.","RS.CO-4.1","Full"]
[236,3.8,"Payment service user relationship management",null,null,94,"EBA GITSRM 94","Where product functionality permits, PSPs should allow PSUs to disable specific payment functionalities related to the payment services offered by the PSP to the PSU.",null,{"$error":"#VALUE!"},"None"]
[237,3.8,"Payment service user relationship management",null,null,95,"EBA GITSRM 95","Where, in accordance with Article 68(1) of Directive (EU) 2015/2366, a PSP has agreed with the payer spending limits for payment transactions executed through specific payment instruments, the PSP should provide the payer with the option to adjust these limits up to the maximum agreed limit.",null,{"$error":"#VALUE!"},"None"]
[238,3.8,"Payment service user relationship management",null,null,96,"EBA GITSRM 96","PSPs should provide PSUs with the option to receive alerts on initiated and/or failed att empts to initiate payment transactions, enabling them to detect fraudulent or malicious use of their accounts.",null,{"$error":"#VALUE!"},"None"]
[239,3.8,"Payment service user relationship management",null,null,97,"EBA GITSRM 97","PSPs should keep PSUs informed about updates in security procedures that affect PSUs regarding the provision of payment services.","PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate.","PR.AT-3.1","Full"]
[240,3.8,"Payment service user relationship management",null,null,98,"EBA GITSRM 98","PSPs should provide PSUs with assistance on all questions, requests for support and notifications of anomalies or issues regarding security matters related to payment services. PSUs should be appropriately informed about how such assistance can be obtained.",null,{"$error":"#VALUE!"},"None"]

{"sheet":"Catalogue of Mapped Regs","index":11,"n_rows":38,"n_cols":6,"rows_kept":38,"cut":false,"hidden":false,"merged":[[1,1,1,5]]}
[]
[null,"Proprietary"]
[null,"Supervisory Expectations Catalogue: Regulatory, Supervisory and Oversight Issuances (Regulations, Guidance, Questionnaires) That Have Been Mapped"]
[]
[null,"Issued By","Name of Issuance","Region","Issue Date","Description"]
[null,"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S.","2016-09-19","Federal Register notice of final rule for “System Safeguards Testing Requirements,” which promulgates new cybersecurity testing requirements."]
[null,"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S.","N/A - 2016","CFTC cybersecurity examination."]
[null,"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S.","2013-05-20","Requires financial institutions and creditors to develop and implement a written identity theft prevention program designed to detect, prevent, and mitigate identity theft in connection with certain existing accounts or the opening of new accounts. The rules include guidelines to assist entities in the formulation and maintenance of programs that would satisfy the requirements of the rules.  "]
[null,"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","N/A - 2016","Information security survey of financial institutions."]
[null,"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","Global","2016-06-29","Publication of “Guidance on cyber resilience for financial market infrastructures,” which provides guidance for financial market infrastructures to enhance cyber resilience.  IOSCO member agencies regulate “more than 95% of the world's securities markets in more than 115 jurisdictions.”"]
[null,"EBA","European Banking Authority's \"Guidelines on ICT and security risk management\"",null,"2020-06-30","These Guidelines establish requirements for credit institutions, investment firms and payment service providers (PSPs) on the mitigation and management of their information and communication technology (ICT) and security risks and aim to ensure a consistent and robust approach across the Single market."]
[null,"ECB","European Central Bank, \"Cyber resilience oversight expectations for financial market infrastructures\"","EMEA","2018-12-03","The ECB CROE serves three key purposes:\n- it provides financial market infrastructures (FMIs) with detailed steps on how to operationalise the guidance, ensuring they are able to foster improvements and enhance their cyber resilience over a sustained period of time;\n- it provides overseers with clear expectations to assess FMIs under their responsibility; and\n- it provides the basis for a meaningful discussion between the FMIs and their respective overseers."]
[null,"FFIEC","FFIEC \"Cybersecurity Assessment Tool\"","U.S.","2015-06-30","FFIEC issued cybersecurity assessment tool."]
[null,"FFIEC","FFIEC \"IT Examination Handbook - Business Continuity Planning\"","U.S.","2015-02-01","This \"Business Continuity Planning\" booklet is one in a series of booklets that comprise the Federal Financial Institutions Examination Council (FFIEC) Information Technology (IT) Examination Handbook. This booklet provides guidance to assist examiners in evaluating financial institution and service provider risk management processes to ensure the availability of critical financial services."]
[null,"FFIEC","FFIEC \"IT Examination Handbook - Information Security Booklet\"","U.S.","2016-09-01","The \"Information Security Booklet\" is one of several that comprise the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook (IT Handbook)."]
[null,"FFIEC","FFIEC \"IT Examination Handbook - Management Booklet\"","U.S.","2015-11-01","The \"Management Booklet\" is one of several that comprise the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook (IT Handbook)."]
[null,"FFIEC","FFIEC \"IT Examination Handbook - Operations Booklet\"","U.S.","2004-07-01","The \"Operations Booklet\" is one of several that comprise the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook (IT Handbook)."]
[null,"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S.","2016-04-29","“Appendix E: Mobile Financial Services” issued as an appendix to the “Retail Payments Booklet” of the “FFIEC IT Examination Handbook.”"]
[null,"FFIEC","FFIEC - \"IT Examination Handbook - Business Continuity Management Booklet \"","U.S.","2019-11-14","Revised “Information Technology Examination Handbook: Business Continuity Management Booklet” issued, which provides guidance to assist examiners in evaluating financial institution and service provider risk management processes to ensure the availability of critical financial services."]
[null,"FFIEC ","FFIEC \"IT Examination Handbook - Audit Booklet\"","U.S.","2012-04-01","This \"Audit Booklet\" is one of several booklets that comprise the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook (IT Handbook) and provides guidance to examiners and financial institutions on the characteristics of an effective information technology (IT) audit function."]
[null,"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S.","2015-02-03","Summary of cybersecurity principles and effective practices."]
[null,"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S.","2016-10-26","Federal Register notice of advanced notice of proposed rulemaking (ANPRM), entitled, “Enhanced Cyber Risk Management Standards,” which, if issued as currently written, would impose new cybersecurity regulatory requirements on financial institutions with asset sizes of $50B+."]
[null,"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S.","2015-06-30","FTC Issues “Start with Security, A Guide for Business: Lessons Learned from FTC Cases,” which details cybersecurity expectations to avoid UDAP enforcement action."]
[null,"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Member Nations","2016-10-11","Publication of the Group of 7 (G-7) “Fundamental Elements of Cybersecurity for the Financial Sector,” which are described as a concise set of principles on best practices in cybersecurity for public and private entities in the financial sector."]
[null,"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","2016-03-23","Hong Kong SFC's circular announcing key areas of cyber concern and suggested cyber controls."]
[null,"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S.","N/A - 2016","Cybersecurity survey of individual financial institutions."]
[null,"NAIC","NAIC \"Insurance Data Security Model Law\"","U.S.","2017 Q4","The proposed “Insurance Data Security Model Law,” Version 4 https://www.naic.org/store/free/MDL-668.pdf"]
[null,"NAIC","NAIC Handbook Risk Statements/Exhibit C","U.S.","2019 Q2","Revisions to the General Information Technology Review and Exhibit C – Evaluation of\nControls in Information Systems. For more information, please contact NAIC"]
[null,"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S.","2015-10-23","Adoption of interpretive notice, “9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS,” effective March 1, 2016 and requiring adoption and enforcement of a written information systems security program."]
[null,"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S.","2017-02-16","NYDFS's cybersecurity regulatory requirements"]
[null,"Saudi Arabia - SAMA","Saudi Arabia - SAMA \"Information Security Survey - 2016\"","EMEA","N/A - 2016","Information security survey of financial institutions."]
[null,"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S.","2015-09-15","Office of Compliance Inspections and Examinations’ “Risk Alert” announcing further cyber exams of broker/dealers and investment advisors with new focus areas."]
[null,"SEC","SEC \"Regulation SCI\"","U.S.","2015-02-03","SEC Regulation System Comliance and Integrity (SCI).  Requires designated SCI entities to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets."]
[null,"SEC","SEC \"Regulation S-P\"","U.S.","2015-02-03","Requires registered broker-dealers, investment companies, and investment advisers to \"adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.\" "]
[null,"SEC","SEC \"Regulation SDR\"","U.S.","2015-05-18","Requires security-based swap data repositories, with respect to systems that support or are integrally related to the performance of its activities, to establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[null,"SEC","SEC \"Market Access Rule\"","U.S.","2010-11-03","Requires brokers or dealers with access to trading securities directly on an exchange or alternative trading system (“ATS”) to establish, document, and maintain a system of risk management controls and supervisory procedures that, among other things, are reasonably designed to address operational risks associated with market access."]
[null,"SEC","SEC \"Regulation FD\"","U.S.","2000-10-23","The SEC adopted the rule to address three issues: the selective disclosure by issuers of material nonpublic information; when insider trading liability arises in connection with a trader's \"use\" or \"knowing possession\" of material nonpublic information; and when the breach of a family or other non-business relationship may give rise to liability under the misappropriation theory of insider trading.  On 2/26/2018, further interpretive guidance was issued to assist public companies in preparing disclosures about cybersecurity risks and incidents: https://www.sec.gov/rules/interp/2018/33-10459.pdf"]
[null,"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","N/A - 2016","Information technology questionnaire of financial institutions."]

{"sheet":"Mapping to NAIC HBRS|ExC","index":12,"n_rows":288,"n_cols":7,"rows_kept":288,"cut":false,"hidden":false,"merged":[[283,4,284,4],[283,5,284,5],[285,2,286,2],[285,3,286,3],[285,4,286,4],[240,0,287,0],[240,1,244,1],[240,2,243,2],[240,3,243,3],[240,4,243,4],[264,4,270,4],[264,5,270,5],[271,2,274,2],[271,3,274,3],[271,4,274,4],[271,5,274,5],[275,1,282,1],[275,2,277,2],[275,3,277,3],[275,4,277,4],[275,5,277,5],[278,2,282,2],[278,3,282,3],[278,4,282,4],[278,5,282,5],[285,5,286,5],[283,1,287,1],[283,2,284,2],[283,3,284,3],[240,5,243,5],[248,5,252,5],[255,2,259,2],[255,3,259,3],[255,4,259,4],[253,2,254,2],[253,3,254,3],[253,4,254,4],[253,5,254,5],[255,5,259,5],[245,1,274,1],[245,2,247,2],[245,3,247,3],[245,4,247,4],[245,5,247,5],[248,2,252,2],[248,3,252,3],[248,4,252,4],[264,2,270,2],[197,0,227,0],[198,1,210,1],[198,2,200,2],[198,3,200,3],[264,3,270,3],[260,2,263,2],[260,3,263,3],[260,4,263,4],[260,5,263,5],[224,1,227,1],[224,2,226,2],[224,3,226,3],[224,4,226,4],[224,5,226,5],[228,0,239,0],[228,1,233,1],[228,2,233,2],[228,3,233,3],[228,4,233,4],[228,5,233,5],[234,1,235,1],[236,1,239,1],[236,2,237,2],[236,3,237,3],[236,4,237,4],[236,5,237,5],[216,3,218,3],[216,4,218,4],[216,5,218,5],[222,5,223,5],[211,1,218,1],[212,2,213,2],[212,3,213,3],[212,4,213,4],[212,5,213,5],[216,2,218,2],[219,1,223,1],[219,2,220,2],[219,3,220,3],[219,4,220,4],[219,5,220,5],[222,2,223,2],[222,3,223,3],[222,4,223,4],[198,4,200,4],[198,5,200,5],[205,2,206,2],[205,3,206,3],[205,4,206,4],[205,5,206,5],[208,2,210,2],[208,3,210,3],[208,4,210,4],[208,5,210,5],[201,2,204,2],[201,3,204,3],[201,4,204,4],[201,5,204,5],[165,0,196,0],[165,1,170,1],[167,2,168,2],[167,3,168,3],[167,4,168,4],[171,3,174,3],[171,4,174,4],[171,5,174,5],[176,2,178,2],[176,3,178,3],[176,4,178,4],[176,5,178,5],[189,3,190,3],[189,4,190,4],[189,5,190,5],[182,3,184,3],[182,4,184,4],[182,5,184,5],[191,1,196,1],[194,2,195,2],[194,3,195,3],[194,4,195,4],[194,5,195,5],[185,2,188,2],[153,4,156,4],[153,5,156,5],[144,2,145,2],[144,3,145,3],[144,4,145,4],[171,1,190,1],[171,2,174,2],[157,1,158,1],[159,1,164,1],[159,2,160,2],[159,3,160,3],[159,4,160,4],[159,5,160,5],[179,2,180,2],[185,3,188,3],[185,4,188,4],[185,5,188,5],[189,2,190,2],[179,3,180,3],[179,4,180,4],[179,5,180,5],[182,2,184,2],[167,5,168,5],[129,1,156,1],[129,2,131,2],[129,3,131,3],[129,4,131,4],[129,5,131,5],[132,2,134,2],[132,3,134,3],[132,4,134,4],[150,2,152,2],[150,3,152,3],[132,5,134,5],[136,2,139,2],[136,3,139,3],[136,4,139,4],[136,5,139,5],[150,4,152,4],[144,5,145,5],[146,2,149,2],[146,3,149,3],[146,4,149,4],[146,5,149,5],[150,5,152,5],[153,2,156,2],[153,3,156,3],[119,1,128,1],[119,2,120,2],[119,3,120,3],[119,4,120,4],[119,5,120,5],[121,2,122,2],[121,3,122,3],[121,4,122,4],[121,5,122,5],[116,2,117,2],[116,3,117,3],[116,4,117,4],[116,5,117,5],[110,2,112,2],[110,3,112,3],[110,4,112,4],[110,5,112,5],[107,3,109,3],[107,4,109,4],[107,5,109,5],[113,2,115,2],[113,3,115,3],[113,4,115,4],[113,5,115,5],[105,2,106,2],[105,3,106,3],[105,4,106,4],[105,5,106,5],[107,1,118,1],[107,2,109,2],[93,0,164,0],[93,1,106,1],[93,2,95,2],[93,3,95,3],[93,4,95,4],[93,5,95,5],[99,2,101,2],[99,3,101,3],[99,4,101,4],[99,5,101,5],[102,2,103,2],[102,3,103,3],[102,4,103,4],[102,5,103,5],[97,2,98,2],[97,3,98,3],[97,4,98,4],[97,5,98,5],[70,0,92,0],[70,1,78,1],[72,2,74,2],[72,3,74,3],[72,4,74,4],[72,5,74,5],[76,2,77,2],[76,3,77,3],[76,4,77,4],[76,5,77,5],[85,3,90,3],[85,4,90,4],[85,5,90,5],[91,2,92,2],[91,3,92,3],[91,4,92,4],[91,5,92,5],[62,2,63,2],[62,3,63,3],[62,4,63,4],[62,5,63,5],[64,2,66,2],[58,1,66,1],[58,2,61,2],[58,3,61,3],[58,4,61,4],[58,5,61,5],[64,3,66,3],[64,4,66,4],[79,1,92,1],[81,2,83,2],[81,3,83,3],[81,4,83,4],[81,5,83,5],[85,2,90,2],[67,1,69,1],[67,2,68,2],[67,3,68,3],[67,4,68,4],[67,5,68,5],[51,1,57,1],[51,2,54,2],[51,3,54,3],[51,4,54,4],[55,5,56,5],[55,2,56,2],[55,3,56,3],[55,4,56,4],[46,1,50,1],[46,2,47,2],[46,3,47,3],[46,4,47,4],[46,5,47,5],[48,2,50,2],[48,3,50,3],[48,4,50,4],[48,5,50,5],[33,1,40,1],[33,2,34,2],[33,3,34,3],[33,4,34,4],[33,5,34,5],[38,2,40,2],[41,1,45,1],[42,2,45,2],[42,3,45,3],[42,4,45,4],[42,5,45,5],[8,0,8,6],[9,0,10,0],[9,1,10,1],[9,2,10,2],[9,5,10,5],[9,6,10,6],[30,4,32,4],[30,5,32,5],[11,0,69,0],[11,1,20,1],[11,2,15,2],[11,3,15,3],[11,4,15,4],[11,5,15,5],[27,2,29,2],[27,3,29,3],[38,3,40,3],[38,4,40,4],[38,5,40,5],[21,5,26,5],[35,2,37,2],[35,3,37,3],[35,4,37,4],[35,5,37,5],[21,1,32,1],[21,2,26,2],[21,3,26,3],[21,4,26,4],[27,4,29,4],[27,5,29,5],[17,2,19,2],[17,3,19,3],[17,4,19,4],[17,5,19,5],[30,2,32,2],[30,3,32,3]]}
[]
[]
[]
[]
[]
[]
["Proprietary"]
[]
["Instructions: This tool integrates guidance from Financial Condition Examiners Handbook - Exhibit C into the CRI Financial Services Cybersecurity Profile. The mapping was performed at the subcategory level. This level is more granular and procedural based than the full category level. As a result, it was deemed more applicable to the work being performed by examiners. The mappings to Exhibit C are not meant to be resrictive, examiners may use the Exhibit C mapping reference as a starting point, but if other areas of Exhibit C relate more closely to the work being performed, Examiners are encouraged to tailor the use of information as they see fit. Regulators are expected to exercise judgement in integrating the information within this tool into the exam process. Exhibit C splits procedures into the categories of 1) Common Controls 2) Preliminary Information Requests and 3) Possible Test Procedures. The mapping to Exhibit C could be relevant in any of those 3 sections. "]
["Functions","Categories","Subcategories",null,null,"NIST CSF v1.1 Ref","Diagnostic Statements"]
[null,null,null,"NAIC Exhibit C Ref. #","NAIC Handbook Risk Statement"]
["GOVERNANCE (GV)","Strategy and Framework (GV.SF): The organization has a cyber risk management framework that is reviewed and approved by the Board and is informed by the organization's risk tolerances and its role in critical infrastructure.","GV.SF-1: Organization has a cyber risk management strategy and framework.","APO.03 & APO.09","Enterprise goals may not be met because the data and systems architecture is poorly defined and/or fragmented. \n\nIT-enabled services and internal service levels are not managed to ensure that IT services align with enterprise needs and expectations.","ID.BE-3;  ID.RM-1 - with sector enhancement ","GV.SF-1.1: The organization has a cyber risk management strategy and framework that is approved by the appropriate governing authority (e.g., the Board or one of its committees) and incorporated into the overall business strategy and enterprise risk management framework."]
[null,null,null,null,null,null,"GV.SF-1.2: An appropriate governing authority (e.g., the Board or one of its committees) oversees and holds senior management accountable for implementing the organization’s cyber risk management strategy and framework."]
[null,null,null,null,null,null,"GV.SF-1.3: The organization's cyber risk management strategy identifies and documents the organization's role as it relates to other critical infrastructures outside of the financial services sector and the risk that the organization may pose to them. "]
[null,null,null,null,null,null,"GV.SF-1.4: The cyber risk management strategy identifies and communicates the organization’s role within the financial services sector as a component of critical infrastructure in the financial services industry."]
[null,null,null,null,null,null,"GV.SF-1.5: The cyber risk management strategy and framework establishes and communicates priorities for organizational mission, objectives, and activities."]
[null,null,"GV.SF-2: Cyber risk management strategy and framework is appropriately informed by international, national, and industry standards and guidelines.","APO.02","Enterprise business objectives cannot be attained due to the development of an IT strategy that is inadequate, ineffective and not in alignment with business objectives, including inadequate management oversight over the achievement of the IT strategy.","None","GV.SF-2.1: The cyber risk management strategy and framework is appropriately informed by applicable international, national, and financial services industry standards and guidelines."]
[null,null,"GV.SF-3: Cyber risk management strategy and framework address applicable cybersecurity risks.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.GV-4 - with sector enhancement","GV.SF-3.1: An appropriate governing authority (e.g., the Board or one of its committees) endorses and periodically reviews the cyber risk appetite and is regularly informed about the status of and material changes in the organization's inherent cyber risk profile."]
[null,null,null,null,null,null,"GV.SF-3.2: An appropriate governing authority (e.g., the Board or one of its committees) periodically reviews and evaluates the organization's ability to manage its cyber risks."]
[null,null,null,null,null,null,"GV.SF-3.3: The cyber risk management framework provides mechanisms to determine the adequacy of resources to fulfill cybersecurity objectives."]
[null,null,"GV.SF-4: The organization’s determination of cyber risk appetite is informed by its role in critical infrastructure and sector specific risk analysis.","APO.04 & APO.12","Company operations may lack efficiency and competitive advantage because system technology is obsolete and poorly aligned with business objectives.\n\nIT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.RM-3 - with sector enhancement","GV.SF-4.1: The risk appetite is informed by the organization’s role in critical infrastructure."]
[null,"Risk Management (GV.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.","GV.RM-1: Cyber risk management processes are established, managed, and agreed to by organizational stakeholders.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.RM-1 - with sector enhancement","GV.RM-1.1: The cyber risk management program incorporates cyber risk identification, measurement, monitoring, and reporting."]
[null,null,null,null,null,null,"GV.RM-1.2: The cyber risk management program is integrated into daily operations and is tailored to address enterprise-specific risks (both internal and external) and evaluate the organization's cybersecurity policies, procedures, processes, and controls.  "]
[null,null,null,null,null,null,"GV.RM-1.3: As a part of the cyber risk management program, the organization has documented its cyber risk assessment process and methodology, which are periodically updated to address changes to the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[null,null,null,null,null,null,"GV.RM-1.4: The cyber risk assessment process is consistent with the organization's policies and procedures and includes criteria for the evaluation and categorization of enterprise-specific cyber risks and threats.  "]
[null,null,null,null,null,null,"GV.RM-1.5: The cyber risk management program and risk assessment process produce actionable recommendations that the organization uses to select, design, prioritize, implement, maintain, evaluate, and modify security controls."]
[null,null,null,null,null,null,"GV.RM-1.6: The cyber risk management program addresses identified cyber risks in one of the following ways:  risk acceptance, risk mitigation, risk avoidance, or risk transfer, which includes cyber insurance."]
[null,null,"GV.RM-2: Organizational risk tolerance is determined and clearly expressed.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.RM-2","GV.RM-2.1: The organization has established a cyber risk tolerance consistent with its risk appetite, and integrated it into technology or operational risk management, as appropriate."]
[null,null,null,null,null,null,"GV.RM-2.2: The cyber risk management strategy articulates how the organization intends to address its inherent cyber risk (before mitigating controls or other factors are taken into consideration)."]
[null,null,null,null,null,null,"GV.RM-2.3: The cyber risk management strategy articulates how the organization would maintain an acceptable level of residual cyber risk set by the appropriate governing authority (e.g., the Board or one of its committees)."]
[null,null,"GV.RM-3: Cyber risk management framework is integrated into the enterprise risk management framework.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","GV.RM-3.1: The cyber risk management framework is integrated into the enterprise risk management framework."]
[null,null,null,null,null,null,"GV.RM-3.2: The organization has a process for monitoring its cyber risks including escalating those risks that exceed risk tolerance to management.  "]
[null,null,null,null,null,null,"GV.RM-3.3: The organization's cyber risk management framework provides for segregation of duties between policy development, implementation, and oversight to ensure rigorous review of both policy and implementation."]
[null,"Policy (GV.PL): The organization has established a security policy in support of its cyber risk management framework.","GV.PL-1: Organizational cybersecurity policy is established and has been approved by appropriate governance bodies.","APO.01","IT organizational structure is inadequate to support business objectives.","ID.GV-1 -\nwith sector enhancement","GV.PL-1.1: The organization maintains a documented cybersecurity policy or policies approved by a designated Cybersecurity Officer (e.g., CISO) or an appropriate governing authority (e.g., the Board or one of its committees)."]
[null,null,null,null,null,null,"GV.PL-1.2: The organization's cybersecurity policy integrates with an appropriate employee accountability policy to ensure that all personnel are held accountable for complying with cybersecurity policies and procedures."]
[null,null,"GV.PL-2: Organizational cybersecurity policy addresses appropriate controls, identified through risk assessment.","APO.01","IT organizational structure is inadequate to support business objectives.","None","GV.PL-2.1: The cybersecurity policy is supported by the organization's risk management program."]
[null,null,null,null,null,null,"GV.PL-2.2: Cybersecurity processes and procedures are established based on the cybersecurity policy."]
[null,null,null,null,null,null,"GV.PL-2.3: The cybersecurity policy is periodically reviewed and revised under the leadership of a designated Cybersecurity Officer (e.g., CISO) to address changes in the risk profile and risk appetite (e.g., new technologies, products, services, interdependencies, and the evolving threat environment)."]
[null,null,"GV.PL-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed.","MEA.03","IT processes and IT-supported business processes are not compliant with applicable laws, regulations and other contractual requirements.","ID.GV-3","GV.PL-3.1: The cybersecurity policy, strategy and framework should take into account the organization's legal and regulatory obligations."]
[null,null,null,null,null,null,"GV.PL-3.2: The organization's cybersecurity policies are consistent with its privacy and civil liberty obligations."]
[null,null,null,null,null,null,"GV.PL-3.3: The organization implements and maintains a documented policy or policies that address customer data privacy, and is approved by a designated officer or the organization’s appropriate governing body (e.g., the Board or one of its committees)."]
[null,"Roles and Responsibilities (GV.RR): The organization has designated appropriate roles and responsibilities, including an individual responsible for cybersecurity for the organization.","GV.RR-1: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners.","APO.01","IT organizational structure is inadequate to support business objectives.","ID.GV-2","GV.RR-1.1: The organization coordinates and aligns roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework with internal and external partners."]
[null,null,"GV.RR-2: Organization has appointed a manager responsible for cybersecurity efforts within the organization, including authority, sufficient budget, and access to the executive suite and appropriate governing authority (e.g., the Board or one of its committees).","APO.01 & APO.06","IT organizational structure is inadequate to support business objectives.\n\nThe IT budget is not representative of the organization's goals and business needs, and IT expenses are not properly allocated.","None","GV.RR-2.1: The organization has designated a Cybersecurity Officer (e.g., CISO) who is responsible and accountable for developing cybersecurity strategy, overseeing and implementing its cybersecurity program and enforcing its cybersecurity policy."]
[null,null,null,null,null,null,"GV.RR-2.2: The organization provides adequate resources, appropriate authority, and access to the governing authority for the designated Cybersecurity Officer (e.g., CISO). "]
[null,null,null,null,null,null,"GV.RR-2.3: The designated Cybersecurity Officer (e.g., CISO) periodically reports to the appropriate governing authority (e.g., the Board or one of its committees) or equivalent governing body on the status of cybersecurity within the organization.  "]
[null,null,null,null,null,null,"GV.RR-2.4: The organization provides adequate resources to maintain and enhance the cybersecurity situational awareness of senior managers within the organization."]
[null,"Security Program (GV.SP):  The organization has a cybersecurity program that is continually measured and improved.","GV.SP-1: Organization has a cybersecurity program that implements, monitors and updates its policies, procedures, processes, and controls to continually manage cybersecurity risks to the organization.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","GV.SP-1.1: The organization has established, and maintains, a cybersecurity program designed to protect the confidentiality, integrity and availability of its information and operational systems, commensurate with the organization's risk appetite."]
[null,null,null,null,null,null,"GV.SP-1.2: Based on a periodic risk assessment, the organization's cybersecurity program identifies and implements appropriate security controls to manage applicable cyber risks within the risk tolerance set by the governing authority (e.g., the Board or one of its committees)."]
[null,null,"GV.SP-2: Cybersecurity performance is measured and regularly reported to senior executives and the Board or an appropriate governing body.","APO.09","IT-enabled services and internal service levels are not managed to ensure that IT services align with enterprise needs and expectations.","None","GV.SP-2.1: The organization implements a repeatable process to develop, collect, store, report, and refresh actionable cybersecurity key performance indicators and metrics. "]
[null,null,null,null,null,null,"GV.SP-2.2: The organization develops, implements, and reports to management and the appropriate governing body (e.g., the Board or one of its committees) key cybersecurity performance indicators and metrics based on the cyber risk strategy and framework to  measure, monitor, and report actionable indicators to help guide the security program.  "]
[null,null,null,null,null,null,"GV.SP-2.3: The organization establishes specific objectives, performance criteria, benchmarks, and tolerance limits to identify areas that have improved or are in need of improvement over time."]
[null,"Independent Risk Management Function (GV.IR): The organization has an independent risk management function.","GV.IR-1: An independent risk management function provides assurance that the cybersecurity risk management framework has been implemented according to policy and is consistent with the organization's risk appetite and tolerance.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","GV.IR-1.1: The organization's enterprise-wide cyber risk management framework includes an independent risk management function that provides assurance that the cyber risk management framework is implemented as intended."]
[null,null,null,null,null,"None","GV.IR-1.2: An independent risk management function has sufficient independence, stature, authority, resources, and access to the appropriate governing body (e.g., the Board or one of its committees), including reporting lines, to ensure consistency with the organization's cyber risk management framework."]
[null,null,null,null,null,"None","GV.IR-1.3: The independent risk management function has appropriate understanding of the organization's structure, cybersecurity program, and relevant risks and threats.  "]
[null,null,null,null,null,"None","GV.IR-1.4: Individuals responsible for independent risk management and oversight are independent of business line management, including senior leadership."]
[null,null,"GV.IR-2: An independent risk management function assesses the appropriateness of the risk management program for the organization's risk appetite and proposes risk mitigation strategies.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","GV.IR-2.1: An independent risk management function assesses the appropriateness of the cyber risk management program according to the organization's risk appetite."]
[null,null,null,null,null,null,"GV.IR-2.2: An independent risk management function frequently and recurrently assesses the organization's controls and cyber risk exposure, identifies opportunities for improvement based on assessment results, and proposes risk mitigation strategies and improvement actions when needed."]
[null,null,"GV.IR-3: An independent risk management function reports implementation of cyber risk management framework to the appropriate governing authority (e.g., the Board or one of its committees)","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","GV.IR-3.1: An independent risk management function reports to the appropriate governing authority (e.g., the Board or one of its committees) and to the appropriate risk management officer within the organization on the implementation of the cyber risk management framework throughout the organization."]
[null,"Audit (GV.AU): The organization has an independent audit function to provide for appropriate oversight of the cybersecurity program.","GV.AU-1: An independent audit function assesses compliance with internal controls and applicable laws and regulations.  ","MEA.02","The company does not identify and address internal control deficiencies related to IT systems. ","None","GV.AU-1.1: The organization has an independent audit function. "]
[null,null,null,null,null,null,"GV.AU-1.2: The organization has an independent audit plan that provides for an evaluation of the organization's compliance with the appropriately approved cyber risk management framework and its cybersecurity policies and processes including how well the organization adapts to the evolving cyber risk environment while remaining within its stated risk appetite and tolerance."]
[null,null,null,null,null,null,"GV.AU-1.3: An independent audit function tests security controls and information security policies."]
[null,null,null,null,null,null,"GV.AU-1.4: An independent audit function assesses compliance with applicable laws and regulations."]
[null,null,"GV.AU-2: An independent audit function updates its procedures to adjust to the evolving cybersecurity environment.","BAI.03","Project deliverables fail to meet business objectives due to inadequate design and/or ineffective oversight of implementation.","None","GV.AU-2.1: A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector."]
[null,null,null,null,null,null,"GV.AU-2.2: A formal process is in place for the independent audit function to update its procedures based on changes to the organization's risk appetite and risk tolerance."]
[null,null,"GV.AU-3: An independent audit function identifies, tracks, and reports significant changes in the organization's cyber risk exposure to the appropriate governing authority (e.g., the Board or one of its committees).","BAI.03","Project deliverables fail to meet business objectives due to inadequate design and/or ineffective oversight of implementation.","None","GV.AU-3.1: An independent audit function reviews cybersecurity practices and identifies weaknesses and gaps."]
[null,null,null,null,null,"None","GV.AU-3.2: An independent audit function tracks identified issues and corrective actions from internal audits and independent testing/assessments to ensure timely resolution. "]
[null,null,null,null,null,"None","GV.AU-3.3: An independent audit function reports to the appropriate governing authority (e.g., the Board or one of its committees) within the organization, including when its assessment differs from that of the organization, or when cyber risk tolerance has been exceeded in any part of the organization."]
[null,"Technology (GV.TE): The organization integrates cyber risk considerations into new technology development, design, implementation, and adoption.","GV.TE-1: Organization integrates consideration of cyber risks into technology implementations.","APO.04","Company operations may lack efficiency and competitive advantage because system technology is obsolete and poorly aligned with business objectives.","None","GV.TE-1.1: The organization identifies how cybersecurity will support emerging technologies that support business needs (e.g., cloud, mobile, IoT, IIoT, etc.) by integrating cybersecurity considerations into the lifecycle of new technologies from their inception."]
[null,null,null,null,null,null,"GV.TE-1.2: The organization applies its cyber risk management framework to all technology projects."]
[null,null,"GV.TE-2: Organization should use technical security standards, architectures, and tools to ensure security to the maximum extent possible.","BAI.10","A lack of configuration management threatens system stability, integrity and recovery.","None","GV.TE-2.1: The organization defines, maintains, and uses technical security standards, architectures, processes or practices (including automated tools when practical) to ensure the security of its applications and infrastructure."]
["IDENTIFY (ID)","Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.","ID.AM-1: Physical devices and systems within the organization are inventoried.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","ID.AM-1","ID.AM-1.1: The organization maintains a current and complete asset inventory of physical devices, hardware, and information systems."]
[null,null,"ID.AM-2: Software platforms and applications within the organization are inventoried.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","ID.AM-2","ID.AM-2.1: The organization maintains a current and complete inventory of software platforms and business applications."]
[null,null,"ID.AM-3: Organizational communication and data flows are mapped.","APO.03","Enterprise goals may not be met because the data and systems architecture is poorly defined and/or fragmented. ","ID.AM-3","ID.AM-3.1: The organization maintains an inventory of internal assets and business functions, that includes mapping to other assets, business functions, and information flows. "]
[null,null,null,null,null,null,"ID.AM-3.2: The organization maintains a current and complete inventory of types of data being created, stored, or processed by its information assets."]
[null,null,null,null,null,null,"ID.AM-3.3: The organization's asset inventory includes maps of network resources, as well as connections with external and mobile resources."]
[null,null,"ID.AM-4: External information systems are catalogued.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","ID.AM-4","ID.AM-4.1: The organization maintains an inventory of external information systems. "]
[null,null,"ID.AM-5: Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","ID.AM-5","ID.AM-5.1: The organization implements and maintains a written risk-based policy or policies on data governance and classification, approved by a Senior Officer or the organization's governing body (e.g., the Board or one of its committees).  "]
[null,null,null,null,null,null,"ID.AM-5.2: The organization's resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification, criticality, vulnerability, business value, and importance to the organization."]
[null,null,"ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established.","APO.01","IT organizational structure is inadequate to support business objectives.","ID.AM-6","ID.AM-6.1: Roles and responsibilities for the entire cybersecurity workforce and directly managed third-party personnel are established, well-defined and aligned with internal roles and responsibilities."]
[null,"Risk Assessment (ID.RA): The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-1: Asset vulnerabilities are identified and documented.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","ID.RA-1","ID.RA-1.1: The organization's business units identify, assess and document applicable cyber risks and potential vulnerabilities associated with business assets to include workforce, data, technology, facilities, service, and IT connection points for the respective unit."]
[null,null,"ID.RA-2: Cyber threat intelligence is received from information sharing forums and sources.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","ID.RA-2","ID.RA-2.1: The organization participates actively (in geopolitical alignment with its business operations) in applicable information-sharing groups and collectives (e.g., cross-industry, cross-government and cross-border groups) to gather, distribute and analyze information about cyber practices, cyber threats and early warning indicators relating to cyber threats. "]
[null,null,"ID.RA-3: Cyber threats, both internal and external, are identified and documented.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.RA-3 - with sector enhancement","ID.RA-3.1: The organization identifies, documents, and analyzes threats that are internal and external to the firm."]
[null,null,null,null,null,null,"ID.RA-3.2: The organization includes in its threat analysis those cyber threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past. "]
[null,null,null,null,null,null,"ID.RA-3.3: The organization regularly reviews and updates results of its cyber threat analysis."]
[null,null,"ID.RA-4: Potential business impacts and likelihoods are identified.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","ID.RA-4","ID.RA-4.1: The organization's risk assessment approach includes identification of likelihood and potential business impact of applicable cyber risks being exploited."]
[null,null,"ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.RA-5","ID.RA-5.1: Cyber threats, vulnerabilities, likelihoods, and impacts are used to determine overall cyber risk to the organization."]
[null,null,null,null,null,null,"ID.RA-5.2: The organization considers threat intelligence received from the organization's participants, service and utility providers and other industry organizations."]
[null,null,null,null,null,null,"ID.RA-5.3: The organization has established threat modeling capabilities to identify how and why critical assets might be compromised by a threat actor, what level of protection is needed for those critical assets, and what the impact would be if that protection failed."]
[null,null,null,null,null,null,"ID.RA-5.4: The organization's business units assess, on an ongoing basis, the cyber risks associated with the activities of the business unit."]
[null,null,null,null,null,null,"ID.RA-5.5: The organization tracks connections among assets and cyber risk levels throughout the life cycles of the assets."]
[null,null,null,null,null,null,"ID.RA-5.6: The organization determines ways to aggregate cyber risk to assess the organization's residual cyber risk."]
[null,null,"ID.RA-6: Risk responses are identified and prioritized.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.RA-6","ID.RA-6.1: The organization's business units ensure that information regarding cyber risk is shared with the appropriate level of senior management in a timely manner, so that they can address and respond to emerging cyber risk."]
[null,null,null,null,null,null,"ID.RA-6.2: Independent risk management is required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units. "]
["PROTECT (PR)","Identity Management and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.AC-1","PR.AC-1.1: Physical and logical access to systems is permitted only for individuals who have a legitimate business requirement and have been authorized."]
[null,null,null,null,null,null,"PR.AC-1.2: User access authorization is limited to individuals who are appropriately trained and monitored."]
[null,null,null,null,null,null,"PR.AC-1.3: Identities and credentials are actively managed or automated for authorized devices and users (e.g., removal of default and factory passwords, revocation of credentials for users who change roles or leave the organization, etc.)."]
[null,null,"PR.AC-2: Physical access to assets is managed and protected.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","PR.AC-2","PR.AC-2.1: The organization manages and protects physical access to information assets (e.g., session lockout, physical control of server rooms)."]
[null,null,"PR.AC-3: Remote access is managed.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.AC-3","PR.AC-3.1: Remote access is actively managed and restricted to necessary systems."]
[null,null,null,null,null,null,"PR.AC-3.2: The organization implements multi-factor authentication, or at least equally secure access controls for remote access, if it is warranted by applicable risk considerations."]
[null,null,"PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.AC-4","PR.AC-4.1: The organization limits access privileges to the minimum necessary."]
[null,null,null,null,null,null,"PR.AC-4.2: The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. "]
[null,null,null,null,null,null,"PR.AC-4.3: The organization institutes controls over service account (i.e., accounts used by systems to access other systems) lifecycles to ensure strict security over creation, use, and termination; access credentials (e.g., no embedded passwords in code); frequent reviews of account ownership; visibility for unauthorized use; and hardening against malicious insider use."]
[null,null,"PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.AC-5 - with sector enhancement","PR.AC-5.1: Networks and systems are segmented to maintain appropriate security."]
[null,null,null,null,null,null,"PR.AC-5.2: The organization controls access to its wireless networks and the information that these networks process by implementing appropriate mechanisms (e.g., strong authentication for authentication and transmission, preventing unauthorized devices from connecting to the internal networks, restricting unauthorized traffic, and segregating guest wireless networks)."]
[null,null,"PR.AC-6: Identities are proofed and bound to credentials, and asserted in interactions.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.AC-6","PR.AC-6.1: The organization authenticates identity and validates the authorization level of a user before granting access to its systems."]
[null,null,"PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).\n","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.AC-7","PR.AC-7.1: The organization performs a risk assessment for prospective users, devices and other assets which authenticate into its ecosystem with a specific focus on:\n(1) The type of data being accessed (e.g., customer PII, public data);\n(2) The risk of the transaction (e.g., internal-to-internal, external-to-internal);\n(3) The organization's level of trust for the accessing agent (e.g., external application, internal user); and\n(4) The potential for harm."]
[null,null,null,null,null,null,"PR.AC-7.2: Based on the risk level of a given transaction, the organization has defined and implemented authentication requirements, such as including implementing multi-factor, out-of-band authentication for high risk transactions."]
[null,"Awareness and Training (PR.AT): The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-1: All users are informed and trained.","APO.01","IT organizational structure is inadequate to support business objectives.","PR.AT-1","PR.AT-1.1: All personnel (full-time or part-time; permanent, temporary or contract) receive periodic cybersecurity awareness training, as permitted by law."]
[null,null,null,null,null,null,"PR.AT-1.2: Cybersecurity awareness training includes at a minimum appropriate awareness of and competencies for data protection, detecting and addressing cyber risks, and how to report any unusual activity or incidents.  "]
[null,null,null,null,null,null,"PR.AT-1.3: Cybersecurity awareness training is updated on a regular basis to reflect risks identified by the organization in its risk assessment."]
[null,null,"PR.AT-2: Privileged users understand their roles and responsibilities.","APO.01","IT organizational structure is inadequate to support business objectives.","PR.AT-2","PR.AT-2.1: High-risk groups, such as those with privileged system access or in sensitive business functions (including privileged users, senior executives, cybersecurity personnel and third-party stakeholders), receive cybersecurity situational awareness training for their roles and responsibilities."]
[null,null,null,null,null,null,"PR.AT-2.2: Cybersecurity personnel receive training appropriate for their roles and responsibilities in cybersecurity, including situational awareness training sufficient to maintain current knowledge of cyber threats and countermeasures. "]
[null,null,null,null,null,null,"PR.AT-2.3: A mechanism is in place to verify that key cybersecurity personnel maintain current knowledge of changing cyber threats and countermeasures. "]
[null,null,"PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities.","APO.10","Third-party service provider risks are not properly assessed, addressed, and mitigated.","PR.AT-3","PR.AT-3.1: The organization has established and maintains a cybersecurity awareness program through which the organization's customers are kept aware of their role in cybersecurity, as appropriate."]
[null,null,null,null,null,null,"PR.AT-3.2: Cybersecurity training provided through a third-party service provider or affiliate should be consistent with the organization's cybersecurity policy and program."]
[null,null,null,null,null,null,"PR.AT-3.3: Cybersecurity training covers topics designed to minimize risks to or from interconnected parties."]
[null,null,"PR.AT-4: Senior executives understand their roles and responsibilities.","APO.01","IT organizational structure is inadequate to support business objectives.","PR.AT-4","PR.AT-4.1: The organization's governing body (e.g., the Board or one of its committees) and senior management receive cybersecurity situational awareness training to include appropriate skills and knowledge to: \n(1) Evaluate and manage cyber risks;\n(2) Promote a culture that recognizes that staff at all levels have important responsibilities in ensuring the organization's cyber resilience; and\n(3) Lead by example."]
[null,null,null,null,null,null,"PR.AT-4.2: Where the organization's governing authority (e.g., the Board or one of its committees) does not have adequate cybersecurity expertise, they should have direct access to the senior officer responsible for cybersecurity to discuss cybersecurity related matters."]
[null,null,"PR.AT-5: Physical and information security personnel understand roles and responsibilities.","APO.01","IT organizational structure is inadequate to support business objectives.","PR.AT-5","PR.AT-5.1: The individuals who fulfill the organization’s physical and cybersecurity objectives (employees or outsourced) have been informed of their roles and responsibilities."]
[null,"Data Security (PR.DS): Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-1: Data-at-rest is protected.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.DS-1","PR.DS-1.1: Data-at-rest is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,null,null,null,"PR.DS-1.2: Controls for data-at-rest include, but are not be restricted to, appropriate encryption, authentication and access control.  "]
[null,null,"PR.DS-2: Data-in-transit is protected.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.DS-2","PR.DS-2.1: Data-in-transit is protected commensurate with the criticality and sensitivity of the information and in alignment with the data classification and protection policy."]
[null,null,null,null,null,null,"PR.DS-2.2: Controls for data-in-transit include, but are not be restricted to, appropriate encryption, authentication and access control.  "]
[null,null,"PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.DS-3","PR.DS-3.1: The organization has an asset management process in place and assets are formally managed (e.g., in a configuration management database) throughout removal, transfers, end-of-life, and secure disposal or re-use of equipment processes."]
[null,null,"PR.DS-4: Adequate capacity to ensure availability is maintained.","BAI.04","Systems fail to meet current and future business needs due to inadequate planning for capacity, performance and availability.","PR.DS-4","PR.DS-4.1: The organization maintains appropriate system and network availability, consistent with business requirements and risk assessment."]
[null,null,"PR.DS-5: Protections against data leaks are implemented.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.DS-5","PR.DS-5.1: The organization implements data loss identification and prevention tools to monitor and protect against confidential data theft or destruction by an employee or an external actor."]
[null,null,"PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.DS-6","PR.DS-6.1: The organization uses integrity checking mechanisms to verify software, firmware and information integrity, as practicable. "]
[null,null,"PR.DS-7: The development and testing environment(s) are separate from the production environment.","BAI.06 & 07","A lack of proper change management threatens system stability and/or integrity. ","PR.DS-7","PR.DS-7.1: The organization's development, testing and acceptance environment(s) are separate from the production environment, and test data is protected and not used in the production environment."]
[null,null,"PR.DS-8: Integrity checking mechanisms are used to verify hardware integrity.","BAI.03","Project deliverables fail to meet business objectives due to inadequate design and/or ineffective oversight of implementation.","PR.DS-8","PR.DS-8.1: The organization uses integrity checking mechanisms to verify hardware integrity, as practicable."]
[null,"Information Protection Processes and Procedures (PR.IP): Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.\n","PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g., concept of least functionality).","BAI.10","A lack of configuration management threatens system stability, integrity and recovery.","PR.IP-1","PR.IP-1.1: The organization establishes and maintains baseline system security configuration standards to facilitate consistent application of security settings to designated information assets."]
[null,null,null,null,null,null,"PR.IP-1.2: The organization establishes policies, procedures and tools, such as policy enforcement, device fingerprinting, patch status, operating system version, level of security controls, etc., to manage personnel's mobile devices before allowing access to the organization's network and resources."]
[null,null,null,null,null,null,"PR.IP-1.3: The organization performs regular enforcement checks to ensure that non-compliance with baseline system security standards is promptly rectified."]
[null,null,"PR.IP-2: A System Development Life Cycle to manage systems is implemented.","BAI.01","IT projects may fail to meet business objectives/ERM goals or run over budget in the absence of an effective program and project-management methodology.","PR.IP-2","PR.IP-2.1: The organization implements a process for Secure System Development Lifecycle for in-house software design and development."]
[null,null,null,null,null,null,"PR.IP-2.2: The organization implements a process for evaluating (e.g., assessing or testing) externally developed applications."]
[null,null,null,null,null,null,"PR.IP-2.3: The organization assesses the cyber risks of software prior to deployment."]
[null,null,"PR.IP-3: Configuration change control processes are in place.","BAI.06 & 07","A lack of proper change management threatens system stability and/or integrity. ","PR.IP-3","PR.IP-3.1: The organization's change management process explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. "]
[null,null,"PR.IP-4: Backups of information are conducted, maintained, and tested periodically.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","PR.IP-4 - with sector enhancement","PR.IP-4.1: The organization designs and tests its systems and processes to enable recovery of accurate data (e.g., material financial transactions) sufficient to support normal operations and obligations following a cybersecurity incident. "]
[null,null,null,null,null,null,"PR.IP-4.2: The organization conducts and maintains backups of information and periodically conduct tests of backups to business assets (including full system recovery) to achieve cyber resilience."]
[null,null,null,null,null,null,"PR.IP-4.3: The organization has plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives. "]
[null,null,null,null,null,null,"PR.IP-4.4: Recovery point objectives to support data integrity efforts are consistent with the organization's resumption time objective for critical operations."]
[null,null,"PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","PR.IP-5","PR.IP-5.1: Physical and environmental security policies are implemented and managed. "]
[null,null,"PR.IP-6: Data is destroyed according to policy.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.IP-6","PR.IP-6.1: Data is maintained, stored, retained and destroyed according to the organization's data retention policy."]
[null,null,"PR.IP-7: Protection processes are continuously improved.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","PR.IP-7 - with sector enhancement","PR.IP-7.1:  A formal process is in place to improve protection processes by integrating lessons learned and responding to changes in the organization's environment."]
[null,null,"PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","PR.IP-8 - with sector enhancement","PR.IP-8.1:  The organization shares appropriate types of information about the effectiveness of its protective measures with appropriate parties."]
[null,null,"PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","PR.IP-9","PR.IP-9.1:  The organization's business continuity, disaster recovery, crisis management and response plans are in place and managed."]
[null,null,null,null,null,null,"PR.IP-9.2: The organization defines objectives for resumption of critical operations."]
[null,null,"PR.IP-10: Response and recovery plans are tested.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","PR.IP-10","PR.IP-10.1: The organization establishes testing programs that include a range of scenarios, including severe but plausible scenarios (e.g., disruptive, destructive, corruptive) that could affect the organization's ability to service clients."]
[null,null,null,null,null,null,"PR.IP-10.2: The organization's testing program validates the effectiveness of its cyber resilience framework on a regular basis."]
[null,null,null,null,null,null,"PR.IP-10.3: The organization's governing body (e.g., the Board or one of its committees) is involved in testing as part of a crisis management team and is informed of test results."]
[null,null,null,null,null,null,"PR.IP-10.4: The organization promotes, designs, organizes and manages testing exercises designed to test its response, resumption and recovery plans and processes. "]
[null,null,"PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening).","BAI.08","Systems cannot be properly managed and optimized due to inadequate documentation and training. ","PR.IP-11","PR.IP-11.1: The organization conducts background/screening checks on all new employees, as permitted by law."]
[null,null,null,null,null,null,"PR.IP-11.2: The organization conducts background/screening checks on all staff at regular intervals throughout their employment, commensurate with staff’s access to critical systems or a change in role, as permitted by law."]
[null,null,null,null,null,null,"PR.IP-11.3: The organization establishes processes and controls to mitigate cyber risks related to employment termination, as permitted by law."]
[null,null,"PR.IP-12: A vulnerability management plan is developed and implemented.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.IP-12","PR.IP-12.1: The organization establishes and maintains capabilities for ongoing vulnerability management, including systematic scans or reviews reasonably designed to identify publicly known cyber vulnerabilities in the organization based on the risk assessment."]
[null,null,null,null,null,null,"PR.IP-12.2: The organization establishes a process to prioritize and remedy issues identified through vulnerability scanning."]
[null,null,null,null,null,null,"PR.IP-12.3: The organization has a formal exception management process for vulnerabilities that cannot be mitigated due to business-related exceptions."]
[null,null,null,null,null,null,"PR.IP-12.4: The organization ensures that a process exists and is implemented to identify patches to technology assets, evaluate patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[null,"Maintenance (PR.MA): Maintenance and repairs of industrial control and information system components are performed consistent with policies and procedures.","PR.MA-1: Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","PR.MA-1 - with sector enhancement","PR.MA-1.1: Policies, standards and procedures for the maintenance of assets include, but are not limited to, physical entry controls, equipment maintenance and removal of assets."]
[null,null,"PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.MA-2","PR.MA-2.1: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access."]
[null,"Protective Technology (PR.PT): Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.","PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","PR.PT-1","PR.PT-1.1: The organization's audit trails are designed to detect cybersecurity events that may materially harm normal operations of the organization."]
[null,null,null,null,null,null,"PR.PT-1.2: The organization's activity logs and other security event logs are reviewed and are retained in a secure manner for an appropriate amount of time."]
[null,null,"PR.PT-2: Removable media is protected and its use restricted according to policy.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.PT-2","PR.PT-2.1: The organization's removable media and mobile devices are protected and use is restricted according to policy."]
[null,null,"PR.PT-3:  The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.PT-3","PR.PT-3.1: The organization's systems are configured to provide only essential capabilities to implement the principle of least functionality."]
[null,null,"PR.PT-4: Communications and control networks are protected.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","PR.PT-4","PR.PT-4.1: The organization's communications and control networks are protected through applying defense-in-depth principles (e.g., network segmentation, firewalls, physical access controls to network equipment, etc.)."]
[null,null,"PR.PT-5: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","PR.PT-5","PR.PT-5.1: The organization implements mechanisms (e.g., failsafe, load balancing, hot swap) to achieve resilience requirements in normal and adverse situations."]
["DETECT (DE)","Anomalies and Events (DE.AE): Anomalous activity is detected in a timely manner and the potential impact of events is understood.","DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.AE-1","DE.AE-1.1: The organization identifies, establishes, documents and manages a baseline mapping of network resources, expected connections and data flows. "]
[null,null,"DE.AE-2: Detected events are analyzed to understand attack targets and methods.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","DE.AE-2","DE.AE-2.1: The organization performs timely collection of relevant data, as well as advanced and automated analysis (including use of security tools such as antivirus, IDS/IPS) on the detected events to:\n(1) Assess and understand the nature, scope and method of the attack;\n(2) Predict and block a similar future attack; and\n(3) Report timely risk metrics."]
[null,null,"DE.AE-3: Event data are collected and correlated from multiple sources and sensors.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.AE-3","DE.AE-3.1: The organization has a capability to collect, analyze, and correlate events data across the organization in order to predict, analyze, and respond to changes in the operating environment."]
[null,null,null,null,null,null,"DE.AE-3.2: The organization deploys tools, as appropriate, to perform real-time central aggregation and correlation of anomalous activities, network and system alerts, and relevant event and cyber threat intelligence from multiple sources, including both internal and external sources, to better detect and prevent multifaceted cyber attacks."]
[null,null,"DE.AE-4: Impact of events is determined.","DSS.03","The company has an ineffective problem-management process that increases operating costs and reduces system availability, service levels and customer satisfaction. ","DE.AE-4","DE.AE-4.1: The organization has a documented process in place to analyze the impact of a material cybersecurity incident (including the financial impact) on the organization as well as across the financial sector, as appropriate, per organization's size, scope, and complexity and its role in the financial sector."]
[null,null,"DE.AE-5: Incident alert thresholds are established.","DSS.03","The company has an ineffective problem-management process that increases operating costs and reduces system availability, service levels and customer satisfaction. ","DE.AE-5","DE.AE-5.1: The organization establishes and documents cyber event alert parameters and thresholds as well as rule-based triggers for an automated response within established parameters when known attack patterns, signatures or behaviors are detected."]
[null,"Security Continuous Monitoring (DE.CM): The information system and assets are monitored at discrete intervals to identify cybersecurity events and verify the effectiveness of protective measures.","DE.CM-1: The network is monitored to detect potential cybersecurity events.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.CM-1","DE.CM-1.1: The organization establishes relevant system logging policies that include the types of logs to be maintained and their retention periods."]
[null,null,null,null,null,null,"DE.CM-1.2: The organization implements systematic and real-time logging, monitoring, detecting, and alerting measures across multiple layers of the organization's infrastructure (covering physical perimeters, network, operating systems, applications and data)."]
[null,null,null,null,null,null,"DE.CM-1.3: The organization deploys an intrusion detection and intrusion prevention capabilities to detect and prevent a potential network intrusion in its early stages for timely containment and recovery. "]
[null,null,null,null,null,null,"DE.CM-1.4: The organization implements mechanisms, such as alerting and filtering sudden high volume and suspicious incoming traffic, to prevent (Distributed) Denial of Services (DoS/DDoS) attacks."]
[null,null,"DE.CM-2: The physical environment is monitored to detect potential cybersecurity events.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","DE.CM-2","DE.CM-2.1: The organization's controls include monitoring and detection of anomalous activities and potential cybersecurity events across the organization's physical environment and infrastructure, including unauthorized physical access to high-risk or confidential systems."]
[null,null,"DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.CM-3","DE.CM-3.1: The organization's controls actively monitor personnel (both authorized and unauthorized) for access, authentication, usage, connections, devices, and anomalous behavior to rapidly detect potential cybersecurity events."]
[null,null,null,null,null,null,"DE.CM-3.2: The organization performs logging and reviewing of the systems activities of privileged users, and monitoring for anomalies is implemented."]
[null,null,null,null,null,null,"DE.CM-3.3: The organization conducts periodic cyber attack simulations to detect control gaps in employee behavior, policies, procedures and resources. "]
[null,null,"DE.CM-4: Malicious code is detected.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.CM-4","DE.CM-4.1: The organization implements and manages appropriate tools to detect and block malware from infecting networks and systems."]
[null,null,null,null,null,null,"DE.CM-4.2: The organization implements email protection mechanisms to automatically scan, detect, and protect from any attached malware or malicious links present in the email."]
[null,null,"DE.CM-5: Unauthorized mobile code is detected.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.CM-5","DE.CM-5.1: The organization implements safeguards against mobile malware and attacks for mobile devices connecting to corporate network and accessing corporate data (e.g., anti-virus, timely patch deployment, etc.)."]
[null,null,"DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events.","APO.10","Third-party service provider risks are not properly assessed, addressed, and mitigated.","DE.CM-6","DE.CM-6.1: The organization authorizes and monitors all third-party connections."]
[null,null,null,null,null,null,"DE.CM-6.2: The organization collaborates with third-party service providers to maintain and improve the security of external connections."]
[null,null,null,null,null,null,"DE.CM-6.3: The organization implements an explicit approval and logging process and sets up automated alerts to monitor and prevent any unauthorized access to a critical system by a third-party service provider."]
[null,null,"DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.CM-7","DE.CM-7.1: The organization implements appropriate controls to prevent use of unsupported and unauthorized software. "]
[null,null,null,null,null,null,"DE.CM-7.2: The organization has policies, procedures and adequate tools in place to monitor, detect, and block access from/to devices, connections, and data transfers."]
[null,null,null,null,null,null,"DE.CM-7.3: The organization sets up automatic and real-time alerts when an unauthorized software, hardware or configuration change occurs."]
[null,null,null,null,null,null,"DE.CM-7.4: The organization implements web-filtering tools and technology to block access to inappropriate or malicious websites. "]
[null,null,"DE.CM-8: Vulnerability scans are performed.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.CM-8","DE.CM-8.1: The organization conducts periodic vulnerability scanning, including automated scanning across all environments to identify potential system vulnerabilities, including publicly known vulnerabilities, upgrade opportunities, and new defense layers."]
[null,null,null,null,null,null,"DE.CM-8.2: The organization conducts, either by itself or by an independent third-party, periodic penetration testing and red team testing on the organization's network, internet-facing applications or systems, and critical applications to identify gaps in cybersecurity defenses. "]
[null,"Detection Processes (DE.DP): Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability.","APO.01","IT organizational structure is inadequate to support business objectives.","DE.DP-1","DE.DP-1.1: The organization has established and assigned roles and responsibilities for systematic monitoring and reporting processes."]
[null,null,"DE.DP-2: Detection activities comply with all applicable requirements.","MEA.03","IT processes and IT-supported business processes are not compliant with applicable laws, regulations and other contractual requirements.","DE.DP-2","DE.DP-2.1: The organization's monitoring and detection processes comply with all applicable requirements."]
[null,null,"DE.DP-3: Detection processes are tested.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.DP-3","DE.DP-3.1: The organization establishes a comprehensive testing program to conduct periodic and proactive testing and validation of the effectiveness of the organization's incident detection processes and controls."]
[null,null,"DE.DP-4: Event detection information is communicated to appropriate parties.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","DE.DP-4 - with sector enhancement","DE.DP-4.1: The organization has established processes and protocols to communicate, alert and periodically report detected potential cyber attacks and incident information including its corresponding analysis and cyber threat intelligence to internal and external stakeholders."]
[null,null,null,null,null,null,"DE.DP-4.2: The organization tests and validates the effectiveness of the incident reporting and communication processes and protocols with internal and external stakeholders."]
[null,null,"DE.DP-5: Detection processes are continuously improved.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","DE.DP-5","DE.DP-5.1: The organization establishes a systematic and comprehensive program to periodically evaluate and improve the monitoring and detection processes and controls, as well as incorporate the lessons learned, as the threat landscape evolves."]
["RESPOND (RS)","Response Planning (RS.RP): Response processes and procedures are executed and maintained, to ensure timely response to detected cybersecurity incidents.","RS.RP-1: Response plan is executed during or after an incident.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.RP-1","RS.RP-1.1: The organization's response plans are in place and executed during or after an incident."]
[null,"Communications (RS.CO): Response activities are coordinated with internal and external stakeholders, as appropriate, to include external support from law enforcement agencies.","RS.CO-1: Personnel know their roles and order of operations when a response is needed.","APO.01","IT organizational structure is inadequate to support business objectives.","RS.CO-1","RS.CO-1.1: The organization's incident response plan contains clearly defined roles, responsibilities and levels of decision-making authority."]
[null,null,null,null,null,null,"RS.CO-1.2: The organization ensures cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the organization."]
[null,null,null,null,null,null,"RS.CO-1.3: The organization's personnel know their roles and responsibilities and order of operations when a response is needed."]
[null,null,"RS.CO-2: Incidents are reported consistent with established criteria.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.CO-2","RS.CO-2.1: The organization's incident response plan describes how to appropriately document and report cyber events and related incident response activities."]
[null,null,null,null,null,null,"RS.CO-2.2: In the event of a cybersecurity incident, the organization notifies appropriate stakeholders including, as required, government bodies, self-regulatory agencies or any other supervisory bodies."]
[null,null,null,null,null,null,"RS.CO-2.3: The organization's incident response program includes effective escalation protocols linked to organizational decision levels and communication strategies, including which types of information will be shared, with whom (e.g., the organization's appropriate governing authority and senior management), and how information provided to the organization will be acted upon."]
[null,null,null,null,null,null,"RS.CO-2.4: The organization's reporting requirements and capabilities are consistent with information-sharing arrangements within the organization's communities and the financial sector."]
[null,null,"RS.CO-3: Information is shared consistent with response plans.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.CO-3","RS.CO-3.1: Information is shared consistent with response plans.  "]
[null,null,null,null,null,null,"RS.CO-3.2: In the event of a cybersecurity incident, the organization shares information in an appropriate manner that could facilitate the detection, response, resumption and recovery of its own systems and those of other financial sector participants through trusted channels."]
[null,null,"RS.CO-4: Coordination with stakeholders occurs consistent with response plans.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.CO-4","RS.CO-4.1: The organization has a plan to coordinate and communicate with internal and external stakeholders during or following a cyber attack as appropriate."]
[null,null,"RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.CO-5","RS.CO-5.1: The organization actively participates in multilateral information-sharing arrangements to facilitate a sector-wide response to large-scale incidents."]
[null,null,null,null,null,null,"RS.CO-5.2: The organization shares information on its cyber resilience framework bilaterally with trusted external stakeholders to promote understanding of each other’s approach to securing systems that are linked or interfaced."]
[null,null,null,null,null,null,"RS.CO-5.3: The organization maintains ongoing situational awareness of its operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them."]
[null,"Analysis (RS.AN): Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-1: Notifications from detection systems are investigated.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.AN-1","RS.AN-1.1: Tools and processes are in place to ensure timely detection, alert, and activation of the incident response program."]
[null,null,"RS.AN-2: The impact of the incident is understood.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.AN-2","RS.AN-2.1: The organization uses cyber-attack scenarios to determine potential impact to critical business processes."]
[null,null,null,null,null,null,"RS.AN-2.2: The organization performs a thorough investigation to determine the nature of a cyber event, its extent, and the damage inflicted."]
[null,null,"RS.AN-3: Forensics are performed.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.AN-3","RS.AN-3.1: The organization has the capability to assist in or conduct forensic investigations of cybersecurity incidents and engineer protective and detective controls to facilitate the investigative process."]
[null,null,"RS.AN-4: Incidents are categorized consistent with response plans.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.AN-4","RS.AN-4.1: The organization categorizes and prioritizes cybersecurity incident response consistent with response plans and criticality of systems to the enterprise."]
[null,null,"RS.AN-5: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g., internal testing, security bulletins, or security researchers).","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","RS.AN-5","RS.AN-5.1: The organization has established enterprise processes for receiving and appropriately channeling vulnerability disclosures from:\n(1) Public sources (e.g., security researchers);\n(2) Vulnerability sharing forums (e.g., FS-ISAC); and\n(3) Third-parties (e.g., cloud vendors);\n(4) Internal sources (e.g., development teams)."]
[null,null,null,null,null,null,"RS.AN-5.2: The organization has established enterprise processes to analyze disclosed vulnerabilities with a focus on:\n(1) Determining its validity;\n(2) Aassessing its scope (e.g., affected assets);\n(3) Determining it's severity and impact;\n(4) Identifying affected stakeholders or customers; and\n(5) Analyzing options to respond."]
[null,null,null,null,null,null,"RS.AN-5.3: The organization has established processes to implement vulnerability mitigation plans, as well as validate their completion and effectiveness."]
[null,"Mitigation (RS.MI): Activities are performed to prevent expansion of an event, mitigate its effects, and resolve the incident.","RS.MI-1: Incidents are contained.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.MI-1","RS.MI-1.1: The organization contains cybersecurity incidents in a timely manner.  "]
[null,null,null,null,null,null,"RS.MI-1.2: The organization's procedures include containment strategies and notifying potentially impacted third-parties, as appropriate."]
[null,null,"RS.MI-2: Incidents are mitigated.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.MI-2","RS.MI-2.1: The organization mitigates cybersecurity incidents in a timely manner.  "]
[null,null,"RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks.","MEA.02","The company does not identify and address internal control deficiencies related to IT systems. ","RS.MI-3","RS.MI-3.1: The organization's incident response plan identifies requirements for the remediation of any identified weaknesses in systems and associated controls."]
[null,null,null,null,null,null,"RS.MI-3.2: Vulnerabilities identified as a result of a cybersecurity incident are mitigated or documented by the organization as accepted risks and monitored."]
[null,"Improvements (RS.IM): Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.","RS.IM-1: Response plans incorporate lessons learned.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.IM-1","RS.IM-1.1: The organization's incident response plans are actively updated based on current cyber threat intelligence, information-sharing and lessons learned following a cyber event."]
[null,null,null,null,null,null,"RS.IM-1.2: The results of the testing program are used by the organization to support ongoing improvement of its cyber resilience."]
[null,null,null,null,null,null,"RS.IM-1.3: The organization's cyber resilience and incident response programs have processes in place to incorporate lessons learned from cyber events that have occurred within and outside the organization."]
[null,null,"RS.IM-2: Response strategies are updated.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RS.IM-2","RS.IM-2.1: The organization periodically reviews response strategy and exercises and updates them as necessary, based on:\n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
["RECOVER (RC)","Recovery Planning (RC.RP): Recovery processes and procedures are executed and maintained to ensure timely restoration of systems or assets affected by cybersecurity incidents.","RC.RP-1: Recovery plan is executed during or after a cybersecurity incident.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","RC.RP-1","RC.RP-1.1: The organization executes its recovery plans, including incident recovery, disaster recovery and business continuity plans, during or after an incident to resume operations."]
[null,null,null,null,null,null,"RC.RP-1.2: Organization's recovery plans are executed by first resuming critical services and core business functions, and without causing any potential concurrent and widespread interruptions to interconnected entities and critical infrastructure, such as energy and telecommunications."]
[null,null,null,null,null,null,"RC.RP-1.3: The recovery plan includes a minimum recovery time for the sector critical systems."]
[null,null,null,null,null,null,"RC.RP-1.4: The recovery plan includes recovery of clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date."]
[null,null,null,null,null,null,"RC.RP-1.5: The recovery plan includes recovery of resilience following a long term loss of capability (e.g., site or third-party) detailing when the plan should be activated and implementation steps."]
[null,null,null,null,null,null,"RC.RP-1.6: The recovery plan includes plans to come back for both traditional and highly available (e.g., cloud) infrastructure."]
[null,"Improvements (RC.IM): Recovery planning and processes are improved by incorporating lessons learned into future activities.","RC.IM-1: Recovery plans incorporate lessons learned.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","RC.IM-1","RC.IM-1.1: The organization refines its cyber resilience and incident response plans by actively identifying and incorporating crucial lessons learned from:\n(1) cybersecurity incidents that have occurred within the organization;\n(2) Cybersecurity assessments and testing performed internally; and\n(3) Widely reported events, industry reports and cybersecurity incidents that have occurred outside the organization."]
[null,null,"RC.IM-2: Recovery strategies are updated.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","RC.IM-2","RC.IM-2.1: The organization periodically reviews recovery strategy and exercises and updates them as necessary, based on: \n(1) Lessons learned from cybersecurity incidents that have occurred (both within and outside the organization);\n(2) Current cyber threat intelligence (both internal and external sources);\n(3) Recent and wide-scale cyber attack scenarios;\n(4) Operationally and technically plausible future cyber attacks; and\n(5) New technological developments."]
[null,"Communications (RC.CO): Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.","RC.CO-1: Public relations are managed.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","RC.CO-1","RC.CO-1.1: The organization's governing body (e.g., the Board or one of its committees) ensures that a communication plan exists to notify internal and external stakeholders about an incident, as appropriate."]
[null,null,null,null,null,null,"RC.CO-1.2: The organization promptly communicates the status of recovery activities to regulatory authorities and relevant external stakeholders, as appropriate."]
[null,null,"RC.CO-2: Reputation after an event is repaired.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","RC.CO-2 - with sector enhancement","RC.CO-2.1: Actionable and effective mitigation techniques are taken and communicated appropriately to restore and improve the organization's reputation after an incident."]
[null,null,"RC.CO-3: Recovery activities are communicated to internal and external stakeholders as well as and executive and management teams.","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","RC.CO-3","RC.CO-3.1: The organization timely involves and communicates the recovery activities, procedures, cyber risk management issues to the appropriate governing body (e.g., the Board or one of its committees), senior management and relevant internal stakeholders."]
["SUPPLY CHAIN/DEPENDENCY MANAGEMENT (DM)","Internal Dependencies (DM.ID): The organization manages risks associated with its internal dependencies.","DM.ID-1: The organization integrates internal dependency management strategy into the overall strategic risk management plan.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","DM.ID-1.1: The organization has integrated its internal dependency management strategy into the overall strategic risk management plan."]
[null,null,null,null,null,null,"DM.ID-1.2: The organization monitors the effectiveness of its internal dependency management strategy."]
[null,null,null,null,null,null,"DM.ID-1.3: The organization ensures appropriate oversight of and compliance with the internal dependency management strategy implementation."]
[null,null,null,null,null,null,"DM.ID-1.4: The organization has established and applies appropriate controls to address the inherent risk of internal dependencies."]
[null,null,"DM.ID-2: Roles and responsibilities for internal dependency management are defined and assigned.","APO.01","IT organizational structure is inadequate to support business objectives.","None","DM.ID-2.1: Roles and responsibilities for internal dependency management are defined and assigned."]
[null,"External Dependencies (DM.ED): The organization manages risks associated with its external dependencies.","DM.ED-1: The organization integrates external dependency management strategy into the overall strategic risk management plan.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","DM.ED-1.1: The organization has integrated its external dependency management strategy into the overall cyber risk management plan."]
[null,null,null,null,null,null,"DM.ED-1.2: The organization monitors the effectiveness of its external dependency management strategy to reduce cyber risks associated with external dependencies."]
[null,null,null,null,null,null,"DM.ED-1.3: The organization ensures appropriate oversight and compliance with the external dependency strategy implementation."]
[null,null,"DM.ED-2: Dependency management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders.","APO.10","Third-party service provider risks are not properly assessed, addressed, and mitigated.","ID.SC-1 - with sector enhancement","DM.ED-2.1: The organization has established policies, plans, and procedures to identify and manage cyber risks associated with external dependencies throughout those dependencies' lifecycles in a timely manner, including sector-critical systems and operations."]
[null,null,null,null,null,null,"DM.ED-2.2: The organization's dependency management policies, plans, and procedures are regularly updated."]
[null,null,null,null,null,null,"DM.ED-2.3: The organization's dependency management policies, plans, and procedures have been reviewed and approved by appropriate organizational stakeholders."]
[null,null,null,null,null,null,"DM.ED-2.4: Dependency management processes may allow the organization to the adopt  security program(s) of its \"affiliate(s)\" as long as such program provides an appropriate level of control and assurance."]
[null,null,null,null,null,null,"DM.ED-2.5: The organization's dependency management process identifies third-party relationships that are in place, including those relationships that were established without formal approval."]
[null,null,"DM.ED-3: Roles and responsibilities for external dependency management are defined and assigned.","APO.01","IT organizational structure is inadequate to support business objectives.","None","DM.ED-3.1: Roles and responsibilities for external dependency management are defined and assigned."]
[null,null,null,null,null,null,"DM.ED-3.2: Responsibilities for ongoing independent oversight (external) of third-party access are defined and assigned."]
[null,null,"DM.ED-4: The organization manages cyber risks associated with external dependencies.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","None","DM.ED-4.1: The organization ensures that cyber risks associated with external dependencies are consistent with cyber risk appetite approved by an appropriate governing body (e.g., the Board or one of its committees)."]
[null,null,null,null,null,null,"DM.ED-4.2: The organization has established and applies appropriate policies and controls to address the inherent risk of external dependencies to the enterprise and the sector, if appropriate."]
[null,null,null,null,null,null,"DM.ED-4.3: The organization conducts a risk assessment to define appropriate controls to address the cyber risk presented by each external partner, implements these controls, and monitors their status throughout the lifecycle of partner relationships."]
[null,null,null,null,null,null,"DM.ED-4.4: The organization has a documented third-party termination/exit strategy to include procedures for timely removal of the third-party access when no longer required."]
[null,null,null,null,null,null,"DM.ED-4.5: The organization establishes contingencies to address circumstances that might put a vendor out of business or severely impact delivery of services to the organization, sector-critical systems, or the financial sector as a whole."]
[null,null,"DM.ED-5:  Functions, activities, products, and services - including interconnections, dependencies, and third parties - are identified and prioritized based on their criticality to the organization.","APO.10","Third-party service provider risks are not properly assessed, addressed, and mitigated.","ID.SC-2; ID.BE-1; ID.BE-2 - with sector enhancement","DM.ED-5.1: The organization has identified and monitors the organizational ecosystem of external dependencies for assets/systems that are critical to the enterprise and the financial services sector."]
[null,null,null,null,null,null,"DM.ED-5.2: The organization maintains a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions."]
[null,null,null,null,null,null,"DM.ED-5.3: The organization has prioritized functions, activities, products, and services provided by external dependencies based on criticality."]
[null,null,null,null,null,null,"DM.ED-5.4: The organization has prioritized external dependencies according to their criticality to the supported business functions, enterprise mission, and to the financial services sector."]
[null,null,"DM.ED-6: Minimum cybersecurity practices for critical external dependencies designed to meet the objectives of the Cyber Risk Management Program or Cyber Supply Chain Risk Management Plan are identified and documented.","APO.10","Third-party service provider risks are not properly assessed, addressed, and mitigated.","ID.SC-3 - with sector enhancement","DM.ED-6.1: The organization has documented minimum cybersecurity requirements for critical third-parties that, at a minimum, meet cybersecurity practices of the organization."]
[null,null,null,null,null,null,"DM.ED-6.2: The organization's contracts require third-parties to implement minimum cybersecurity requirements and to maintain those practices for the life of the relationship."]
[null,null,null,null,null,null,"DM.ED-6.3: Minimum cybersecurity requirements for third-parties include how the organization will monitor security of its external dependencies to ensure that requirements are continually satisfied."]
[null,null,null,null,null,null,"DM.ED-6.4: Minimum cybersecurity requirements for third-parties include consideration of whether the third-party is responsible for the security of the organization's confidential data and of geographic limits on where data can be stored and transmitted."]
[null,null,null,null,null,null,"DM.ED-6.5: Minimum cybersecurity requirements for third-parties include how the organization and its suppliers and partners will communicate and coordinate in times of emergency, including:\n1) Joint maintenance of contingency plans;\n2) Responsibilities for responding to cybersecurity incident; \n3) Planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption; and\n4) Incorporating potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place."]
[null,null,null,null,null,null,"DM.ED-6.6: Minimum cybersecurity requirements for third-parties identify conditions of and the recourse available to the organization should the third-party fail to meet their cybersecurity requirements. "]
[null,null,null,null,null,null,"DM.ED-6.7: Minimum cybersecurity requirements for third-parties cover the entire relationship lifecycle, including return or destruction of data during cloud or virtualization use and upon relationship termination."]
[null,null,"DM.ED-7: Suppliers and partners are monitored to confirm that they have satisfied their obligations as required. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted.","DSS.01","The quality, timeliness and availability of business data is reduced due to an ineffective data management process.","ID.SC-4 - with sector enhancement","DM.ED-7.1: The organization has a formal program for third-party due diligence and monitoring."]
[null,null,null,null,null,null,"DM.ED-7.2: The organization conducts regular third-party reviews for critical vendors to validate that appropriate security controls have been implemented."]
[null,null,null,null,null,null,"DM.ED-7.3: A process is in place to confirm that the organization's third-party service providers conduct due diligence of their own third-parties (e.g., subcontractors)."]
[null,null,null,null,null,null,"DM.ED-7.4: A process is in place to confirm that the organization's third-party service providers conduct periodic resiliency testing or justify why it is not needed."]
[null,"Resilience (DM.RS): The organization is resilient and able to operate while experiencing a cyber attack.","DM.RS-1: Organization is capable of operating critical business functions in the face of cyber-attacks and continuously enhance its cyber resilience.","DSS.05","The company’s business is threatened by the impact of operational information security vulnerabilities and incidents.","None","DM.RS-1.1: The organization has an enterprise-wide cyber resilience (including business continuity, and incident response) strategy and program."]
[null,null,null,null,null,null,"DM.RS-1.2: The cyber resilience strategy and program are based on the organization's enterprise-wide cyber risk management strategy that addresses the risks that the organization may present to other critical infrastructure sectors and the risk that the organization may present to other firms in the financial sector."]
[null,null,null,null,null,null,"DM.RS-1.3: The cyber resilience program ensures that the organization can continue operating critical business functions and deliver services to stakeholders during cybersecurity incidents and cyber attacks (e.g., propagation of malware or corrupted data).  "]
[null,null,"DM.RS-2: Organizational incident response, business continuity, and disaster recovery plans and exercises incorporate its external dependencies and critical business partners.","DSS.02","Inadequate or ineffective response and resolution to user requests and incidents could result in interruption of services or inefficient usage of technology solutions.","ID.SC-5 - with sector enhancement","DM.RS-2.1: The organization has incorporated its external dependencies and critical business partners into its cyber resilience (e.g., incident response, business continuity, and disaster recovery) strategy, plans, and exercises. "]
[null,null,null,null,null,null,"DM.RS-2.2: The organization's cyber resilience strategy addresses the organization's obligations for performing core business functions including those performed for the financial sector as a whole, in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications. "]
[null,null,null,null,null,null,"DM.RS-2.3: The organization designs and tests its cyber resilience plans, and exercises to support financial sector's sector-wide resilience and address external dependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, etc.  "]
[null,null,null,null,null,null,"DM.RS-2.4: The organization periodically identifies and tests alternative solutions in case an external partner fails to perform as expected.  "]
[null,null,null,null,null,null,"DM.RS-2.5: When planning and executing incident response and recovery activities, the organization takes into consideration sector-wide impact of its systems and puts a priority on response and recovery activities for those systems ahead of the other systems."]
[null,"Business Environment (DM.BE): The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","DM.BE-1: The organization’s place in critical infrastructure and its industry sector is identified and communicated.","APO.02","Enterprise business objectives cannot be attained due to the development of an IT strategy that is inadequate, ineffective and not in alignment with business objectives, including inadequate management oversight over the achievement of the IT strategy.","ID.BE-2","DM.BE-1.1: The cyber risk strategy identifies and communicates the organization's role as it relates to other critical infrastructures and as a component of the financial services sector.  "]
[null,null,null,null,null,null,"DM.BE-1.2: A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across other sectors the institution depends upon."]
[null,null,"DM.BE-2: Dependencies and critical functions for delivery of critical services are established.","APO.12","IT-related enterprise risks have not been integrated into the overall enterprise risk management (ERM) program.","ID.BE-4","DM.BE-2.1: The organization has established and implemented plans to identify and mitigate the cyber risks it poses through interconnectedness to sector partners and external stakeholders."]
[null,null,null,null,null,null,"DM.BE-2.2: The organization has prioritized monitoring of systems according to their criticality to the supported business functions, enterprise mission, and to the financial services sector."]
[null,null,"DM.BE-3: Resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations).","DSS.04","Inadequate continuity management may result in the inability to ensure critical business functions.","ID.BE-5","DM.BE-3.1: Cyber resilience requirements to support delivery of critical services are established for all operating states (e.g., under duress/attack, during recovery, normal operations)."]

{"sheet":"Mapping to NIST CSF v1.1 v2","index":13,"n_rows":2320,"n_cols":16,"rows_kept":2320,"cut":false,"hidden":false,"merged":[]}
[]
["Proprietary"]
["Mapping of Regulatory, Supervisory and Oversight Issuances (Regulations, Guidance, Questionnaires) to NIST CSF (1.1 Draft) and ISO/IEC 27001"]
[]
["Index","NIST Function ID","NIST Function","NIST Category ID","NIST Category","NIST Subcategory ID","NIST Subcategory ","ISO/IEC 27001 Clause","ISO/IEC 27001 Objective","Regulator","Regulatory Engagement Name","Region","Domain","Principle","Requirement","Reverse Validation"]
[1,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","System security management","8.6.1. Please describe the main contents of the company's system security management policy, such as requirements around system security policy, security configuration, log management and daily operational processes"]
[2,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Intrusion prevention and malicious codes prevention","2.5.4a. Does the firm carry out regular exercise.\n\n2.5.4b. Please describe. E.g. the exercise frequency"]
[3,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Access control","2.2.3a.Does the firm allow/deny data to pass base on its sensitivity label?\n\n2.2.3b. Please describe."]
[4,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","System security management","8.8.2.Please describe encryption key management in your company, include but not limited to the generation, distribution, reception, usage, storage, update and destruction of keys,"]
[5,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Content security","10.3.1a. Has the firm implemented measures to prevent its website from unauthorized/unexpected amendment? Does the firm conduct integrity checks on website documents?\n\n10.3.1b. If yes, please describe."]
[6,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Log management","10.7.2a. Do you back up logs and use access control to prevent logs being deleted or modified?\n\n10.7.2b. If yes, please specify."]
[7,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Intrusion prevention and malicious codes prevention","2.5.3a. Have you established response mechanism?\n\n2.5.3b. Please describe"]
[8,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Intrusion prevention and malicious codes prevention","2.5.7a. Does the firm upgrade code base or patch regularly?\n\n2.5.7b. Please describe. E.g. update frequency."]
[9,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Security Audit","2.3.7a. Does the firm protect audit records, to prevent it from unexpected deletion, modification or over-write? \n\n2.3.7b. Please describe."]
[10,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Security Audit","2.3.8a.Is your log retention period longer than 1 year?\n\n2.3.8b. Please state your retention period"]
[11,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","3. Server security","Security Audit","3.4.1a. Does the firm enable security audit function? \n\n3.4.1b. If yes, how Does the firm define audit scope, what contents are in scope for audit?"]
[12,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","3. Server security","Security Audit","3.4.2a. Does the firm have security audit records?\n\n3.4.2b. If yes, please specify the contents of the audit records, the retention period. How Does the firm protect the records? Does the firm generate audit reports from the records? How Does the firm protect the audit process?"]
[13,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Log management","10.7.1a.Do you save relevant logs? Do you have stand-alone log server?\n\n10.7.1b. If yes, please name the logs (e.g. Network device logs, application logs, Maintenance logs,OS logs)"]
[14,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Log management","10.7.3a.Do you conduct regular checks on logs, to detect possible intrusion or illegal operations\n\n10.7.3b. If yes, please specify."]
[15,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","Malicious code prevention","8.4.4. Have you established security control center, which centrally manages security related activities such as device performance, malicious codes, patching and upgrading and security audit. "]
[16,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","System security management","8.6.6. Please describe how the company carries out analysis on system logs and audit trials, and how to deal with abnormal activities."]
[17,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Intrusion prevention and malicious codes prevention","2.5.2a.Does the firm generate alerts when abnormal activities are detected?\n\n2.5.2b.Please describe"]
[18,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Security Audit","2.3.2a. Do you alert on abnormal activities?\n\n2.3.2b.Please describe, such as monitoring and alerting on sudden high volume traffic, access request, access denied etc."]
[19,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Intrusion prevention and malicious codes prevention","2.5.1a. Have you deployed intrusion detection system\n\n2.5.1b. Please describe."]
[20,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","3. Server security","Intrusion prevention","3.6.1a.Does the firm have intrusion prevention mechanism (for servers) ?\n\n3.6.1b.If yes, what are the requirements does the intrusion detection system has on operating system? What function and results Does the firm want to achieve by using intrusion prevention?"]
[21,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","Monitoring management  and security management center","8.5.2. Please describe the firm's network security management situation, such as conducting regular network checks, maintaining network monitoring records, analyzing and dealing with alerts. "]
[22,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Intrusion prevention and malicious codes prevention","2.5.5a. Have you deployed malicious code detection tool (e.g. anti-virus tool)\n\n2.5.5b. Please describe."]
[23,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Intrusion prevention and malicious codes prevention","2.5.6a.Does the firm inspect the documents, data being transferred from external to internal network at the network boundary ?\n\n2.5.6b. Please describe. E.g. the inspection subject"]
[24,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","3. Server security","Malicious code prevention","3.6.2a. Have you installed anti-malicious code software?\n\n3.6.2b. If yes, what is your requirement on anti-malicious code software? How Does the firm monitor the computer infection situation within the network?"]
[25,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","System security management","8.7.1. Please describe the deployment and upgrade of anti-virus software, and how to deal with situations where virus cannot be deleted automatically by the software."]
[26,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","2.Network security","Integrity check of network perimeter","2.4.2a. Can you monitor and restrict unauthorized connection to external network, restrict internal users to connect to external environment without authorization?\n\n2.4.2b. Please describe."]
[27,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","Network security management","8.5.3. Please describe the network security testing and scanning conducted by the company, as well as the remediation progress."]
[28,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","8. System operation and maintenance","System security management","8.6.3. Please describe system vulnerability scanning and vulnerability remediation"]
[29,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Monitoring and control","10.5.1a. Do you monitor or check for system vulnerability, cyber attacks on regular basis?"]
[30,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Security technical inspections","10.6.1a. Does the company conducts vulnerability scanning and pen test on websites and internet facing system.\n\n10.6.1b. If yes, what is the frequency"]
[31,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Security technical inspections","10.6.2a. If there is a vulnerability found, does the firm produce a report on it? Does the firm has remediation plan and remediate in time? Does the firm conduct re-test on the issues found and keep the records?\n\n10.6.2b. If yes, please specify."]
[32,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","A. Categories of Risk Analysis and Oversight","N.A","programs of risk analysis and oversight must address by further defining the six categories addressed by the current rules. The six categories are: (1) Information security; (2) Business-continuity disaster recovery planning and resources; (3) Capacity and performance planning; (4) Systems operations; (5) Systems development and quality assurance; and (6) Physical security and environmental controls. In addition, the final rules add and define enterprise risk management as a seventh category.","GV.RM-1, GV.SP-1, GV.AU-1"]
[33,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","A. Categories of Risk Analysis and Oversight","N.A","programs of risk analysis and oversight must address by further defining the six categories addressed by the current rules. The six categories are: (1) Information security; (2) Business-continuity disaster recovery planning and resources; (3) Capacity and performance planning; (4) Systems operations; (5) Systems development and quality assurance; and (6) Physical security and environmental controls. In addition, the final rules add and define enterprise risk management as a seventh category.","GV.RM-1, GV.SP-1, GV.AU-1"]
[34,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","A. Categories of Risk Analysis and Oversight","N.A","programs of risk analysis and oversight must address by further defining the six categories addressed by the current rules. The six categories are: (1) Information security; (2) Business-continuity disaster recovery planning and resources; (3) Capacity and performance planning; (4) Systems operations; (5) Systems development and quality assurance; and (6) Physical security and environmental controls. In addition, the final rules add and define enterprise risk management as a seventh category.","GV.RM-1, GV.SP-1, GV.AU-1"]
[35,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","F. Scope of Testing and Assessment","N.A","The final rules provide that the scope for all system safeguards testing and assessment must be broad enough to include the testing of automated systems and controls that the entity’s required program of risk analysis and oversight and its current cybersecurity threat analysis indicate is necessary to identify risks and vulnerabilities that could enable an intruder or unauthorized user or insider to: (1) Interfere with the entity’s operations or with fulfillment of the entity’s statutory and regulatory responsibilities; (2) impair or degrade the reliability, security, or adequate scalable capacity of the entity’s automated systems; (3) add to, delete, augment, modify, exfiltrate, or compromise the integrity of any data related to the entity’s regulated activities; or (4) undertake any other unauthorized action affecting the entity’s regulated activities or the hardware or software used in connection with those activities.","GV.RM-1"]
[36,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","7. Enterprise Technology Risk Assessment","(1) ETRA Requirement: The final rules define enterprise technology risk assessment as an assessment that includes an analysis of threats and vulnerabilities in the context of mitigating controls. In addition, the assessment identifies, estimates, and prioritizes risks to the entity’s operations or assets, or to market participants, individuals, or other entities, resulting from impairment of the confidentiality, integrity, and availability of data and information or the reliability, security, or capacity of automated systems. "]
[37,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","7. Enterprise Technology Risk Assessment","(1) ETRA Requirement: The final rules define enterprise technology risk assessment as an assessment that includes an analysis of threats and vulnerabilities in the context of mitigating controls. In addition, the assessment identifies, estimates, and prioritizes risks to the entity’s operations or assets, or to market participants, individuals, or other entities, resulting from impairment of the confidentiality, integrity, and availability of data and information or the reliability, security, or capacity of automated systems. "]
[38,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","7. Enterprise Technology Risk Assessment","(1) ETRA Requirement: The final rules define enterprise technology risk assessment as an assessment that includes an analysis of threats and vulnerabilities in the context of mitigating controls. In addition, the assessment identifies, estimates, and prioritizes risks to the entity’s operations or assets, or to market participants, individuals, or other entities, resulting from impairment of the confidentiality, integrity, and availability of data and information or the reliability, security, or capacity of automated systems. "]
[39,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","7. Enterprise Technology Risk Assessment","(1) ETRA Requirement: The final rules define enterprise technology risk assessment as an assessment that includes an analysis of threats and vulnerabilities in the context of mitigating controls. In addition, the assessment identifies, estimates, and prioritizes risks to the entity’s operations or assets, or to market participants, individuals, or other entities, resulting from impairment of the confidentiality, integrity, and availability of data and information or the reliability, security, or capacity of automated systems. "]
[40,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","A. Categories of Risk Analysis and Oversight","N.A","programs of risk analysis and oversight must address by further defining the six categories addressed by the current rules. The six categories are: (1) Information security; (2) Business-continuity disaster recovery planning and resources; (3) Capacity and performance planning; (4) Systems operations; (5) Systems development and quality assurance; and (6) Physical security and environmental controls. In addition, the final rules add and define enterprise risk management as a seventh category.","GV.RM-1, GV.SP-1, GV.AU-1"]
[41,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","B. Requirement To Follow Generally Accepted Standards and Best Practices","N.A","DCMs, SEFs, and SDRs should take generally accepted best\npractices and standards into account as they conduct appropriate and current\nanalysis of individual risks and conducts appropriate and effective\noversight with respect to such risks. \nA program of risk analysis and oversight should consider all generally accepted\nsources of best practices in addressing the particular risks and circumstances of\nthe entity in question in an effective and appropriate way","GV.SF-2"]
[42,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","5. Controls Testing","(1) Requirement for Controls Testing: The final rules define controls testing as an assessment of the DCM’s, SEF’s, or SDR’s market controls to determine whether such controls are implemented correctly, are operating as intended, and are enabling the entity to meet the system safeguard requirements established by the respective chapters."]
[43,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","5. Controls Testing","(3) Who Should Perform Controls Testing: Covered DCMs and SDRs also are required to engage independent contractors to test and assess their key controls no less frequently than every three years. The entities may conduct any other controls testing by using either independent contractors or employees of the DCM or SDR who are not responsible for development or operation of the systems or capabilities being tested."]
[44,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","7. Enterprise Technology Risk Assessment","(1) ETRA Requirement: The final rules define enterprise technology risk assessment as an assessment that includes an analysis of threats and vulnerabilities in the context of mitigating controls. In addition, the assessment identifies, estimates, and prioritizes risks to the entity’s operations or assets, or to market participants, individuals, or other entities, resulting from impairment of the confidentiality, integrity, and availability of data and information or the reliability, security, or capacity of automated systems. ","GV.RM-1"]
[45,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","7. Enterprise Technology Risk Assessment","(3) Who Should Conduct ETRAs: The final rules provide that all DCMs, SEFs, and SDRs may conduct ETRAs by using independent contractors, or employees of the entity who are not responsible for development or operation of the systems or capabilities being assessed."]
[46,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","G. Internal Reporting and Review","N.A","The final rules require the senior management and the Board of Directors of the DCM, SEF, or SDR to receive and review reports setting forth the results of all testing and assessment required by the respective sections. In addition, the final rules require the DCM, SEF, or SDR to establish and follow appropriate procedures for the remediation of issues identified through such review, as provided in §§ 38.1051(m), 37.1401(m), and 49.24(n) (Remediation), and for evaluation of the effectiveness of testing and assessment protocols.  "]
[47,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","H. Remediation","N.A","The final rules require DCMs, SEFs, and SDRs to identify and document the vulnerabilities and deficiencies in the entity’s systems revealed by the testing and assessment in the respective sections. The entity shall conduct and document an appropriate risk analysis of the risks presented by such vulnerabilities and deficiencies, to determine and document whether to remediate or accept each risk. When an entity determines to remediate a vulnerability or deficiency, it must remediate in a timely manner given the nature and magnitude of the associated risk. "]
[48,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","2. Vulnerability Testing","(1) Requirement for Vulnerability Testing: The final rules define vulnerability testing as testing of a DCM’s, SEF’s, or SDR’s automated systems to determine what information may be discoverable through a reconnaissance analysis of those systems and what vulnerabilities may be present on those systems."]
[49,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","2. Vulnerability Testing","(2) Vulnerability Testing Frequency: Additionally, the final rules require a DCM, SEF, or SDR to conduct vulnerability testing that is sufficient to satisfy the testing scope requirements in new §§ 38.1051(k), 37.1401(k), and 49.24(l), at a frequency determined by an appropriate risk analysis. At a minimum, covered DCMs and SDRs are required to conduct vulnerability testing no less frequently than quarterly.\n"]
[50,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","2. Vulnerability Testing"," (4) Vulnerability Testing by Independent Contractors: For all DCMs, SEFs, and SDRs, vulnerability testing may be conducted by either independent contractors or employees of the entity that are not responsible for development or operation of the systems or capabilities being tested."]
[51,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","3. External Penetration Testing","(1) Requirement for External Penetration Testing: The final rules define external penetration testing as attempts to penetrate a DCM’s, SEF’s or SDR’s automated systems from outside the systems’ boundaries to identify and exploit vulnerabilities. "]
[52,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","3. External Penetration Testing","(3) External Penetration Testing by Independent Contractors: Covered DCMs and SDRs also are required to engage independent contractors to perform the required annual external penetration test, although the entity could have other external penetration testing conducted by employees who are not responsible for development or operation of the systems or capabilities being tested. "]
[53,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","4. Internal Penetration Testing","(1) Requirement for Internal Penetration Testing: The final rules define internal penetration testing as attempts to penetrate a DCM’s, SEF’s, or SDR’s automated systems from inside the systems’ boundaries to identify and exploit vulnerabilities. "]
[54,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","4. Internal Penetration Testing","(3) Who Should Perform Internal Penetration Testing: All DCM, SEFs, or SDRs may engage independent contractors to conduct the test, or the entity may use employees of the entity who are not responsible for development or operation of the systems or capabilities being tested."]
[55,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","C. Business Continuity Disaster Recovery Plan","N.A","The final rules require a DCM, SEF, or SDR to update its BC–DR plan and emergency procedures at a frequency determined by an appropriate risk analysis, but at a minimum no less frequently than annually"]
[56,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","6. Security Incident Response Plan Testing","(1) Requirement To Maintain and Test a SIRP:The final rules define security incident response testing as testing of a DCM’s, SEF’s, or SDR’s security incident plan to determine the plan’s effectiveness, identifying its potential weaknesses or deficiencies, enabling regular plan updating and improvement, and maintaining organizational preparedness and resiliency with respect to security incidents. In addition, the methods of conducting security incident response plan testing may include checklist completion, walk-through or table-top exercises, simulations, and comprehensive exercises. "]
[57,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","6. Security Incident Response Plan Testing","(3) Who Should Conduct SIRP Testing: All DCMs, SEFs, and SDRs may conduct such testing by engaging either independent contractors or employees of the entity. "]
[58,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","2. Vulnerability Testing","(3) Automated Scanning and Authenticated Scanning: Moreover, such vulnerability testing shall include automated vulnerability scanning and follow best practices in this regard. "]
[59,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","D. Books and Records Requirements","N.A","The final rules require a DCM, SEF, or SDR, in accordance with Commission regulation § 1.31,162 to provide the Commission with the following system safeguards-related books and records promptly upon request of any Commission representative: (1) Current copies of the BC–DR plans and other emergency procedures; (2) all assessments of the entity’s operational risks or system safeguards-related controls; (3) all reports concerning system safeguards testing and assessment required by this chapter, whether performed by independent contractors or employees of the DCM, SEF, or SDR; and (4) all other books and records requested by Commission staff in connection with Commission oversight of system safeguards pursuant to the Act or Commission regulations, or in connection with Commission maintenance of a current profile of the entity’s automated systems."]
[60,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","G. Internal Reporting and Review","N.A","The final rules require the senior management and the Board of Directors of the DCM, SEF, or SDR to receive and review reports setting forth the results of all testing and assessment required by the respective sections. In addition, the final rules require the DCM, SEF, or SDR to establish and follow appropriate procedures for the remediation of issues identified through such review, as provided in §§ 38.1051(m), 37.1401(m), and 49.24(n) (Remediation), and for evaluation of the effectiveness of testing and assessment protocols.  "]
[61,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","D. Books and Records Requirements","N.A","The final rules require a DCM, SEF, or SDR, in accordance with Commission regulation § 1.31,162 to provide the Commission with the following system safeguards-related books and records promptly upon request of any Commission representative: (1) Current copies of the BC–DR plans and other emergency procedures; (2) all assessments of the entity’s operational risks or system safeguards-related controls; (3) all reports concerning system safeguards testing and assessment required by this chapter, whether performed by independent contractors or employees of the DCM, SEF, or SDR; and (4) all other books and records requested by Commission staff in connection with Commission oversight of system safeguards pursuant to the Act or Commission regulations, or in connection with Commission maintenance of a current profile of the entity’s automated systems."]
[62,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","G. Internal Reporting and Review","N.A","The final rules require the senior management and the Board of Directors of the DCM, SEF, or SDR to receive and review reports setting forth the results of all testing and assessment required by the respective sections. In addition, the final rules require the DCM, SEF, or SDR to establish and follow appropriate procedures for the remediation of issues identified through such review, as provided in §§ 38.1051(m), 37.1401(m), and 49.24(n) (Remediation), and for evaluation of the effectiveness of testing and assessment protocols.  "]
[63,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","D. Books and Records Requirements","N.A","The final rules require a DCM, SEF, or SDR, in accordance with Commission regulation § 1.31,162 to provide the Commission with the following system safeguards-related books and records promptly upon request of any Commission representative: (1) Current copies of the BC–DR plans and other emergency procedures; (2) all assessments of the entity’s operational risks or system safeguards-related controls; (3) all reports concerning system safeguards testing and assessment required by this chapter, whether performed by independent contractors or employees of the DCM, SEF, or SDR; and (4) all other books and records requested by Commission staff in connection with Commission oversight of system safeguards pursuant to the Act or Commission regulations, or in connection with Commission maintenance of a current profile of the entity’s automated systems."]
[64,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","G. Internal Reporting and Review","N.A","The final rules require the senior management and the Board of Directors of the DCM, SEF, or SDR to receive and review reports setting forth the results of all testing and assessment required by the respective sections. In addition, the final rules require the DCM, SEF, or SDR to establish and follow appropriate procedures for the remediation of issues identified through such review, as provided in §§ 38.1051(m), 37.1401(m), and 49.24(n) (Remediation), and for evaluation of the effectiveness of testing and assessment protocols.  "]
[65,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","H. Remediation","N.A","The final rules require DCMs, SEFs, and SDRs to identify and document the vulnerabilities and deficiencies in the entity’s systems revealed by the testing and assessment in the respective sections. The entity shall conduct and document an appropriate risk analysis of the risks presented by such vulnerabilities and deficiencies, to determine and document whether to remediate or accept each risk. When an entity determines to remediate a vulnerability or deficiency, it must remediate in a timely manner given the nature and magnitude of the associated risk. "]
[66,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","D. Books and Records Requirements","N.A","The final rules require a DCM, SEF, or SDR, in accordance with Commission regulation § 1.31,162 to provide the Commission with the following system safeguards-related books and records promptly upon request of any Commission representative: (1) Current copies of the BC–DR plans and other emergency procedures; (2) all assessments of the entity’s operational risks or system safeguards-related controls; (3) all reports concerning system safeguards testing and assessment required by this chapter, whether performed by independent contractors or employees of the DCM, SEF, or SDR; and (4) all other books and records requested by Commission staff in connection with Commission oversight of system safeguards pursuant to the Act or Commission regulations, or in connection with Commission maintenance of a current profile of the entity’s automated systems."]
[67,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","G. Internal Reporting and Review","N.A","The final rules require the senior management and the Board of Directors of the DCM, SEF, or SDR to receive and review reports setting forth the results of all testing and assessment required by the respective sections. In addition, the final rules require the DCM, SEF, or SDR to establish and follow appropriate procedures for the remediation of issues identified through such review, as provided in §§ 38.1051(m), 37.1401(m), and 49.24(n) (Remediation), and for evaluation of the effectiveness of testing and assessment protocols.  "]
[68,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","3. External Penetration Testing","(2) External Penetration Testing Frequency: Additionally, the final rules require a DCM, SEF, or SDR to conduct external penetration testing that is sufficient to satisfy the scope requirements in new §§ 38.1051(k), 37.1401(k), and 49.24(l), at a frequency determined by an appropriate risk analysis. At a minimum, covered DCMs and SDRs are required to conduct external penetration testing no less frequently than annually. "]
[69,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","4. Internal Penetration Testing","(2) Internal Penetration Testing Frequency: Additionally, the final rules require a DCM, SEF, or SDR to conduct internal penetration testing that is sufficient to satisfy the scope requirements in new §§ 38.1051(k), 37.1401(k), and 49.24(l), at a frequency determined by an appropriate risk analysis. At a minimum, covered DCMs and SDRs are required to conduct the internal penetration testing no less frequently than annually. "]
[70,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","5. Controls Testing","(2) Controls Testing Frequency: Additionally, the final rules require a DCM, SEF, or an SDR to conduct controls testing that is sufficient to satisfy the scope requirements in new §§ 38.1051(k), 37.1401(k), and 49.24(l), at a frequency determined by an appropriate risk analysis. Covered DCMs and SDRs are required to test the key controls in the entity’s risk analysis and oversight no less frequently than every three years. Such testing may be conducted on a rolling basis over the course of the minimum three-year period or over a minimum period determined by an appropriate risk analysis, whichever is shorter. "]
[71,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","6. Security Incident Response Plan Testing","(2) SIRP Testing Frequency: The final rules require covered DCMs and SDRs to conduct such testing at a frequency determined by an appropriate risk analysis, but at a minimum no less frequently than annually. "]
[72,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC","CFTC \"System Safeguards Testing Requirements\"","U.S","E. System Safeguards Testing","7. Enterprise Technology Risk Assessment","(2) ETRA Frequency and Scope: The final rules require covered DCMs and SDRs to conduct an ETRA at a frequency determined by an appropriate risk analysis, but at a minimum no less frequently than annually. "]
[73,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-4","External information systems are catalogued",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Security of equipment and assets off-premises"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","4.      Cataloging and risk assessing of connections to your firm’s network from external sources (e.g., websites, vendors, and third parties)."]
[74,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","2.   Inventories of physical devices (e.g., PCs, laptops, and mobile devices), hardware (e.g., routers), and software platforms and applications as well as a prioritization of these resources for protection based on their sensitivity and business value."]
[75,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","D. Vendors and Other Third Parties\n(VOTP)","N.A","6.      Maintenance of contingency plans with the firm’s systems critical vendors.","DM.ED-6"]
[76,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","10.      Periodic updating of policies and procedures to reflect additional published cybersecurity standards (such as those issued by the National Institute of Standards and Technology or the International Organization for Standardization).","GV.PL-2"]
[77,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","20..  Periodic audits of compliance with information security policies.","GV.AU-1"]
[78,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","1.      The governance process over cybersecurity, including delineating responsibilities, establishing reporting lines to the firm’s governing body, requiring specified management reporting content and frequency, and requiring explicit approval of the firm’s cybersecurity policies and procedures.","GV.SF-1"]
[79,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","9.      Maintenance of insurance coverage that specifically covers customer/counterparty and firm losses and expenses attributable to cybersecurity incidents, including requirements as to the provider, nature, and amount of coverage.","GV.RM-1"]
[80,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","D. Vendors and Other Third Parties\n(VOTP)","N.A","1.      Cybersecurity risk assessments of vendors and business partners with access to your firm’s networks, customer data, or other sensitive information, or due to the cybersecurity risk of the outsourced function"]
[81,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","13.      Firm subscriptions to and use of threat and vulnerability information sharing sources(s) (e.g., the Financial Services – Information Sharing and Analysis Center (FS-ISAC))."]
[82,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","6.      Periodic risk assessments to identify data, systems and physical (e.g., hardware and critical infrastructure) cybersecurity threats, vulnerabilities, and potential business consequences."]
[83,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","11.      Metrics and management reporting used by the firm to measure, monitor, and report key information and indicators governing the cybersecurity management process.","GV.SP-2"]
[84,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","C. Risks  Associated  With  Remote  Customer  or  Counterparty  Access  and  Funds Transfer Requests\n(CAFTR)","N.A","2.      Methods employed for customer or counterparty authentication, including multi-factor authentication, for on-line account access and transactions."]
[85,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","C. Risks  Associated  With  Remote  Customer  or  Counterparty  Access  and  Funds Transfer Requests\n(CAFTR)","N.A","3.      Use of software or other practices for detecting anomalous transaction requests that may be the result of compromised customer or counterparty account access, including evaluation of remotely-initiated requests for transfers of assets and procedures for verifying the authenticity of email requests."]
[86,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","18.  Maintenance of policies relating to the use of devices to access the firm’s system externally (i.e., firm-issued laptops, tablets, etc. and personal devices such as a personal computer or smart phone), including those addressing the encryption of such devices and the firm’s ability to remotely monitor, track, and deactivate remote devices."]
[87,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","D. Vendors and Other Third Parties\n(VOTP)","N.A","4.      Assessment of the segregation of sensitive network resources from resources accessible by third parties."]
[88,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","6.      Updating or terminating access rights based on personnel or system changes."]
[89,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","1.      Provision of written guidance and periodic training to employees concerning information security risks and responsibilities."]
[90,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","17.  The use of system notifications to users, including employees and customers, of appropriate usage obligations when logging into the firm’s system (e.g., log-on banners, warning messages, or acceptable use notifications.)"]
[91,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","2.      Provision of written guidance and periodic training to third-party vendors and business partners of critical systems concerning information security risks and responsibilities."]
[92,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","C. Risks  Associated  With  Remote  Customer  or  Counterparty  Access  and  Funds Transfer Requests\n(CAFTR)","N.A","1.      Written standards specifying the qualifications of third parties that manage on-line account access by customers or counterparties."]
[93,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","C. Risks  Associated  With  Remote  Customer  or  Counterparty  Access  and  Funds Transfer Requests\n(CAFTR)","N.A","5.      Education of customers and counterparties about means of reducing cybersecurity risks in conducting transactions/business with your firm."]
[94,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","D. Vendors and Other Third Parties\n(VOTP)","N.A","3.      Incorporation of requirements relating to cybersecurity risk into contracts with vendors and business partners, including acknowledgement of responsibility for sensitive data, requirements for testing of cyber controls, and allocation of responsibilities for responding to security incidents."]
[95,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","D. Vendors and Other Third Parties\n(VOTP)","N.A","7.      Notices required from third-party vendors, such as notices prior to any significant changes to the third-party vendors’ systems, components, or services that could potentially have security impacts to the firm or the firm’s data containing PII."]
[96,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","15.      Use of encryption for data, communications, and devices."]
[97,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","9.      Management of removal, transfers, and disposal of information technology assets."]
[98,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","21.  Monitoring exfiltration and unauthorized distribution of sensitive materials outside of the firm through various distribution channels."]
[99,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","C. Risks  Associated  With  Remote  Customer  or  Counterparty  Access  and  Funds Transfer Requests\n(CAFTR)","N.A","4.      Use of security measures to protect customer or counterparty personal identification numbers (PINs) and personal identifiable information (PII.)"]
[100,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","7.      Maintenance of an environment for testing and development of software and applications that is separate from the business environment."]
[101,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","8.      Maintenance of a baseline configuration of hardware and software that users are prevented from altering without authorization and an assessment of security implications."]
[102,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","12.      Maintenance of protection against Distributed Denial of Service (DDoS) attacks for critical internet-facing IP addresses."]
[103,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","7.      Change management process for changes to systems, configurations, hardware, software, applications, and security tools."]
[104,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","14.      Periodic testing of the security protocol of backup systems."]
[105,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","13.      Maintenance of a written data destruction policy including inactive or no longer used customer/counterparty data."]
[106,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","8.      Cyber incident response planning, including mitigation of the effects of a cybersecurity incident, recovery from such an incident, and incident response plan testing."]
[107,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","10.      Regular system maintenance, including installation of software and hardware patches that address security vulnerabilities (e.g., anti-virus and anti-malware software to detect malicious code on your firm’s hardware, software, networks and/or mobile devices) and requirements for the testing and employment of such software."]
[108,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","5.      Assessment of the adequacy, appropriate retention, and secure maintenance of system activity logging capabilities and practices."]
[109,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","11.      Maintenance of controls to secure laptop computers and removable and mobile media against malware and data leakage."]
[110,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","3.      Entitlement review process including maintenance of controls to prevent unauthorized escalation of user privileges and lateral movement among network resources, and the definition and periodic review of role-based entitlements to ensure appropriate separation of duties."]
[111,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","4.      Restriction of users to those network resources necessary for their business functions."]
[112,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","6.      Updating or terminating access rights based on personnel or system changes."]
[113,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","23.      Locking of a system session after a pre-determined period of inactivity."]
[114,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","22.      The use of firewalls and other similar devices to protect systems connected to  the internet."]
[115,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","3.      Mapping of network resources, connections, and data flows (including locations where customer or counterparty data is housed)."]
[116,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","E. Detection of Unauthorized Activity\n(DUA)","N.A","1.      Monitoring the firm’s network and physical environment to detect potential cybersecurity events."]
[117,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","5.      Monitoring of user access to networks and systems for unusual activity."]
[118,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","16.      Monitoring of log-in attempts, log-in failures, lockouts, and unlocks or resets for perimeter-facing systems and deactivation of access, following a specified number of unauthorized log-in attempts and for dormant user accounts."]
[119,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","24.      The use of email protection mechanisms which are used to filter for cyber threats (e.g., attached malware or malicious links)."]
[120,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","D. Vendors and Other Third Parties\n(VOTP)","N.A","2.      Receipt and review of periodic audits, assessments and operational performance reports for critical third party vendors for validating security controls."]
[121,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","D. Vendors and Other Third Parties\n(VOTP)","N.A","5.      Maintenance of an explicit approval process, logging process, entitlement review process or other controls(including monitoring of third party activity), to prevent unauthorized access by vendors, business parties, or other third parties that have access to your firm’s networks and/or devices."]
[122,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","E. Detection of Unauthorized Activity\n(DUA)","N.A","2.      Monitoring for the presence of unauthorized users, devices, connections, and/or software on your firm’s networks."]
[123,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","E. Detection of Unauthorized Activity\n(DUA)","N.A","3.      Utilization of penetration tests and vulnerability scans."]
[124,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","E. Detection of Unauthorized Activity\n(DUA)","N.A","4.      Testing of the reliability of event detection processes."]
[125,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","12.      Reporting of cybersecurity incidents to senior management, law enforcement, the Commission, the Financial Crimes Enforcement Network (through the filing of a Suspicious Activity Report); FINRA; the SEC; another state or federal regulatory agency; or an industry or public-private organization facilitating the exchange of information about cybersecurity incidents and risks."]
[126,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","B. Protection of Firm Networks and Information\n(FNI)","N.A","19.  Handling of customer complaints received by the firm related to abnormal or unauthorized activity, including description of the resolution of the complaints and any remediation efforts undertaken in response."]
[127,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of information assets and related access. Similarly, an FMI should identify and maintain a current inventory of its information assets and system configurations, including interconnections with other internal and external systems, in order to know at all times the assets that support its business functions and processes. An FMI should carry out a risk assessment of those assets and classify them in terms of criticality. It should identify and maintain a current log of both individual and system credentials to know the access rights to information assets and their supporting systems, and should use this information to facilitate identification and investigation of anomalous activities."]
[128,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of information assets and related access. Similarly, an FMI should identify and maintain a current inventory of its information assets and system configurations, including interconnections with other internal and external systems, in order to know at all times the assets that support its business functions and processes. An FMI should carry out a risk assessment of those assets and classify them in terms of criticality. It should identify and maintain a current log of both individual and system credentials to know the access rights to information assets and their supporting systems, and should use this information to facilitate identification and investigation of anomalous activities."]
[129,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of information assets and related access. Similarly, an FMI should identify and maintain a current inventory of its information assets and system configurations, including interconnections with other internal and external systems, in order to know at all times the assets that support its business functions and processes. An FMI should carry out a risk assessment of those assets and classify them in terms of criticality. It should identify and maintain a current log of both individual and system credentials to know the access rights to information assets and their supporting systems, and should use this information to facilitate identification and investigation of anomalous activities."]
[130,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-4","External information systems are catalogued",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Security of equipment and assets off-premises"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of information assets and related access. Similarly, an FMI should identify and maintain a current inventory of its information assets and system configurations, including interconnections with other internal and external systems, in order to know at all times the assets that support its business functions and processes. An FMI should carry out a risk assessment of those assets and classify them in terms of criticality. It should identify and maintain a current log of both individual and system credentials to know the access rights to information assets and their supporting systems, and should use this information to facilitate identification and investigation of anomalous activities."]
[131,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of information assets and related access. Similarly, an FMI should identify and maintain a current inventory of its information assets and system configurations, including interconnections with other internal and external systems, in order to know at all times the assets that support its business functions and processes. An FMI should carry out a risk assessment of those assets and classify them in terms of criticality. It should identify and maintain a current log of both individual and system credentials to know the access rights to information assets and their supporting systems, and should use this information to facilitate identification and investigation of anomalous activities."]
[132,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Interconnections","Risks from interconnections. An FMI should implement protective measures to mitigate risks arising from the entities within its ecosystem. an FMI should implement measures to mitigate effectively the risk arising from its connected entities, including the following:\n(B) The FMI’s framework to manage its relationship with service providers should address and be designed to mitigate cyber risks. At a minimum, an FMI should ensure that its outsourced services are accorded the same level of cyber resilience needed if their services were provided by the FMI itself."]
[133,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of business functions and processes. An FMI should identify its business functions and supporting processes and conduct a risk assessment in order to ensure that it thoroughly understands the importance of each function and supporting processes, and their interdependencies, in performing its functions. Identified business functions and processes should then be classified in terms of criticality, which in turn should guide the FMI’s prioritisation of its protective, detective, response and recovery efforts.","DM.ED-5"]
[134,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of business functions and processes. An FMI should identify its business functions and supporting processes and conduct a risk assessment in order to ensure that it thoroughly understands the importance of each function and supporting processes, and their interdependencies, in performing its functions. Identified business functions and processes should then be classified in terms of criticality, which in turn should guide the FMI’s prioritisation of its protective, detective, response and recovery efforts.","DM.ED-5"]
[135,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of business functions and processes. An FMI should identify its business functions and supporting processes and conduct a risk assessment in order to ensure that it thoroughly understands the importance of each function and supporting processes, and their interdependencies, in performing its functions. Identified business functions and processes should then be classified in terms of criticality, which in turn should guide the FMI’s prioritisation of its protective, detective, response and recovery efforts.","DM.ED-5"]
[136,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","Cyber resilience framework. An FMI should have a framework that clearly articulates how it determines its cyber resilience objectives and cyber risk tolerance, as well as how it effectively identifies, mitigates, and manages its cyber risks to support its objectives. The FMI’s board should endorse this framework, ensuring it is aligned with the FMI’s formulated cyber resilience strategy. The FMI’s cyber resilience framework should support financial stability objectives while ensuring the ongoing efficiency, effectiveness and economic viability of its services to its users. Therefore, framework objectives should aim to maintain and promote the FMI’s ability to anticipate, withstand, contain and recover from cyber attacks, so as to limit the likelihood or impact of a successful cyber attack on its operations or on the broader financial system. The FMI’s cyber resilience framework should be reviewed and updated periodically to ensure that it remains relevant.","GV.SF-1"]
[137,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Role of the board and senior management","Board and senior management responsibilities. An FMI’s board is ultimately responsible for setting the cyber resilience framework and ensuring that cyber risk is effectively managed. The Board should endorse the FMI’s cyber resilience framework, and set the FMI’s tolerance for cyber risk. The board should be regularly apprised of the FMI’s cyber risk profile to ensure that it remains consistent with the FMI’s risk tolerance as well as the FMI’s overall business objectives. As part of this responsibility, the board should consider how material changes to the FMI’s products, services, policies or practices, and the threat landscape affect its cyber risk profile. Senior management should closely oversee the FMI’s implementation of its cyber resilience framework, and the policies, procedures and controls that support it.","GV.SF-1"]
[138,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Identification of business functions and processes. An FMI should identify its business functions and supporting processes and conduct a risk assessment in order to ensure that it thoroughly understands the importance of each function and supporting processes, and their interdependencies, in performing its functions. Identified business functions and processes should then be classified in terms of criticality, which in turn should guide the FMI’s prioritisation of its protective, detective, response and recovery efforts.","DM.ED-5"]
[139,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","Risk management governance. An FMI’s cyber resilience framework should clearly define the roles and responsibilities including accountability for decision making within the organisation for managing cyber risk, including in emergencies and in a crisis.","GV.SF-1, GV.RR-1"]
[140,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Role of the board and senior management","Accountability. In view of FMIs’ growing reliance on ICT systems to support their businesses and operations, and the increasing cyber threat, FMIs should designate a senior executive to be responsible and accountable for executing the cyber resilience framework within the organisation. This role should have sufficient authority, independence, resources and access to the board. The senior executive performing this role should possess the requisite expertise and knowledge to competently plan and execute the cyber resilience initiatives.","GV.RR-2"]
[141,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Cyber threat intelligence","Threat intelligence process. An FMI should establish a process to gather and analyse relevant cyber threat information. Its analysis should be in conjunction with other sources of internal and external business and system information so as to provide business-specific context, turning the information into usable cyber threat intelligence that provides timely insights and informs enhanced decision-making by enabling the FMI to anticipate a cyber attacker’s capabilities, intentions and modus operandi."]
[142,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Information Sharing","Information-sharing groups. FMIs should participate actively in information-sharing groups and collectives, including cross-industry, cross-government and cross-border groups to gather, distribute and assess information about cyber practices, cyber threats and early warning indicators relating to cyber threats. FMIs should, where appropriate, share information both bilaterally and multilaterally. As appropriate, an FMI should consider exchanging information on its cyber resilience framework bilaterally with trusted stakeholders so as to promote understanding of each other’s approach to securing systems that are linked or interfaced. Such information exchange would facilitate an FMI’s and its stakeholders’ efforts at dovetailing their respective security measures to achieve greater cyber resilience. Multilateral information-sharing arrangements should be designed to facilitate a sector-wide response to large-scale incidents."]
[143,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Cyber threat intelligence","Identification of potential cyber threats. An FMI should identify cyber threats that could materially affect its ability to perform or to provide services as expected, or that could have a significant impact on its ability to meet its own obligations or have knock-on effects within its ecosystem. In doing so, an FMI should consider threats to the confidentiality, integrity and availability of the FMI’s business processes and to its reputation that could arise from internal and external sources. In addition, an FMI should include in its threat analysis those threats which could trigger extreme but plausible cyber events, even if they are considered unlikely to occur or have never occurred in the past. The FMI should regularly review and update this analysis."]
[144,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Cyber threat intelligence","Scope of cyber threat intelligence gathering. The scope of cyber threat intelligence gathering should include the capability to gather and interpret information about relevant cyber threats arising from the FMI’s participants, service and utility providers and other FMIs, and to interpret this information in ways that allow the FMI to identify, assess and manage security threats and vulnerabilities for the purpose of implementing appropriate safeguards in its systems.  In this context, relevant cyber threat intelligence could include information on geopolitical developments that may trigger cyber attacks on any entity within the FMI’s ecosystem."]
[145,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Cyber threat intelligence","Effective use of information. FMIs should ensure that cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the FMI. Cyber threat intelligence should be used to ensure that the implementation of any cyber resilience measures is threat-informed. When properly contextualised, cyber threat information enables an FMI to validate and inform the prioritisation of resources, risk mitigation strategies and training programmes."]
[146,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","Cyber resilience framework. An FMI should have a framework that clearly articulates how it determines its cyber resilience objectives and cyber risk tolerance, as well as how it effectively identifies, mitigates, and manages its cyber risks to support its objectives. The FMI’s board should endorse this framework, ensuring it is aligned with the FMI’s formulated cyber resilience strategy. The FMI’s cyber resilience framework should support financial stability objectives while ensuring the ongoing efficiency, effectiveness and economic viability of its services to its users. Therefore, framework objectives should aim to maintain and promote the FMI’s ability to anticipate, withstand, contain and recover from cyber attacks, so as to limit the likelihood or impact of a successful cyber attack on its operations or on the broader financial system. The FMI’s cyber resilience framework should be reviewed and updated periodically to ensure that it remains relevant.","GV.SF-1, GV.SF-2, GV.SF-3, GV.SF-4"]
[147,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","Cyber is more than just ICT. The strategies and measures in an FMI’s cyber resilience framework should not be restricted to securing the viability of its information technology operations alone, but should also cover people and processes. The framework should, in addition, include timely communication to enable the FMI to collaborate with relevant stakeholders to effectively respond to and recover from cyber attacks, whether on the FMI or on the financial system as a whole."]
[148,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","Enterprise risk management. At the broader level, the FMI’s cyber resilience framework should be consistent with its enterprise operational risk management framework. Such consistency is important, and recognises that an FMI’s cyber resilience framework is likely to share common elements with the policies, procedures and controls that it has established to manage other areas of risks. For example, limiting physical access can be a key control to address the risk to critical ICT infrastructure","GV.RM-4"]
[149,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","An FMI’s ecosystem. An FMI should take an integrated and comprehensive view of the potential cyber threats it faces. In particular, an FMI’s cyber resilience framework should consider how the FMI would regularly review and actively mitigate the cyber risks that it bears from and poses to its participants, other FMIs, vendors, vendor products and its service providers, which are collectively referred to in this document as an FMI’s ecosystem."]
[150,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","Audits and compliance. An FMI’s internal processes should help the board and senior management assess and measure the adequacy and effectiveness of the FMI’s cyber resilience framework. The adequacy of and adherence to an FMI’s cyber resilience framework should be assessed and measured regularly through independent compliance programmes and audits carried out by qualified individuals."]
[151,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Role of the board and senior management","Board and senior management responsibilities. An FMI’s board is ultimately responsible for setting the cyber resilience framework and ensuring that cyber risk is effectively managed. The Board should endorse the FMI’s cyber resilience framework, and set the FMI’s tolerance for cyber risk. The board should be regularly apprised of the FMI’s cyber risk profile to ensure that it remains consistent with the FMI’s risk tolerance as well as the FMI’s overall business objectives. As part of this responsibility, the board should consider how material changes to the FMI’s products, services, policies or practices, and the threat landscape affect its cyber risk profile. Senior management should closely oversee the FMI’s implementation of its cyber resilience framework, and the policies, procedures and controls that support it.","GV.SF-1, GV. SF-3, GV.PL-1, "]
[152,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Cyber threat intelligence","Effective use of information. FMIs should ensure that cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the FMI. Cyber threat intelligence should be used to ensure that the implementation of any cyber resilience measures is threat-informed. When properly contextualised, cyber threat information enables an FMI to validate and inform the prioritisation of resources, risk mitigation strategies and training programmes.","ID.RA-2"]
[153,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Role of the board and senior management","Board and senior management responsibilities. An FMI’s board is ultimately responsible for setting the cyber resilience framework and ensuring that cyber risk is effectively managed. The Board should endorse the FMI’s cyber resilience framework, and set the FMI’s tolerance for cyber risk. The board should be regularly apprised of the FMI’s cyber risk profile to ensure that it remains consistent with the FMI’s risk tolerance as well as the FMI’s overall business objectives. As part of this responsibility, the board should consider how material changes to the FMI’s products, services, policies or practices, and the threat landscape affect its cyber risk profile. Senior management should closely oversee the FMI’s implementation of its cyber resilience framework, and the policies, procedures and controls that support it.","GV.SF-1, GV. SF-3, GV.PL-1, "]
[154,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Role of the board and senior management","Board and senior management responsibilities. An FMI’s board is ultimately responsible for setting the cyber resilience framework and ensuring that cyber risk is effectively managed. The Board should endorse the FMI’s cyber resilience framework, and set the FMI’s tolerance for cyber risk. The board should be regularly apprised of the FMI’s cyber risk profile to ensure that it remains consistent with the FMI’s risk tolerance as well as the FMI’s overall business objectives. As part of this responsibility, the board should consider how material changes to the FMI’s products, services, policies or practices, and the threat landscape affect its cyber risk profile. Senior management should closely oversee the FMI’s implementation of its cyber resilience framework, and the policies, procedures and controls that support it.","GV.SF-1, GV. SF-3, GV.PL-1, "]
[155,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Contagion. Because an FMI’s systems and processes are often interconnected with the systems and processes of other entities within its ecosystem, in the event of a large-scale cyber incident it is possible for an FMI to pose contagion risk (ie, propagation of malware or corrupted data) to, or be exposed to contagion risk from, its ecosystem. An FMI should work together with its interconnected entities to enable the resumption of operations (the first priority being its critical services) as soon as it is safe and practicable to do so without causing unnecessary risk to the wider sector or further detriment to financial stability.","DM.BE-1"]
[156,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Interconnections","an FMI should identify the cyber risks that it bears from and poses to entities in its ecosystem and coordinate with relevant entities, as appropriate, as they design and implement resilience efforts with the objective of improving the overall resilience of the ecosystem.","DM.BE-1"]
[157,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Insider Threats","Access control. Physical and logical access to systems should be permitted only for individuals who are authorised, and authorisation should be limited to individuals who are appropriately trained and monitored. FMIs should institute controls that reliably restrict such access to systems to those with a legitimate business requirement. In particular, FMIs should institute strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. Controls such as roles-based access, logging and reviewing of the systems activities of privileged users, strong authentication, and monitoring for anomalies should be implemented"]
[158,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Insider Threats","Access control. Physical and logical access to systems should be permitted only for individuals who are authorised, and authorisation should be limited to individuals who are appropriately trained and monitored. FMIs should institute controls that reliably restrict such access to systems to those with a legitimate business requirement. In particular, FMIs should institute strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. Controls such as roles-based access, logging and reviewing of the systems activities of privileged users, strong authentication, and monitoring for anomalies should be implemented"]
[159,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Strong ICT controls. FMIs should consistently maintain a strong ICT control environment, this being a fundamental and critical component of an FMI’s overall cyber resilience. \n(A) Protecting information. Implementing appropriate measures to protect information (both in transit and at rest), commensurate with the criticality and sensitivity of the information held by and transmitted through the FMI. This should include, but not be restricted to, appropriate encryption (eg, end-to-end encryption), authentication (eg, multifactor authentication) and access control."]
[160,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Insider Threats","Access control. Physical and logical access to systems should be permitted only for individuals who are authorised, and authorisation should be limited to individuals who are appropriately trained and monitored. FMIs should institute controls that reliably restrict such access to systems to those with a legitimate business requirement. In particular, FMIs should institute strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. Controls such as roles-based access, logging and reviewing of the systems activities of privileged users, strong authentication, and monitoring for anomalies should be implemented"]
[161,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Layered protection that facilitates response and recovery. An FMI’s protective controls should enable the monitoring and detection of anomalous activity across multiple layers of the FMI’s infrastructure, which requires a baseline profile of system activity. segmenting networks in a manner that segregates systems and data of varying criticality may have multiple benefits, both by helping the FMI to insulate systems in one segment from a security compromise in other segments, and by facilitating more efficient recovery of services"]
[162,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Insider Threats","Access control. Physical and logical access to systems should be permitted only for individuals who are authorised, and authorisation should be limited to individuals who are appropriately trained and monitored. FMIs should institute controls that reliably restrict such access to systems to those with a legitimate business requirement. In particular, FMIs should institute strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. Controls such as roles-based access, logging and reviewing of the systems activities of privileged users, strong authentication, and monitoring for anomalies should be implemented"]
[163,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Strong ICT controls. FMIs should consistently maintain a strong ICT control environment, this being a fundamental and critical component of an FMI’s overall cyber resilience. \n(A) Protecting information. Implementing appropriate measures to protect information (both in transit and at rest), commensurate with the criticality and sensitivity of the information held by and transmitted through the FMI. This should include, but not be restricted to, appropriate encryption (eg, end-to-end encryption), authentication (eg, multifactor authentication) and access control."]
[164,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Training","FMI staff. An FMI should ensure that all relevant staff, be they permanent or temporary, receive training to develop and maintain appropriate awareness of and competencies for detecting and addressing cyber-related risks. They should also be trained on how to report any unusual activity and incidents."]
[165,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Training","High-risk groups. High-risk groups, such as those with privileged system access or in sensitive business functions, should be identified and should receive targeted information security training."]
[166,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Interconnections","Risks from interconnections. An FMI should implement protective measures to mitigate risks arising from the entities within its ecosystem. an FMI should implement measures to mitigate effectively the risk arising from its connected entities, including the following:\n(B) The FMI’s framework to manage its relationship with service providers should address and be designed to mitigate cyber risks. At a minimum, an FMI should ensure that its outsourced services are accorded the same level of cyber resilience needed if their services were provided by the FMI itself."]
[167,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Role of the board and senior management","Culture. An FMI’s board and senior management should cultivate a strong level of awareness of and commitment to cyber resilience. To that end, an FMI’s board and management should promote a culture that recognises that staff at all levels have important responsibilities in ensuring the FMI’s cyber resilience, and lead by example"]
[168,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Role of the board and senior management","Skills. In order for the board and senior management to have effective oversight of the FMI’s cyber resilience framework and cyber risk profile, both groups should contain members with the appropriate skills and knowledge to understand and manage the risks posed by cyber threats, while ensuring that those skills remain current."]
[169,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Training","High-risk groups. High-risk groups, such as those with privileged system access or in sensitive business functions, should be identified and should receive targeted information security training."]
[170,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Strong ICT controls. FMIs should consistently maintain a strong ICT control environment, this being a fundamental and critical component of an FMI’s overall cyber resilience. \n(A) Protecting information. Implementing appropriate measures to protect information (both in transit and at rest), commensurate with the criticality and sensitivity of the information held by and transmitted through the FMI. This should include, but not be restricted to, appropriate encryption (eg, end-to-end encryption), authentication (eg, multifactor authentication) and access control."]
[171,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Strong ICT controls. FMIs should consistently maintain a strong ICT control environment, this being a fundamental and critical component of an FMI’s overall cyber resilience. \n(A) Protecting information. Implementing appropriate measures to protect information (both in transit and at rest), commensurate with the criticality and sensitivity of the information held by and transmitted through the FMI. This should include, but not be restricted to, appropriate encryption (eg, end-to-end encryption), authentication (eg, multifactor authentication) and access control."]
[172,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Layered protection that facilitates response and recovery. An FMI’s protective controls should enable the monitoring and detection of anomalous activity across multiple layers of the FMI’s infrastructure, which requires a baseline profile of system activity. segmenting networks in a manner that segregates systems and data of varying criticality may have multiple benefits, both by helping the FMI to insulate systems in one segment from a security compromise in other segments, and by facilitating more efficient recovery of services"]
[173,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Strong ICT controls. FMIs should consistently maintain a strong ICT control environment, this being a fundamental and critical component of an FMI’s overall cyber resilience\n(C) Security settings consistent with levels of protection. Configuring ICT systems and devices with security settings that are consistent with the expected level of protection. FMIs should establish baseline system security configuration standards to facilitate consistent application of security settings to operating systems, databases, network devices and enterprise mobile devices within the ICT environment. Regular enforcement checks should also be performed to ensure that non-compliance with such standards is promptly rectified."]
[174,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Testing programme. An FMI should establish a comprehensive testing programme to validate the effectiveness of its cyber resilience framework on a regular and frequent basis. It should employ appropriate cyber threat intelligence to inform its testing methods – for example, by designing tests to simulate advanced threat agent capabilities and extreme but plausible scenarios. The results of the testing programme should be used by the FMI to support the ongoing improvement of its cyber resilience. Where applicable, these tests should include both internal and external stakeholders such as business line management including business continuity, incident and crisis response teams, and the relevant entities in its ecosystem. An FMI should involve its board and senior management appropriately (eg, as part of crisis management teams) and inform them of test results."]
[175,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Methodologies and practices. FMIs should employ a variety of effective testing methodologies and practices, including the following (which may partly overlap or be combined): \n(B) Scenario-based testing. An FMI’s response, resumption and recovery plans should be subject to periodic review and testing. Tests should address an appropriately broad scope of scenarios, including simulation of extreme but plausible cyber attacks, and should be designed to challenge the assumptions of response, resumption and recovery practices, including governance arrangements and communication plans. FMIs should use cyber threat intelligence and cyber threat modelling to the extent possible to imitate the unique characteristics of cyber threats. They should also conduct exercises to test the ability of their staff and processes to respond to unfamiliar scenarios, with a view to achieving stronger operational resilience."]
[176,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Coordination","Coordination. An FMI should, to the extent practicable and possible, promote, design, organise and manage exercises designed to test its response, resumption and recovery plans and processes. Such exercises should include FMI participants, critical service providers and linked FMIs. Where appropriate, FMIs should participate in exercises organised by relevant authorities and in industry-wide tests. Achieving market-wide timely recovery of operations calls for an added dimension to testing exercises. Traditional isolated testing implicitly assumes that all other players operate as usual. Removing that hypothesis helps an FMI to identify plausible complexities, dependencies and weaknesses that may have been overlooked in its recovery plans. Accordingly, testing should include scenarios that cover breaches affecting multiple portions of the FMI’s ecosystem."]
[177,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Insider Threats","Changes in employment status. An FMI should conduct screening/background checks on new employees to mitigate insider threats. Similar checks should be conducted on all staff at regular intervals throughout their employment, commensurate with staff’s access to critical systems. FMIs also should establish processes and controls to mitigate risks related to employees terminating employment or changing responsibilities."]
[178,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Methodologies and practices. FMIs should employ a variety of effective testing methodologies and practices, including the following (which may partly overlap or be combined): \n(A) Vulnerability assessment (VA). FMIs should regularly perform vulnerability assessments to identify and assess security vulnerabilities in their systems and processes. FMIs should establish a process to prioritise and remedy issues identified in VAs and perform subsequent validation to assess whether gaps have been fully addressed"]
[179,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Resilience by design. An FMI should consider cyber resilience from the ground up during system, process, and product design."]
[180,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Strong ICT controls. FMIs should consistently maintain a strong ICT control environment, this being a fundamental and critical component of an FMI’s overall cyber resilience\n(B) Change management. Ensuring that the FMI has a comprehensive change management process that explicitly considers cyber risks, in terms of residual cyber risks identified both prior to and during a change, and of any new cyber risk created post-change. Ensuring that a process exists to identify patches to technology and software assets, evaluate the patch criticality and risk, and test and apply the patch within an appropriate time frame."]
[181,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Design elements","Data integrity. FMIs should have plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives. Therefore, FMIs should design and test their systems and processes to enable recovery of accurate data following a breach. Data instances should be safeguarded by stringent protective and detective controls. In addition, the FMI’s cyber resilience framework should include data recovery measures, such as keeping a copy of all received and processed data (including the original intent of instructions being sent to the FMI for processing), maintaining transaction replay capability and conducting frequent periodic independent reconciliation of participants’ positions. Recovery point objectives to support data integrity efforts should be consistent with the FMI’s resumption time objective for critical operations. FMI’s should consider diverse approaches to achieving these objectives."]
[182,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Testing programme. An FMI should establish a comprehensive testing programme to validate the effectiveness of its cyber resilience framework on a regular and frequent basis. It should employ appropriate cyber threat intelligence to inform its testing methods – for example, by designing tests to simulate advanced threat agent capabilities and extreme but plausible scenarios. The results of the testing programme should be used by the FMI to support the ongoing improvement of its cyber resilience. Where applicable, these tests should include both internal and external stakeholders such as business line management including business continuity, incident and crisis response teams, and the relevant entities in its ecosystem. An FMI should involve its board and senior management appropriately (eg, as part of crisis management teams) and inform them of test results."]
[183,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Controls. An FMI should implement appropriate protective controls that are in line with leading-practice cyber resilience standards to minimise the likelihood and impact of a successful cyber attack on identified critical business functions, information assets and data. Protective controls should be proportionate to the FMI’s threat landscape and systemic role in the financial system, and consistent with its risk tolerance."]
[184,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Design elements","Design and business integration. System and process design and controls for critical functions and operations should support incident response activities to the extent possible. FMIs should design systems and processes to limit the impact of any cyber incident, resume critical operations within two hours of a disruption, complete settlement by day-end and preserve transaction integrity. The possibility to resume critical operations in a system that is technically different from the primary system or in a system that performs those operations and completes settlement in a non-standardised way may be among the options for an FMI to consider. An FMI’s incident response, resumption and recovery processes should be closely integrated with crisis management, business continuity and disaster recovery planning and recovery operations, and coordinated with relevant internal and external stakeholders"]
[185,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Insider Threats","Access control. Physical and logical access to systems should be permitted only for individuals who are authorised, and authorisation should be limited to individuals who are appropriately trained and monitored. FMIs should institute controls that reliably restrict such access to systems to those with a legitimate business requirement. In particular, FMIs should institute strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. Controls such as roles-based access, logging and reviewing of the systems activities of privileged users, strong authentication, and monitoring for anomalies should be implemented"]
[186,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Incident response. An FMI’s monitoring and detection capabilities should facilitate its incident response process and support information collection for the forensic investigation process."]
[187,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Layered protection that facilitates response and recovery. An FMI’s protective controls should enable the monitoring and detection of anomalous activity across multiple layers of the FMI’s infrastructure, which requires a baseline profile of system activity. segmenting networks in a manner that segregates systems and data of varying criticality may have multiple benefits, both by helping the FMI to insulate systems in one segment from a security compromise in other segments, and by facilitating more efficient recovery of services"]
[188,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Layered detection. The ability to detect an intrusion early is critical for swift containment and recovery. FMIs should take a defence-in-depth approach by instituting multi-layered detection controls covering people, processes and technology, with each layer serving as a safety net for preceding layers."]
[189,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Layered protection that facilitates response and recovery. An FMI’s protective controls should enable the monitoring and detection of anomalous activity across multiple layers of the FMI’s infrastructure, which requires a baseline profile of system activity. segmenting networks in a manner that segregates systems and data of varying criticality may have multiple benefits, both by helping the FMI to insulate systems in one segment from a security compromise in other segments, and by facilitating more efficient recovery of services"]
[190,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Layered detection. The ability to detect an intrusion early is critical for swift containment and recovery. FMIs should take a defence-in-depth approach by instituting multi-layered detection controls covering people, processes and technology, with each layer serving as a safety net for preceding layers."]
[191,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Layered protection that facilitates response and recovery. An FMI’s protective controls should enable the monitoring and detection of anomalous activity across multiple layers of the FMI’s infrastructure, which requires a baseline profile of system activity. segmenting networks in a manner that segregates systems and data of varying criticality may have multiple benefits, both by helping the FMI to insulate systems in one segment from a security compromise in other segments, and by facilitating more efficient recovery of services"]
[192,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Insider Threats","Security analytics. An FMI should implement measures to capture and analyse anomalous behaviour by persons with access to its systems. Data loss identification and prevention techniques should be employed to protect against the removal of confidential data from the FMI’s network."]
[193,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Layered detection. The ability to detect an intrusion early is critical for swift containment and recovery. FMIs should take a defence-in-depth approach by instituting multi-layered detection controls covering people, processes and technology, with each layer serving as a safety net for preceding layers."]
[194,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Security analytics. An FMI should implement measures to capture and analyse anomalous behaviour by persons with access to the corporate network."]
[195,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Interconnections","Risks from interconnections. An FMI should implement protective measures to mitigate risks arising from the entities within its ecosystem. an FMI should implement measures to mitigate effectively the risk arising from its connected entities, including the following:\n(A) An FMI’s participation requirements should be designed to ensure that they adequately support its cyber resilience framework."]
[196,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Comprehensive scope of monitoring. An FMI should monitor relevant internal and external factors, including business line and administrative functions and transactions. The FMI should seek to detect both publicly known vulnerabilities and vulnerabilities that are not yet publicly known, such as so-called zero-day exploits, through a combination of signature monitoring for known vulnerabilities and behaviourally based detection mechanisms. Detection capabilities should also address misuse of access by service providers or other trusted agents, potential insider threats and other advanced threat activity"]
[197,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Layered detection. The ability to detect an intrusion early is critical for swift containment and recovery. FMIs should take a defence-in-depth approach by instituting multi-layered detection controls covering people, processes and technology, with each layer serving as a safety net for preceding layers."]
[198,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Comprehensive scope of monitoring. An FMI should monitor relevant internal and external factors, including business line and administrative functions and transactions. The FMI should seek to detect both publicly known vulnerabilities and vulnerabilities that are not yet publicly known, such as so-called zero-day exploits, through a combination of signature monitoring for known vulnerabilities and behaviourally based detection mechanisms. Detection capabilities should also address misuse of access by service providers or other trusted agents, potential insider threats and other advanced threat activity"]
[199,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Comprehensive scope of monitoring. An FMI should monitor relevant internal and external factors, including business line and administrative functions and transactions. The FMI should seek to detect both publicly known vulnerabilities and vulnerabilities that are not yet publicly known, such as so-called zero-day exploits, through a combination of signature monitoring for known vulnerabilities and behaviourally based detection mechanisms. Detection capabilities should also address misuse of access by service providers or other trusted agents, potential insider threats and other advanced threat activity"]
[200,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Methodologies and practices. FMIs should employ a variety of effective testing methodologies and practices, including the following (which may partly overlap or be combined): \n(A) Vulnerability assessment (VA). FMIs should regularly perform vulnerability assessments to identify and assess security vulnerabilities in their systems and processes. FMIs should establish a process to prioritise and remedy issues identified in VAs and perform subsequent validation to assess whether gaps have been fully addressed"]
[201,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Continuous monitoring. An FMI should establish capabilities to continuously monitor (in real time or near real time) and detect anomalous activities and events. One practice that may help to accomplish this is to set up what is commonly referred to as a “security operations centre”. These capabilities should be adaptively maintained and tested."]
[202,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Testing programme. An FMI should establish a comprehensive testing programme to validate the effectiveness of its cyber resilience framework on a regular and frequent basis. It should employ appropriate cyber threat intelligence to inform its testing methods – for example, by designing tests to simulate advanced threat agent capabilities and extreme but plausible scenarios. The results of the testing programme should be used by the FMI to support the ongoing improvement of its cyber resilience. Where applicable, these tests should include both internal and external stakeholders such as business line management including business continuity, incident and crisis response teams, and the relevant entities in its ecosystem. An FMI should involve its board and senior management appropriately (eg, as part of crisis management teams) and inform them of test results."]
[203,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Continuous monitoring. An FMI should establish capabilities to continuously monitor (in real time or near real time) and detect anomalous activities and events. One practice that may help to accomplish this is to set up what is commonly referred to as a “security operations centre”. These capabilities should be adaptively maintained and tested."]
[204,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Testing programme. An FMI should establish a comprehensive testing programme to validate the effectiveness of its cyber resilience framework on a regular and frequent basis. It should employ appropriate cyber threat intelligence to inform its testing methods – for example, by designing tests to simulate advanced threat agent capabilities and extreme but plausible scenarios. The results of the testing programme should be used by the FMI to support the ongoing improvement of its cyber resilience. Where applicable, these tests should include both internal and external stakeholders such as business line management including business continuity, incident and crisis response teams, and the relevant entities in its ecosystem. An FMI should involve its board and senior management appropriately (eg, as part of crisis management teams) and inform them of test results."]
[205,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Incident response planning. Upon detection of a successful cyber attack or an attack attempt, FMIs should perform a thorough investigation to determine its nature and extent as well as the damage inflicted. While the investigation is ongoing, FMIs should also take immediate actions to contain the situation to prevent further damage and commence recovery efforts to restore operations based on their response planning."]
[206,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Incident response planning. Upon detection of a successful cyber attack or an attack attempt, FMIs should perform a thorough investigation to determine its nature and extent as well as the damage inflicted. While the investigation is ongoing, FMIs should also take immediate actions to contain the situation to prevent further damage and commence recovery efforts to restore operations based on their response planning."]
[207,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Forensic readiness. FMIs should have the capability to assist in or conduct forensic investigations of cyber incidents and engineer protective and detective controls to facilitate the investigative process. In this regard, FMIs should establish relevant system logging policies that include the types of logs to be maintained and their retention periods. While forensic analysis may need to be postponed, eg in the event of contagion giving rise to financial stability concerns, and ICT resources may be focused on recovering critical systems, FMIs should take appropriate steps so that investigations can still be performed post-event to the extent possible, eg through preservation of necessary system logs and evidence."]
[208,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Cyber threat intelligence","Effective use of information. FMIs should ensure that cyber threat intelligence is made available to appropriate staff with responsibility for the mitigation of cyber risks at the strategic, tactical and operational levels within the FMI. Cyber threat intelligence should be used to ensure that the implementation of any cyber resilience measures is threat-informed. When properly contextualised, cyber threat information enables an FMI to validate and inform the prioritisation of resources, risk mitigation strategies and training programmes."]
[209,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Crisis communication. FMIs should plan in advance for communications with participants, interdependent FMIs, authorities and others (such as service providers and, where relevant, the media). Communication plans should be developed through an adaptive process informed by scenario-based planning and analysis as well as prior experience. Because rapid escalation of cyber incidents may be necessary, FMIs should determine decision-making responsibilities for incident response in advance, and implement clearly defined escalation and decision-making procedures. FMIs should inform relevant oversight and regulatory authorities promptly of potentially material or systemic events."]
[210,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Information Sharing","Planning ahead. To facilitate sector-wide response to large-scale incidents, FMIs should plan for information-sharing through trusted channels in the event of an incident, collecting and exchanging timely information that could facilitate the detection, response, resumption and recovery of its own systems and those of other sector participants during and following a cyber attack. FMIs should, as part of their response programmes, determine beforehand which types of information will be shared, with whom, and how information provided to the FMI will be acted upon. Reporting requirements and capabilities should be consistent with information-sharing arrangements within the FMI’s communities and the financial sector."]
[211,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Planning and preparation. FMIs should develop and test response, resumption and recovery plans. These plans should support objectives to protect and, if necessary, re-establish integrity and availability of its operations, and the confidentiality of its information assets. Plans should be actively updated based on current cyber threat intelligence, information-sharing and lessons learned from previous events, as well as analysis of operationally and technically plausible scenarios that have not yet occurred. The FMI should consult and coordinate with relevant internal and external stakeholders during the establishment of its response, resumption and recovery plans."]
[212,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Crisis communication. FMIs should plan in advance for communications with participants, interdependent FMIs, authorities and others (such as service providers and, where relevant, the media). Communication plans should be developed through an adaptive process informed by scenario-based planning and analysis as well as prior experience. Because rapid escalation of cyber incidents may be necessary, FMIs should determine decision-making responsibilities for incident response in advance, and implement clearly defined escalation and decision-making procedures. FMIs should inform relevant oversight and regulatory authorities promptly of potentially material or systemic events."]
[213,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Information Sharing","Planning ahead. To facilitate sector-wide response to large-scale incidents, FMIs should plan for information-sharing through trusted channels in the event of an incident, collecting and exchanging timely information that could facilitate the detection, response, resumption and recovery of its own systems and those of other sector participants during and following a cyber attack. FMIs should, as part of their response programmes, determine beforehand which types of information will be shared, with whom, and how information provided to the FMI will be acted upon. Reporting requirements and capabilities should be consistent with information-sharing arrangements within the FMI’s communities and the financial sector."]
[214,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Crisis communication. FMIs should plan in advance for communications with participants, interdependent FMIs, authorities and others (such as service providers and, where relevant, the media). Communication plans should be developed through an adaptive process informed by scenario-based planning and analysis as well as prior experience. Because rapid escalation of cyber incidents may be necessary, FMIs should determine decision-making responsibilities for incident response in advance, and implement clearly defined escalation and decision-making procedures. FMIs should inform relevant oversight and regulatory authorities promptly of potentially material or systemic events."]
[215,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Information Sharing","Planning ahead. To facilitate sector-wide response to large-scale incidents, FMIs should plan for information-sharing through trusted channels in the event of an incident, collecting and exchanging timely information that could facilitate the detection, response, resumption and recovery of its own systems and those of other sector participants during and following a cyber attack. FMIs should, as part of their response programmes, determine beforehand which types of information will be shared, with whom, and how information provided to the FMI will be acted upon. Reporting requirements and capabilities should be consistent with information-sharing arrangements within the FMI’s communities and the financial sector."]
[216,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Planning and preparation. FMIs should develop and test response, resumption and recovery plans. These plans should support objectives to protect and, if necessary, re-establish integrity and availability of its operations, and the confidentiality of its information assets. Plans should be actively updated based on current cyber threat intelligence, information-sharing and lessons learned from previous events, as well as analysis of operationally and technically plausible scenarios that have not yet occurred. The FMI should consult and coordinate with relevant internal and external stakeholders during the establishment of its response, resumption and recovery plans."]
[217,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Responsible disclosure policy. FMIs should have a policy and procedure to enable the responsible disclosure of potential vulnerabilities. In particular, FMIs should prioritise disclosures that could facilitate early response and risk mitigation by stakeholders for the benefit of the ecosystem and broader financial stability,"]
[218,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Situational awareness","Information Sharing","Information-sharing groups. FMIs should participate actively in information-sharing groups and collectives, including cross-industry, cross-government and cross-border groups to gather, distribute and assess information about cyber practices, cyber threats and early warning indicators relating to cyber threats. FMIs should, where appropriate, share information both bilaterally and multilaterally. As appropriate, an FMI should consider exchanging information on its cyber resilience framework bilaterally with trusted stakeholders so as to promote understanding of each other’s approach to securing systems that are linked or interfaced. Such information exchange would facilitate an FMI’s and its stakeholders’ efforts at dovetailing their respective security measures to achieve greater cyber resilience. Multilateral information-sharing arrangements should be designed to facilitate a sector-wide response to large-scale incidents."]
[219,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Planning and preparation. FMIs should develop and test response, resumption and recovery plans. These plans should support objectives to protect and, if necessary, re-establish integrity and availability of its operations, and the confidentiality of its information assets. Plans should be actively updated based on current cyber threat intelligence, information-sharing and lessons learned from previous events, as well as analysis of operationally and technically plausible scenarios that have not yet occurred. The FMI should consult and coordinate with relevant internal and external stakeholders during the establishment of its response, resumption and recovery plans."]
[220,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Learning and evolving","Ongoing learning","Lessons from cyber events. An FMI should systematically identify and distil key lessons from cyber events that have occurred within and outside the organisation in order to advance its resilience capabilities. Useful learning points can often be gleaned from successful cyber intrusions and near misses in terms of the methods used and vulnerabilities exploited by cyber attackers."]
[221,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Planning and preparation. FMIs should develop and test response, resumption and recovery plans. These plans should support objectives to protect and, if necessary, re-establish integrity and availability of its operations, and the confidentiality of its information assets. Plans should be actively updated based on current cyber threat intelligence, information-sharing and lessons learned from previous events, as well as analysis of operationally and technically plausible scenarios that have not yet occurred. The FMI should consult and coordinate with relevant internal and external stakeholders during the establishment of its response, resumption and recovery plans."]
[222,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Learning and evolving","Ongoing learning","Acquiring new knowledge and capabilities. An FMI should actively monitor technological developments and keep abreast of new cyber risk management processes that can effectively counter existing and newly developed forms of cyber attack. An FMI should consider acquiring such technology and know-how to maintain its cyber resilience."]
[223,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Incident response planning. Upon detection of a successful cyber attack or an attack attempt, FMIs should perform a thorough investigation to determine its nature and extent as well as the damage inflicted. While the investigation is ongoing, FMIs should also take immediate actions to contain the situation to prevent further damage and commence recovery efforts to restore operations based on their response planning."]
[224,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Incident response planning. Upon detection of a successful cyber attack or an attack attempt, FMIs should perform a thorough investigation to determine its nature and extent as well as the damage inflicted. While the investigation is ongoing, FMIs should also take immediate actions to contain the situation to prevent further damage and commence recovery efforts to restore operations based on their response planning."]
[225,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","an FMI should, design and test its systems and processes to enable the safe resumption of critical operations within two hours of a disruption and to enable itself to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios."]
[226,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Contingency planning. While FMIs should plan to safely resume critical operations within two hours of a disruption, they should also plan for scenarios in which this objective is not achieved. FMIs should analyse critical functions, transactions and interdependencies to prioritise resumption and recovery actions, which may, depending on the design of the FMI, facilitate the processing of critical transactions, for example, while remediation efforts continue. FMIs should also plan for situations where critical people, processes or systems may be unavailable for significant periods – for example, by potentially reverting, where feasible, safe and practicable, to manual processing if automated systems are unavailable."]
[227,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Contagion. Because an FMI’s systems and processes are often interconnected with the systems and processes of other entities within its ecosystem, in the event of a large-scale cyber incident it is possible for an FMI to pose contagion risk (ie, propagation of malware or corrupted data) to, or be exposed to contagion risk from, its ecosystem. An FMI should work together with its interconnected entities to enable the resumption of operations (the first priority being its critical services) as soon as it is safe and practicable to do so without causing unnecessary risk to the wider sector or further detriment to financial stability."]
[228,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Crisis communication. FMIs should plan in advance for communications with participants, interdependent FMIs, authorities and others (such as service providers and, where relevant, the media). Communication plans should be developed through an adaptive process informed by scenario-based planning and analysis as well as prior experience. Because rapid escalation of cyber incidents may be necessary, FMIs should determine decision-making responsibilities for incident response in advance, and implement clearly defined escalation and decision-making procedures. FMIs should inform relevant oversight and regulatory authorities promptly of potentially material or systemic events."]
[229,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Crisis communication. FMIs should plan in advance for communications with participants, interdependent FMIs, authorities and others (such as service providers and, where relevant, the media). Communication plans should be developed through an adaptive process informed by scenario-based planning and analysis as well as prior experience. Because rapid escalation of cyber incidents may be necessary, FMIs should determine decision-making responsibilities for incident response in advance, and implement clearly defined escalation and decision-making procedures. FMIs should inform relevant oversight and regulatory authorities promptly of potentially material or systemic events."]
[230,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Learning and evolving","Ongoing learning","Lessons from cyber events. An FMI should systematically identify and distil key lessons from cyber events that have occurred within and outside the organisation in order to advance its resilience capabilities. Useful learning points can often be gleaned from successful cyber intrusions and near misses in terms of the methods used and vulnerabilities exploited by cyber attackers."]
[231,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","Planning and preparation. FMIs should develop and test response, resumption and recovery plans. These plans should support objectives to protect and, if necessary, re-establish integrity and availability of its operations, and the confidentiality of its information assets. Plans should be actively updated based on current cyber threat intelligence, information-sharing and lessons learned from previous events, as well as analysis of operationally and technically plausible scenarios that have not yet occurred. The FMI should consult and coordinate with relevant internal and external stakeholders during the establishment of its response, resumption and recovery plans."]
[232,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Learning and evolving","Ongoing learning","Acquiring new knowledge and capabilities. An FMI should actively monitor technological developments and keep abreast of new cyber risk management processes that can effectively counter existing and newly developed forms of cyber attack. An FMI should consider acquiring such technology and know-how to maintain its cyber resilience."]
[233,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Contagion. Because an FMI’s systems and processes are often interconnected with the systems and processes of other entities within its ecosystem, in the event of a large-scale cyber incident it is possible for an FMI to pose contagion risk (ie, propagation of malware or corrupted data) to, or be exposed to contagion risk from, its ecosystem. An FMI should work together with its interconnected entities to enable the resumption of operations (the first priority being its critical services) as soon as it is safe and practicable to do so without causing unnecessary risk to the wider sector or further detriment to financial stability."]
[234,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Continuous monitoring. An FMI should establish capabilities to continuously monitor (in real time or near real time) and detect anomalous activities and events. One practice that may help to accomplish this is to set up what is commonly referred to as a “security operations centre”. These capabilities should be adaptively maintained and tested."]
[235,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Incident response. An FMI’s monitoring and detection capabilities should facilitate its incident response process and support information collection for the forensic investigation process."]
[236,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Incident response, resumption and recovery","an FMI should, design and test its systems and processes to enable the safe resumption of critical operations within two hours of a disruption and to enable itself to complete settlement by the end of the day of the disruption, even in the case of extreme but plausible scenarios."]
[237,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Methodologies and practices. FMIs should employ a variety of effective testing methodologies and practices, including the following (which may partly overlap or be combined):\n(C) Penetration tests. FMIs should carry out penetration tests to identify vulnerabilities that may affect their systems, networks, people or processes. To provide an in-depth evaluation of the security of FMIs’ systems, those tests should simulate actual attacks on the systems. Penetration tests on internet-facing systems should be conducted regularly and whenever systems are updated or deployed. Where applicable, the tests could include other internal and external stakeholders, such as those involved in business continuity, incident and crisis response teams, as well as third parties, such as service providers and participants"]
[238,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Testing","Comprehensive testing programme","Methodologies and practices. FMIs should employ a variety of effective testing methodologies and practices, including the following (which may partly overlap or be combined):\n(D) Red team tests. FMIs should challenge their own organisations and ecosystems through the use of so-called red teams to introduce an adversary perspective in a controlled setting. Red teams serve to test for possible vulnerabilities and the effectiveness of an FMI’s mitigating controls. A red team may consist of an FMI’s own employees and/or outside experts, who are in either case independent of the function being tested."]
[239,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Learning and evolving","Ongoing learning","Predictive capacity. FMIs’ cyber risk management practices should go beyond reactive controls and include proactive protection against future cyber events. Predictive capabilities and anticipation of future cyber events are based on analysing activity that deviates from the baseline. FMIs should work towards achieving predictive capabilities, capturing data from multiple internal and external sources, and defining a baseline for behavioural and system activity."]
[240,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Learning and evolving","Cyber resilience benchmarking","Metrics. Metrics and maturity models allow an FMI to assess its cyber resilience maturity against a set of predefined criteria, typically its operational reliability objectives. This benchmarking requires an FMI to analyse and correlate findings from audits, management reviews, incidents, near misses, tests and exercises as well as external and internal intelligence gathered."]
[241,"N.A - External Dependency Management","N.A - External Dependency Management","N.A - External Dependency Management","N.A - External Dependency Management","N.A - External Dependency Management",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Interconnections","Data-sharing agreements. In the event of a successful cyber attack that compromises the integrity of an FMI’s data, a successful recovery may require obtaining uncorrupted data from third parties and/or participants. FMIs should consider setting up data-sharing agreements with relevant third parties or participants in advance in order to enable such uncorrupted data to be received in a timely manner once a successful cyber attack has been identified."]
[242,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Governance","Cyber resilience framework","International and national standards. There are many relevant international, national and industry-level standards, guidelines or recommendations that an FMI could use as a benchmark in designing its cyber resilience framework. Given FMIs’ systemic importance, they should align themselves with leading standards, guidelines or recommendations, reflecting current industry best approaches in managing cyber threats, and incorporate the most effective cyber resilience solutions.","GV.SF-2"]
[243,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Identification","Identification and classification","Regular review and update. An FMI should integrate identification efforts with other relevant processes, such as acquisition and change management, in order to facilitate a regular review of its list of critical business processes, functions, individual and system credentials and its inventory of information assets so that that they remain current, accurate and complete.","GV.SP-2"]
[244,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Response & Recovery","Design elements","Data integrity. FMIs should have plans to identify, in a timely manner, the status of all transactions and member positions at the time of a disruption, supported by corresponding recovery point objectives. Therefore, FMIs should design and test their systems and processes to enable recovery of accurate data following a breach. Data instances should be safeguarded by stringent protective and detective controls. In addition, the FMI’s cyber resilience framework should include data recovery measures, such as keeping a copy of all received and processed data (including the original intent of instructions being sent to the FMI for processing), maintaining transaction replay capability and conducting frequent periodic independent reconciliation of participants’ positions. Recovery point objectives to support data integrity efforts should be consistent with the FMI’s resumption time objective for critical operations. FMI’s should consider diverse approaches to achieving these objectives."]
[245,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","An inventory of organizational assets (e.g., hardware, software, data, and systems hosted externally) is maintained. (FFIEC Information Security Booklet, page 9)"]
[246,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management assigns accountability for maintaining an inventory of organizational assets. (FFIEC Information Security Booklet, page 9)"]
[247,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management is responsible for ensuring compliance with legal and regulatory requirements related to cybersecurity.","GF.SV-1"]
[248,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","An inventory of organizational assets (e.g., hardware, software, data, and systems hosted externally) is maintained."]
[249,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","A validated asset inventory is used to create comprehensive diagrams depicting data repositories, data flow, infrastructure, and connectivity."]
[250,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Critical business processes have been mapped to the supporting external connections."]
[251,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Data flow diagrams are in place and document information flow to external parties. (FFIEC Information Security Booklet, page 10)"]
[252,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Diagram(s) of external connections is interactive, shows real-time changes to the network connection infrastructure, new connections, and volume fluctuations, and alerts when risks arise."]
[253,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Network and systems diagrams are stored in a secure manner with proper restrictions on access."]
[254,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","The network diagram is updated when connections with third parties change or at least annually."]
[255,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-4","External information systems are catalogued",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Security of equipment and assets off-premises"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A list of third-party service providers is maintained. (FFIEC Outsourcing Booklet, page 19)"]
[256,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-4","External information systems are catalogued",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Security of equipment and assets off-premises"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","A network diagram is in place and identifies all external connections. (FFIEC Information Security Booklet, page 9)"]
[257,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Cybersecurity tools and staff are requested through the budget process."]
[258,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Institutional  assets (e.g., hardware, systems, data, and applications) are prioritized for protection based on the data classification and business value. (FFIEC Information Security Booklet, page 12)"]
[259,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The budgeting process includes information security related expenses and tools. (FFIEC E-Banking Booklet, page 20)"]
[260,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk assessment identifies internet-based systems and high-risk transactions that warrant additional authentication controls. (FFIEC Information Security Booklet, page 12)"]
[261,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","The institution is investing in the development of new threat intelligence and collaboration mechanisms (e.g., technologies, business processes) that will transform how information is gathered and shared."]
[262,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Automated controls are put in place based on risk scores to infrastructure assets, including automatically disconnecting affected assets."]
[263,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Domain Name System Security Extensions (DNSSEC) is deployed across the enterprise."]
[264,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The institution risk scores all of its infrastructure assets and updates in real time based on threats, vulnerabilities, or operational changes."]
[265,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","Information security roles and responsibilities have been identified.\n(FFIEC Information Security Booklet, page 7)"]
[266,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Management holds employees accountable for complying with the information security program. (FFIEC Information Security Booklet, page\n7)"]
[267,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or an appropriate board committee has cybersecurity expertise or engages experts to assist with oversight responsibilities.\n"]
[268,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The response team includes individuals with a wide range of backgrounds and expertise, from many different areas within the institution (e.g., management, legal, public relations, as well as information technology). (FFIEC Information Security Booklet, page 84)"]
[269,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-1","The organization’s role in the supply chain is identified and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.3\nA.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","A formal process is used to identify cybersecurity tools and expertise that may be needed."]
[270,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-1","The organization’s role in the supply chain is identified and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.3\nA.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The cybersecurity strategy identifies and communicates the institution’s role as a component of critical infrastructure in the financial services industry.","DM.BE-1"]
[271,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Independent audit or review evaluates policies, procedures, and controls across the institution for significant risks and control issues associated with the institution's operations, including risks in new products, emerging technologies, and information systems. (FFIEC Audit Booklet, page 4)","GV.AU-1"]
[272,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The cybersecurity strategy identifies and communicates the institution’s\nrole as it relates to other critical infrastructures.","DM.BE-1"]
[273,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function validates controls related to the storage or transmission of confidential data. (FFIEC Audit Booklet, page 1)","GV.AU-1"]
[274,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function validates that the institution’s cybersecurity controls function is commensurate with the institution’s risk and complexity.","GV.AU-1"]
[275,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function validates that the institution’s incident response program and resilience are commensurate with the institution’s risk and complexity.","GV.AU-1"]
[276,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function validates that the institution’s third-party relationship management is commensurate with the institution’s risk and complexity.","GV.AU-1"]
[277,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function validates that the institution’s threat information sharing is commensurate with the institution’s risk and complexity.","GV.AU-1"]
[278,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function validates that the institution’s threat intelligence and collaboration are commensurate with the institution’s risk and complexity.","GV.AU-1"]
[279,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function validates that the risk management\nfunction is commensurate with the institution’s risk and complexity.","GV.AU-1"]
[280,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","A risk-based, independent information assurance function evaluates the security of internal applications.","GV.AU-1, GV.AU-2"]
[281,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across the sector.","GV.AU-2"]
[282,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","A formal process is in place for the independent audit function to update\nits procedures based on changes to the institution’s inherent risk profile.","GV.AU-2"]
[283,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Independent audits or reviews are used to identify cybersecurity weaknesses, root causes, and the potential impact to business units.","GV.AU-3"]
[284,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Independent audits or reviews are used to identify gaps in existing security capabilities and expertise.","GV.AU-3"]
[285,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Issues and corrective actions from internal audits and independent testing/assessments are formally tracked to ensure procedures and control lapses are resolved in a timely manner. (FFIEC Information Security Booklet, page 6)","GV.AU-3"]
[286,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Cyber risk reporting is presented and discussed at the independent risk management meetings.","GV.IR-1"]
[287,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","All medium and high risk issues identified in penetration testing, vulnerability scanning, and other independent testing are escalated to the board or an appropriate board committee for risk acceptance if not resolved in a timely manner.","GV.IR-1"]
[288,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","The institution validates the effectiveness of training (e.g., social engineering or phishing tests)."]
[289,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","The board or an appropriate board committee reviews a summary of due diligence results including management’s recommendations to use third parties that will affect the institution’s inherent risk profile."]
[290,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","The critical business processes that are dependent on external connectivity have been identified. (FFIEC Information Security Booklet, page 9)"]
[291,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Organizational assets (e.g., hardware, systems, data, and applications) are prioritized for protection based on the data classification and business value."]
[292,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management considers the risks posed by other critical infrastructures (e.g., telecommunications, energy) to the institution. (FFIEC Business Continuity Planning Booklet, page J-12)","DM.BE-1"]
[293,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","The institution is developing technologies that will remediate systems damaged by zero-day attacks to maintain current recovery time objectives."]
[294,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A formal backup and recovery plan exists for all critical business lines. (FFIEC Business Continuity Planning Booklet, page 4)"]
[295,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Alternative processes have been established to continue critical activity within a reasonable time period."]
[296,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Multiple systems, programs, or processes are implemented into a comprehensive cyber resilience program to sustain, minimize, and recover operations from an array of potentially disruptive and destructive cyber incidents.","DM.RS-1"]
[297,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Independent risk management sets and monitors cyber-related risk limits for business units.","GV.IR-1"]
[298,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has a comprehensive set of policies commensurate with its risk and complexity that address the concepts of threat intelligence.","GV.PL-1"]
[299,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has board-approved policies commensurate with its risk and complexity that address information security. (FFIEC Information Security Booklet, page 16)","GV.PL-1"]
[300,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","The institution has formal standards of conduct that hold all employees accountable for complying with cybersecurity policies and procedures.","GV.PL-1"]
[301,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has policies commensurate with its risk and complexity that address the concepts of incident response and resilience. (FFIEC Information Security Booklet, page 83)","GV.PL-1"]
[302,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","A formal process is in place to cross-reference and simultaneously update all policies related to cyber risks across business lines.","GV.PL-2"]
[303,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Management monitors moderate and high residual risk issues from the cybersecurity risk assessment until items are addressed.","GV.RM-1"]
[304,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","Processes are in place to identify additional expertise needed to improve information security defenses. (FFIEC Information Security Work Program, Objective I: 2-8)"]
[305,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Contracts acknowledge that the third party is responsible for the security of the institution’s confidential data that it possesses, stores, processes, or transmits. (FFIEC Information Security Booklet, page 12)","DM.ED-6"]
[306,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Contracts establish responsibilities for responding to security incidents. (FFIEC E-Banking Booklet, page 22)","DM.ED-6"]
[307,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk management program incorporates cyber risk identification, measurement, mitigation, monitoring, and reporting.","GV.RM-1"]
[308,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","Contact information for law enforcement and the regulator(s) is maintained and updated regularly. (FFIEC Business Continuity Planning Work Program, Objective I: 5-1)"]
[309,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","A formal process is in place for the independent audit function to update its procedures based on changes to the evolving threat landscape across other sectors the institution depends upon.","DM.BE-1"]
[310,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Cyber risks that exceed the risk appetite are escalated to management. ","GV.RM-1"]
[311,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk assessment is updated in real time as changes to the risk profile occur, new applicable standards are released or updated, and new exposures are anticipated.","GV.RM-1"]
[312,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk assessment is updated to address new technologies, products, services, and connections before deployment. (FFIEC Information Security Booklet, page 13)","GV.RM-1"]
[313,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk management function identifies and analyzes commonalities in cyber events that occur both at the institution and across other sectors to enable more predictive risk management.","GV.RM-1"]
[314,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A system automatically informs management of the level of business risk specific to the institution and the progress of recommended steps taken to mitigate the risks.","GV.RM-1"]
[315,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The cybersecurity strategy is incorporated into, or conceptually fits within, the institution’s enterprise-wide risk management strategy. ","GV.RM-4"]
[316,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","The risk culture requires formal consideration of cyber risks in all business decisions.","GV.RM-4"]
[317,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Independent risk management staff escalates to management and the board or an appropriate board committee significant discrepancies from business unit’s assessments of cyber-related risk.","GV.RM-4, GV.AU-5"]
[318,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","Management with appropriate knowledge and experience leads the institution's cybersecurity efforts.","GV.RR-2"]
[319,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Information security risks are discussed in management meetings when prompted by highly visible cyber events or regulatory alerts. (FFIEC Information Security Booklet, page 6)","GV.RR-2"]
[320,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The cybersecurity function has a clear reporting line that does not present a conflict of interest.","GV.RR-2, GV.AU-5"]
[321,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Management ensures performance plans are tied to compliance with cybersecurity policies and standards in order to hold employees accountable.","GV.SF-1"]
[322,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Logging practices are independently reviewed periodically to ensure appropriate log management (e.g., access controls, retention, and maintenance). (FFIEC Operations Booklet, page 29)"]
[323,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management links strategic cybersecurity objectives to tactical goals.","GV.SF-1"]
[324,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The cybersecurity strategy outlines the institution’s future state of cybersecurity with short-term and long-term perspectives.","GV.SF-1"]
[325,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","All elements of the information security program are coordinated enterprise-wide. (FFIEC Information Security Booklet, page 7)","GV.SF-1"]
[326,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management and the board or an appropriate board committee hold business units accountable for effectively managing all cyber risks associated with their activities.","GV.SF-1"]
[327,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Designated members of management are held accountable by the board or an appropriate board committee for implementing and managing the information security and business continuity programs. (FFIEC Information Security Booklet, page 3)","GV.SF-1"]
[328,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution augmented its information security strategy to incorporate cybersecurity and resilience.","GV.SF-1"]
[329,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has an information security strategy that integrates technology, policies, procedures, and training to mitigate risk. (FFIEC Information Security Booklet, page 3)\n","GV.SF-1"]
[330,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","An information security and business continuity risk management function(s) exists within the institution. (FFIEC Information Security Booklet, page 68)","GV.SF-1, DM.RS-1"]
[331,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Industry-recognized cybersecurity standards are used as sources during the analysis of cybersecurity program gaps.","GV.SF-2"]
[332,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk assessment is adjusted to consider widely known risks or risk management practices.","GV.SF-2"]
[333,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management provides a written report on the overall status of the information security and business continuity programs to the board or an appropriate board committee at least annually. (FFIEC Information Security Booklet, page 5)","GV.SF-2, GV.RR-2"]
[334,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management is continuously improving the existing cybersecurity program to adapt as the desired cybersecurity target state changes.","GV.SF-3"]
[335,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management periodically reviews the cybersecurity strategy to address evolving cyber threats and changes to the institution’s inherent risk profile.","GV.SF-3"]
[336,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or an appropriate board committee ensures management takes appropriate actions to address changing cyber risks or significant cybersecurity issues.","GV.SF-3"]
[337,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or an appropriate board committee ensures management’s annual cybersecurity self-assessment evaluates the institution’s ability to meet its cyber risk management standards.","GV.SF-3"]
[338,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or an appropriate board committee reviews and approves management’s prioritization and resource allocation decisions based on the results of the cyber assessments.","GV.SF-3"]
[339,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The budget process for requesting additional cybersecurity staff and tools is integrated into business units’ budget processes.","GV.SF-3"]
[340,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The budget process for requesting additional cybersecurity staff and tools maps current resources and tools to the cybersecurity strategy.","GV.SF-3"]
[341,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","At least annually, the board or an appropriate board committee reviews and approves the institution’s cybersecurity program.","GV.SF-3"]
[342,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has a cyber risk appetite statement approved by the board or an appropriate board committee.","GV.SF-3"]
[343,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","There is a process to analyze and assign potential losses and related expenses, by cost center, associated with cybersecurity incidents.","GV.SF-3"]
[344,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","There is a process to formally discuss and estimate potential expenses associated with cybersecurity incidents as part of the budgeting process.","GV.SF-3"]
[345,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or board committee approved cyber risk appetite statement is part of the enterprise-wide risk appetite statement.","GV.SF-3"]
[346,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Security processes and technology are centralized and coordinated in a Security Operations Center (SOC) or equivalent."]
[347,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or an appropriate board committee verifies that management’s actions consider the cyber risks that the institution poses to other critical infrastructures (e.g., telecommunications, energy).","GV.SF-3, DM.RS-3"]
[348,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Cyber risks are actively discussed at business unit meetings. ","GV.SP-1"]
[349,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A continuous process improvement program is in place for third-party due diligence activity.","DM.ED-7"]
[350,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A formal process exists to analyze assessments of third-party cybersecurity controls.","DM.ED-7"]
[351,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A formal program assigns responsibility for ongoing oversight of third- party access.","DM.ED-6"]
[352,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A process is in place to confirm that the institution’s third-party service providers conduct due diligence of their third parties (e.g., subcontractors).","DM.ED-7"]
[353,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A process to identify new third-party relationships is in place, including identifying new relationships that were established without formal approval.","DM.ED-2"]
[354,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A risk assessment is conducted to identify criticality of service providers. (FFIEC Outsourcing Booklet, page 6)","DM.ED-4"]
[355,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","A third-party termination/exit strategy has been established and validated with management."]
[356,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Audits of high-risk vendors are conducted on an annual basis.","DM.ED-4"]
[357,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Audits, assessments, and operational performance reports are obtained and reviewed regularly validating security controls for critical third parties. (FFIEC Information Security Booklet, page 86)","DM.ED-4"]
[358,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Contracts identify the recourse available to the institution should the third party fail to meet defined security requirements. (FFIEC Outsourcing Booklet, page 12)","DM.ED-6"]
[359,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Contracts require third-party service provider’s security policies meet or\nexceed those of the institution.","DM.ED-6"]
[360,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Contracts specify the security requirements for the return or destruction of data upon contract termination. (FFIEC Outsourcing Booklet, page 15)","DM.ED-6"]
[361,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Contracts stipulate geographic limits on where data can be stored or transmitted.","DM.ED-6"]
[362,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Contracts stipulate that the third-party security controls are regularly reviewed and validated by an independent party. (FFIEC Information Security Booklet, page 12)","DM.ED-2, DM.ED-7"]
[363,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Periodic on-site assessments of high-risk vendors are conducted to ensure appropriate security controls are in place."]
[364,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Pre-contract, physical site visits of high-risk vendors are conducted by the institution or by a qualified third party."]
[365,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Responsibilities for managing devices (e.g., firewalls, routers) that secure connections with third parties are formally documented in the contract."]
[366,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Responsibility for notification of direct and indirect security incidents and vulnerabilities is documented in contracts or service-level agreements (SLAs)."]
[367,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Risk-based due diligence is performed on prospective third parties before contracts are signed, including reviews of their background, reputation, financial condition, stability, and security controls. (FFIEC Information Security Booklet, page 69)"]
[368,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","The institution is leading efforts to develop new auditable processes and for conducting due diligence and ongoing monitoring of cybersecurity risks posed by third parties."]
[369,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","The institution promotes sector-wide efforts to build due diligence mechanisms that lead to in-depth and efficient security and resilience reviews."]
[370,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","The third-party risk assessment is updated regularly. (FFIEC Outsourcing Booklet, page 3)"]
[371,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Third-party SLAs or similar means are in place that require timely notification of security events."]
[372,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A direct cooperative or contractual agreement(s) is in place with an incident response organization(s) or provider(s) to assist rapidly with mitigation efforts."]
[373,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The institution’s risk management of significant cyber incidents results in limited to no disruptions to critical services."]
[374,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The focus of the risk assessment has expanded beyond customer information to address all information assets."]
[375,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","Threat information is used to monitor threats and vulnerabilities. (FFIEC Information Security Booklet, page 83)"]
[376,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Independent testing (including penetration testing and vulnerability scanning) is conducted according to the risk assessment for external- facing systems and the internal network. (FFIEC Information Security Booklet, page 61)"]
[377,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The institution proactively seeks to identify control gaps that may be used as part of a zero-day attack."]
[378,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Vulnerability scanning is conducted and analyzed before deployment/redeployment of new/existing devices."]
[379,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Weekly vulnerability scanning is rotated among environments to scan all environments throughout the year."]
[380,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","A formal threat intelligence program is implemented and includes subscription to threat feeds from external providers and internal sources."]
[381,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","A threat intelligence team is in place that evaluates threat intelligence from multiple sources for credibility, relevance, and exposure."]
[382,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Formal processes have been defined to resolve potential conflicts in information received from sharing and analysis centers or other sources."]
[383,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","The institution belongs or subscribes to a threat and vulnerability information sharing source(s) that provides information on threats (e.g., Financial Services Information Sharing and Analysis Center [FS-ISAC], U.S. Computer Emergency Readiness Team [US-CERT]). (FFIEC E- Banking Work Program, page 28)"]
[384,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","A cyber intelligence model is used for gathering threat information."]
[385,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","A dedicated cyber threat identification and analysis committee or team exists to centralize and coordinate initiatives and communications."]
[386,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","A process is implemented to monitor threat information to discover emerging threats."]
[387,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","A profile is created for each threat that identifies the likely intent, capability, and target of the threat."]
[388,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","A read-only, central repository of cyber threat intelligence is maintained."]
[389,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","IT systems automatically detect configuration weaknesses based on threat intelligence and alert management so actions can be prioritized."]
[390,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Monitoring systems operate continuously with adequate support for efficient incident handling."]
[391,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","The institution’s threat intelligence includes information related to geopolitical events that could increase cybersecurity threat levels."]
[392,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Threat information sources that address all components of the threat profile are prioritized and monitored."]
[393,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Threat intelligence is analyzed to develop cyber threat summaries including risks to the institution and specific actions for the institution to consider."]
[394,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","Threat intelligence is automatically received from multiple sources in real time."]
[395,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","An automated tool triggers system and/or fraud alerts when customer logins occur within a short period of time but from physically distant IP locations."]
[396,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Systems are in place to detect anomalous behavior automatically during customer, employee, and third-party authentication."]
[397,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","The institution is able to detect anomalous activities through monitoring across the environment. (FFIEC Information Security Booklet, page 32)"]
[398,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk management program specifically addresses cyber risks beyond the boundaries of the technological impacts (e.g., financial, strategic, regulatory, compliance)."]
[399,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Appropriate steps are taken to contain and control an incident to prevent further unauthorized access to or use of customer information"]
[400,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Criteria have been established for escalating cyber incidents or vulnerabilities to the board and senior management based on the potential impact and criticality of the risk."]
[401,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","A risk assessment focused on safeguarding customer information identifies reasonable and foreseeable internal and external threats, the likelihood and potential damage of threats, and the sufficiency of policies, procedures, and customer information systems. (FFIEC Information Security Booklet, page 8)"]
[402,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","An enterprise-wide risk management function incorporates cyber threat analysis and specific risk exposure as part of the enterprise risk assessment."]
[403,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Risk assessments are used to identify the cybersecurity risks stemming from new products, services, or relationships."]
[404,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Highest risk scenarios are used to predict threats against specific business targets."]
[405,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","Management communicates threat intelligence with business risk context and specific risk management recommendations to the business units."]
[406,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","The institution uses multiple sources of intelligence, correlated log analysis, alerts, internal traffic flows, and geopolitical events to predict potential future attacks and attack trends."]
[407,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","Threat information is used to enhance internal risk management and controls. (FFIEC Information Security Booklet, page 4)"]
[408,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","Threat information received by the institution includes analysis of tactics, patterns, and risk mitigation recommendations."]
[409,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The focus of the risk assessment has expanded beyond customer information to address all information assets."]
[410,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Threat intelligence is viewed within the context of the institution's risk profile and risk appetite to prioritize mitigating actions in anticipation of threats."]
[411,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Tracked cyber incidents are correlated for trend analysis and reporting."]
[412,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The incident response plan is designed to prioritize incidents, enabling a rapid response for significant cybersecurity incidents or vulnerabilities."]
[413,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution has documented how it will react and respond to cyber incidents. (FFIEC Business Continuity Planning Booklet, page 4)"]
[414,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The remediation plan and process outlines the mitigating actions, resources, and time parameters."]
[415,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has policies commensurate with its risk and complexity that address the concepts of information technology risk management. (FFIEC Information Security Booklet, page, 16)","GV.SP-1"]
[416,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has a formal cybersecurity program that is based on technology and security industry standards or benchmarks.","GV.SP-1, GV.SF-2"]
[417,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Management uses the results of independent audits and reviews to improve cybersecurity.","GV.SP-2"]
[418,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function uses sophisticated data mining tools to perform continuous monitoring of cybersecurity processes or controls.","GV.SP-2"]
[419,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Benchmarks or target performance metrics have been established for showing improvements or regressions of the security posture over time.","GV.SP-2"]
[420,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The institution uses information from risk assessments to predict threats and drive real-time responses."]
[421,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Cybersecurity metrics are used to facilitate strategic decision-making and funding in areas of need.","GV.SP-2, GV.SF-3"]
[422,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The risk assessment considers the risk of using EOL software and hardware components.","GV.TE-1"]
[423,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function regularly reviews management’s cyber risk appetite statement.","GV-AU.3"]
[424,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Designated members of management are held accountable by the board or an appropriate board committee for implementing and managing the information security and business continuity programs."]
[425,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The independent audit function regularly reviews the institution’s cyber risk appetite statement in comparison to assessment results and incorporates gaps into the audit strategy.","GV-AU.3"]
[426,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Multifactor authentication (e.g., tokens, digital certificates) techniques are used for employee access to high-risk systems as identified in the risk assessment(s). (*N/A if no high risk systems.)"]
[427,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","All interdependencies between applications and services have been identified.","ID.RA"]
[428,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has a cyber risk appetite statement approved by the board or an appropriate board committee."]
[429,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The risk appetite is informed by the institution’s role in critical infrastructure."]
[430,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Supply chain risk is reviewed before the acquisition of mission-critical information systems including system components."]
[431,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Processes are in place to trigger the incident response program when an incident occurs at a third party."]
[432,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Access to make changes to systems configurations (including virtual machines and hypervisors) is controlled and monitored. (FFIEC Information Security Booklet, page 56)"]
[433,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Identification and authentication are required and managed for access to systems, applications, and hardware. (FFIEC Information Security Booklet, page 21)"]
[434,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Real-time risk mitigation is taken based on automated risk scoring of user credentials."]
[435,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The institution is leading efforts to create new technologies and processes for managing customer, employee, and third-party authentication and access."]
[436,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Administrative, physical, or technical controls are in place to prevent users without administrative responsibilities from installing unauthorized software. (FFIEC Information Security Booklet, page 25)"]
[437,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Physical security controls are used to prevent unauthorized access to information systems and telecommunication systems. (FFIEC Information Security Booklet, page 47)"]
[438,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication. (FFIEC Information Security Booklet, page 45)"]
[439,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Security controls are used for remote access to all administrative consoles, including restricted virtual systems."]
[440,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The institution wipes data remotely on mobile devices when a device is missing or stolen. (*N/A if mobile devices are not used.)"]
[441,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Access controls are in place for database administrators to prevent unauthorized downloading or transmission of confidential data."]
[442,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Administrators have two accounts: one for administrative use and one for general purpose, non-administrative tasks."]
[443,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Changes to physical and logical user access, including those that result from voluntary and involuntary terminations, are submitted to and approved by appropriate personnel. (FFIEC Information Security Booklet, page 18)"]
[444,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Controls are in place to prevent unauthorized access to collaborative computing devices and applications (e.g., networked white boards, cameras, microphones, online applications such as instant messaging and document sharing). (* N/A if collaborative computing devices are not used.)"]
[445,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Customer access to Internet-based products or services requires authentication controls (e.g., layered controls, multifactor) that are commensurate with the risk. (FFIEC Information Security Booklet, page 21)"]
[446,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Customer service (e.g., the call center) utilizes formal procedures to authenticate customers commensurate with the risk of the transaction or request. (FFIEC Information Security Booklet, page 19)"]
[447,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Elevated privileges are monitored. (FFIEC Information Security Booklet, page 19)"]
[448,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Employee access is granted to systems and confidential data based on job responsibilities and the principles of least privilege. (FFIEC Information Security Booklet, page 19)"]
[449,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Employee access to systems and confidential data provides for separation of duties. (FFIEC Information Security Booklet, page 19)"]
[450,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Multifactor authentication and/or layered controls have been implemented to secure all third-party access to the institution's network and/or systems and applications."]
[451,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Programs that can override system, object, network, virtual machine, and application controls are restricted. (FFIEC Information Security Booklet, page 41)"]
[452,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Guest wireless networks are fully segregated from the internal network(s). (*N/A if there are no wireless networks.)"]
[453,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Network environments and virtual instances are designed and configured to restrict and monitor traffic between trusted and untrusted zones."]
[454,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Network perimeter defense tools (e.g., border router and firewall) are used. (FFIEC Information Security Booklet, page 33)"]
[455,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Only one primary function is permitted per server to prevent functions that require different security levels from co-existing on the same server."]
[456,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Systems that are accessed from the Internet or by external parties are protected by firewalls or other similar devices. (FFIEC Information Security Booklet, page 46)"]
[457,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The broadcast range of the wireless network(s) is confined to institution- controlled boundaries. (*N/A if there are no wireless networks.)"]
[458,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The enterprise network is segmented in multiple, separate trust/security zones with defense-in-depth strategies (e.g., logical network segmentation, hard backups, air-gapping) to mitigate attacks."]
[459,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","There is a firewall at each Internet connection and between any\nDemilitarized Zone (DMZ) and internal network(s)."]
[460,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Wireless network environments have perimeter firewalls that are implemented and configured to restrict unauthorized traffic. (*N/A if there are no wireless networks.)"]
[461,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","The institution's connections can be segmented or severed instantaneously to prevent contagion from cyber attacks."]
[462,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Access controls are in place for database administrators to prevent unauthorized downloading or transmission of confidential data."]
[463,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Employee access is granted to systems and confidential data based on job responsibilities and the principles of least privilege. (FFIEC Information Security Booklet, page 19)"]
[464,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Employee access to systems and confidential data provides for separation of duties. (FFIEC Information Security Booklet, page 19)"]
[465,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Annual information security training includes incident response, current cyber threats (e.g., phishing, spear phishing, social engineering, and mobile security), and emerging issues. (FFIEC Information Security Booklet, page 66)"]
[466,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Annual information security training is provided. (FFIEC Information\nSecurity Booklet, page 66)"]
[467,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Business units are provided cybersecurity training relevant to their particular business risks, over and above what is required of the institution as a whole."]
[468,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Business units are provided cybersecurity training relevant to their particular business risks."]
[469,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Employees have a clear understanding of how to identify and escalate potential cybersecurity issues."]
[470,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Key performance indicators are used to determine whether training and awareness programs positively influence behavior."]
[471,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Management ensures continuous improvement of cyber risk cultural awareness."]
[472,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Management incorporates lessons learned from social engineering and phishing exercises to improve the employee awareness programs."]
[473,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Situational awareness materials are made available to employees when prompted by highly visible cyber events or by regulatory alerts. (FFIEC Information Security Booklet, page 7)"]
[474,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","The institution has a program for continuing cybersecurity training and skill development for cybersecurity staff."]
[475,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A formal protocol is in place for sharing threat, vulnerability, and incident information to employees based on their specific job function."]
[476,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Employees with privileged account permissions receive additional cybersecurity training commensurate with their levels of responsibility."]
[477,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Customer awareness materials are readily available (e.g., DHS’ Cybersecurity Awareness Month materials). (FFIEC E-Banking Work Program, Objective 6-3)"]
[478,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Cybersecurity awareness information is provided to retail customers and commercial clients at least annually."]
[479,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Independent directors are provided with cybersecurity training that addresses how complex products, services, and lines of business affect the institution's cyber risk."]
[480,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Management is provided cybersecurity training relevant to their job responsibilities."]
[481,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","Dedicated cybersecurity staff develops, or contributes to developing, integrated enterprise-level security and cyber defense strategies."]
[482,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","Staffs with cybersecurity responsibilities have the requisite qualifications to perform the necessary tasks of the position."]
[483,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","Employees with privileged account permissions receive additional cybersecurity training commensurate with their levels of responsibility"]
[484,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","All passwords are encrypted in storage and in transit. (FFIEC Information Security Booklet, page 21)"]
[485,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Confidential data is identified on the institution's network."]
[486,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","An automated tool(s) is in place to detect and prevent data mining by insider threats."]
[487,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Encryption of select data at rest is determined by the institution’s data classification and risk assessment."]
[488,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store confidential data. (*N/A if mobile devices are not used.) (FFIEC Information Security Booklet, page 51)"]
[489,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Tools to detect unauthorized data mining are used."]
[490,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Use of customer data in non-production environments complies with legal, regulatory, and internal policy requirements for concealing or removing of sensitive data elements."]
[491,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Formal contracts that address relevant security and privacy requirements are in place for all third parties that process, store, or transmit confidential data or provide critical services. (FFIEC Information Security Booklet, page 7)"]
[492,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Confidential data and applications on mobile devices are only accessible via a secure, isolated sandbox or a secure container."]
[493,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Confidential data are encrypted in transit across private connections (e.g., frame relay and T1) and within the institution’s trusted zones."]
[494,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Confidential data are encrypted when transmitted across public or untrusted networks (e.g., Internet). (FFIEC Information Security Booklet, page 51)"]
[495,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Controls are in place to prevent unauthorized access to cryptographic keys."]
[496,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Wireless networks use strong encryption with encryption keys that are changed frequently. (*N/A if there are no wireless networks.)"]
[497,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Automated tools enable tracking, updating, asset prioritizing, and custom reporting of the asset inventory."]
[498,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The asset inventory, including identification of critical assets, is updated at least annually to address new, relocated, re-purposed, and sunset assets."]
[499,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has a documented asset life-cycle process that considers whether assets to be acquired have appropriate security safeguards."]
[500,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution proactively manages system EOL (e.g., replacement) to limit security risks."]
[501,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","The institution benchmarks its cybersecurity staffing against peers to identify whether its recruitment, retention, and succession planning are commensurate."]
[502,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","The institution has a program for talent recruitment, retention, and succession planning for the cybersecurity and resilience staffs."]
[503,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","A risk-based solution is in place at the institution or Internet hosting provider to mitigate disruptive cyber attacks (e.g., DDoS attacks)."]
[504,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A formal backup and recovery plan exists for all critical business lines."]
[505,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution plans to use business continuity, disaster recovery, and data backup programs to recover operations following an incident."]
[506,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Alternative processes have been established to continue critical activity within a reasonable time period."]
[507,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Controls or tools (e.g., data loss prevention) are in place to detect potential unauthorized or unintentional transmissions of confidential data."]
[508,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Data loss prevention controls or devices are implemented for inbound and outbound communications (e.g., e-mail, FTP, Telnet, prevention of large file transfers)."]
[509,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Tags on fictitious confidential data or files are used to provide advanced alerts of potential malicious activity when the data is accessed."]
[510,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The institution has implemented tools to prevent unauthorized access to or exfiltration of confidential data."]
[511,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication."]
[512,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Mobile device management includes integrity scanning (e.g., jailbreak/rooted detection). (*N/A if mobile devices are not used.)"]
[513,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Software code executables and scripts are digitally signed to confirm the software author and guarantee that the code has not been altered or corrupted."]
[514,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Tokenization is used to substitute unique values for confidential information (e.g., virtual credit card)."]
[515,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Production and non-production environments are segregated to prevent unauthorized access or changes to information assets. (*N/A if no production environment exists at the institution or the institution’s third party.) (FFIEC Information Security Booklet, page 64)"]
[516,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Segregated or separate systems are in place that mirror production systems allowing for rapid testing and implementation of patches and provide for rapid fallback when needed."]
[517,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Comprehensive automated enterprise tools are implemented to detect and block unauthorized changes to software and hardware."]
[518,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Threat intelligence is used to update architecture and configuration standards."]
[519,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","All default passwords and unnecessary default accounts are changed before system implementation. (FFIEC Information Security Booklet, page 61)"]
[520,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Controls for unsupported systems are implemented and tested."]
[521,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Ports, functions, protocols and services are prohibited if no longer needed for business purposes. (FFIEC Information Security Booklet, page 50)"]
[522,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.AC-2","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","System sessions are locked after a pre-defined period of inactivity and are terminated after pre-defined conditions are met. (FFIEC Information Security Booklet, page 23)"]
[523,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Systems configurations (for servers, desktops, routers, etc.) follow industry standards and are enforced. (FFIEC Information Security Booklet, page 56)"]
[524,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","System performance reports contain information that can be used as a risk indicator to detect information security incidents. (FFIEC Information Security Booklet, page 86)"]
[525,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Cyber incident scenarios are used to stress test potential financial losses across the sector."]
[526,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Cybersecurity incident scenarios involving significant financial loss are used to stress test the institution's risk management."]
[527,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Incident response testing evaluates the institution from an attacker's perspective to determine how the institution or its assets at critical third parties may be targeted."]
[528,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Resilience testing is based on analysis and identification of realistic and highly likely threats as well as new and emerging threats facing the institution."]
[529,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Resilience testing is comprehensive and coordinated across all critical business functions."]
[530,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Scenarios are used to improve incident detection and response.\n(FFIEC Information Security Booklet, page 71)"]
[531,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Systems, applications, and data recovery is tested at least annually.  (FFIEC Business Continuity Planning Booklet, page J-7)"]
[532,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The critical online systems and processes are tested to withstand stresses for extended periods (e.g., DDoS)."]
[533,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution has validated that it is able to remediate systems damaged by zero-day attacks to maintain current recovery time objectives."]
[534,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution is leading the development of more realistic test environments."]
[535,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution tests the ability to shift business processes or functions between different processing centers or technology systems for cyber incidents without interruption to business or loss of productivity or data."]
[536,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution validates that it is able to recover from cyber events similar to by known sophisticated attacks at other organizations."]
[537,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","Employment candidates, contractors, and third parties are subject to background verification proportional to the confidentiality of the data accessed, business requirements, and acceptable risk."]
[538,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","All physical and logical access is removed immediately upon notification of involuntary termination and within 24 hours of an employee’s voluntary departure."]
[539,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","A centralized end-point management tool provides fully integrated patch, configuration, and vulnerability management, while also being able to detect malware upon arrival to prevent an exploit."]
[540,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","A formal process is in place to acquire, test, and deploy software patches based on criticality."]
[541,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","A patch management program is implemented and ensures that software and firmware patches are applied in a timely manner. (FFIEC Information Security Booklet, page 62)"]
[542,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","An automated tool(s) is used to identify missing security patches as well as the number of days since each patch became available."]
[543,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Antivirus and anti-malware tools are deployed on end-point devices (e.g., workstations, laptops, and mobile devices)."]
[544,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Antivirus and anti-malware tools are updated automatically."]
[545,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Audit or risk management resources review the penetration testing scope and results to help determine the need for rotating companies based on the quality of the work."]
[546,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Formal processes are in place to resolve weaknesses identified during penetration testing."]
[547,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Missing patches across all environments are prioritized and tracked."]
[548,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Operational impact is evaluated before deploying security patches."]
[549,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Patch management reports are reviewed and reflect missing security patches. (FFIEC Development and Acquisition Booklet, page 50)"]
[550,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Patch monitoring software is installed on all servers to identify any missing patches for the operating system software, middleware, database, and other key software."]
[551,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Patches are tested before being applied to systems and/or software.  (FFIEC Operations Booklet, page 22)"]
[552,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Patches for high-risk vulnerabilities are tested and applied when released or the risk is accepted and accountability assigned."]
[553,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Penetration testing is repeated to confirm that medium- and high-risk, exploitable vulnerabilities have been resolved."]
[554,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Systems are configured to retrieve patches automatically. "]
[555,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","The institution monitors patch management reports to ensure security patches are tested and implemented within aggressive time frames (e.g., 0-30 days)."]
[556,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Developers working for the institution follow secure program coding practices, as part of a system development life cycle (SDLC), that meet industry standards. (FFIEC Information Security Booklet, page 56)"]
[557,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Independent code reviews are completed on internally developed or vendor-provided custom applications to ensure there are no security gaps."]
[558,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Intellectual property and production code are held in escrow. (*N/A if there is no production code to hold in escrow.) (FFIEC Development and Acquisition Booklet, page 39)"]
[559,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Processes are in place to mitigate vulnerabilities identified as part of the secure development of systems and applications."]
[560,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Security testing occurs at all post-design phases of the SDLC for all applications, including mobile applications. (*N/A if there is no software development.)"]
[561,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Software code is actively scanned by automated tools in the development environment so that security weaknesses can be resolved immediately during the design phase."]
[562,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Technical measures are in place to prevent the execution of unauthorized code on institution owned or managed devices, network infrastructure, and systems components."]
[563,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","The institution develops security patches or bug fixes or contributes to open source code development for systems it uses."]
[564,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The security controls in internally developed software code are independently reviewed before migrating the code to production. (*N/A if there is no software development.) (FFIEC Development and Acquisition Booklet, page 2)"]
[565,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The security controls of internally developed software are periodically reviewed and tested. (*N/A if there is no software development.) (FFIEC Information Security Booklet, page 59)"]
[566,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The security of applications, including Web-based applications connected to the Internet, is tested against known types of cyber attacks (e.g., SQL injection, cross-site scripting, buffer overflow) before implementation or following significant changes."]
[567,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Vulnerabilities identified through a static code analysis are remediated before implementing newly developed or changed applications into production."]
[568,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","The security architecture is validated and documented before network connection infrastructure changes."]
[569,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","A change management process is in place to request and approve changes to systems configurations, hardware, software, applications, and security tools. (FFIEC Information Security Booklet, page 56)"]
[570,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","A formal change management function governs decentralized or highly distributed change requests and identifies and measures security risks that may cause increased exposure to cyber attack."]
[571,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","A formal IT change management process requires cybersecurity risk to be evaluated during the analysis, approval, testing, and reporting of changes."]
[572,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Baseline configurations cannot be altered without a formal change request, documented approval, and an assessment of security implications."]
[573,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Changes are formally approved by an individual or committee with appropriate authority and with separation of duties."]
[574,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The change management system uses thresholds to determine when a risk assessment of the impact of the change is required."]
[575,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Any changes to systems/applications or to access entitlements necessary for incident management are reviewed by management for formal approval before implementation."]
[576,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Audit logs are backed up to a centralized log server or media that is difficult to alter."]
[577,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A formal backup and recovery plan exists for all critical business lines."]
[578,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Information backups are tested periodically to verify they are accessible and readable."]
[579,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The technology infrastructure has been engineered to limit the effects of a cyber attack on the production environment from migrating to the backup environment (e.g., air-gapped environment and processes)."]
[580,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-5","Policy and regulations regarding the physical operating environment for organizational assets are met",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.11.2.1\nA.11.2.2\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nEquipment siting and protection\nSupporting utilities\nCabling security"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Physical security controls are used to prevent unauthorized access to information systems and telecommunication systems."]
[581,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Data is destroyed or wiped on hardware and portable/mobile media when a device is missing, stolen, or no longer needed."]
[582,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Data is disposed of or destroyed according to documented requirements and within expected time frames. (FFIEC Information Security Booklet, page 66)"]
[583,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The institution wipes data remotely on mobile devices when a device is missing or stolen. (*N/A if mobile devices are not used.)"]
[584,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","A formal process is in place to update policies as the institution’s inherent risk profile changes."]
[585,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management has a formal process to continuously improve cybersecurity oversight."]
[586,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Management reviews and uses the results of audits to improve existing cybersecurity policies, procedures, and controls."]
[587,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","The institution routinely updates its training to security staff to adapt to new threats."]
[588,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-8","Effectiveness of protection technologies is shared with appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A representative from the institution participates in law enforcement or information-sharing organization meetings."]
[589,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-8","Effectiveness of protection technologies is shared with appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","Information security threats are gathered and shared with applicable internal employees. (FFIEC Information Security Booklet, page 83)"]
[590,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Business impact analyses have been updated to include cybersecurity."]
[591,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Due diligence has been performed on technical sources, consultants, or forensic service firms that could be called to assist the institution during or following an incident."]
[592,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Methods for responding to and recovering from cyber incidents are tightly woven throughout the business units’ disaster recovery, business continuity, and crisis management plans."]
[593,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Plans are in place to re-route or substitute critical functions and/or services that may be affected by a successful attack on Internet-facing systems."]
[594,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution has documented how it will react and respond to cyber incidents"]
[595,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Processes are in place to ensure assets affected by a security incident that cannot be returned to operational status are quarantined, removed, disposed of, and/or replaced."]
[596,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Processes are in place to ensure that restored assets are appropriately reconfigured and thoroughly tested before being placed back into operation."]
[597,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Recovery scenarios include plans to recover from data destruction and impacts to data integrity, data loss, and system and data availability."]
[598,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The corporate disaster recovery, business continuity, and crisis management plans have integrated consideration of cyber incidents."]
[599,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The incident response plan is designed to ensure recovery from disruption of services, assurance of data integrity, and recovery of lost or corrupted data following a cybersecurity incident."]
[600,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The institution calls upon third parties, as needed, to provide mitigation services"]
[601,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution plans to use business continuity, disaster recovery, and data backup programs to recover operations following an incident. (FFIEC Information Security Booklet, page 71)"]
[602,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Automated processes are in place to detect and block unauthorized changes to software and hardware."]
[603,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Public-facing servers are routinely rotated and restored to a known clean\nstate to limit the window of time a system is exposed to potential threats."]
[604,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","The maintenance and repair of organizational assets are logged in a timely manner."]
[605,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","The maintenance and repair of organizational assets are performed by authorized individuals with approved and controlled tools."]
[606,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-2","Remote maintenance of organizational assets is approved, logged, and performed in a mannerthat prevents unauthorized access",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4\nA.15.1.1\nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nInformation security policy for supplier relationships\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Access to make changes to systems configurations (including virtual machines and hypervisors) is controlled and monitored."]
[607,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has policies commensurate with its risk and complexity that address the concepts of threat information sharing. (FFIEC E- Banking Booklet, page 28)"]
[608,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Audit log records and other security event logs are reviewed and retained in a secure manner. (FFIEC Information Security Booklet, page 79)"]
[609,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Computer event logs are used for investigations once an event has occurred. (FFIEC Information Security Booklet, page 83)"]
[610,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Logs provide traceability for all system access by individual users. "]
[611,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Security logs are reviewed regularly."]
[612,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Thresholds for security logging are evaluated periodically."]
[613,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Controls are in place to prevent unauthorized individuals from copying confidential data to removable media."]
[614,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Controls are in place to restrict the use of removable media to authorized personnel. (FFIEC Information Security Work Program, Objective I: 4-1)"]
[615,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has board-approved policies commensurate with its risk and complexity that address information security."]
[616,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Technical controls prevent unauthorized devices, including rogue wireless access devices and removable media, from connecting to the internal network(s)."]
[617,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Access controls include password complexity and limits to password attempts and reuse. (FFIEC Information Security Booklet, page 66)"]
[618,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Adaptive access controls de-provision or isolate an employee, third-party, or customer credentials to minimize potential damage if malicious behavior is suspected."]
[619,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Changes to user access permissions trigger automated notices to appropriate personnel."]
[620,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Controls are in place to prevent unauthorized escalation of user privileges."]
[621,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Elevated privileges (e.g., administrator privileges) are limited and tightly controlled (e.g., assigned to individuals, not shared, and require stronger password controls). (FFIEC Information Security Booklet, page 19)"]
[622,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Employees’ and third parties’ devices (including mobile) without the latest security patches are quarantined and patched before the device is granted access to the network."]
[623,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The institution has controls to prevent the unauthorized addition of new connections."]
[624,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Tools automatically block attempted access by unregistered devices to internal networks."]
[625,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Unstructured confidential data are tracked and secured through an identity-aware, cross-platform storage system that protects against internal threats, monitors user access, and tracks changes."]
[626,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","User access reviews are performed periodically for all systems and applications based on the risk to the application or system. (FFIEC Information Security Booklet, page 18)"]
[627,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Third-party employee access to the institution's confidential data are tracked actively based on the principles of least privilege."]
[628,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","All ports are monitored. (FFIEC Information Security Booklet, page 50)"]
[629,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Automated tools detect unauthorized changes to critical system files, firewalls, IPS, IDS, or other security devices."]
[630,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Firewall rules are audited or verified at least quarterly. (FFIEC Information Security Booklet, page 82)"]
[631,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Firewall rules are updated routinely."]
[632,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Network perimeter defense tools (e.g., border router and firewall) are used."]
[633,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Physical security controls are used to prevent unauthorized access to information systems, and telecommunication systems"]
[634,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","The enterprise network is segmented in multiple, separate trust/security zones with defense-in- depth strategies (e.g., logical network segmentation, hard backups, air-gapping) to mitigate attacks."]
[635,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Wireless network environments require security settings with strong encryption for authentication and transmission. (*N/A if there are no wireless networks.) (FFIEC Information Security Booklet, page 40)"]
[636,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","A normal network activity baseline is established. (FFIEC Information\nSecurity Booklet, page 77)"]
[637,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Data flow diagrams are in place and document information flow to external parties"]
[638,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Advanced or automated analytics offer predictive information and real- time risk metrics."]
[639,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Antivirus and intrusion detection/prevention systems (IDS/IPS) detect and block actual and attempted attacks or intrusions."]
[640,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Analysis of events is used to improve the institution's security measures and policies."]
[641,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Lessons learned from real-life cyber risk incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan."]
[642,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","The cyber risk data aggregation and real-time reporting capabilities support the institution’s ongoing reporting needs, particularly during cyber incidents."]
[643,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","A threat analysis system automatically correlates threat data to specific risks and then takes risk-based automated actions while alerting management."]
[644,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","Emerging internal and external threat intelligence and correlated log analysis are used to predict future attacks."]
[645,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","A process is in place to correlate event information from multiple sources\n(e.g., network, application, or firewall)."]
[646,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Anomalous activity and other network and system alerts are correlated across business units to detect and prevent multifaceted attacks (e.g., simultaneous account takeover and DDoS attack)."]
[647,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","The institution is leading efforts to develop event detection systems that will correlate in real time when events are about to occur."]
[648,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Tools are in place to actively correlate event information from multiple sources and send alerts based on established parameters."]
[649,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Incident detection processes are capable of correlating events across the enterprise."]
[650,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Network and system alerts are correlated across business units to better detect and prevent multifaceted attacks (e.g., simultaneous DDoS attack and account takeover)."]
[651,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Sophisticated and adaptive technologies are deployed that can detect and alert the incident response team of specific tasks when threat indicators across the enterprise indicate potential external and internal threats."]
[652,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Technical measures apply defense-in-depth techniques such as deep- packet inspection and black holing for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns and/or DDoS attacks."]
[653,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","A process is in place to analyze the financial impact cyber incidents have on the institution’s capital."]
[654,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","A process is in place to analyze the financial impact that a cyber incident at the institution may have across the financial sector."]
[655,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","The institution has a mechanism for real-time automated risk scoring of threats."]
[656,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Recovery scenarios include plans to recover from data destruction, and impacts to data integrity, data loss, and system and data availability."]
[657,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Criteria have been established for escalating cyber incidents or vulnerabilities to the board and senior management based on the potential impact and criticality of the risk"]
[658,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Thresholds have been established to determine activity within logs that would warrant management response."]
[659,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Tools actively monitor security logs for anomalous behavior and alert within established parameters."]
[660,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Alert parameters are set for detecting information security incidents that prompt mitigating actions. (FFIEC Information Security Booklet, page 43)"]
[661,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The incident response process includes detailed actions and rule- based triggers for automated response."]
[662,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The incident response program is triggered when anomalous behaviors and attack patterns or signatures are detected."]
[663,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Anti-spoofing measures are in place to detect and block forged source IP addresses from entering the network."]
[664,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Customer transactions generating anomalous activity alerts are monitored and reviewed. (FFIEC Wholesale Payments Booklet, page 12)"]
[665,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Logs of physical and/or logical access are reviewed following events. (FFIEC Information Security Booklet, page 73)"]
[666,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Real-time network monitoring and detection is implemented and incorporates sector-wide event information."]
[667,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Controls for primary and backup third-party connections are monitored and tested on a regular basis."]
[668,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Monitoring controls cover all internal network-to-network connections."]
[669,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Physical access to high-risk or confidential systems is restricted, logged, and unauthorized access is blocked."]
[670,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","The physical environment is monitored to detect potential unauthorized access. (FFIEC Information Security Booklet, page 47)"]
[671,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","A system is in place to monitor and analyze employee behavior (network use patterns, work hours, and known devices) to alert on anomalous activities."]
[672,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Automated tool(s) proactively identifies high-risk behavior signaling an employee who may pose an insider threat."]
[673,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Customer authentication for high-risk transactions includes methods to prevent malware and man-in-the-middle attacks (e.g., using visual transaction signing)."]
[674,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Processes are in place to monitor potential insider activity that could lead to data theft or destruction."]
[675,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The institution has processes to detect and alert the incident response team when potential insider activity manifests that could lead to data theft or destruction."]
[676,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Antivirus and anti-malware tools are used to detect attacks. (FFIEC Information Security Booklet, page 55)"]
[677,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","E-mail protection mechanisms are used to filter for common cyber threats (e.g., attached malware or malicious links). (FFIEC Information Security Booklet, page 39)"]
[678,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","E-mails and attachments are automatically scanned to detect malware and are blocked when malware is present."]
[679,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Up to date antivirus and anti-malware tools are used. (FFIEC Information Security Booklet, page 78)"]
[680,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","User tasks and content (e.g., opening an e-mail attachment) are automatically isolated in a secure container or virtual environment so that malware can be analyzed but cannot access vital data, end-point operating systems, or applications on the institution’s network."]
[681,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Mobile devices connecting to the corporate network for storing and accessing company information allow for remote software version/patch validation. (*N/A if mobile devices are not used.)"]
[682,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Mobile devices with access to the institution’s data are centrally managed for antivirus and patch deployment. (*N/A if mobile devices are not used.)"]
[683,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Antivirus and anti-malware tools are deployed on end-point devices (e.g., workstations, laptops, and mobile devices)."]
[684,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The institution has policies commensurate with its risk and complexity that address the concepts of external dependency or third-party management. (FFIEC Outsourcing Booklet, page 2)"]
[685,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Access to critical systems by third parties is monitored for unauthorized or unusual activity. (FFIEC Outsourcing Booklet, page 26)"]
[686,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Automated reminders or ticklers are in place to identify when required third-party information needs to be obtained or analyzed."]
[687,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Monitoring controls cover all external connections (e.g., third-party service providers, business partners, customers)."]
[688,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Monitoring of third parties is scaled, in terms of depth and frequency, according to the risk of the third parties."]
[689,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Ongoing monitoring practices include reviewing critical third-parties’ resilience plans. (FFIEC Outsourcing Booklet, page 19)"]
[690,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","The institution ensures that third-party connections are authorized. (FFIEC Information Security Booklet, page 17)"]
[691,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","The institution is leading efforts to develop new auditable processes for ongoing monitoring of cybersecurity risks posed by third parties."]
[692,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","The institution works closely with third-party service providers to maintain and improve the security of external connections."]
[693,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Third-party employee access to confidential data on third-party hosted systems is tracked actively via automated reports and alerts."]
[694,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","External transfers from customer accounts generate alerts and require review and authorization if anomalous behavior is detected."]
[695,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Online customer transactions are actively monitored for anomalous behavior."]
[696,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Processes are in place to monitor for the presence of unauthorized users, devices, connections, and software. (FFIEC Information Security Work Program, Objective II: M-9)"]
[697,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Real-time alerts are automatically sent when unauthorized software, hardware, or changes occur."]
[698,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Specialized security monitoring is used for critical assets throughout the infrastructure."]
[699,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","The institution is developing new technologies that will detect potential insider threats and block activity in real time."]
[700,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","The institution is leading the development effort to design new technologies that will detect potential insider threats and block activity in real time."]
[701,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Tools automatically block attempted access from unpatched employee and third-party devices."]
[702,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Connections","Security controls are designed and verified to detect and prevent intrusions from third-party connections."]
[703,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Automated tools are implemented to provide specialized security monitoring based on the risk of the assets to detect and alert incident response teams in real time."]
[704,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The institution has the ability to discover infiltration, before the attacker traverses across systems, establishes a foothold, steals information, or causes damage to data and systems."]
[705,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Critical systems supported by legacy technologies are regularly reviewed to identify for potential vulnerabilities, upgrade opportunities, or new defense layers."]
[706,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Independent penetration testing is performed on Internet-facing applications or systems before they are launched or undergo significant change."]
[707,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Independent penetration testing of network boundary and critical Web- facing applications is performed routinely to identify security control gaps."]
[708,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Penetration tests include cyber attack simulations and/or real-world tactics and techniques such as red team testing to detect control gaps in employee behavior, security defenses, policies, and resources."]
[709,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Remediation efforts are confirmed by conducting a follow-up vulnerability scan."]
[710,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Vulnerability scanning is conducted and analyzed before deployment/redeployment of new/existing devices."]
[711,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Vulnerability scanning is performed on a weekly basis across all environments."]
[712,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-1","Roles and responsibilities for detection are well defined to ensure accountability",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Responsibilities for monitoring and reporting suspicious systems activity have been assigned. (FFIEC Information Security Booklet, page 83)"]
[713,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-2","Detection activities comply with all applicable requirements",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Privacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management is responsible for ensuring compliance with legal and regulatory requirements related to cybersecurity."]
[714,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Event detection processes are proven reliable."]
[715,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Detective Controls","Mechanisms (e.g., antivirus alerts, log event alerts) are in place to alert management to potential attacks. (FFIEC Information Security Booklet, page 78)"]
[716,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","A process exists to contact personnel who are responsible for analyzing and responding to an incident. (FFIEC Information Security Booklet, page 83)"]
[717,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Criteria have been established for escalating cyber incidents or vulnerabilities to the board and senior management based on the potential impact and criticality of the risk."]
[718,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Links between threat intelligence, network operations, and incident response allow for proactive response to potential incidents."]
[719,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The incident management function collaborates effectively with the cyber threat intelligence function during an incident."]
[720,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","The institution prepares an annual report of security incidents or violations for the board or an appropriate board committee. (FFIEC Information Security Booklet, page 5)"]
[721,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Lessons learned from real-life cyber incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan."]
[722,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-1","Notifications from detection systems are investigated ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.3\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nAdministrator and operator logs\nResponse to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Tools and processes are in place to detect, alert, and trigger the incident response program. (FFIEC Information Security Booklet, page 84)"]
[723,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-1","Notifications from detection systems are investigated ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.3\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nAdministrator and operator logs\nResponse to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Incidents are detected in real time through automated processes that include instant alerts to appropriate personnel who can respond"]
[724,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Analysis of security incidents is performed in the early stages of an intrusion to minimize the impact of the incident."]
[725,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Cyber-attack scenarios are analyzed to determine potential impact to critical business processes."]
[726,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","A process is in place to analyze the financial impact cyber incidents have on the institution’s capital."]
[727,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Recovery scenarios include plans to recover from data destruction, impacts to data integrity, data loss, and system and data availability."]
[728,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Criteria have been established for escalating cyber incidents or vulnerabilities to the board and senior management based on the potential impact and criticality of the risk."]
[729,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","Management identifies root cause(s) when cyber-attacks result in material loss."]
[730,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Generally accepted and appropriate forensic procedures, including chain of custody, are used to gather and present evidence to support potential legal action."]
[731,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Security investigations, forensic analysis, and remediation are performed by qualified staff or third parties."]
[732,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-4","Incidents are categorized consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Incidents are classified, logged and tracked."]
[733,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-4","Incidents are categorized consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The incident response plan is designed to prioritize incidents, enabling a rapid response for significant cybersecurity incidents or vulnerabilities"]
[734,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Employees that are essential to mitigate the risk (e.g., fraud, business resilience) know their role in incident escalation."]
[735,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Roles and responsibilities for incident response team members are defined. (FFIEC Information Security Booklet, page 84)"]
[736,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Monitoring and Analyzing","The threat information and analysis process is assigned to a specific group or individual."]
[737,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Communication channels exist to provide employees a means for reporting information security events in a timely manner. (FFIEC Information Security Booklet, page 83)"]
[738,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Detailed metrics, dashboards, and/or scorecards outlining cyber incidents and events are provided to management and are part of the board meeting package."]
[739,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Incidents are classified, logged, and tracked. (FFIEC Operations Booklet, page 28)"]
[740,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Incidents are detected in real time through automated processes that include instant alerts to appropriate personnel who can respond."]
[741,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Records are generated to support incident investigation and mitigation. "]
[742,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","The institution has established quantitative and qualitative metrics for the cybersecurity incident response process."]
[743,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A mechanism is in place for sharing cyber threat intelligence with business units in real time including the potential financial and operational impact of inaction."]
[744,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","A communication plan is used to notify other organizations, including third parties, of incidents that may affect them or their customers."]
[745,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Procedures exist to notify customers, regulators, and law enforcement as required or necessary when the institution becomes aware of an incident involving the unauthorized access to or use of sensitive customer information. (FFIEC Information Security Booklet, page 84)"]
[746,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Regulators, law enforcement, and service providers, as appropriate, are notified when the institution is aware of any unauthorized access to systems or a cyber incident occurs that could result in degradation of services."]
[747,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","A mechanism is in place to provide instantaneous notification of incidents to management and essential employees through multiple communication channels with tracking and verification of receipt."]
[748,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","A process exists to contact personnel who are responsible for analyzing and responding to an incident."]
[749,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A strategy is in place to coordinate and communicate with internal and external stakeholders during or following a cyber attack."]
[750,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Business continuity testing involves collaboration with critical third parties. (FFIEC Business Continuity Planning Booklet, page J-6)"]
[751,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Resources","The institution actively partners with industry associations and academia to inform curricula based on future cybersecurity staffing needs of the industry."]
[752,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Training and Culture","The institution leads efforts to promote cybersecurity culture across the sector and to other sectors that they depend upon."]
[753,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The standard board meeting package includes reports and metrics that go beyond events and incidents to address threat intelligence trends and the institution’s security posture."]
[754,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A formal and secure process is in place to share threat and vulnerability information with other entities."]
[755,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A network of trust relationships (formal and/or informal) has been established to evaluate information about cyber threats."]
[756,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A process is in place to communicate and collaborate with the public sector regarding cyber threats."]
[757,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","A representative from the institution participates in law enforcement or information-sharing organization meetings"]
[758,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","Information about threats is shared with law enforcement and regulators when required or prompted. (FFIEC Information Security Booklet, page 84)"]
[759,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","Information is shared proactively with the industry, law enforcement, regulators, and information-sharing forums."]
[760,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","Information-sharing agreements are used as needed or required to facilitate sharing threat information with other financial sector organizations or third parties."]
[761,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","Protocols are implemented for collecting information from industry peers and government."]
[762,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","Relationships exist with employees of peer institutions for sharing cyber threat intelligence."]
[763,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Information Sharing","The institution is leading efforts to create new sector-wide information- sharing channels to address gaps in external-facing information-sharing mechanisms."]
[764,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","The institution promotes a sector-wide effort to influence contractual requirements for critical third parties to the industry."]
[765,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution participates in sector-specific cyber exercises or scenarios (e.g., FS-ISAC Cyber Attack (against) Payment Processors (CAPP))."]
[766,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A process is in place to continuously improve the resilience plan."]
[767,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Lessons learned from real-life cyber incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan."]
[768,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The results of cyber event exercises are used to improve the incident response plan and automated triggers."]
[769,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Lessons learned from real-life cyber incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan."]
[770,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The results of cyber event exercises are used to improve the incident response plan and automated triggers."]
[771,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","A process is in place to help contain incidents and restore operations with minimal service disruption."]
[772,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Appropriate steps are taken to contain and control an incident to prevent further unauthorized access to or use of customer information. (FFIEC Information Security Booklet, page 84)"]
[773,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Containment and mitigation strategies are developed for multiple incident types (e.g., DDoS, malware)."]
[774,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Procedures include containment strategies and notifying potentially impacted third parties."]
[775,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","The institution is able to detect and block zero-day attempts and inform management and the incident response team in real time."]
[776,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Alert parameters are set for detecting information security incidents that prompt mitigating actions."]
[777,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Containment and mitigation strategies are developed for multiple incident types (e.g., DDoS, malware)"]
[778,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","A risk-based solution is in place at the institution or Internet-hosting provider to mitigate disruptive cyber attacks (e.g., DDoS attacks)."]
[779,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Corrective Controls","Issues identified in assessments are prioritized and resolved based on criticality and within the time frames established in the response to the assessment report. (FFIEC Information Security Booklet, page 87)"]
[780,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Risk Management","Risk assessments are used to identify the cybersecurity risks stemming from new products, services, or relationships."]
[781,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution has documented how it will react and respond to cyber incidents"]
[782,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Detection, Response, and Mitigation","Processes are in place to trigger the incident response program when an incident occurs at a third party."]
[783,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or an appropriate board committee discusses ways for management to develop cybersecurity improvements that may be adopted sector-wide.\n"]
[784,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","1: Cyber Risk Management & Oversight","Governance","The board or an appropriate board committee ensures that management’s actions consider the cyber risks that the institution poses to the financial sector."]
[785,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","An external communication plan is used for notifying media regarding incidents when applicable."]
[786,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Reputation after an event is repaired",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A strategy is in place to coordinate and communicate with internal and external stakeholders during or following a cyber attack."]
[787,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","A strategy is in place to coordinate and communicate with internal and external stakeholders during or following a cyber attack."]
[788,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","A process exists to contact personnel who are responsible for analyzing and responding to an incident."]
[789,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution corrects root causes for problems discovered during cybersecurity resilience testing."]
[790,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Lessons learned from real-life cyber incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan."]
[791,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Widely reported events are used to evaluate and improve the institution's response."]
[792,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The results of cyber event exercises are used to improve the incident response plan and automated triggers."]
[793,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","Lessons learned from real-life cyber incidents and attacks on the institution and other organizations are used to improve the institution’s risk mitigation capabilities and response plan."]
[794,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Incident Resilience Planning and Strategy","The institution plans to use business continuity, disaster recovery, and data backup programs to recover operations following an incident"]
[795,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Compliance Risk","Financial institution management should identify the compliance risks as it determines which MFS to offer and continue to monitor these risks as the technology for MFS evolves. Consumer laws, regulations, and supervisory guidance that apply to a given financial product or payment method generally apply regardless of the technology used to provide the products and services. \nManagement should understand how the institution’s risk profile changes when it uses any third party, but particularly a third-party service provider that is unfamiliar with the regulation and supervision of the financial services sector, to design applications.","GV.TE-1"]
[796,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","N.A","When offering MFS, management should mitigate identified risks by implementing effective controls across the institution. As is the case with any new product offering, management should develop and implement policies and procedures to comply with applicable laws and regulations and require appropriate internal controls for security and confidentiality of the MFS transactions. As part of the institution’s audit of retail payments systems, audit coverage should include MFS.","GV.TE-1"]
[797,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Compliance Risk Mitigation","Institution management and system designers should consult with compliance staff to minimize compliance risks when developing and implementing MFS. Financial institution management should reassess its current mobile service offerings regularly and, in conjunction with appropriate compliance and legal staff, examine applicable laws and regulations, including those for consumer protection, to determine which may apply to their specific mobile financial service offerings. The compliance officer should take the following steps:\n- Determine whether applicable disclosure requirements are fully accessible on the mobile device.\n- Review the institution’s existing compliance management system and ability to make appropriate modifications to policies and procedures to address the products, services, and operating features of the MFS technology.\n-  Monitor for any legal and regulatory changes that may be applicable to MFS on an ongoing basis.\n- Train institution staff regarding compliance implications of MFS.","GV.TE-1"]
[798,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management identifies the risks associated with offering MFS","6. With respect to compliance risk, determine whether management identified the applicable risks related to MFS. Review whether management understands that the consumer laws, regulations, and supervisory guidance that apply to a given financial product or payment method generally apply regardless of the technology used. Additionally, determine whether management identified risks associated with the use of nontraditional third-party service providers often found in the innovation and development sphere of MFS.","GV.IR"]
[799,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Strategic Risk","Management should identify the risks associated with the decision to offer MFS and determine what types of MFS best fit with the strategic vision, goals, and risk appetite of the institution.","GV.TE-1"]
[800,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Operational Risk","Management should identify the risks involved with transaction initiation, authentication and authorization, and the MFS technology itself. \nmanagement should consider the implications of operational risks when evaluating and implementing such technologies\n(a) SMS technology risk\n(B) mobile-enabled web site risk\n(c) mobile application risk\n(d) mobile payment risk","GV.TE-1"]
[801,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Compliance Risk","Financial institution management should identify the compliance risks as it determines which MFS to offer and continue to monitor these risks as the technology for MFS evolves. Consumer laws, regulations, and supervisory guidance that apply to a given financial product or payment method generally apply regardless of the technology used to provide the products and services. \nManagement should understand how the institution’s risk profile changes when it uses any third party, but particularly a third-party service provider that is unfamiliar with the regulation and supervision of the financial services sector, to design applications.","GV.TE-1"]
[802,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Reputation Risk","Management should identify and consider how providing MFS may create reputation risk. Reputation risk is particularly relevant in the context of privacy and data security, as public scrutiny of the treatment of customer information continues to grow.","GV.TE-1"]
[803,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Reputation Risk Mitigation","To protect its brand reputation, management should adopt appropriate and effective controls over customer information accessed, transmitted, or stored by the MFS to minimize or prevent disclosure of personal information and the potential for fraudulent transactions. Management should implement such controls whether it is providing the MFS directly or through a third party","GV.TE-1"]
[804,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management effectively identifies and implements controls to mitigate identified and prioritized risks associated with the MFS offering.","3. Determine whether management puts in place appropriate internal controls to ensure security and confidentiality of MFS.","GV.IR"]
[805,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management effectively identifies and implements controls to mitigate identified and prioritized risks associated with the MFS offering.","4. Determine whether management implements controls to mitigate all applicable categories of risks related to MFS, including strategic, operational, compliance, and reputation risk.","GV.IR"]
[806,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Measurement","N.A","The identification of risks should be followed by a measurement of the level and types of risks involved in offering MFS. Management should measure potential risks across all applicable risk categories. This assessment may help management determine the likelihood and impact of the risks affecting the institution. The results should be prioritized to determine which controls may be appropriate for the services provided by the institution. This process should be ongoing and updated whenever management implements a change to the strategy or MFS."]
[807,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management identifies the risks associated with offering MFS","5. Determine whether management also considered the implications of operational risks specific to technologies used to implement MFS. Specifically, review whether management appropriately identified the differing risks related to the following technologies: \na. SMS: Include the lack of security through unencrypted text messages; SMS spoofing; and fraudulent text messages (phishing).\nb. Mobile-enabled Web sites: Include vulnerabilities with Internet banking (hardware, operating system, and security limitations); malicious messages through Web-based attack vectors; limitations on anti-phishing and anti-XSS capabilities; malicious attacks through unvalidated redirects and forwards; user constraints on recognizing phished or forged sites; and limitations on visual security cues.\nc. Mobile application: Include application vulnerabilities (e.g., unpatched and outdated applications); malware; ability to jailbreak or root devices; use of unapproved application stores; weak storage controls over confidential information on devices; and inappropriate access to back-end databases.\nd. Mobile payments: Include loss or theft of mobile devices leading to unauthorized payments, funds transfers, and credit card purchases; interception of NFC communications; and weak security controls in the payment provisioning process."]
[808,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management appropriately and effectively measures risks associated with MFS and determines the likelihood and impact of those risks.","1. Determine whether management effectively measures risks and determines the likelihood and impact of those risks.\n2. Determine whether management effectively prioritizes measured risks.\n3. Determine the effectiveness of the frequency of the measurement process."]
[809,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management identifies the risks associated with offering MFS","6. With respect to compliance risk, determine whether management identified the applicable risks related to MFS. Review whether management understands that the consumer laws, regulations, and supervisory guidance that apply to a given financial product or payment method generally apply regardless of the technology used. Additionally, determine whether management identified risks associated with the use of nontraditional third-party service providers often found in the innovation and development sphere of MFS."]
[810,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management identifies the risks associated with offering MFS","7. With respect to reputation risk, determine whether management identified the following:\na. Potential reputation risk that may arise from providing MFS, including issues related to privacy and data security.\nb. Risks associated with the decision to outsource the development and maintenance of mobile products and the effect of third parties on the institution’s risk profile."]
[811,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management appropriately and effectively measures risks associated with MFS and determines the likelihood and impact of those risks.","1. Determine whether management effectively measures risks and determines the likelihood and impact of those risks.\n2. Determine whether management effectively prioritizes measured risks.\n3. Determine the effectiveness of the frequency of the measurement process."]
[812,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Measurement","N.A","The identification of risks should be followed by a measurement of the level and types of risks involved in offering MFS. Management should measure potential risks across all applicable risk categories. This assessment may help management determine the likelihood and impact of the risks affecting the institution. The results should be prioritized to determine which controls may be appropriate for the services provided by the institution. This process should be ongoing and updated whenever management implements a change to the strategy or MFS."]
[813,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management appropriately and effectively measures risks associated with MFS and determines the likelihood and impact of those risks.","1. Determine whether management effectively measures risks and determines the likelihood and impact of those risks.\n2. Determine whether management effectively prioritizes measured risks.\n3. Determine the effectiveness of the frequency of the measurement process."]
[814,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Strategic Risk","Management should identify the risks associated with the decision to offer MFS and determine what types of MFS best fit with the strategic vision, goals, and risk appetite of the institution.","GV.TE-1"]
[815,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Operational Risk","Management should identify the risks involved with transaction initiation, authentication and authorization, and the MFS technology itself. \nmanagement should consider the implications of operational risks when evaluating and implementing such technologies\n(a) SMS technology risk\n(B) mobile-enabled web site risk\n(c) mobile application risk\n(d) mobile payment risk","GV.TE-1"]
[816,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Compliance Risk","Financial institution management should identify the compliance risks as it determines which MFS to offer and continue to monitor these risks as the technology for MFS evolves. Consumer laws, regulations, and supervisory guidance that apply to a given financial product or payment method generally apply regardless of the technology used to provide the products and services. \nManagement should understand how the institution’s risk profile changes when it uses any third party, but particularly a third-party service provider that is unfamiliar with the regulation and supervision of the financial services sector, to design applications.","GV.PL-3"]
[817,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Identification","Reputation Risk","Management should identify and consider how providing MFS may create reputation risk. Reputation risk is particularly relevant in the context of privacy and data security, as public scrutiny of the treatment of customer information continues to grow.","GV.RM-1"]
[818,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Measurement","N.A","The identification of risks should be followed by a measurement of the level and types of risks involved in offering MFS. Management should measure potential risks across all applicable risk categories. This assessment may help management determine the likelihood and impact of the risks affecting the institution. The results should be prioritized to determine which controls may be appropriate for the services provided by the institution. This process should be ongoing and updated whenever management implements a change to the strategy or MFS.","GV.RM-1"]
[819,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","N.A","When offering MFS, management should mitigate identified risks by implementing effective controls across the institution. As is the case with any new product offering, management should develop and implement policies and procedures to comply with applicable laws and regulations and require appropriate internal controls for security and confidentiality of the MFS transactions. As part of the institution’s audit of retail payments systems, audit coverage should include MFS.","GV.PL-2"]
[820,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Strategic Risk Mitigation","Financial institution management should incorporate decisions on providing MFS into its strategic planning process. Various elements should be part of any mobile strategy, including the products and services to be offered, types of transactions allowed, limits over transaction amounts, mobile architecture design, supported mobile devices, customer needs, and use of third parties.","GV.TE-1"]
[821,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Reputation Risk Mitigation","To protect its brand reputation, management should adopt appropriate and effective controls over customer information accessed, transmitted, or stored by the MFS to minimize or prevent disclosure of personal information and the potential for fraudulent transactions. Management should implement such controls whether it is providing the MFS directly or through a third party","GV.PL-2"]
[822,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Monitoring and Reporting","N.A","Modify the business plan, when appropriate, based on the performance of the product or service. Such changes may include exiting the activity should actual results fail to achieve projections.","GV.TE-1"]
[823,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management identifies the risks associated with offering MFS","1. After the MFS strategy is complete, determine whether the institution developed an effective risk assessment process for the MFS offerings. Verify whether management incorporates the results of the risk assessment into a process to periodically review and update the strategy.\n2. Review whether the risk identification process includes risks associated with MFS, particularly in the areas of strategic, operational, regulatory, and reputation risks.\n3. With respect to strategic risk, determine whether management identified the risks associated with the decision to offer MFS and whether that is consistent with the strategic vision, goals, and risk appetite of the institution.\n4. Determine whether management considered and identified operational risks associated with MFS, including risks involved with the following:\na. Transaction initiation and completion.\nb. Authentication and authorization.\nc. Technology used for MFS.\nd. Mobile devices.\ne. Method of communication between the device and the terminal accepting payment.\nf. Authentication and security of access points.\ng. Fraud tools and techniques.\nh. Current and emerging threats to mobile applications, weaknesses in mobile application security, and prevalence of mobile devices, common operating systems, and downloadable applications.","GV.IR"]
[824,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management identifies the risks associated with offering MFS","5. Determine whether management also considered the implications of operational risks specific to technologies used to implement MFS. Specifically, review whether management appropriately identified the differing risks related to the following technologies: \na. SMS: Include the lack of security through unencrypted text messages; SMS spoofing; and fraudulent text messages (phishing).\nb. Mobile-enabled Web sites: Include vulnerabilities with Internet banking (hardware, operating system, and security limitations); malicious messages through Web-based attack vectors; limitations on anti-phishing and anti-XSS capabilities; malicious attacks through unvalidated redirects and forwards; user constraints on recognizing phished or forged sites; and limitations on visual security cues.\nc. Mobile application: Include application vulnerabilities (e.g., unpatched and outdated applications); malware; ability to jailbreak or root devices; use of unapproved application stores; weak storage controls over confidential information on devices; and inappropriate access to back-end databases.\nd. Mobile payments: Include loss or theft of mobile devices leading to unauthorized payments, funds transfers, and credit card purchases; interception of NFC communications; and weak security controls in the payment provisioning process.","GV.IR"]
[825,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management effectively identifies and implements controls to mitigate identified and prioritized risks associated with the MFS offering.","1. Determine whether management incorporates mobile risks into the overall risk management process.\n2. Determine whether management implements policies and procedures for the MFS offering.","GV.IR"]
[826,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Measurement","N.A","The identification of risks should be followed by a measurement of the level and types of risks involved in offering MFS. Management should measure potential risks across all applicable risk categories. This assessment may help management determine the likelihood and impact of the risks affecting the institution. The results should be prioritized to determine which controls may be appropriate for the services provided by the institution. This process should be ongoing and updated whenever management implements a change to the strategy or MFS.","GV.RM-1"]
[827,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Monitoring and Reporting","N.A","Include limits on the level of acceptable risk exposure that management and the board are willing to assume.","GV.SF-3"]
[828,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management maintains effective oversight of MFS activities. Management maintains appropriate reporting for various levels of management to support that oversight.","1. Review the monitoring process to determine whether the institution has appropriate performance monitoring systems to allow management to assess whether the product or service is meeting operational expectations. Determine whether the systems include the following features: \na. Limits on the level of acceptable risk exposure that management and the board are willing to assume.\nb. Specific objectives and performance criteria to evaluate success of the product or service.\nc. Ability to produce reports that periodically compare actual results with projections and qualitative benchmarks that provide trend information.\nd. Ability to produce reports that provide data, which would trigger changes in the business plan, as appropriate","GV.IR"]
[829,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Monitoring and Reporting","N.A","Periodically compare actual results with projections and qualitative benchmarks to detect and address adverse trends or concerns in a timely manner.","GV.SP-2"]
[830,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Monitoring and Reporting","N.A","Modify the business plan, when appropriate, based on the performance of the product or service. Such changes may include exiting the activity should actual results fail to achieve projections.","GV.TE-1"]
[831,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Monitoring and Reporting","N.A","Management should structure the report content to meet the needs of the various levels of management. Reports should address point-in-time as well as trend activity for both individual customers and mobile channel activities to compare actual trends with the mobile strategy. Reports for new services should emphasize the volume of activity from the onset and report on changes in usage or volume over time. Management should develop reports to document the various demographic and industry sectors served and monitor changes in these areas to determine whether the MFS offered are meeting the institution’s strategy or should be refined.","GV.SP-2"]
[832,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management maintains effective oversight of MFS activities. Management maintains appropriate reporting for various levels of management to support that oversight.","1. Review the monitoring process to determine whether the institution has appropriate performance monitoring systems to allow management to assess whether the product or service is meeting operational expectations. Determine whether the systems include the following features: \na. Limits on the level of acceptable risk exposure that management and the board are willing to assume.\nb. Specific objectives and performance criteria to evaluate success of the product or service.\nc. Ability to produce reports that periodically compare actual results with projections and qualitative benchmarks that provide trend information.\nd. Ability to produce reports that provide data, which would trigger changes in the business plan, as appropriate","GV.IR"]
[833,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Contracts. The institution should use well-constructed contracts, developed with legal counsel, to mitigate its risks from third parties. Contracts should be appropriate for the institution’s specific mobile strategy and should clearly identify each party’s roles and responsibilities. Financial institution management may need to establish contracts with the institution’s customers and third parties that cover types of data collected and circumstances related to data sharing"]
[834,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Enrollment. Financial institution management should have appropriate controls and communication of policy and procedures to verify a customer’s identity when enrolling customers in mobile payment systems used at the point of sale (e.g., allowing a customer with a physical payment card the ability to enroll that card into the customer’s mobile wallet)."]
[835,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Application security. Management should ensure that the institution’s MFS contain log-on credentials in addition to those used to access the device. Management should employ multi-factor authentication or layered security controls depending on the types and volumes of transactions. The system should require re-authentication whenever the device or MFS is unused for a designated period and each time the user launches the application."]
[836,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Authentication controls of both the user and application."]
[837,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Authentication and authorization. A financial institution should have a process for authenticating users of MFS to protect customers against fraudulent transactions or malicious activities. Depending on the technology used and associated level of risk, financial institutions may consider biometric (e.g., voice, fingerprint, facial recognition) or out-of-band authentication processes. The financial institution should not use mobile payment applications that rely on less secure (e.g., single factor) methods of authentication."]
[838,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Securing back-end servers containing the MFS application and customer data to prevent unauthorized users from accessing data. If a third party manages the application and back-end server, validate that the third party implements appropriate security measures."]
[839,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Traffic filtering to help prevent or minimize denial-of-service attacks"]
[840,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Enrollment. Financial institution management should have appropriate controls and communication of policy and procedures to verify a customer’s identity when enrolling customers in mobile payment systems used at the point of sale (e.g., allowing a customer with a physical payment card the ability to enroll that card into the customer’s mobile wallet)."]
[841,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Provide specific training and security awareness materials for users and customers accessing the institution’s sites to teach them how to identify compromised sites."]
[842,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Mobile Application Risk Mitigation: \n- Providing security awareness training to end users to help them recognize legitimate applications and provide a list of reputable sites to download institution-approved applications.\n- Providing basic customer education relative to security to mitigate the risks associated with rooted or jailbroken devices."]
[843,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","N.A","financial institution management should provide security awareness materials to the institution’s customers, which may include prudent security practices for the device (e.g., use of mobile anti-malware, PIN protection) so that customers understand their roles in securing the device and the need for such security."]
[844,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Customer awareness. Financial institution management should make reasonable efforts to educate customers about the need to maintain the physical and logical security24 of mobile devices and suggest that users regularly install operating system and firmware updates. Management should make clear that customers should download applications only from reputable sources, and the institution’s Web site should have a link to the source of any institution-approved applications. Institutions should have customer security awareness materials available to help customers understand the risks involved in using MFS, including the use of unsecured “public” wireless networks. Financial institutions should suggest that customers consider running anti-malware software on their mobile devices, if possible."]
[845,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Provide specific training and security awareness materials for users and customers accessing the institution’s sites to teach them how to identify compromised sites."]
[846,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Mobile Application Risk Mitigation: Designing applications to ensure that critical information, such as passwords and credit card numbers, does not reside directly on a device. If critical information resides directly on a device, it should be stored securely (e.g., within an encrypted data section or within encrypted storage in the file system)."]
[847,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Encryption of personal information stored on the mobile device"]
[848,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Secure telecommunications protocols (e.g., secure sockets layer/transport layer security [SSL/TLS])."]
[849,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Encryption to minimize the opportunity for the interception of traffic."]
[850,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile browsers have available safeguards implemented, such as anti-XSS modules or additional monitoring of browsers for those that are no longer supported, and deny access to devices with mobile browsers not meeting minimum standards"]
[851,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile-enabled Web sites are designed with the following mitigating controls to help minimize the potential for exploitation of “redirect and forward” vulnerabilities:\n – Avoid using redirects and forwards. \n– Explicitly hard code the URL to prevent manipulation by an attacker.\n – Apply additional validation or control checks to verify the user trying to access the URL, validate the URL, check the appropriateness of the URL request, and prevent a malicious user from redirecting site users to a phishing, malicious, or nonaffiliated site.\n – Create a whitelist26 of trusted URLs.\n – Force all redirects to go through a page that notifies a user that he or she is leaving the page and require user confirmation.\n – Perform frequent vulnerability scans."]
[852,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile-enabled Web sites are designed with the following mitigating controls to help minimize the potential for exploitation of “redirect and forward” vulnerabilities:\n – Avoid using redirects and forwards. \n– Explicitly hard code the URL to prevent manipulation by an attacker.\n – Apply additional validation or control checks to verify the user trying to access the URL, validate the URL, check the appropriateness of the URL request, and prevent a malicious user from redirecting site users to a phishing, malicious, or nonaffiliated site.\n – Create a whitelist26 of trusted URLs.\n – Force all redirects to go through a page that notifies a user that he or she is leaving the page and require user confirmation.\n – Perform frequent vulnerability scans."]
[853,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Periodically testing the functionality of MFS applications with other integrated mobile applications and services."]
[854,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Developing applications in a “sandbox,”which creates a more secure area within the device from which to process transactions."]
[855,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Make available a baseline set of controls, and educate customers on the use of those controls to protect their device and information (e.g., device passwords with complexity, application passwords, and an auto-wipe feature after excessive password failures)."]
[856,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management effectively identifies and implements controls to mitigate identified and prioritized risks associated with the MFS offering.","5. Determine whether management has appropriate and independent testing of controls for effectiveness."]
[857,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Maintaining awareness of vulnerabilities through online forums, vendor sites, and U.S. Computer Emergency Readiness Team (US-CERT) or Financial Services-Information Sharing and Analysis Center (FS-ISAC) alerts. The vulnerabilities may affect unpatched and unsupported operating system versions. Take a risk-based approach when offering MFS to customers using unpatched and unsupported operating system versions and recommend to customers that they upgrade to more secure software, operating systems, and devices when appropriate."]
[858,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Application development and distribution. The application development life cycle should include a thorough design and architecture review using threat-modeling21 techniques to reduce potential risks and meet the financial institution’s security objectives. Additionally, application developers should develop applications using secure coding techniques,22 and applications should be rigorously tested for vulnerabilities (e.g., detailed code analysis and white-hat hacking23) at least annually. Institutions should distribute applications and updates securely and in a timely fashion. Management should consider designing anti-malware capabilities into mobile applications. Applications should not retain sensitive customer information on the device, such as user IDs and passwords, and the application should securely wipe any sensitive customer information from memory when the customer exits the application. If a third party developed the application, the third-party developer should incorporate these control requirements into its development process."]
[859,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Require Web site developers to follow a secure development life cycle to increase the security of the Web sites designed for the financial institution."]
[860,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Mobile Application Risk Mitigation: Performing security testing at all post-design phases of the system development life cycle for all applications. Establishing a process to deactivate older application versions that no longer meet minimum security requirements or prompt the end user to upgrade to an acceptable version."]
[861,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Designing applications to mitigate the risk of unpatched devices or those that are no longer supported by the manufacturer"]
[862,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Application development and distribution. The application development life cycle should include a thorough design and architecture review using threat-modeling21 techniques to reduce potential risks and meet the financial institution’s security objectives. Additionally, application developers should develop applications using secure coding techniques,22 and applications should be rigorously tested for vulnerabilities (e.g., detailed code analysis and white-hat hacking23) at least annually. Institutions should distribute applications and updates securely and in a timely fashion. Management should consider designing anti-malware capabilities into mobile applications. Applications should not retain sensitive customer information on the device, such as user IDs and passwords, and the application should securely wipe any sensitive customer information from memory when the customer exits the application. If a third party developed the application, the third-party developer should incorporate these control requirements into its development process."]
[863,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","N.A","When offering MFS, management should mitigate identified risks by implementing effective controls across the institution. As is the case with any new product offering, management should develop and implement policies and procedures to comply with applicable laws and regulations and require appropriate internal controls for security and confidentiality of the MFS transactions. As part of the institution’s audit of retail payments systems, audit coverage should include MFS."]
[864,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Management effectively responds to issues raised or problems related to MFS.","2. Review management’s response to audit recommendations on MFS, if any, noted since the prior examination. Consider the following:\na. Adequacy and timing of corrective action.\nb. Resolution of root causes rather than just specific audit deficiencies.\nc. Existence of any outstanding issues.\nd. Monitoring systems used to track the implementation of recommendations on an ongoing basis."]
[865,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","SMS Technology Risk Mitigation\nFinancial institution management should employ compensating controls (e.g., redacting customer account numbers when sent via SMS) to mitigate the inability to encrypt SMS messages. Additionally, management should limit the access or functionality available to the customer through SMS banking. When the transaction risk is more significant, management should consider other risk mitigation methods, including pre-registration and the use of security tokens. PINs also could be employed, but are often easier to break and harder to remember. To strengthen the security of PIN usage, management can implement specific requirements (e.g., requiring them to be regularly changed). An institution should update its customer awareness materials to include information on avoiding phishing messages by SMS."]
[866,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","SMS Technology Risk Mitigation\nFinancial institution management should employ compensating controls (e.g., redacting customer account numbers when sent via SMS) to mitigate the inability to encrypt SMS messages. Additionally, management should limit the access or functionality available to the customer through SMS banking. When the transaction risk is more significant, management should consider other risk mitigation methods, including pre-registration and the use of security tokens. PINs also could be employed, but are often easier to break and harder to remember. To strengthen the security of PIN usage, management can implement specific requirements (e.g., requiring them to be regularly changed). An institution should update its customer awareness materials to include information on avoiding phishing messages by SMS."]
[867,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile-enabled Web sites are designed with the following mitigating controls to help minimize the potential for exploitation of “redirect and forward” vulnerabilities:\n – Avoid using redirects and forwards. \n– Explicitly hard code the URL to prevent manipulation by an attacker.\n – Apply additional validation or control checks to verify the user trying to access the URL, validate the URL, check the appropriateness of the URL request, and prevent a malicious user from redirecting site users to a phishing, malicious, or nonaffiliated site.\n – Create a whitelist of trusted URLs.\n – Force all redirects to go through a page that notifies a user that he or she is leaving the page and require user confirmation.\n – Perform frequent vulnerability scans."]
[868,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Trusted platform modules."]
[869,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Tokenization to limit the transmission of account information."]
[870,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Logging and monitoring. Management should have logging and monitoring capabilities on all MFS to track customer activity and security changes and identify anomalous behavior and transactions."]
[871,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Traffic filtering to help prevent or minimize denial-of-service attacks"]
[872,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Logging and monitoring. Management should have logging and monitoring capabilities on all MFS to track customer activity and security changes and identify anomalous behavior and transactions."]
[873,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile-enabled Web sites are designed with the following mitigating controls to help minimize the potential for exploitation of “redirect and forward” vulnerabilities:\n – Avoid using redirects and forwards. \n– Explicitly hard code the URL to prevent manipulation by an attacker.\n – Apply additional validation or control checks to verify the user trying to access the URL, validate the URL, check the appropriateness of the URL request, and prevent a malicious user from redirecting site users to a phishing, malicious, or nonaffiliated site.\n – Create a whitelist26 of trusted URLs.\n – Force all redirects to go through a page that notifies a user that he or she is leaving the page and require user confirmation.\n – Perform frequent vulnerability scans."]
[874,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Anti-malware software."]
[875,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Logging and monitoring. Management should have logging and monitoring capabilities on all MFS to track customer activity and security changes and identify anomalous behavior and transactions."]
[876,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile browsers have available safeguards implemented, such as anti-XSS modules or additional monitoring of browsers for those that are no longer supported, and deny access to devices with mobile browsers not meeting minimum standards"]
[877,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile-enabled Web sites are designed with the following mitigating controls to help minimize the potential for exploitation of “redirect and forward” vulnerabilities:\n – Avoid using redirects and forwards. \n– Explicitly hard code the URL to prevent manipulation by an attacker.\n – Apply additional validation or control checks to verify the user trying to access the URL, validate the URL, check the appropriateness of the URL request, and prevent a malicious user from redirecting site users to a phishing, malicious, or nonaffiliated site.\n – Create a whitelist26 of trusted URLs.\n – Force all redirects to go through a page that notifies a user that he or she is leaving the page and require user confirmation.\n – Perform frequent vulnerability scans."]
[878,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Anti-malware software."]
[879,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Mobile Application Risk Mitigation: Employing tools, such as policy enforcement and device fingerprinting, to determine whether a customer’s mobile device will be allowed to access the institution’s MFS by validating device characteristics (e.g., level of security controls, operating system type, operating system version, whether the mobile device is rooted or jailbroken, and patch status)."]
[880,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Determine whether mobile-enabled Web sites are designed with the following mitigating controls to help minimize the potential for exploitation of “redirect and forward” vulnerabilities:\n – Avoid using redirects and forwards. \n– Explicitly hard code the URL to prevent manipulation by an attacker.\n – Apply additional validation or control checks to verify the user trying to access the URL, validate the URL, check the appropriateness of the URL request, and prevent a malicious user from redirecting site users to a phishing, malicious, or nonaffiliated site.\n – Create a whitelist26 of trusted URLs.\n – Force all redirects to go through a page that notifies a user that he or she is leaving the page and require user confirmation.\n – Perform frequent vulnerability scans."]
[881,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management effectively identifies and implements controls to mitigate identified and prioritized risks associated with the MFS offering.","5. Determine whether management has appropriate and independent testing of controls for effectiveness."]
[882,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management maintains effective oversight of MFS activities. Management maintains appropriate reporting for various levels of management to support that oversight.","2. Determine whether the institution’s reporting process describes the following:\na. MFS activities.\nb. Information to meet the needs of the various levels of management.\nc. Trends, volumes, and changes in activity over time.\nd. Statistics on demographics and locations served to evaluate whether the institution is meeting its strategy"]
[883,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Discuss corrective action and communicate findings.","1. Review preliminary conclusions with the examiner-in-charge (EIC) regarding the following:\na. Violations of laws and regulations.\nb. Significant issues warranting inclusion as matters requiring attention or recommendations in the report of examination.\nc. Proposed URSIT33 management component rating and the potential impact of the conclusion on composite or other component information technology ratings.\nd. Potential impact of the conclusions on the institution’s risk assessment.\n2. Discuss findings with management and obtain proposed corrective action for significant deficiencies.\n3. Document conclusions in a memorandum to the EIC that provides report-ready comments for all relevant sections of the report of examination and guidance to future examiners.\n4. Organize work papers to ensure clear support for significant findings by examination objective."]
[884,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Discuss corrective action and communicate findings.","1. Review preliminary conclusions with the examiner-in-charge (EIC) regarding the following:\na. Violations of laws and regulations.\nb. Significant issues warranting inclusion as matters requiring attention or recommendations in the report of examination.\nc. Proposed URSIT33 management component rating and the potential impact of the conclusion on composite or other component information technology ratings.\nd. Potential impact of the conclusions on the institution’s risk assessment.\n2. Discuss findings with management and obtain proposed corrective action for significant deficiencies.\n3. Document conclusions in a memorandum to the EIC that provides report-ready comments for all relevant sections of the report of examination and guidance to future examiners.\n4. Organize work papers to ensure clear support for significant findings by examination objective."]
[885,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Technologies","Short Message Service","SMS is a text messaging service component of phone, Web, or mobile communication systems. SMS uses standardized communications protocols to allow devices to exchange short text messages. Messages are typically limited to 160 characters and communicate either between mobile devices or between businesses and mobile devices (e.g., financial institutions requesting customer verification of transactions). Within the context of MFS, a customer uses SMS to provide financial transaction instructions to their financial institution. Financial institutions use SMS to provide information to customers, including account alerts or to communicate one-time passwords for Web site authentication."]
[886,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Technologies","Mobile-Enabled Web Sites","A mobile device’s browser allows customers to access a financial institution’s Web site. Many financial institutions provide mobile-enabled Web sites, in addition to their regular Web site, which may improve the customer experience. The mobile-enabled Web site is designed to detect the type of device the customer is using (e.g., mobile device or desktop computer) and displays Web pages in the best format for that device."]
[887,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Technologies","Mobile Applications","Mobile applications are downloadable software applications developed specifically for use on mobile devices. Mobile financial applications are developed by or for financial institutions to allow customers to perform account inquiries, retrieve information, or initiate financial transactions. This technology leverages features and functions unique to each type of mobile device and often provides a more user-friendly interface than is possible or available with either SMS or Web-based mobile banking."]
[888,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Technologies","Wireless Payment Technologies","Customers may use mobile technologies to initiate wireless payments at point-of-sale (POS) terminals, make person-to-person (P2P) payments, or make other types of wireless payments, such as parking meter and mass transit access payments. Mobile wallets3 allow customers to make wireless payments with a virtual payment card, as opposed to a physical card. The exchange of payment credentials and authorization between the mobile device and the payment recipient can use different core technologies. Technologies that provide the ability to make wireless payments include the following: 1) Near field communication (NFC). Wireless protocol that allows for exchange of payment credentials stored on the mobile device and other data at close range. For example, NFC is used to facilitate mobile payment systems developed by mobile phone manufacturers in conjunction with issuing financial institutions. 2) Image-based. Coded images similar to bar codes used to initiate payments. Credentials may be encoded within an image or stored in the cloud. For example, specific retailers use quick response (QR) codes4 to identify customers in a closed-loop mobile payment5 system. 3) Carrier-based. Payments billed directly to a customer’s mobile carrier account. Merchants are paid directly by the mobile carrier, bypassing traditional payment networks. For example, a carrier-based payment may occur when mobile users donate money to charity through SMS messages. 4) Mobile P2P. Payments initiated on a mobile device using the recipient’s mobile phone number, e-mail address, or other identifier. Payment is through established retail payment technologies. For example, customers may download a P2P mobile application from their financial institution that allows them to send money to other users enrolled in the institution’s system."]
[889,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Require developers to build a secure Web site especially for mobile devices and encourage them to follow the guidelines provided from the Open Web Application Security Project (OWASP)25 Top 10 for Web application and OWASP Top 10 for mobile."]
[890,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Establishing processes when implementing mobile applications to collect only necessary information and appropriately secure that information and any related analytics reporting available within or external to the mobile application."]
[891,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Management effectively responds to issues raised or problems related to MFS.","1. Review examination documents and financial institution reports for outstanding issues or problems related to MFS. Consider the following:\na. Pre-examination planning memos.\nb. Prior regulatory reports of examination.\nc. Prior examination work papers.\nd. Internal and external audit reports, including SSAE 1631 reports.\ne. Financial institution’s overall risk assessment and strategic plan","GV.IR"]
[892,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Monitoring and Reporting","N.A","Identify specific objectives and performance criteria, including quantitative benchmarks for evaluating success of the product or service.","GV.SP-2"]
[893,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Mobile Financial Services Work Program","Financial institution management incorporates (or plans to incorporate) its plan for implementing MFS into its strategic planning process.","1. Determine whether financial institution management has an MFS strategy to identify the types of MFS that management plans to offer.\n2. Describe the MFS that the financial institution offers. Determine whether the institution offers or implements MFS through one or more of the following technologies:\na. SMS.\nb. Mobile-enabled Web sites or browsers.\nc. Mobile applications.\nd. Technologies that enable mobile payments","GV.TE-1"]
[894,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-1","The organization’s role in the supply chain is identified and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.3\nA.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","TSP Alternatives","It is incumbent on financial institutions and third-party service providers to identify and prepare for potentially-significant disruptive events, including those that may have a low probability of occurring but would have a high impact on the institution. In these situations,  a financial institution and its TSPs should assess the impact on their respective customers and take the necessary steps to minimize the impact of the event."]
[895,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","TSP Alternatives","It is incumbent on financial institutions and third-party service providers to identify and prepare for potentially-significant disruptive events, including those that may have a low probability of occurring but would have a high impact on the institution. In these situations,  a financial institution and its TSPs should assess the impact on their respective customers and take the necessary steps to minimize the impact of the event."]
[896,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Communications Infrastructure Disruption","A financial institution should recognize these possible scenarios and plan for alternate communications infrastructure: \n1. Reliance on a single communications provider, potentially creating a single point of failure.\n2. Disruptions that affect multiple financial institutions due to TSP concentration.\n3. Simultaneous disruptions of telecommunications and electronic messaging due to the convergence of voice and data services in the same network.\n4. Disruption of data and voice communications between other entities and TSPs."]
[897,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","TSP Alternatives","It is incumbent on financial institutions and third-party service providers to identify and prepare for potentially-significant disruptive events, including those that may have a low probability of occurring but would have a high impact on the institution. In these situations,  a financial institution and its TSPs should assess the impact on their respective customers and take the necessary steps to minimize the impact of the event."]
[898,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","For critical business functions, test strategies and plans should be extended beyond third-party network connectivity and include transaction processing and functionality testing to assess infrastructure, capacity, and data integrity."]
[899,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Performing integrated tests or exercises that incorporate more than one system or application, as well as external dependencies, to gauge the effectiveness of continuity plans for a business line or major function."]
[900,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Testing interdependencies where two or more departments, business lines, processes, functions, and/or third parties support one another."]
[901,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Communications Infrastructure Disruption","A financial institution should recognize these possible scenarios and plan for alternate communications infrastructure: \n1. Reliance on a single communications provider, potentially creating a single point of failure.\n2. Disruptions that affect multiple financial institutions due to TSP concentration.\n3. Simultaneous disruptions of telecommunications and electronic messaging due to the convergence of voice and data services in the same network.\n4. Disruption of data and voice communications between other entities and TSPs."]
[902,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Communications Infrastructure Disruption","A financial institution should recognize these possible scenarios and plan for alternate communications infrastructure: \n1. Reliance on a single communications provider, potentially creating a single point of failure.\n2. Disruptions that affect multiple financial institutions due to TSP concentration.\n3. Simultaneous disruptions of telecommunications and electronic messaging due to the convergence of voice and data services in the same network.\n4. Disruption of data and voice communications between other entities and TSPs."]
[903,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Foreign-based service providers: A financial institution should review data security controls of foreign-based TSPs or foreign-based subcontractors that back up and/or store data offshore. Because information security and data privacy standards may be different in foreign jurisdictions, the contract should clearly address the need for data security and confidentiality to, at a minimum, adhere to U.S. regulatory standards."]
[904,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","TSP updates: Contracts should empower a financial institution to request information from its service provider(s) describing the TSP’s response to relevant regulations, supervisory guidance, or other notices published by any of the federal banking agencies"]
[905,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Financial institutions and their service providers should anticipate potential cyber incidents and develop a framework to respond to these incidents."]
[906,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","A financial institution should develop plausible and realistic scenarios of threats that may potentially disrupt business processes and the financial institution’s ability to meet both business requirements and customers' expectations. These scenarios should include those threats that may affect services provided by third parties to test the incident response plan and crisis management, including communication processes with third-party providers and other applicable stakeholders."]
[907,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - TSP outage or disruption, resulting in activation of the third party’s alternative recovery arrangements"]
[908,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP -  Financial institution outage or disruption"]
[909,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - Cyber events demonstrating the financial institution’s and third-party provider’s ability to respond quickly and efficiently to such an event."]
[910,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - Simultaneous attack affecting both the institution and its service provider."]
[911,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Insider Threats","The financial institution should consider the possibility that a knowledgeable insider may cause a disruptive event and the potential impact of the event on business resilience."]
[912,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","Financial institution management should ensure that any issues identified with either their recovery capabilities or those of their TSPs are documented with action plans and target dates for resolution."]
[913,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Increased awareness of potential insider threats;"]
[914,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","For critical business functions, test strategies and plans should be extended beyond third-party network connectivity and include transaction processing and functionality testing to assess infrastructure, capacity, and data integrity."]
[915,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Performing integrated tests or exercises that incorporate more than one system or application, as well as external dependencies, to gauge the effectiveness of continuity plans for a business line or major function."]
[916,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Testing interdependencies where two or more departments, business lines, processes, functions, and/or third parties support one another."]
[917,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","Financial institution management should ensure that any issues identified with either their recovery capabilities or those of their TSPs are documented with action plans and target dates for resolution."]
[918,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Following testing, the financial institution should evaluate the results and understand any gaps that may exist between the service provider and the institution. A plan should be developed to ensure these gaps are addressed as appropriate"]
[919,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","N.A","Financial institutions, and their TSPs, need to incorporate the potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place"]
[920,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","If a financial institution or its TSP is under attack, management should consider the potential impact of any decision to limit or suspend processing and any downstream implications to the financial institution’s business partners, customers, or other TSPs."]
[921,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","N.A","Financial institutions, and their TSPs, need to incorporate the potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place"]
[922,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Financial institutions and their service providers should anticipate potential cyber incidents and develop a framework to respond to these incidents."]
[923,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","Financial institution management should ensure that any issues identified with either their recovery capabilities or those of their TSPs are documented with action plans and target dates for resolution."]
[924,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Following testing, the financial institution should evaluate the results and understand any gaps that may exist between the service provider and the institution. A plan should be developed to ensure these gaps are addressed as appropriate"]
[925,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","The terms of service should be defined in written contracts that have been reviewed by a financial institution’s legal counsel and subject matter experts before execution."]
[926,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Default and termination: Contracts should define events that constitute contractual default (e.g., the inability to meet BCP provisions, SLAs, and/or RTOs) and provide a list of acceptable remedies and opportunities for curing a default."]
[927,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Data governance: Contracts should clearly define data ownership and handling expectations during the relationship and following the conclusion of the contract."]
[928,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Strategic Considerations","Financial institution management should ensure business resilience considerations are embedded within their third-party risk management life cycle."]
[929,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Subcontracting: If agreements allow for subcontracting, the TSP’s contractual provisions should also apply to the subcontractor. Contract provisions should clearly state that the primary TSP has overall accountability for all services that the TSP and its subcontractors provide, including business continuity capabilities. Agreements should define the services that may be subcontracted, the TSP’s due diligence process for engaging and monitoring subcontractors, and the notification requirements regarding changes to the TSP’s subcontractors. The contractual provisions should also address the right to audit and BCP testing requirements for subcontractors."]
[930,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Foreign-based service providers: A financial institution should review data security controls of foreign-based TSPs or foreign-based subcontractors that back up and/or store data offshore. Because information security and data privacy standards may be different in foreign jurisdictions, the contract should clearly address the need for data security and confidentiality to, at a minimum, adhere to U.S. regulatory standards."]
[931,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","BCP testing: Contracts should address the financial institution’s BCP testing requirements for the TSPs. The contract should define testing frequency and the availability of test results. The contract should also include the financial institution’s ability to participate in the TSP’s BCP testing on a periodic basis"]
[932,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Security issues: Contracts should clearly state the responsibility of the TSP to address security issues associated with services and, where appropriate, to communicate the issue(s) and solution(s) to its financial institution clients."]
[933,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Strategic Considerations","the oversight and controls on outsourced activities should be commensurate with the level of risk presented by these arrangements."]
[934,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Strategic Considerations","The financial institution should ensure that each TSP has a robust third-party management program that includes a review of each subcontractor’s business continuity plan."]
[935,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","the right to perform or participate in BCP testing with third parties should be described within the contract governing the third-party relationship."]
[936,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Financial institutions and their service providers should anticipate potential cyber incidents and develop a framework to respond to these incidents."]
[937,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","a financial institution relying on such third-party services should plan for potential limited availability during a large-scale cyber event"]
[938,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Due Diligence","A financial institution should evaluate and perform thorough due diligence before engaging a TSP."]
[939,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Due Diligence"," A financial institution should consider the maturity of new technologies and gain an understanding of the benefits and risks of engaging TSPs using such technologies during the due diligence process."]
[940,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Due Diligence","An institution should understand the due diligence process the TSP uses for its subcontractors and service providers. "]
[941,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Subcontracting: If agreements allow for subcontracting, the TSP’s contractual provisions should also apply to the subcontractor. Contract provisions should clearly state that the primary TSP has overall accountability for all services that the TSP and its subcontractors provide, including business continuity capabilities. Agreements should define the services that may be subcontracted, the TSP’s due diligence process for engaging and monitoring subcontractors, and the notification requirements regarding changes to the TSP’s subcontractors. The contractual provisions should also address the right to audit and BCP testing requirements for subcontractors."]
[942,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Strategic Considerations","the oversight and controls on outsourced activities should be commensurate with the level of risk presented by these arrangements."]
[943,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","TSP Alternatives","A financial institution should have contingency plans in place to address alternatives for the resilience of services supporting critical operations if the current TSP cannot continue to provide the service. These plans should identify alternate TSPs or in-house arrangements and preparations required for such a conversion to the extent possible."]
[944,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","Strategic Considerations","Given the increased concentration of providers in the TSP industry, a financial institution should ensure that it has identified, and potentially prearranged, a comprehensive set of alternative resources to provide full resilience of operations in such scenarios."]
[945,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","The testing program should be based on a financial institution’s established risk prioritization and evaluation of the criticality of the functions involved."]
[946,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","a financial institution relying on such third-party services should plan for potential limited availability during a large-scale cyber event"]
[947,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Due Diligence","the financial institution should review the TSP’s BCP program and its alignment with the financial institution’s own program, including an evaluation of the TSP’s BCP testing strategy and results to ensure they meet the financial institution’s requirements and promote resilience.","DM.ED-6"]
[948,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","TSP updates: Contracts should empower a financial institution to request information from its service provider(s) describing the TSP’s response to relevant regulations, supervisory guidance, or other notices published by any of the federal banking agencies","DM.ED-6"]
[949,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Strategic Considerations","The financial institution should ensure that each TSP has a robust third-party management program that includes a review of each subcontractor’s business continuity plan.","DM.ED-6"]
[950,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","Strategic Considerations","A financial institution should ensure that its TSPs have adequate planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption","DM.ED-6"]
[951,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","N.A","Financial institutions, and their TSPs, need to incorporate the potential impact of a cyber event into their BCP process and ensure appropriate resilience capabilities are in place","DM.ED-6"]
[952,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Right to audit: Agreements should provide for the right of the financial institution or its representatives to audit the TSP and/or to have access to audit reports. A financial institution should review available audit reports addressing TSPs’ resiliency capabilities and interdependencies (e.g., subcontractors), BCP testing, and remediation efforts, and assess the impact, if any, on the financial institution’s BCP."]
[953,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Ongoing Monitoring","Management should effectively monitor TSP performance throughout the life of the contract."]
[954,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Ongoing Monitoring","The financial institution should perform periodic in-depth assessments of the TSP’s control environment, including BCP, through the review of service provider business continuity plan testing activities, independent and/or third party assessments,7 and management information systems (MIS) reports to assess the potential impact on the financial institution’s business resilience"]
[955,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Ongoing Monitoring","The financial institution should ensure that results of such reviews are documented and reported by the TSP to the appropriate management oversight committee or the board of directors and used to determine any necessary changes to the financial institution’s BCP and, if warranted, the service provider contract."]
[956,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Establishing and monitoring performance standards: Contracts should define measurable service level agreements (SLAs) for the services being provided. For business continuity expectations, clear recovery time objectives and recovery point objectives (RPOs) should be addressed."]
[957,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","BCP testing: Contracts should address the financial institution’s BCP testing requirements for the TSPs. The contract should define testing frequency and the availability of test results. The contract should also include the financial institution’s ability to participate in the TSP’s BCP testing on a periodic basis"]
[958,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","TSP updates: Contracts should empower a financial institution to request information from its service provider(s) describing the TSP’s response to relevant regulations, supervisory guidance, or other notices published by any of the federal banking agencies"]
[959,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","Strategic Considerations","A financial institution should ensure that its TSPs have adequate planning and testing strategies that address severe events in order to identify single points of failure that would cause wide-scale disruption"]
[960,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","Testing with third parties should disclose the adequacy of both organizations’ ability to recover, restore, resume, and maintain operations after disruptions, consistent with business and contractual requirements."]
[961,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","The testing program should be based on a financial institution’s established risk prioritization and evaluation of the criticality of the functions involved."]
[962,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","A financial institution should ensure it is an active participant in its TSPs’ testing programs and that these providers have a testing strategy that includes testing plausible significant disruptive events"]
[963,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","A financial institution should ensure that it understands its TSP's testing process to ensure that the testing is adequate to meet its continuity ex-pectations."]
[964,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","the right to perform or participate in BCP testing with third parties should be described within the contract governing the third-party relationship."]
[965,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Because not all clients can participate in every testing activity, TSPs should be transparent about testing activities and results and should provide information that facilitates third-party relationship monitoring."]
[966,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Service providers should share test results and reports, remediation action plans and status reports on their completion, and related analysis/modeling."]
[967,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","each financial institution should participate in its TSP’s BCP testing program when possible."]
[968,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Following testing, the financial institution should evaluate the results and understand any gaps that may exist between the service provider and the institution. A plan should be developed to ensure these gaps are addressed as appropriate"]
[969,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Due Diligence","As part of its due diligence, a financial institution should assess the effectiveness of a TSP’s business continuity program, with particular emphasis on recovery capabilities and capacity"]
[970,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Establishing and monitoring performance standards: Contracts should define measurable service level agreements (SLAs) for the services being provided. For business continuity expectations, clear recovery time objectives and recovery point objectives (RPOs) should be addressed."]
[971,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","BCP testing: Contracts should address the financial institution’s BCP testing requirements for the TSPs. The contract should define testing frequency and the availability of test results. The contract should also include the financial institution’s ability to participate in the TSP’s BCP testing on a periodic basis"]
[972,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","Strategic Considerations","Institutions of all sizes should consider methods to participate through user groups or industry initiatives to test recovery scenarios."]
[973,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","The testing program should be based on a financial institution’s established risk prioritization and evaluation of the criticality of the functions involved."]
[974,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","A financial institution should ensure it is an active participant in its TSPs’ testing programs and that these providers have a testing strategy that includes testing plausible significant disruptive events"]
[975,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","A financial institution should ensure that it understands its TSP's testing process to ensure that the testing is adequate to meet its continuity ex-pectations."]
[976,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","N.A","the right to perform or participate in BCP testing with third parties should be described within the contract governing the third-party relationship."]
[977,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","A financial institution should develop plausible and realistic scenarios of threats that may potentially disrupt business processes and the financial institution’s ability to meet both business requirements and customers' expectations. These scenarios should include those threats that may affect services provided by third parties to test the incident response plan and crisis management, including communication processes with third-party providers and other applicable stakeholders."]
[978,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - TSP outage or disruption, resulting in activation of the third party’s alternative recovery arrangements"]
[979,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP -  Financial institution outage or disruption"]
[980,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - Cyber events demonstrating the financial institution’s and third-party provider’s ability to respond quickly and efficiently to such an event."]
[981,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - Simultaneous attack affecting both the institution and its service provider."]
[982,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Conducting end-to-end exercises to demonstrate the ability of the financial institution to recover a business process from initiation (e.g., customer contact) through process finalization (e.g., transaction closure), including functions provided by a TSP."]
[983,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Conducting full-scale exercises that involve recovery of systems and applications in an interactive manner in a recovery environment, including all critical functions and modules provided by a TSP."]
[984,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Performing exercises that include the financial institution’s third-party provider’s subcontractors, vendors, or servicers."]
[985,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Because not all clients can participate in every testing activity, TSPs should be transparent about testing activities and results and should provide information that facilitates third-party relationship monitoring."]
[986,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Service providers should share test results and reports, remediation action plans and status reports on their completion, and related analysis/modeling."]
[987,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","each financial institution should participate in its TSP’s BCP testing program when possible."]
[988,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Strategic Considerations","Following testing, the financial institution should evaluate the results and understand any gaps that may exist between the service provider and the institution. A plan should be developed to ensure these gaps are addressed as appropriate"]
[989,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","Management at the financial institution and the TSP should ensure appropriate redundancy controls and segregation of replicated backup data files to provide for sufficient recovery capabilities against these threats."]
[990,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Malware","To strengthen resilience against malware threats, financial institutions and TSPs should use a layered anti-malware strategy, including integrity checks, anomaly detection, system behavior monitoring, and employee security awareness training, in addition to traditional signature-based anti-malware systems."]
[991,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party management","Contracts","Security issues: Contracts should clearly state the responsibility of the TSP to address security issues associated with services and, where appropriate, to communicate the issue(s) and solution(s) to its financial institution clients."]
[992,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Malware","To strengthen resilience against malware threats, financial institutions and TSPs should use a layered anti-malware strategy, including integrity checks, anomaly detection, system behavior monitoring, and employee security awareness training, in addition to traditional signature-based anti-malware systems."]
[993,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Incident response processes should also address concerns regarding availability, confidentiality, and integrity of data with different sensitivities"]
[994,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Malware","To strengthen resilience against malware threats, financial institutions and TSPs should use a layered anti-malware strategy, including integrity checks, anomaly detection, system behavior monitoring, and employee security awareness training, in addition to traditional signature-based anti-malware systems."]
[995,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","financial institutions and TSPs should ensure that data integrity controls are in place to detect possible corruption in production and backup data."]
[996,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Data integrity controls, such as check sums;"]
[997,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Incident response processes should also address concerns regarding availability, confidentiality, and integrity of data with different sensitivities"]
[998,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Malware","To strengthen resilience against malware threats, financial institutions and TSPs should use a layered anti-malware strategy, including integrity checks, anomaly detection, system behavior monitoring, and employee security awareness training, in addition to traditional signature-based anti-malware systems."]
[999,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","financial institutions and TSPs should ensure that data integrity controls are in place to detect possible corruption in production and backup data."]
[1000,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Data integrity controls, such as check sums;"]
[1001,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Incident response processes should also address concerns regarding availability, confidentiality, and integrity of data with different sensitivities"]
[1002,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","the financial institution and its TSPs should periodically update and test their incident response plan to ensure that it functions as intended, given the rapidly changing threat landscape"]
[1003,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","the financial institution and TSP should take steps to ensure that replicated backup data cannot be destroyed or corrupted in an attack on production data."]
[1004,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Data backup architectures and technology that minimize the potential for data destruction and corruption"]
[1005,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","Management at the financial institution and the TSP should ensure appropriate redundancy controls and segregation of replicated backup data files to provide for sufficient recovery capabilities against these threats."]
[1006,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Third-party capacity","Strategic Considerations","Institutions of all sizes should consider methods to participate through user groups or industry initiatives to test recovery scenarios."]
[1007,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","A financial institution should develop testing strategies that demonstrate its ability to support connectivity, functionality, volume, and capacity using alternate facilities."]
[1008,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","A financial institution should develop plausible and realistic scenarios of threats that may potentially disrupt business processes and the financial institution’s ability to meet both business requirements and customers' expectations. These scenarios should include those threats that may affect services provided by third parties to test the incident response plan and crisis management, including communication processes with third-party providers and other applicable stakeholders."]
[1009,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - TSP outage or disruption, resulting in activation of the third party’s alternative recovery arrangements"]
[1010,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP -  Financial institution outage or disruption"]
[1011,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - Cyber events demonstrating the financial institution’s and third-party provider’s ability to respond quickly and efficiently to such an event."]
[1012,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Scenarios","the financial institution should develop appropriate scenarios to test their response in the event of a significant event or crisis at the TSP - Simultaneous attack affecting both the institution and its service provider."]
[1013,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","Financial institutions and TSPs should develop specific procedures for the investigation and resolution of data corruption in response and recovery strategies"]
[1014,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","Financial institutions should ensure that cloud-based disaster recovery services protect against data destruction or corruption with the same level of assurance as non-cloud-based disaster recovery solutions"]
[1015,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Simultaneous Attack on Financial Institutions and TSPs","Financial insitutions and TSPs should consider their susceptibility to simultaneous attacks in their business resilience planning, recovery, and testing strategies."]
[1016,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Enhanced disaster recovery planning to include the possibility of simultaneous attacks"]
[1017,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Enhanced incident response plans reflecting the current threat landscape"]
[1018,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","For critical business functions, test strategies and plans should be extended beyond third-party network connectivity and include transaction processing and functionality testing to assess infrastructure, capacity, and data integrity."]
[1019,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Performing integrated tests or exercises that incorporate more than one system or application, as well as external dependencies, to gauge the effectiveness of continuity plans for a business line or major function."]
[1020,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Testing interdependencies where two or more departments, business lines, processes, functions, and/or third parties support one another."]
[1021,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Conducting end-to-end exercises to demonstrate the ability of the financial institution to recover a business process from initiation (e.g., customer contact) through process finalization (e.g., transaction closure), including functions provided by a TSP."]
[1022,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Conducting full-scale exercises that involve recovery of systems and applications in an interactive manner in a recovery environment, including all critical functions and modules provided by a TSP."]
[1023,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Testing with third-party TSPs","Testing Complexity","the financial institution should, as appropriate, consider the following: Performing exercises that include the financial institution’s third-party provider’s subcontractors, vendors, or servicers."]
[1024,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","financial institutions and TSPs should have plans and processes to reconstitute their operations after a destructive attack."]
[1025,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Increased awareness of potential insider threats;"]
[1026,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Incident response processes should also address concerns regarding availability, confidentiality, and integrity of data with different sensitivities"]
[1027,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","the financial institution and its TSPs should periodically update and test their incident response plan to ensure that it functions as intended, given the rapidly changing threat landscape"]
[1028,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-5","Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.2\nA.17.2.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Implementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Data or Systems Destruction and Corruption","financial institutions and TSPs should have plans and processes to reconstitute their operations after a destructive attack."]
[1029,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-5","Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.2\nA.17.2.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Implementing information security continuity\nAvailability of information processing facilities"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","Incident response processes should also address concerns regarding availability, confidentiality, and integrity of data with different sensitivities"]
[1030,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","If a financial institution or its TSP is under attack, management should consider the potential impact of any decision to limit or suspend processing and any downstream implications to the financial institution’s business partners, customers, or other TSPs."]
[1031,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Malware","To strengthen resilience against malware threats, financial institutions and TSPs should use a layered anti-malware strategy, including integrity checks, anomaly detection, system behavior monitoring, and employee security awareness training, in addition to traditional signature-based anti-malware systems."]
[1032,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Malware","To strengthen resilience against malware threats, financial institutions and TSPs should use a layered anti-malware strategy, including integrity checks, anomaly detection, system behavior monitoring, and employee security awareness training, in addition to traditional signature-based anti-malware systems."]
[1033,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Layered anti-malware strategy;"]
[1034,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Risks - Malware","To strengthen resilience against malware threats, financial institutions and TSPs should use a layered anti-malware strategy, including integrity checks, anomaly detection, system behavior monitoring, and employee security awareness training, in addition to traditional signature-based anti-malware systems."]
[1035,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Layered anti-malware strategy;"]
[1036,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Prearranged third-party forensic and incident management services"]
[1037,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations - Incident Response","the financial institution and TSP should consider identifying and making advance arrangements for third-party forensic and incident management services."]
[1038,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Independent, redundant alternative communications providers"]
[1039,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FFIEC","FFIEC Appx. J - \"IT Examination Handbook - Business Continuity Planning Booklet  - Appendix J: Strengthening the Resilience of Outsourced Technology Services\"","U.S","Cyber resilience","Strategic Considerations","The financial institution should consider the following mitigating controls incorporate them into their BCP: Independent, redundant alternative communications providers"]
[1040,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Risk Assessment","Principle: Firms should conduct regular assessments to identify Cybersecurity risks associated with Firm assets and vendors and prioritize their remediation. Effective practices include stablishing and implementing governance frameworks to:","a) Identify and maintain an inventory of assets authorized to access the Firm’s network:\n\n- critical assets should be accorded prioritized protection.\n- have strong policies to ensure that all assets are subjected to centralized review and control."]
[1041,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(e)dedicating resources to achieve the desired risk posture; and"]
[1042,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(b)ensuring active senior management, and as appropriate to the firm, board-level engagement with cybersecurity issues;","GV.SF-1"]
[1043,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Risk Assessment","Principle: Firms should conduct regular assessments to identify Cybersecurity risks associated with Firm assets and vendors and prioritize their remediation. Effective practices include stablishing and implementing governance frameworks to:","b) Conduct comprehensive risk assessments that include \n- an assessment of external and internal threats and asset vulnerabilities.\n- Prioritized and time-bound recommendations to remediate identified risks.","GV.RM-1"]
[1044,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","h) Implementation of measures to maintain client confidence, including:\n\n- provision of credit monitoring for individuals whose personal information has been compromised; and\n- reimbursement to customers for financial losses incurred.\n"]
[1045,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(a) defining a governance framework to support decision making based on risk appetite;","GV.SF-1"]
[1046,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(c)identifying frameworks and standards to address cybersecurity;","GV.SF-1"]
[1047,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(d)using metrics and thresholds to inform governance processes;","GV.SP-2"]
[1048,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","b) Incorporation of current Threat Intelligence to identify the most common incident types and address different attack scenarios, since incidents can occur along many different attack vectors."]
[1049,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cyber Intelligence and Information Sharing","Principle:  Firms should use Cyber Threat Intelligence to improve their ability to identify, detect and respond to Cybersecurity threats. Effective practices include:","a) Assigning responsibility for Cybersecurity intelligence gathering and analysis at the organizational and individual levels."]
[1050,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cyber Intelligence and Information Sharing","Principle:  Firms should use Cyber Threat Intelligence to improve their ability to identify, detect and respond to Cybersecurity threats. Effective practices include:","b) Establishing mechanisms to disseminate Threat Intelligence and analysis rapidly to appropriate groups within the Firm, for example, the Firm’s risk management and front-line information technology security staff."]
[1051,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cyber Intelligence and Information Sharing","Principle:  Firms should use Cyber Threat Intelligence to improve their ability to identify, detect and respond to Cybersecurity threats. Effective practices include:","c) Evaluating Threat Intelligence from tactical and strategic perspectives, and determining the appropriate time frame for the course of action."]
[1052,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Risk Assessment","Principle: Firms should conduct regular assessments to identify Cybersecurity risks associated with Firm assets and vendors and prioritize their remediation. Effective practices include stablishing and implementing governance frameworks to:","b) Conduct comprehensive risk assessments that include \n- an assessment of external and internal threats and asset vulnerabilities.\n- Prioritized and time-bound recommendations to remediate identified risks.","GV.RM-1"]
[1053,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Risk Assessment","Principle: Firms should conduct regular assessments to identify Cybersecurity risks associated with Firm assets and vendors and prioritize their remediation. Effective practices include stablishing and implementing governance frameworks to:","b) Conduct comprehensive risk assessments that include \n- an assessment of external and internal threats and asset vulnerabilities.\n- Prioritized and time-bound recommendations to remediate identified risks.","GV.RM-1"]
[1054,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cyber Insurance","Principle: Firms should evaluate the utility of Cyber insurance as a way to transfer some risk as part of their risk management processes. Effective practices include:","a) For Firms that have Cybersecurity coverage, conducting a periodic analysis of the adequacy of the coverage provided in connection with the Firm’s risk assessment process to determine if the policy and its coverage align with the Firm’s risk assessment and ability to bear losses:\n","GV.RM-1"]
[1055,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cyber Insurance","Principle: Firms should evaluate the utility of Cyber insurance as a way to transfer some risk as part of their risk management processes. Effective practices include:","b) For Firms that do not have Cyber insurance, evaluating the Cyber insurance market to determine if coverage is available that would enhance the Firm’s ability to manage the financial impact of Cybersecurity events.\n","GV.RM-1"]
[1056,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(a) defining a governance framework to support decision making based on risk appetite;","GV.SF-1"]
[1057,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(f) performing cybersecurity risk assessments (discussed in a later section)."]
[1058,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(a) defining a governance framework to support decision making based on risk appetite;","GV.SF-1"]
[1059,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1060,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Vendor Management","Principle: Firms should manage Cybersecurity risk that can arise across the lifecycle of vendor relationships using a risk-based approach to vendor management. Effective practices to manage Vendor risk include: ","f) Establishing, maintaining and monitoring vendor entitlements so as to align with Firm risk appetite and information security standards (see “Technical Controls” section)."]
[1061,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1062,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1063,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1064,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1065,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Staff Training","Principle:  Firms should provide Cybersecurity training that is tailored to staff needs. Effective practices for Cybersecurity training include:","a) Defining Cybersecurity training needs requirements;\nb) Identifying appropriate Cybersecurity training update cycles;\nc) Delivering interactive training with audience participation to increase retention; and\nd) Developing training around information from the Firm’s loss incidents, risk assessment process and Threat Intelligence gathering."]
[1066,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Staff Training","Principle:  Firms should provide Cybersecurity training that is tailored to staff needs. Effective practices for Cybersecurity training include:","a) Defining Cybersecurity training needs requirements;\nb) Identifying appropriate Cybersecurity training update cycles;\nc) Delivering interactive training with audience participation to increase retention; and\nd) Developing training around information from the Firm’s loss incidents, risk assessment process and Threat Intelligence gathering."]
[1067,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Staff Training","Principle:  Firms should provide Cybersecurity training that is tailored to staff needs. Effective practices for Cybersecurity training include:","a) Defining Cybersecurity training needs requirements;\nb) Identifying appropriate Cybersecurity training update cycles;\nc) Delivering interactive training with audience participation to increase retention; and\nd) Developing training around information from the Firm’s loss incidents, risk assessment process and Threat Intelligence gathering."]
[1068,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Staff Training","Principle:  Firms should provide Cybersecurity training that is tailored to staff needs. Effective practices for Cybersecurity training include:","a) Defining Cybersecurity training needs requirements;\nb) Identifying appropriate Cybersecurity training update cycles;\nc) Delivering interactive training with audience participation to increase retention; and\nd) Developing training around information from the Firm’s loss incidents, risk assessment process and Threat Intelligence gathering."]
[1069,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cybersecurity Governance and Risk Management","Principle: Firms should establish and implement a Cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage Cybersecurity risks. The framework should include defined risk management policies, processes and structures coupled with relevant controls tailored to the nature of the Cybersecurity risks the Firm faces and the resources the Firm has available. Effective practices include:","(b)ensuring active senior management, and as appropriate to the firm, board-level engagement with cybersecurity issues;"]
[1070,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Staff Training","Principle:  Firms should provide Cybersecurity training that is tailored to staff needs. Effective practices for Cybersecurity training include:","a) Defining Cybersecurity training needs requirements;\nb) Identifying appropriate Cybersecurity training update cycles;\nc) Delivering interactive training with audience participation to increase retention; and\nd) Developing training around information from the Firm’s loss incidents, risk assessment process and Threat Intelligence gathering."]
[1071,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1072,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1073,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1074,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1075,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1076,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","g) Involvement in industrywide, and Firm-specific simulation exercises as appropriate to the role and scale of a Firm’s business."]
[1077,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","a)  Preparation of incident responses for those types of incidents to which the Firm is most likely to be subject, e.g., loss of customer PII, data corruption, Dodos attack, network intrusion, customer account intrusion or malware infection"]
[1078,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","c) Containment and mitigation strategies for multiple incident types. Established procedures could led the Firm to address this situation more rapidly."]
[1079,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","d) Eradication and recovery plans for systems and data."]
[1080,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","e) Investigation and damage assessment processes."]
[1081,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1082,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Vendor Management","Principle: Firms should manage Cybersecurity risk that can arise across the lifecycle of vendor relationships using a risk-based approach to vendor management. Effective practices to manage Vendor risk include: ","e) Establishing and implementing procedures to terminate vendor access to Firm systems immediately upon contract termination: \n\n- How a Firm retrieves this data\n- How it is removed from vendor systems\n- How this removal is documented\n- How and when vendor access to Firm systems is revoked Until all data is deleted or access to that data is terminated, the vendor relationship should be included in the Firm’s risk assessment process and continually reviewed."]
[1083,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1084,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1085,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1086,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1087,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1088,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1089,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Vendor Management","Principle: Firms should manage Cybersecurity risk that can arise across the lifecycle of vendor relationships using a risk-based approach to vendor management. Effective practices to manage Vendor risk include: ","a) Performing pre-contract due diligence on prospective service providers;"]
[1090,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Vendor Management","Principle: Firms should manage Cybersecurity risk that can arise across the lifecycle of vendor relationships using a risk-based approach to vendor management. Effective practices to manage Vendor risk include: ","b) Establishing contractual terms appropriate to the sensitivity of information and systems to which the vendor may have access and which govern both the ongoing relationship with the vendor and the vendor’s obligations after the relationship ends:\n\n- Non-disclosure agreements and confidentiality agreements\n- Data storage, retention and delivery\n- Breach notification responsibilities\n- Right-to-audit clauses\n- Right-to-audit clauses\n- Vendor employee access limitations\n- Use of subcontractors\n- Vendor obligations upon contract termination"]
[1091,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Vendor Management","Principle: Firms should manage Cybersecurity risk that can arise across the lifecycle of vendor relationships using a risk-based approach to vendor management. Effective practices to manage Vendor risk include: ","c) Performing ongoing due diligence on existing vendors."]
[1092,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Vendor Management","Principle: Firms should manage Cybersecurity risk that can arise across the lifecycle of vendor relationships using a risk-based approach to vendor management. Effective practices to manage Vendor risk include: ","d) Including vendor relationships and outsourced systems and processes as part of the Firm’s ongoing risk assessment process."]
[1093,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1094,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[1095,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Incident Response Planning","Principle: Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents. Effective practices for incident response include:","f) Preparation of communication/notification plans for outreach to relevant stakeholders,\ne.g., customers, regulators, law enforcement, intelligence agencies, industry information sharing bodies."]
[1096,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Cyber Intelligence and Information Sharing","Principle:  Firms should use Cyber Threat Intelligence to improve their ability to identify, detect and respond to Cybersecurity threats. Effective practices include:","d) Participating in appropriate information sharing organizations—e.g., FS-ISAC—and\nperiodically evaluating the Firm’s information-sharing partners."]
[1097,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities would be required to maintain a current and complete listing of all internal assets and business functions, including mappings to[:]”  [a] other assets …"]
[1098,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities would be required to maintain a current and complete listing of all internal assets and business functions, including mappings to[:]”  [a] other assets …"]
[1099,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities would be required to maintain a current and complete listing of all internal assets and business functions, including mappings to[:]”  [a] other assets …"]
[1100,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities would be required to maintain a current and complete listing of all internal assets and business functions, including mappings to[:]”  [b] other business functions …"]
[1101,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities would be required to maintain a current and complete listing of all internal assets and business functions, including mappings to[:]”  [c] other … information flows, and"]
[1102,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] validate the effectiveness of internal and external communication protocols with stakeholders”"]
[1103,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-4","External information systems are catalogued",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Security of equipment and assets off-premises"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities would be required to maintain a current and complete listing of all internal assets and business functions, including mappings to[:]”  [a] other assets …"]
[1104,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-4","External information systems are catalogued",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Security of equipment and assets off-premises"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities would be required to maintain a current and complete listing of all internal assets and business functions, including mappings to[:]”  [d] other … interconnections"]
[1105,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] maintain an inventory of all business assets on an enterprise-wide basis prioritized according to the assets’ criticality to [:] “[a] the business functions they support,”"]
[1106,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] maintain an inventory of all business assets on an enterprise-wide basis prioritized according to the assets’ criticality to [:] “[b] the firm’s mission and”"]
[1107,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] maintain an inventory of all business assets on an enterprise-wide basis prioritized according to the assets’ criticality to [:] “[c] the financial sector”"]
[1108,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“The internal dependency management strategy would be designed to ensure that: roles and responsibilities for internal dependency management are well defined…”"]
[1109,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be … designed to [c] minimize risks to or from interconnected parties”"]
[1110,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and implement plans to identify and mitigate the cyber risks they pose through interconnectedness to sector partners and external stakeholders to prevent cyber contagion”","DM.BE-4"]
[1111,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be … designed to [b] support the achievement of financial sector-wide resilience”","DM.RS-3"]
[1112,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] address external interdependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, and other critical service providers or partners;”","DM.RS-3"]
[1113,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing of cyber resilience [shall] be undertaken jointly where critical dependencies exist;”","GV.RS-4"]
[1114,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing of cyber resilience [shall] be undertaken jointly where critical dependencies exist;”","GV.RS-4"]
[1115,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“The strategy would articulate … how the entity would … maintain resilience on an ongoing basis”","DM.RS-1"]
[1116,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] staffing, and","DM.RS-1"]
[1117,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] recovery and resilience strategies should address the potential for malware or corrupted data to replicate or propagate through connected systems or high availability solutions","DM.RS-1"]
[1118,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing of cyber resilience [shall] be undertaken jointly where critical dependencies exist;”","GV.RS-4"]
[1119,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[P]olicies and reporting structures to support and implement the entity’s cyber risk management strategy”","GV.PL-1, GV.SF-1"]
[1120,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]overed entity would be expected to establish and maintain policies, procedures, practices, controls, personnel and systems that address the applicable category, and to establish and maintain a corporate governance structure that implements the cyber risk management program on an enterprise-wide basis and along business line levels, monitors compliance with the program, and adjusts corporate practices to address the changes in risk presented by the firm’s operations\"","GV.PL-1, GV.SF-1"]
[1121,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“The board of directors of a covered entity would oversee and hold senior management accountable for implementing the entity’s cyber risk management framework”","GV.SF-1"]
[1122,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[S]enior leaders with responsibility for cyber risk oversight [must] be independent of business line management”","GV.IR-1"]
[1123,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[S]enior leaders [] need [] direct, independent access to the board of directors”","GV.RR-2"]
[1124,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[S]enior leaders [need to] … independently inform the board of directors on an ongoing basis of the firm’s cyber risk exposure and risk management practices, including known and emerging issues and trends”","GV.RR-2"]
[1125,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[D]elineated cyber risk management and oversight responsibilities for the organization, including reporting structures and expectations for: independent risk management,”","GV.IR-1"]
[1126,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[D]elineated cyber risk management and oversight responsibilities for the organization, including reporting structures and expectations for: internal control, and”","GV.AU-1"]
[1127,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[D]elineated cyber risk management and oversight responsibilities for the organization, including reporting structures and expectations for: internal audit personnel;”","GV.AU-1"]
[1128,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[T]he independent risk management function would be required to establish and maintain an up-to-date understanding of the structure of a covered entity’s cybersecurity [a] programs and supporting [b] processes and [c] systems, as well as their [d] relationships to the evolving cyber threat landscape”","GV.IR-1"]
[1129,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[The] external dependency management strategy would ensure that roles and responsibilities for external dependency management are well defined…”","DM.ED-3, DM.ID-2"]
[1130,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]overed entity would be expected to establish and maintain policies, procedures, practices, controls, personnel and systems that address the applicable category, and to establish and maintain a corporate governance structure that implements the cyber risk management program on an enterprise-wide basis and along business line levels, monitors compliance with the program, and adjusts corporate practices to address the changes in risk presented by the firm’s operations\"","GV.PL-1, GV.SF-1"]
[1131,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]overed entity would be expected to establish and maintain policies, procedures, practices, controls, personnel and systems that address the applicable category, and to establish and maintain a corporate governance structure that implements the cyber risk management program on an enterprise-wide basis and along business line levels, monitors compliance with the program, and adjusts corporate practices to address the changes in risk presented by the firm’s operations\"","GV.PL-1, GV.SF-1"]
[1132,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“The internal dependency management strategy would be designed to ensure that: … appropriate compliance mechanisms are in place”","DM.ID-1"]
[1133,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]overed entity would be expected to establish and maintain policies, procedures, practices, controls, personnel and systems that address the applicable category, and to establish and maintain a corporate governance structure that implements the cyber risk management program on an enterprise-wide basis and along business line levels, monitors compliance with the program, and adjusts corporate practices to address the changes in risk presented by the firm’s operations\"","GV.PL-1, GV.SF-1"]
[1134,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]overed entity would be expected to establish and maintain policies, procedures, practices, controls, personnel and systems that address the applicable category, and to establish and maintain a corporate governance structure that implements the cyber risk management program on an enterprise-wide basis and along business line levels, monitors compliance with the program, and adjusts corporate practices to address the changes in risk presented by the firm’s operations\"","GV.PL-1, GV.SF-1"]
[1135,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[A] covered entity must reduce its residual cyber risk to the appropriate level approved by the board of directors”","GV.SF-1"]
[1136,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[S]enior leaders with responsibility for cyber risk oversight [must] be independent of business line management”","GV.IR-1"]
[1137,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[S]enior leaders [] need [] direct, independent access to the board of directors”","GV.RR-2"]
[1138,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[D]elineated cyber risk management and oversight responsibilities for the organization, including reporting structures and expectations for: internal control, and”","GV.AU-1"]
[1139,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[D]elineated cyber risk management and oversight responsibilities for the organization, including reporting structures and expectations for: internal audit personnel;”","GV.AU-1"]
[1140,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[T]o the greatest extent possible and consistent with their organizational structure, [firms shall] integrate cyber risk management into the responsibilities of at least three independent functions (such as the three lines of defense risk-management model) with appropriate checks and balances” [Stated Rationale: “This would allow covered entities to more accurately and effectively identify, monitor, measure, manage, and report on cyber risk]","GV.RM-4"]
[1141,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[C]overed entities [must] incorporate enterprise-wide cyber risk management into the responsibilities of an independent risk management function”","GV.IR-1"]
[1142,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","[The independent risk management] function would report to the covered entity’s chief risk officer and board of directors, as appropriate, regarding implementation of the firm’s cyber risk management framework throughout the organization”","GV.IR-3"]
[1143,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[I]ndependent risk management would be continually required to assess the firm’s overall exposure to cyber risk and promptly notify the CEO and board of directors, as appropriate, when its assessment of a particular cyber risk differs from that of a business unit,”","GV.IR-3"]
[1144,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[I]ndependent risk management would be continually required to assess the firm’s overall exposure to cyber risk and promptly notify the CEO and board of directors, as appropriate, … of any instances when a unit of the covered entity has exceeded the entity’s established cyber risk tolerances”","GV.IR-3"]
[1145,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … determine whether cyber risk controls are appropriately in place across the enterprise consistent with the entity’s established risk appetite and tolerances”","GV.IR-2"]
[1146,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[C]overed entities [must] assess the [a] completeness, [b] effectiveness, and [c] timeliness with which they reduce the aggregate residual cyber risk of their systems to the appropriate, board-of-directors approved level","GV.IR-2"]
[1147,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[A] covered entity’s independent risk management function [must] have and maintain sufficient [a] independence, [b] stature, [c] authority, [d] resources, and [e] access to the board of directors to ensure that the operations of the entity are consistent with the cyber risk management framework","GV.IR-1"]
[1148,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“The reporting lines [of the independent risk management function] must be clear and separate from those for other operations and business units”","GV.IR-1"]
[1149,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[A] covered entity [must] integrate an internal dependency management strategy into the entity’s overall strategic risk management plan” [Stated Rationale: “The strategy would guide and inform measures taken to reduce cyber risks associated with a covered entity’s internal dependencies”]","DM.ID-1"]
[1150,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“The internal dependency management strategy would be designed to ensure that: … appropriate oversight is in place to monitor effectiveness in reducing cyber risks associated with internal dependencies”","DM.ID-1"]
[1151,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“Covered entities would track connections among assets and cyber risk levels throughout the life cycles of the assets and support relevant data collection and analysis across the organization”"]
[1152,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[The] external dependency management strategy would ensure that … policies, standards, and procedures for external dependency management throughout the lifespan of the relationship (for example, due diligence, contracting and sub-contracting, onboarding, ongoing monitoring, change management, off boarding) are … regularly updated …”","DM.ED-2"]
[1153,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[The] external dependency management strategy would ensure that … appropriate metrics are in place to measure effectiveness in reducing cyber risks associated with external dependencies…”","DM.ED-1"]
[1154,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[The] external dependency management strategy would ensure that … appropriate compliance mechanisms are in place”","DM.ED-1"]
[1155,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[C]overed entities [must] establish effective [a] policies, [b] plans, and [c] procedures to identify and manage real-time cyber risks associated with external dependencies, particularly those connected to or supporting sector-critical systems and operations, throughout their lifespans”","DM.ED-2"]
[1156,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]overed entity would be expected to establish and maintain policies, procedures, practices, controls, personnel and systems that address the applicable category, and to establish and maintain a corporate governance structure that implements the cyber risk management program on an enterprise-wide basis and along business line levels, monitors compliance with the program, and adjusts corporate practices to address the changes in risk presented by the firm’s operations\"","GV.PL-1, GV.SF-1"]
[1157,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[I]dentify and assess those activities and exposures that present cyber risk”,"]
[1158,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Business units would assess the cyber risks and potential vulnerabilities associated with every: “business asset … [] that is, their [:] workforce,"]
[1159,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Business units would assess the cyber risks and potential vulnerabilities associated with every: “business asset … [] that is, their [:] data,"]
[1160,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Business units would assess the cyber risks and potential vulnerabilities associated with every: “business asset … [] that is, their [:] technology"]
[1161,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Business units would assess the cyber risks and potential vulnerabilities associated with every: “business asset … [] that is, their [:] facilities”"]
[1162,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Business units would assess the cyber risks and potential vulnerabilities associated with every: “business asset … [] that is, their [:] service"]
[1163,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Business units would assess the cyber risks and potential vulnerabilities associated with every: “business asset … [] that is, their [:] IT connection point for the respective unit”"]
[1164,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to identify … cyber risk across the enterprise…”"]
[1165,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“The internal dependency management strategy would be designed to ensure that: … [a] policies, [b] standards, and [c] procedures to identify and manage cyber risks associated with internal assets, including those connected to or supporting sector-critical systems, are established…”"]
[1166,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[I]dentify and assess those activities and exposures that present cyber risk”,"]
[1167,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to identify … cyber risk across the enterprise…”"]
[1168,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Covered entities also would be required to establish and maintain threat profiles for identified threats to the firm;” [Threat Profile Definition: Threat profiles include information about critical assets, threat actors, and details about how threat actors might attempt to compromise those critical assets”]"]
[1169,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[I]dentify and assess those activities and exposures that present cyber risk”,"]
[1170,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to identify … cyber risk across the enterprise…”"]
[1171,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] establish and apply appropriate controls to address the inherent cyber risk of their assets (taking into account the prioritization of the entity’s business assets and the cyber risks they pose to the entity) by:  “[c] assessing relevant cyber risks to the assets (including insider threats to systems and data) and"]
[1172,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[C]overed entities [shall] analyze and address the cyber risks that emerge from reviews of their external relationships…”","DM.ED-4"]
[1173,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Covered entities also would be required to establish and maintain threat profiles for identified threats to the firm;” [Threat Profile Definition: Threat profiles include information about critical assets, threat actors, and details about how threat actors might attempt to compromise those critical assets”]"]
[1174,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[T]hen determine ways to aggregate them to assess the entity’s residual cyber risk” [Stated Rationale: “This is important because cyber risk has the potential to produce losses large enough to threaten an entity’s financial health, its reputation, or its ability to maintain core operations if faced with a material cyber event”]"]
[1175,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to identify … cyber risk across the enterprise…”"]
[1176,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[T]hen determine ways to aggregate them to assess the entity’s residual cyber risk” [Stated Rationale: “This is important because cyber risk has the potential to produce losses large enough to threaten an entity’s financial health, its reputation, or its ability to maintain core operations if faced with a material cyber event”]"]
[1177,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[Business] units responsible for the day-to-day business functions of a covered entity [must] assess, on an ongoing basis, the cyber risks associated with the activities of the business unit”"]
[1178,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … measure … cyber risk across the enterprise…”"]
[1179,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“Covered entities would track connections among assets and cyber risk levels throughout the life cycles of the assets and support relevant data collection and analysis across the organization”"]
[1180,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Covered entities also would be required to establish and maintain threat profiles for identified threats to the firm;” [Threat Profile Definition: Threat profiles include information about critical assets, threat actors, and details about how threat actors might attempt to compromise those critical assets”]"]
[1181,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Business units also would need to ensure that information regarding those risks is shared with senior management, including the chief executive officer (CEO), as appropriate, in a timely manner so that senior management can address and respond to emerging cyber risks and cyber incidents as they develop”"]
[1182,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Independent risk management would be required to analyze cyber risk at the enterprise level to identify and ensure effective response to events with the potential to impact one or multiple operating units”"]
[1183,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to prioritize … incident response … of systems critical to the enterprise…”","DM.ED-5"]
[1184,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[D]evelop a written, board-approved, enterprise-wide cyber risk management strategy that is incorporated into the overall business strategy and risk management of the firm”","GV.SF-1"]
[1185,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“The board of directors of a covered entity would oversee and hold senior management accountable for implementing the entity’s cyber risk management framework”","GV.SF-1"]
[1186,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[E]stablished mechanisms for evaluating whether the organization has sufficient resources to address the cyber risks facing the organization;”","GV.SF-3"]
[1187,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[E]stablished policies for addressing any resource shortfalls or knowledge gaps”","GV.SF-3"]
[1188,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[T]o the greatest extent possible and consistent with their organizational structure, [firms shall] integrate cyber risk management into the responsibilities of at least three independent functions (such as the three lines of defense risk-management model) with appropriate checks and balances” [Stated Rationale: “This would allow covered entities to more accurately and effectively identify, monitor, measure, manage, and report on cyber risk]","GV.RM-4"]
[1189,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[B]usiness units would be required to adhere to procedures and processes necessary to comply with the covered entity’s cyber risk management framework”","GV.RM-1"]
[1190,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Such procedures and processes would be designed to ensure that the applicable business unit’s cyber risk is effectively identified … consistent with the covered entity’s risk appetite and tolerances","GV.RM-1"]
[1191,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Such procedures and processes would be designed to ensure that the applicable business unit’s cyber risk is effectively … measured … consistent with the covered entity’s risk appetite and tolerances","GV.RM-1"]
[1192,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Such procedures and processes would be designed to ensure that the applicable business unit’s cyber risk is effectively … monitored … consistent with the covered entity’s risk appetite and tolerances","GV.RM-1"]
[1193,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“Such procedures and processes would be designed to ensure that the applicable business unit’s cyber risk is effectively … controlled … consistent with the covered entity’s risk appetite and tolerances","GV.RM-1"]
[1194,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to prioritize monitoring … of systems critical to the enterprise…”","DM.ED-5"]
[1195,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to prioritize … recovery of systems critical to the enterprise …”;","DM.ED-5"]
[1196,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support the continued reduction of the cyber risk exposure of external dependencies to the enterprise and the sector until the board-approved cyber risk appetite and tolerances are achieved;”","DM.ED-4"]
[1197,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Standards for Sector-Critical Systems of Covered Entities","N.A","“[C]overed entities [must] minimize the residual cyber risk of sector-critical systems by implementing the most effective, commercially available controls” [Minimization Definition/Expectation: “Minimizing residual cyber risk means substantially mitigating the risk of a disruption or failure due to a cyber event”]","GV.SP-1"]
[1198,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]ould require covered entities to establish a cybersecurity framework commensurate with the covered entity’s structure, risk profile, complexity, activities, and size\"","GV.PL-1"]
[1199,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[R]egulation would include details on the specific objectives and practices a firm would be required to achieve in each area of concern in order to demonstrate that its cyber risk management program can adapt to changes in a firm’s operations and to the evolving cyber environment\"","GV.SF-1"]
[1200,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[R]egulation would include details on the specific objectives and practices a firm would be required to achieve in each area of concern in order to demonstrate that its cyber risk management program can adapt to changes in a firm’s operations and to the evolving cyber environment\"","GV.SF-1"]
[1201,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“The strategy would articulate how the entity intends to address its inherent cyber risk (that is, its cyber risk before mitigating controls or other factors are taken into consideration)”;","GV.RM-2"]
[1202,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“The strategy would articulate … how the entity would maintain an acceptable level of residual cyber risk (that is, its remaining cyber risk after mitigating controls and other factors have been taken into consideration)”; and","GV.SF-3"]
[1203,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish cyber risk tolerances consistent with the firm’s risk appetite and strategy, and manage cyber risk appropriate to the nature of the operations of the firm”","GV.SF-3"]
[1204,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","The entity’s “board of directors” must “review and approve the enterprise-wide cyber risk appetite and tolerances of the covered entity”","GV.SF-3"]
[1205,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support the continued reduction of the cyber risk exposure of external dependencies to the enterprise and the sector until the board-approved cyber risk appetite and tolerances are achieved;”","DM.ED-4"]
[1206,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Standards for Sector-Critical Systems of Covered Entities","N.A","“Board-supervised covered entities, at the holding company level, [must] measure (quantitatively) their ability to reduce the aggregate residual cyber risk of their sector-critical systems and their ability to reduce such risk to a minimal level Such measurement would take into account the risks associated with internal dependencies, external dependencies, and trusted connections with access to sector-critical systems”"]
[1207,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On an ongoing basis, the independent risk management function would be required to … determine whether actions need to be taken to strengthen risk management or reduce risk given changes in the covered entity’s risk profile or other conditions, placing particular emphasis on sector-critical systems”","GV.IR-2"]
[1208,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] maintain an inventory of all business assets on an enterprise-wide basis prioritized according to the assets’ criticality to [:] “[c] the financial sector”"]
[1209,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[C]overed entities [must] … prioritize … all external dependencies and trusted connections enterprise-wide based on their criticality to the [a] business functions they support, [b] the firm’s mission, and [c] the financial sector”","DM.ED-5"]
[1210,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to prioritize monitoring … of systems critical to … the financial sector;","DM.ED-5"]
[1211,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to prioritize … incident response … of systems critical to … the financial sector”;","DM.ED-5"]
[1212,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to prioritize … recovery of systems critical to … the financial sector;”","DM.ED-5"]
[1213,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be … designed to [b] support the achievement of financial sector-wide resilience”"]
[1214,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[A] covered entity [must] integrate an external dependency management strategy into the entity’s overall strategic risk management plan to address and reduce cyber risks associated with external dependencies and interconnection risks”","DM.ED-1"]
[1215,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[The] external dependency management strategy would ensure that … policies, standards, and procedures for external dependency management throughout the lifespan of the relationship (for example, due diligence, contracting and sub-contracting, onboarding, ongoing monitoring, change management, off boarding) are established …”","DM.ED-2"]
[1216,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[C]overed entities [must] continually apply and evaluate appropriate controls to reduce the cyber risk of external dependencies to the enterprise and the sector”","DM.ED-4"]
[1217,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Scope of Application","N.A","\"[C]onsidering to apply the standards to third-party service providers with respect to services provided to depository institutions and their affiliates that are covered entities (covered services).\"","DM.ED-6"]
[1218,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[C]overed entities [must] have [] current, accurate, and complete awareness of … all external dependencies and trusted connections enterprise-wide ”","DM.ED-4"]
[1219,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[C]overed entities would be able to generate and maintain a current, accurate, and complete listing of all external dependencies and business functions, including mappings to supported assets and business functions”","DM.ED-5"]
[1220,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … track connections among [:] “external dependencies … throughout [its] lifespan[],”","DM.ED-5"]
[1221,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … track connections among [:] “and cyber risk levels throughout [its] lifespan[]”","DM.ED-5"]
[1222,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[Covered entities must] establish[] and apply[] appropriate controls to address the cyber risk presented by each external partner throughout the lifespan of the relationship”","DM.ED-4"]
[1223,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Scope of Application","N.A","\"[C]onsidering requiring nonbank financial companies and Board-supervised FMIs to verify that any services the nonbank financial company or Board-supervised FMI receives from third parties are subject to the same standards that would apply if the services were being conducted by the nonbank financial company or Board-supervised FMI itself.\"","DM.ED-6"]
[1224,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … monitor the universe of external dependencies that connect to assets supporting systems critical to the enterprise and the sector;”","DM.ED-5"]
[1225,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“[Covered entities shall] identify and periodically test alternative solutions in case an external partner fails to perform as expected”","ED.RS-4"]
[1226,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be … designed to [c] minimize risks to or from interconnected parties”"]
[1227,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[B]oard of directors [must] have adequate expertise in cybersecurity or [] maintain access to resources or staff with such expertise” [Stated Rationale: “Consistent with existing agency expectations, the enhanced standards would require the board of directors to have and maintain the ability to provide credible challenge to management in matters related to cybersecurity and the evaluation of cyber risks and resilience]”"]
[1228,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[T]he covered entity would be expected to ensure that business units maintain, or have access to, resources and staff with the skill sets needed to comply with the unit’s cybersecurity responsibilities”"]
[1229,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“The internal dependency management strategy would be designed to ensure that: … [a] policies, [b] standards, and [c] procedures to identify and manage cyber risks associated with internal assets, including those connected to or supporting sector-critical systems, are … regularly updated throughout those assets’ lifespans…”"]
[1230,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … track connections among [:] “organizational assets … throughout [its] lifespan[],”","DM.ED-5"]
[1231,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] establish and apply appropriate controls to address the inherent cyber risk of their assets (taking into account the prioritization of the entity’s business assets and the cyber risks they pose to the entity) by:  “[b] continually applying controls and monitoring assets and their operating environments (including deviations from baseline cybersecurity configurations) over the lifecycle of the assets; and"]
[1232,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [shall] establish and maintain effective incident response and cyber resilience [a] governance, [b] strategies, and [c] capacities that enable the organizations to [i] anticipate, [ii] withstand, [iii] contain, and [iv] rapidly recover from a disruption caused by a significant cyber event”"]
[1233,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] policies,"]
[1234,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] procedures,"]
[1235,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] governance,"]
[1236,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities conduct specific testing that addresses [a] disruptive, [b] destructive, [c] corruptive, or [d] any other cyber event that could affect their ability to service clients"]
[1237,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities conduct specific testing that addresses … significant downtime that would threaten the business resilience of clients"]
[1238,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] address external interdependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, and other critical service providers or partners;”"]
[1239,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing of cyber resilience [shall] be undertaken jointly where critical dependencies exist;”"]
[1240,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] validate the effectiveness of internal and external communication protocols with stakeholders”"]
[1241,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Standards for Sector-Critical Systems of Covered Entities","N.A","“[Covered entities must establish testing programs that] would include a range of scenarios, including severe but plausible scenarios, and would challenge matters such as communications protocols, governance arrangements, and resumption and recovery practices”"]
[1242,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] establish and apply appropriate controls to address the inherent cyber risk of their assets (taking into account the prioritization of the entity’s business assets and the cyber risks they pose to the entity) by:  “[d] mitigating identified deviations, granted exceptions and known violations to internal dependency cyber risk management policies, standards, and procedures"]
[1243,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] establish and apply appropriate controls to address the inherent cyber risk of their assets (taking into account the prioritization of the entity’s business assets and the cyber risks they pose to the entity) by:  “[d] mitigating identified deviations, granted exceptions and known violations to internal dependency cyber risk management policies, standards, and procedures"]
[1244,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Covered entities also would be required to … establish and maintain capabilities for ongoing vulnerability management”"]
[1245,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] establish and apply appropriate controls to address the inherent cyber risk of their assets (taking into account the prioritization of the entity’s business assets and the cyber risks they pose to the entity) by:  “[a] assessing the cyber risk of assets and their operating environments prior to deployment;"]
[1246,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] establish and apply appropriate controls to address the inherent cyber risk of their assets (taking into account the prioritization of the entity’s business assets and the cyber risks they pose to the entity) by:  “[b] continually applying controls and monitoring assets and their operating environments (including deviations from baseline cybersecurity configurations) over the lifecycle of the assets; and"]
[1247,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] periodically conduct tests of back-ups to business assets to achieve resilience”"]
[1248,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[U]pdating [the entity’s cybersecurity protocols] as the threat landscape evolves”"]
[1249,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[M]echanisms for identifying and responding to cyber incidents and threats,”"]
[1250,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [shall] establish and maintain effective incident response and cyber resilience [a] governance, [b] strategies, and [c] capacities that enable the organizations to [i] anticipate, [ii] withstand, [iii] contain, and [iv] rapidly recover from a disruption caused by a significant cyber event”"]
[1251,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] policies,"]
[1252,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] procedures,"]
[1253,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] governance,"]
[1254,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] independent review"]
[1255,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be required to consider wide-scale recovery scenarios ”"]
[1256,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be … designed to [a] achieve institutional resilience”"]
[1257,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities establish plans and mechanisms to transfer business, where feasible, to another entity or service provider with minimal disruption and within prescribed time frames if the original covered entity or service provider is unable to perform”"]
[1258,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[I]f performance is not feasible and contractual termination/remediation provisions have been exercised, client data would be returned to the original covered entity or service provider in a method that is transferable to an alternate entity or service provider with minimal disruption to the operations of the covered entity”"]
[1259,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“The internal dependency management strategy would be designed to ensure that: … [a] policies, [b] standards, and [c] procedures to identify and manage cyber risks associated with internal assets, including those connected to or supporting sector-critical systems, are … regularly updated throughout those assets’ lifespans…”"]
[1260,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support relevant data collection and analysis across the organization;”","DM.ED-7"]
[1261,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities would be required to establish processes designed to maintain effective situational awareness capabilities to reliably [a] predict, [b] analyze, and [c] respond to changes in the operating environment”"]
[1262,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support relevant data collection and analysis across the organization;”","DM.ED-7"]
[1263,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities would be required to establish processes designed to maintain effective situational awareness capabilities to reliably [a] predict, [b] analyze, and [c] respond to changes in the operating environment”"]
[1264,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On an ongoing basis, the independent risk management function would be required to identify and assess the covered entity’s material aggregate risks…”"]
[1265,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[C]overed entities, at the holding company level, [must] measure (quantitatively) the [a] completeness, [b] effectiveness, and [c] timeliness with which they reduce the aggregate residual cyber risk of their systems to the appropriate, board-of-directors approved level [Stated Rationale: “As noted, this is important because cyber risk has the potential to produce losses large enough to threaten an entity’s financial health, its reputation, or its ability to maintain core operations if faced with a material cyber event”]"]
[1266,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support relevant data collection and analysis across the organization;”","DM.ED-7"]
[1267,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities would be required to establish processes designed to maintain effective situational awareness capabilities to reliably [a] predict, [b] analyze, and [c] respond to changes in the operating environment”"]
[1268,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1269,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support relevant data collection and analysis across the organization;”","DM.ED-7"]
[1270,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities would be required to establish processes designed to maintain effective situational awareness capabilities to reliably [a] predict, [b] analyze, and [c] respond to changes in the operating environment”"]
[1271,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities would be required to establish processes designed to maintain effective situational awareness capabilities to reliably [a] predict, [b] analyze, and [c] respond to changes in the operating environment”"]
[1272,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1273,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1274,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1275,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1276,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1277,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1278,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1279,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1280,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1281,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1282,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1283,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1284,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“On a continuous basis, independent risk management would be required to … monitor cyber risk across the enterprise”"]
[1285,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[P]rocedures for testing the effectiveness of the entity’s cybersecurity protocols…”"]
[1286,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities conduct specific testing that addresses [a] disruptive, [b] destructive, [c] corruptive, or [d] any other cyber event that could affect their ability to service clients"]
[1287,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities conduct specific testing that addresses … significant downtime that would threaten the business resilience of clients"]
[1288,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] address external interdependencies, such as connectivity to markets, payment systems, clearing entities, messaging services, and other critical service providers or partners;”"]
[1289,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing of cyber resilience [shall] be undertaken jointly where critical dependencies exist;”"]
[1290,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] validate the effectiveness of internal and external communication protocols with stakeholders”"]
[1291,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] validate the effectiveness of internal and external communication protocols with stakeholders”"]
[1292,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1293,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 1: Cyber Risk Governance","N.A","“[E]stablish an enterprise-wide cyber risk management framework that would include...[U]pdating [the entity’s cybersecurity protocols] as the threat landscape evolves”"]
[1294,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-1","Notifications from detection systems are investigated ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.3\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nAdministrator and operator logs\nResponse to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support timely responses to cyber risks to the enterprise and the sector;”","DM.RS-3"]
[1295,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support timely responses to cyber risks to the enterprise and the sector;”","DM.RS-3"]
[1296,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support timely responses to cyber risks to the enterprise and the sector;”","DM.RS-3"]
[1297,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-4","Incidents are categorized consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to prioritize … incident response … of systems critical to the enterprise…”","DM.RS-3"]
[1298,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-4","Incidents are categorized consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support timely responses to cyber risks to the enterprise and the sector;”","DM.RS-3"]
[1299,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“A covered entity’s tracking capability would need to enable timely notification of internal cyber risk management issues to designated internal stakeholders”"]
[1300,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]yber resilience and incident response programs would be required to include effective escalation protocols linked to organizational … [c] communication strategies ”"]
[1301,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“A covered entity’s tracking capability would need to enable timely notification of internal cyber risk management issues to designated internal stakeholders”"]
[1302,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“A covered entity’s tracking capability would enable timely notification of cyber risk management issues to designated stakeholders”","DM.ED-7"]
[1303,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]yber resilience and incident response programs would be required to include effective escalation protocols linked to organizational [a] decision levels …”"]
[1304,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]yber resilience and incident response programs would be required to include effective escalation protocols linked to organizational … [c] communication strategies ”"]
[1305,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1306,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]yber resilience and incident response programs would be required to include effective escalation protocols linked to organizational … [b] cyber contagion containment procedures"]
[1307,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“A covered entity’s tracking capability would enable timely notification of cyber risk management issues to designated stakeholders”","DM.ED-7"]
[1308,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities maintain an ongoing situational awareness of their operational status and cybersecurity posture to pre-empt cyber events and respond rapidly to them”"]
[1309,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Covered entities also would be required to … gather actionable cyber threat intelligence and perform security analytics on an ongoing basis;”"]
[1310,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]yber resilience and incident response programs would be required to include effective escalation protocols linked to organizational … [d] processes to incorporate lessons learned back into the program”"]
[1311,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [shall] establish and maintain effective incident response and cyber resilience [a] governance, [b] strategies, and [c] capacities that enable the organizations to [i] anticipate, [ii] withstand, [iii] contain, and [iv] rapidly recover from a disruption caused by a significant cyber event”"]
[1312,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] governance,"]
[1313,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be required to consider wide-scale recovery scenarios ”"]
[1314,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be … designed to [a] achieve institutional resilience”"]
[1315,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] continually apply appropriate controls to reduce the cyber risk of business assets to the enterprise … to the board-approved level"]
[1316,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support timely responses to cyber risks to the enterprise and the sector;”","DM.RS-3"]
[1317,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] continually apply appropriate controls to reduce the cyber risk of business assets to the enterprise … to the board-approved level"]
[1318,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support timely responses to cyber risks to the enterprise and the sector;”","DM.RS-3"]
[1319,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[C]overed entities [must] continually apply appropriate controls to reduce the cyber risk of business assets to the enterprise … to the board-approved level"]
[1320,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“Covered entities would be required to … support timely responses to cyber risks to the enterprise and the sector;”","DM.RS-3"]
[1321,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 4: External Dependency Management","N.A","“A covered entity’s tracking capability would enable timely notification of cyber risk management issues to designated stakeholders”"]
[1322,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[Covered entities’] testing [must] validate the effectiveness of internal and external communication protocols with stakeholders”"]
[1323,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]yber resilience and incident response programs would be required to include effective escalation protocols linked to organizational … [d] processes to incorporate lessons learned back into the program”"]
[1324,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [shall] establish and maintain effective incident response and cyber resilience [a] governance, [b] strategies, and [c] capacities that enable the organizations to [i] anticipate, [ii] withstand, [iii] contain, and [iv] rapidly recover from a disruption caused by a significant cyber event”"]
[1325,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities [must] establish and maintain enterprise-wide cyber resilience and incident response programs, based on their enterprise-wide cyber risk management strategies and supported by appropriate [:] governance,"]
[1326,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be required to consider wide-scale recovery scenarios ”"]
[1327,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Cyber resilience strategies and exercises would be … designed to [a] achieve institutional resilience”"]
[1328,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“For cyber-attacks that may potentially corrupt or destroy critical data, [covered entities’] recovery strategies should be designed to achieve recovery point objectives based on the criticality of the data necessary to keep the institution operational”"]
[1329,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities establish and implement strategies to meet the entity’s obligations for performing core business functions in the event of a disruption, including the potential for multiple concurrent or widespread interruptions and cyber-attacks on multiple elements of interconnected critical infrastructure, such as energy and telecommunications”","DM.RS-3"]
[1330,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Standards for Sector-Critical Systems of Covered Entities","N.A","“[C]overed entities [must] establish an RTO of two hours for their sector-critical systems, validated by testing, to recover from a disruptive, corruptive, or destructive cyber event” [RTO Definition: “an RTO is the ‘amount of time in which a firm aims to recover clearing and settlement activities after a wide-scale disruption with the overall goal of completing material pending transactions on the scheduled settlement date’”]"]
[1331,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[U]pdate [business asset, service, and IT connections point] assessments as threats, technology, and processes evolve"]
[1332,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[The] evaluation would be required to include the entire security lifecycle, including penetration testing and other vulnerability assessment activities as appropriate based on the size, complexity, scope of operations, and interconnectedness of the covered entity”"]
[1333,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities to establish protocols for secure, immutable, off-line storage of critical records, including financial records of[:] the institution,"]
[1334,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities to establish protocols for secure, immutable, off-line storage of critical records, including financial records of[:] loan data,"]
[1335,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities to establish protocols for secure, immutable, off-line storage of critical records, including financial records of[:] asset management account information, and"]
[1336,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“[C]overed entities to establish protocols for secure, immutable, off-line storage of critical records, including financial records of[:] daily deposit account records, including balances and ownership details, formatted using certain defined data standards to allow for restoration of these records by another financial institution, service provider, or the FDIC in the event of resolution”"]
[1337,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Sector-Critical Systems","N.A","\"[C]onsidering additional factors to identify sector-critical systems, such as substitutability and interconnectedness\""]
[1338,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[The] audit function [must] assess whether the cyber risk management framework of a covered entity complies with applicable laws and regulations”","GV.AU-1"]
[1339,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[The] audit function [must] assess whether the cyber risk management framework of a covered entity … is appropriate for its [:] [a] size,","GV.AU-1"]
[1340,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[The] audit function [must] assess whether the cyber risk management framework of a covered entity … is appropriate for its [:] [b] complexity,","GV.AU-1"]
[1341,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[The] audit function [must] assess whether the cyber risk management framework of a covered entity … is appropriate for its [:] [c] interconnectedness, and","GV.AU-1"]
[1342,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[The] audit function [must] assess whether the cyber risk management framework of a covered entity … is appropriate for its [:] [d] risk profile”","GV.AU-1"]
[1343,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“[A]udit would be required to incorporate an assessment of cyber risk management into the overall audit plan of the covered entity”","GV.AU-1"]
[1344,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“The [audit] plan would be required to provide for an evaluation of the adequacy of compliance with the board-approved cyber risk management framework…”","GV.AU-1"]
[1345,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“The [audit] plan would be required to provide for an evaluation of the adequacy of compliance with the cyber risk [a] policies, [b] procedures, and [c] processes established by the firm’s business units or independent risk management","GV.AU-1"]
[1346,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“The audit plan would be required to provide for an assessment of the business unit and independent risk management functions’ capabilities to adapt as appropriate and remain in compliance with the covered entity’s cyber risk management framework”","GV.AU-1"]
[1347,"N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 2: Cyber Risk Management","N.A","“The audit plan would be required to provide for an assessment of the business unit and independent risk management functions’ capabilities to adapt as appropriate and remain … within its stated risk appetite and tolerances”","GV.AU-1"]
[1348,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 3: Internal Dependency Management","N.A","“[Covered entities must] establish[] and apply[] appropriate controls to address the inherent cyber risk of a covered entity’s assets”","DM.ID-1"]
[1349,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Covered entities would be required to be capable of operating critical business functions in the face of cyber-attacks and continuously enhance their cyber resilience”","DM.RS-1"]
[1350,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Category 5: Incident Response, Cyber Resilience, and Situational Awareness","N.A","“Covered entities also would be required to … establish and maintain threat modeling capabilities;” [Threat Modeling Definition: Threat modeling refers to using a structured process to identify how critical assets might be compromised by a threat actor and why, what level of protection is needed for those critical assets, and what the impact would be if that protection failed”]","DM.RS-2"]
[1351,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Scope of Application","N.A","\"[C]onsidering applying the enhanced standards on an enterprise-wide basis to all U.S. bank holding companies with total consolidated assets of $50 billion or more, the U.S. operations of foreign banking organizations with total U.S. assets of $50 billion or more, and all U.S. savings and loan holding companies with total consolidated assets of $50 billion or more.\"","N/A"]
[1352,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Scope of Application","N.A","\"[C]onsidering applying the standards to nonbank financial companies supervised by the Board pursuant to section 165 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), which directs the Board to establish enhanced prudential standards, including overall risk management standards, for these entities.\"","N/A"]
[1353,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Scope of Application","N.A","\"[C]onsidering applying the standards to financial market utilities designated by FSOC (designated FMUs) for which the Board is the Supervisory Agency pursuant to sections 805 and 810 of the Dodd-Frank Act; other FMIs over which the Board has primary (not backup) supervisory authority because the FMIs are members of the Federal Reserve System; and FMIs that are operated by the Federal Reserve Banks (collectively referred to as “Board-supervised FMIs”).\"","N/A"]
[1354,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Sector-Critical Systems","N.A","\"[C]onsidering establishing a two-tiered approach, with the enhanced standards applying to all systems of covered entities, and an additional, higher set of expectations, referred to in the ANPR as “sector-critical standards,” applying to those systems of covered entities that are critical to the financial sector\"","N/A"]
[1355,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Sector-Critical Systems","N.A","\"[C]onsidering whether systems that support the clearing or settlement of at least five percent of the value of transactions (on a consistent basis) in one or more of the markets for federal funds, foreign exchange, commercial paper, U.S. Government and agency securities, and corporate debt and equity securities, should be considered sector-critical systems for the purpose of the sector-critical standards.\"","N/A"]
[1356,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Sector-Critical Systems","N.A","\"[C]onsidering whether systems that support the clearing or settlement of at least five percent of the value of transactions (on a consistent basis) in other markets (for example, exchange-traded and over-the-counter derivatives), or that support the maintenance of a significant share (for example, five percent) of the total U.S. deposits or balances due from other depository institutions in the United States, should be considered sector-critical systems\"","N/A"]
[1357,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Approach to Quantifying Cyber Risk","N.A","\"[C]onsidering how best to measure cyber risk in a consistent, repeatable manner\"","N/A"]
[1358,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FRB-OCC-FDIC","FRB-OCC-FDIC \"Advanced Notice of Proposed Rulemaking on 'Enhanced Cyber Risk Management Standards'\"","U.S","Considerations for Implementation of the Enhanced Standards","N.A","\"[C]ould propose the standards as a combination of a regulatory requirement to maintain a risk management framework for cyber risks along with a policy statement or guidance that describes minimum expectations for the framework, such as policies, procedures, and practices commensurate with the inherent cyber risk level of the covered entity\"","N/A"]
[1359,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","1. Start with security","Don’t collect personal information you don’t need","N.A"]
[1360,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","1. Start with security","Hold on to information only as long as you have a legitimate business need","N.A"]
[1361,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","1. Start with security","Don’t use personal information when it’s not necessary","N.A"]
[1362,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","8. Make sure your service providers implement reasonable security measures","Put it in writing","Insist that appropriate security standards are part of your contracts"]
[1363,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","8. Make sure your service providers implement reasonable security measures","Verify compliance","Including security expectations in contracts with service providers is an important first step, but it’s also important to build oversight into the process."]
[1364,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","7. Apply sound security practices when\ndeveloping new products","Test for common vulnerabilities","There is no way to anticipate every threat, but some vulnerabilities are commonly known and reasonably foreseeable."]
[1365,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","7. Apply sound security practices when\ndeveloping new products","Test for common vulnerabilities","There is no way to anticipate every threat, but some vulnerabilities are commonly known and reasonably foreseeable."]
[1366,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","9. Put procedures in place to keep your\nsecurity current and address vulnerabilities\nthat may arise","Heed credible security warnings and move quickly to fix them","When vulnerabilities come to your attention, listen carefully and then get a move on"]
[1367,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","9. Put procedures in place to keep your\nsecurity current and address vulnerabilities\nthat may arise","Heed credible security warnings and move quickly to fix them","When vulnerabilities come to your attention, listen carefully and then get a move on"]
[1368,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","3. Require secure passwords and\nauthentication","Insist on complex and unique passwords","requiring employees to choose complex passwords and training them not to use the same or similar passwords for both business and personal accounts"]
[1369,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","3. Require secure passwords and\nauthentication","Store passwords securely","N.A"]
[1370,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","6. Secure remote access to your network","Ensure endpoint security","Remote access is managed  "]
[1371,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","2. Control access to data sensibly","Restrict access to sensitive data","If employees don’t have to use personal information as part of their job, there’s no need for them to have access to it."]
[1372,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","2. Control access to data sensibly","Limit administrative access","Administrative access, which allows a user to make system-wide changes to your system, should be limited to the employees tasked to do that job"]
[1373,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","6. Secure remote access to your network","Put sensible access limits in place","Not everyone who might occasionally need to get on your network should have an allaccess, backstage pass"]
[1374,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","5. Segment your network and monitor who’s\ntrying to get in and out","Segment your network","Not every computer in your system needs to be able to communicate with every other one. You can help protect particularly sensitive data by housing it in a separate secure place on your network"]
[1375,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","2. Control access to data sensibly","Limit administrative access","Administrative access, which allows a user to make system-wide changes to your system, should be limited to the employees tasked to do that job"]
[1376,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","4. Store sensitive personal information\nsecurely and protect it during transmission","Keep sensitive information secure throughout its lifecycle","Data doesn’t stay in one place. That’s why it’s important to consider security at all stages, if transmitting information is a necessity for your business"]
[1377,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","10. Secure paper, physical media, and devices","Securely store sensitive files","If it’s necessary to retain important paperwork, take steps to keep it secure"]
[1378,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","4. Store sensitive personal information\nsecurely and protect it during transmission","Keep sensitive information secure throughout its lifecycle","Data doesn’t stay in one place. That’s why it’s important to consider security at all stages, if transmitting information is a necessity for your business"]
[1379,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","10. Secure paper, physical media, and devices","Keep safety standards in place when data is en route","N.A"]
[1380,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","5. Segment your network and monitor who’s\ntrying to get in and out","Segment your network","Not every computer in your system needs to be able to communicate with every other one. You can help protect particularly sensitive data by housing it in a separate secure place on your network"]
[1381,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","4. Store sensitive personal information\nsecurely and protect it during transmission","Ensure proper configuration","N.A"]
[1382,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","7. Apply sound security practices when\ndeveloping new products","Train your engineers in secure coding","The company could have reduced risk of vulnerabilities by adequately training its engineers in secure coding practices."]
[1383,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","4. Store sensitive personal information\nsecurely and protect it during transmission","Ensure proper configuration","N.A"]
[1384,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","10. Secure paper, physical media, and devices","Dispose of sensitive data securely","N.A"]
[1385,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-2","Remote maintenance of organizational assets is approved, logged, and performed in a mannerthat prevents unauthorized access",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4\nA.15.1.1\nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nInformation security policy for supplier relationships\nMonitoring and review of supplier services"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","6. Secure remote access to your network","Ensure endpoint security","Remote access is managed  "]
[1386,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","2. Control access to data sensibly","Restrict access to sensitive data","If employees don’t have to use personal information as part of their job, there’s no need for them to have access to it."]
[1387,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","2. Control access to data sensibly","Limit administrative access","Administrative access, which allows a user to make system-wide changes to your system, should be limited to the employees tasked to do that job"]
[1388,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","6. Secure remote access to your network","Put sensible access limits in place","Not everyone who might occasionally need to get on your network should have an allaccess, backstage pass"]
[1389,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","3. Require secure passwords and\nauthentication","Guard against brute force attacks","N.A"]
[1390,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","3. Require secure passwords and\nauthentication","Protect against authentication bypass","N.A"]
[1391,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","5. Segment your network and monitor who’s\ntrying to get in and out","Monitor activity on your network","N.A"]
[1392,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","5. Segment your network and monitor who’s\ntrying to get in and out","Monitor activity on your network","N.A"]
[1393,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","5. Segment your network and monitor who’s\ntrying to get in and out","Monitor activity on your network","N.A"]
[1394,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","5. Segment your network and monitor who’s\ntrying to get in and out","Monitor activity on your network","N.A"]
[1395,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","5. Segment your network and monitor who’s\ntrying to get in and out","Monitor activity on your network","N.A"]
[1396,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","7. Apply sound security practices when\ndeveloping new products","Test for common vulnerabilities","There is no way to anticipate every threat, but some vulnerabilities are commonly known and reasonably foreseeable."]
[1397,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","7. Apply sound security practices when\ndeveloping new products","Test for common vulnerabilities","There is no way to anticipate every threat, but some vulnerabilities are commonly known and reasonably foreseeable."]
[1398,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","1. Start with security","Don’t collect personal information you don’t need","N.A"]
[1399,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","1. Start with security","Hold on to information only as long as you have a legitimate business need","N.A"]
[1400,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","1. Start with security","Don’t use personal information when it’s not necessary","N.A"]
[1401,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","3. Require secure passwords and\nauthentication","Insist on complex and unique passwords","requiring employees to choose complex passwords and training them not to use the same or similar passwords for both business and personal accounts"]
[1402,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","3. Require secure passwords and\nauthentication","Store passwords securely","N.A"]
[1403,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","7. Apply sound security practices when\ndeveloping new products","Follow platform guidelines for security","N.A"]
[1404,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","7. Apply sound security practices when\ndeveloping new products","Verify that privacy and security features work","If your software offers a privacy or security feature, verify that the feature works as advertised"]
[1405,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","9. Put procedures in place to keep your\nsecurity current and address vulnerabilities\nthat may arise","Update and patch third-party software","Outdated software undermines security. The solution is to update it regularly and\nimplement third-party patches"]
[1406,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","10. Secure paper, physical media, and devices","Protect devices that process personal information","N.A"]
[1407,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","4. Store sensitive personal information\nsecurely and protect it during transmission","Use industry-tested and accepted methods","When considering what technical standards to follow, keep in mind that experts already may have developed effective standards that can apply to your business","GV.SF-2"]
[1408,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1409,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1410,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1411,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-4","External information systems are catalogued",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Security of equipment and assets off-premises"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1412,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1413,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 2: Governance","N.A","Define and facilitate performance of roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework to ensure accountability; provide adequate resources, appropriate authority, and access to the governing authority"]
[1414,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1415,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF"]
[1416,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 2: Governance","N.A","Define and facilitate performance of roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework to ensure accountability; provide adequate resources, appropriate authority, and access to the governing authority","GV.RR"]
[1417,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1418,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF"]
[1419,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1420,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF"]
[1421,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1422,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1423,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF-1, GV.SF-2, GV.SF-3, GV.SF-4"]
[1424,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 2: Governance","N.A","Define and facilitate performance of roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework to ensure accountability; provide adequate resources, appropriate authority, and access to the governing authority","GV.RR-1, GV.RR-2"]
[1425,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF-1, GV.SF-2, GV.SF-3, GV.SF-4"]
[1426,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority.","GV.SP-1"]
[1427,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF-1, GV.SF-2, GV.SF-3, GV.SF-4"]
[1428,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority.","GV.SP-1"]
[1429,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1430,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1431,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1432,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1433,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 8: Continuous Learning","N.A","Review the cybersecurity strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned"]
[1434,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1435,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1436,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1437,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1438,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1439,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1440,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1441,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF-1, GV.SF-2, GV.SF-3, GV.SF-4"]
[1442,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 2: Governance","N.A","Define and facilitate performance of roles and responsibilities for personnel implementing, managing, and overseeing the effectiveness of the cybersecurity strategy and framework to ensure accountability; provide adequate resources, appropriate authority, and access to the governing authority","GV.RR-1, GV.RR-2"]
[1443,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority.","GV.SP-1"]
[1444,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF-1, GV.SF-2, GV.SF-3, GV.SF-4"]
[1445,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority.","GV.SP-1"]
[1446,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 1: Cybersecurity Strategy and Framework.","N.A","Establish and maintain a cybersecurity strategy and framework tailored to specific cyber risks and appropriately informed by international, national, and industry standards and guidelines.","GV.SF-1, GV.SF-2, GV.SF-3, GV.SF-4"]
[1447,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1448,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority.","GV.SP-1"]
[1449,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1450,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify functions, activities, products, and services—including interconnections, dependencies, and third parties—prioritize their relative importance, and assess their respective cyber risks."]
[1451,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1452,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1453,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1454,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1455,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1456,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1457,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1458,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1459,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1460,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1461,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1462,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1463,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1464,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1465,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1466,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1467,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1468,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1469,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1470,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1471,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1472,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1473,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1474,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1475,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1476,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1477,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-5","Policy and regulations regarding the physical operating environment for organizational assets are met",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.11.2.1\nA.11.2.2\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nEquipment siting and protection\nSupporting utilities\nCabling security"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1478,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1479,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1480,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1481,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 8: Continuous Learning","N.A","Review the cybersecurity strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned"]
[1482,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-8","Effectiveness of protection technologies is shared with appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1483,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1484,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1485,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-2","Remote maintenance of organizational assets is approved, logged, and performed in a mannerthat prevents unauthorized access",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4\nA.15.1.1\nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nInformation security policy for supplier relationships\nMonitoring and review of supplier services"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1486,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1487,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1488,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1489,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1490,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1491,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-5","Systems operate in pre-defined functional states to achieve availability (e.g. under duress, under attack, during recovery, normal operations).",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.2\nA.17.2.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Implementing information security continuity\nAvailability of information processing facilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1492,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1493,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1494,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1495,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1496,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (a) assess the nature, scope, and impact of a cyber incident; "]
[1497,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1498,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1499,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (a) assess the nature, scope, and impact of a cyber incident; "]
[1500,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 3: Risk and Control Assessment","N.A","Identify and implement controls—including systems, policies, procedures, and training—to protect against and manage those risks within the tolerance set by the governing authority."]
[1501,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1502,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1503,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1504,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1505,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1506,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1507,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1508,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1509,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1510,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-1","Roles and responsibilities for detection are well defined to ensure accountability",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1511,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-2","Detection activities comply with all applicable requirements",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Privacy and protection of personally identifiable information"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1512,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1513,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1514,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 4: Monitoring","N.A","Establish systematic monitoring processes to rapidly detect cyber incidents and periodically evaluate the effectiveness of identified controls, including through network monitoring, testing, audits, and exercises."]
[1515,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 8: Continuous Learning","N.A","Review the cybersecurity strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned"]
[1516,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (a) assess the nature, scope, and impact of a cyber incident; "]
[1517,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (b) contain the incident and mitigate its impact;"]
[1518,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1519,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-4","Incidents are categorized consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (a) assess the nature, scope, and impact of a cyber incident; "]
[1520,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1521,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1522,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1523,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1524,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1525,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1526,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1527,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1528,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1529,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1530,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1531,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1532,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1533,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1534,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 8: Continuous Learning","N.A","Review the cybersecurity strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned"]
[1535,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","(c) notify internal and external stakeholders (such as law enforcement, regulators, and other public authorities, as well as shareholders, third-party service providers, and customers as appropriate); and \n(d) coordinate joint response activities as needed."]
[1536,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 8: Continuous Learning","N.A","Review the cybersecurity strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned"]
[1537,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (b) contain the incident and mitigate its impact;"]
[1538,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (b) contain the incident and mitigate its impact;"]
[1539,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1540,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (b) contain the incident and mitigate its impact;"]
[1541,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1542,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 5: Response","N.A","Timely (b) contain the incident and mitigate its impact;"]
[1543,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1544,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1545,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-2","Reputation after an event is repaired",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1546,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-2","Reputation after an event is repaired",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1547,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1548,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[1549,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 8: Continuous Learning","N.A","Review the cybersecurity strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned"]
[1550,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 8: Continuous Learning","N.A","Review the cybersecurity strategy and framework regularly and when events warrant—including its governance, risk and control assessment, monitoring, response, recovery, and information sharing components—to address changes in cyber risks, allocate resources, identify and remediate gaps, and incorporate lessons learned"]
[1551,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 6: Recovery","N.A","Resume operations responsibly, while allowing for continued remediation, including by: \n(a) eliminating harmful remnants of the incident; \n(b) restoring systems and data to normal and confirming normal state; \n(c) identifying and mitigating all vulnerabilities that were exploited;\n(d) remediating vulnerabilities to prevent similar incidents; and \n(e) communicating appropriately internally and externally"]
[1552,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","What is the title of the person with primary responsibility for cybersecurity?"]
[1553,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","To whom does this person [the person with primary responsibility for cybersecurity] report?"]
[1554,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Indicate the years of cybersecurity experience (include work experience only) for the following cybersecurity management team members: CISO"]
[1555,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Indicate the years of cybersecurity experience (include work experience only) for the following cybersecurity management team members: CISO’s direct reports (average years)"]
[1556,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Indicate the years of cybersecurity experience (include work experience only) for the following cybersecurity management team members: CISO’s indirect reports at the officer level (average years)"]
[1557,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","How many members are in the cybersecurity management team which are direct reports to the CISO?"]
[1558,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Please indicate the number of board members with direct cybersecurity expertise via career experience or extensive formal training."]
[1559,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","What is the frequency of his/her [the person with primary responsibility for cybersecurity] scheduled or routine reports on cybersecurity to senior management?"]
[1560,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","What is the frequency of his/her [the person with primary responsibility for cybersecurity] scheduled or routine reports on cybersecurity to the board of directors?"]
[1561,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","When did senior management make its first presentation to the board about the bank’s cybersecurity self-assessment? (Quarter & Year)"]
[1562,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Have you completed an assessment of cybersecurity using the FFIEC Cybersecurity Assessment Tool?"]
[1563,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please indicate your Inherent Risk Profile for the applicable categories from your FFIEC Cybersecurity Assessment. Technologies and Connection Types"]
[1564,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please indicate your Inherent Risk Profile for the applicable categories from your FFIEC Cybersecurity Assessment. Delivery Channels"]
[1565,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please indicate your Inherent Risk Profile for the applicable categories from your FFIEC Cybersecurity Assessment. Online/Mobile Products and Technology Services"]
[1566,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please indicate your Inherent Risk Profile for the applicable categories from your FFIEC Cybersecurity Assessment. Organization Characteristics"]
[1567,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please indicate your Inherent Risk Profile for the applicable categories from your FFIEC Cybersecurity Assessment. External Threats"]
[1568,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please provide Maturity Levels from the completed FFIEC Cybersecurity Assessment for the 30 component areas. Baseline"]
[1569,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please provide Maturity Levels from the completed FFIEC Cybersecurity Assessment for the 30 component areas. Evolving"]
[1570,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please provide Maturity Levels from the completed FFIEC Cybersecurity Assessment for the 30 component areas. Intermediate"]
[1571,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please provide Maturity Levels from the completed FFIEC Cybersecurity Assessment for the 30 component areas. Advanced"]
[1572,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please provide Maturity Levels from the completed FFIEC Cybersecurity Assessment for the 30 component areas. Innovative"]
[1573,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please provide Maturity Levels from the completed FFIEC Cybersecurity Assessment for the 30 component areas. Total (sum Baseline, Evolving, Intermediate, Advanced, Innovative)"]
[1574,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please list the 3 most critical project plans identified as a result of the completed FFIEC Cybersecurity Assessment. Most critical project plan"]
[1575,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please list the 3 most critical project plans identified as a result of the completed FFIEC Cybersecurity Assessment. Second most critical project plan"]
[1576,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Please list the 3 most critical project plans identified as a result of the completed FFIEC Cybersecurity Assessment. Third most critical project plan"]
[1577,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","If you have completed the FFIEC assessment please fill out \"N/A\" and move to the next question. If not, have you completed a cybersecurity assessment using a different tool, standard or framework? If so, please indicate the tool/standard/framework in column E."]
[1578,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","If you have not completed the FFIEC assessment please list the 3 most critical project plans identified as a result of any non-FFIEC assessment. Most critical project plan"]
[1579,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","If you have not completed the FFIEC assessment please list the 3 most critical project plans identified as a result of any non-FFIEC assessment. Second most critical project plan"]
[1580,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","If you have not completed the FFIEC assessment please list the 3 most critical project plans identified as a result of any non-FFIEC assessment. Third most critical project plan"]
[1581,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Do you have plans to complete an assessment or re-assessment in the future?"]
[1582,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","If so [you have plans to complete an assessment or re-assessment in the future], what is the target completion date? (Quarter & Year)"]
[1583,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.1 - Internal Assessment","Will this be an assessment using the FFIEC Cybersecurity Assessment Tool?"]
[1584,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","Over the last 3 years, how have outsourced activities versus insourced activities for cybersecurity changed?"]
[1585,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","Over the last 3 years, what were the top three reasons for changes or lack of change in cybersecurity outsourcing. (if only one or two apply, please select 'N/A' for other reasons) Reason #1"]
[1586,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","Over the last 3 years, what were the top three reasons for changes or lack of change in cybersecurity outsourcing. (if only one or two apply, please select 'N/A' for other reasons) Reason #2"]
[1587,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","Over the last 3 years, what were the top three reasons for changes or lack of change in cybersecurity outsourcing. (if only one or two apply, please select 'N/A' for other reasons) Reason #3"]
[1588,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","What is the number of cybersecurity vendors you engage with for cybersecurity services and tools?"]
[1589,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","Over the next 12 months, please list your top three primary focus areas for cybersecurity programs and initiatives. Priority #1"]
[1590,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","Over the next 12 months, please list your top three primary focus areas for cybersecurity programs and initiatives. Priority #2"]
[1591,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","Over the next 12 months, please list your top three primary focus areas for cybersecurity programs and initiatives. Priority #3"]
[1592,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 3: Industry Engagement","3.1 - Threat Intelligence Services","Which threat intelligence services do you consume? Government"]
[1593,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 3: Industry Engagement","3.1 - Threat Intelligence Services","Which threat intelligence services do you consume? Commercial"]
[1594,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 3: Industry Engagement","3.1 - Threat Intelligence Services","Which threat intelligence services do you consume? Open Source"]
[1595,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 3: Industry Engagement","3.1 - Threat Intelligence Services","Which threat intelligence services do you consume? Other (please specify in column E)"]
[1596,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 3: Industry Engagement","3.1 - Threat Intelligence Services","List the 3 most important threat intelligence services that you consume in 'column D' and the frequency that information from each service is reported to senior management in 'column E' (daily, weekly, quarterly, semiannually, annually). Most important threat intelligence service"]
[1597,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 3: Industry Engagement","3.1 - Threat Intelligence Services","List the 3 most important threat intelligence services that you consume in 'column D' and the frequency that information from each service is reported to senior management in 'column E' (daily, weekly, quarterly, semiannually, annually). Second most important threat intelligence service"]
[1598,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 3: Industry Engagement","3.1 - Threat Intelligence Services","List the 3 most important threat intelligence services that you consume in 'column D' and the frequency that information from each service is reported to senior management in 'column E' (daily, weekly, quarterly, semiannually, annually). Third most important threat intelligence service"]
[1599,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","If so [the bank maintain a cybersecurity incident response plan for various cyber-scenarios], what percentage of the cyber scenarios and related responses are tested on an annual basis?"]
[1600,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Within the plan [the bank maintain a cybersecurity incident response plan for various cyber-scenarios], how many cyber-scenarios and related responses include involvement by C-level executives?"]
[1601,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.2 - Internal & External Resources Devoted to Cybersecurity","How frequent are vendors subject to information security reviews?"]
[1602,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Which of the below types of testing has been done in the last 12 months? Please describe related findings and remediation efforts from testing in column E. Penetration Testing"]
[1603,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Which of the below types of testing has been done in the last 12 months? Please describe related findings and remediation efforts from testing in column E. Vulnerability Scanning"]
[1604,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Which of the below types of testing has been done in the last 12 months? Please describe related findings and remediation efforts from testing in column E. Red Team Testing"]
[1605,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Which of the below types of testing has been done in the last 12 months? Please describe related findings and remediation efforts from testing in column E. Tabletop Simulation"]
[1606,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Which of the below types of testing has been done in the last 12 months? Please describe related findings and remediation efforts from testing in column E. Others (please explain in colum E)"]
[1607,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","If you wish, please add any comments on your chosen reporting structure and approach for cybersecurity"]
[1608,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 1: Governance Framework","1.1 - Line of Command Responsible for Cybersecurity","Does the bank maintain a cybersecurity incident response plan for various cyber-scenarios?"]
[1609,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.3 - Incident-Specific Reporting","How many incidents activated an Incident Response Plan / Crisis Plan or Escalation to Senior Management? In 2012"]
[1610,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.3 - Incident-Specific Reporting","How many incidents activated an Incident Response Plan / Crisis Plan or Escalation to Senior Management? In 2013"]
[1611,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.3 - Incident-Specific Reporting","How many incidents activated an Incident Response Plan / Crisis Plan or Escalation to Senior Management? In 2014"]
[1612,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Moody's","Moody’s \"Cybersecurity Survey - 2016\"","U.S","Section 2: Cyber Program Assessment","2.3 - Incident-Specific Reporting","How many incidents activated an Incident Response Plan / Crisis Plan or Escalation to Senior Management? In 2015"]
[1613,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","F. Oversight of Third-Party Service Provider Arrangements","(1) A Licensee shall exercise due diligence in selecting its Third-Party Service Provider; and\n(2) A Licensee shall require a Third-Party Service Provider to implement appropriate administrative, technical, and physical measures to protect and secure the Information Systems and Nonpublic Information that are accessible to, or held by, the Third-Party Service Provider."]
[1614,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","A. Implementation of an Information Security Program","Commensurate with the size and complexity of the Licensee, the nature and scope of the Licensee’s activities, including its use of Third-Party Service Providers, and the sensitivity of the Nonpublic Information used by the Licensee or in the Licensee’s possession, custody or control, each Licensee shall develop, implement, and maintain a comprehensive written Information Security Program based on the Licensee’s Risk Assessment and that contains administrative, technical, and physical safeguards for the protection of Nonpublic Information and the Licensee’s Information System.","GV.SP-1"]
[1615,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","C. Risk Assessment","The Licensee shall:\n(1) Designate one or more employees, an affiliate, or an outside vendor\ndesignated to act on behalf of the Licensee who is responsible for the\nInformation Security Program;","GV.RR-2"]
[1616,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","E. Oversight by Board of Directors","If the Licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum:\n(1) Require the Licensee’s executive management or its delegates to develop, implement, and maintain the Licensee’s Information Security Program;","GV.SF-1"]
[1617,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n…\n(3) Include cybersecurity risks in the Licensee’s enterprise risk management process.","GV.RM-1"]
[1618,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","E. Oversight by Board of Directors","If the Licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum:\n…\n(2) Require the Licensee’s executive management or its delegates to report in\nwriting at least annually, the following information: (a) The overall status of the Information Security Program and the Licensee’s compliance with this Act; and (b) Material matters related to the Information Security Program, addressing issues such as risk assessment, risk management and control decisions, Third-Party Service Provider arrangements, results of testing, Cybersecurity Events or violations and management’s responses thereto, and recommendations for changes in the Information Security Program.","GV.SF-3"]
[1619,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n…\n(4) Stay informed regarding emerging threats or vulnerabilities and utilize reasonable security measures when sharing information relative to the character of the sharing and the type of information shared; and"]
[1620,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","C. Risk Assessment","The Licensee shall:\n…\n(2) Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration or destruction of Nonpublic Information, including the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third- Party Service Providers;"]
[1621,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","C. Risk Assessment","The Licensee shall:\n…\n(3) Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of the Nonpublic Information;"]
[1622,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","C. Risk Assessment","The Licensee shall:\n…\n(3) Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of the Nonpublic Information;"]
[1623,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","C. Risk Assessment","The Licensee shall:\n…\n(5) Implement information safeguards to manage the threats identified in its ongoing assessment, and no less than annually, assess the effectiveness of the safeguards’ key controls, systems, and procedures."]
[1624,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","C. Risk Assessment","The Licensee shall:\n…\n(4) Assess the sufficiency of policies, procedures, Information Systems and other safeguards in place to manage these threats, including consideration of threats in each relevant area of the Licensee’s operations, including: (a) Employee training and management; (b) Information Systems, including network and software design, as well as information classification, governance, processing, storage, transmission, and disposal; and (c) Detecting, preventing, and responding to attacks, intrusions, or other systems failures; and","GV.RM-1"]
[1625,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","A. If the Licensee learns that a Cybersecurity Event has or may have occurred the Licensee or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall conduct a prompt investigation.","N.A","DM.RS-3"]
[1626,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and\nimplement such security measures\n…\n(c) Restrict access at physical locations containing personal information, only to authorized individuals;"]
[1627,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","B. Objectives of Information Security Program","A Licensee’s Information Security Program shall be designed to:\n…\n(3) Protect against unauthorized access to or use of Nonpublic Information, and\nminimize the likelihood of harm to any Consumer; and"]
[1628,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures.\n(a) Place access controls on Information Systems, including controls to authenticate and permit access only to Authorized Individuals to\nprotect against the unauthorized acquisition of Nonpublic\nInformation;"]
[1629,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(d) Protect by encryption or other appropriate means, all Nonpublic Information while being transmitted over an external network and all Nonpublic Information stored on a laptop computer or other portable computing or storage device or media;"]
[1630,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","B. Objectives of Information Security Program","A Licensee’s Information Security Program shall be designed to:\n...\n(2) Protect against any threats or hazards to the security or integrity of Nonpublic Information and the Information System;"]
[1631,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(f) Modify the Information System in accordance with the Licensee’s\nInformation Security Program;"]
[1632,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","B. Objectives of Information Security Program","A Licensee’s Information Security Program shall be designed to:\n…\n(4) Define and periodically reevaluate a schedule for retention of Nonpublic Information and a mechanism for its destruction when no longer needed."]
[1633,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(k) Develop, implement, and maintain procedures for the secure disposal of Nonpublic Information in any format."]
[1634,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","G. Program Adjustments","The Licensee shall monitor, evaluate and adjust, as appropriate, the Information Security Program consistent with any relevant changes in technology, the sensitivity of its Nonpublic Information, internal or external threats to information, and the Licensee’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements and changes to Information Systems."]
[1635,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","B. Objectives of Information Security Program","A Licensee’s Information Security Program shall be designed to:\n…\n(3) Protect against unauthorized access to or use of Nonpublic Information, and\nminimize the likelihood of harm to any Consumer; and"]
[1636,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(g) Utilize effective controls, which may include Multi-Factor\nAuthentication procedures for any individual accessing Nonpublic\nInformation;"]
[1637,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(h) Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, Information Systems;"]
[1638,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and\nimplement such security measures\n…\n(h) Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, Information Systems;"]
[1639,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(h) Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, Information Systems;"]
[1640,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(h) Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, Information Systems;"]
[1641,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and\nimplement such security measures\n…\n(h) Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, Information Systems;"]
[1642,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","B. During the investigation, the Licensee, or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall, at a minimum determine as much of the following information as possible:","(2) Assess the nature and scope of the Cybersecurity Event;"]
[1643,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","B. During the investigation, the Licensee, or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall, at a minimum determine as much of the following information as possible:","(3) Identify any Nonpublic Information that may have been involved in theCybersecurity Event; and"]
[1644,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","B. During the investigation, the Licensee, or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall, at a minimum determine as much of the following information as possible:","(4) Perform or oversee reasonable measures to restore the security of the Information Systems compromised in the Cybersecurity Event in order to prevent further unauthorized acquisition, release or use of Nonpublic Information in the Licensee’s possession, custody or control."]
[1646,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 6. Notification of a Cybersecurity Incident","A. Notification to the Commissioner","Each Licensee shall notify the Commissioner as promptly as possible but in no event later than 72 hours from a determination that a Cybersecurity Event has occurred when either of the following criteria has been met: \n(1) This State is the Licensee’s state of domicile, in the case of an insurer, or this State is the Licensee’s home state, in the case of a producer, as those terms are defined in [insert reference to Producer Licensing Model Act]; or \n(2) The Licensee reasonably believes that the Nonpublic Information involved is of 250 or more Consumers residing in this State and that is either of the following: \n(a) A Cybersecurity Event impacting the Licensee of which notice is required to be provided to any government body, self-regulatory agency or any other supervisory body pursuant to any state or federal law; or \n(b) A Cybersecurity Event that has a reasonable likelihood of materially harming: (i) Any Consumer residing in this State; or (ii) Any material part of the normal operation(s) of the Licensee."]
[1648,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 6. Notification of a Cybersecurity Incident","C. Notification to Consumers","Notification to Consumers. Licensee shall comply with [insert state’s data breach notification law], as applicable, and provide a copy of the notice sent to Consumers under that statute to the Commissioner, when a Licensee is required to notify the Commissioner under Section 6A."]
[1649,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 6. Notification of a Cybersecurity Incident","D. Notice Regarding Cybersecurity Events of Third-Party Service Providers","(1) In the case of a Cybersecurity Event in a system maintained by a Third-Party Service Provider, of which the Licensee has become aware, the Licensee shall treat such event as it would under Section 6A. (2) The computation of Licensee’s deadlines shall begin on the day after the Third-Party Service Provider notifies the Licensee of the Cybersecurity Event or the Licensee otherwise has actual knowledge of the Cybersecurity Event, whichever is sooner. (3) Nothing in this Act shall prevent or abrogate an agreement between a Licensee and another Licensee, a Third-Party Service Provider or any other party to fulfill any of the investigation requirements imposed under Section 5 or notice requirements imposed under Section 6."]
[1653,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 6. Notification of a Cybersecurity Incident","C. Notification to Consumers","Notification to Consumers. Licensee shall comply with [insert state’s data breach notification law], as applicable, and provide a copy of the notice sent to Consumers under that statute to the Commissioner, when a Licensee is required to notify the Commissioner under Section 6A."]
[1655,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","B. During the investigation, the Licensee, or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall, at a minimum determine as much of the following information as possible:","(4) Perform or oversee reasonable measures to restore the security of the Information Systems compromised in the Cybersecurity Event in order to prevent further unauthorized acquisition, release or use of Nonpublic Information in the Licensee’s possession, custody or control."]
[1656,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","B. During the investigation, the Licensee, or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall, at a minimum determine as much of the following information as possible:","(4) Perform or oversee reasonable measures to restore the security of the Information Systems compromised in the Cybersecurity Event in order to prevent further unauthorized acquisition, release or use of Nonpublic Information in the Licensee’s possession, custody or control."]
[1658,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures\n…\n(j) Implement measures to protect against destruction, loss, or damage of Nonpublic Information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures; and"]
[1659,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","A. If the Licensee learns that a Cybersecurity Event has or may have occurred the Licensee or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall conduct a prompt investigation.","N.A"]
[1660,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","B. Objectives of Information Security Program","A Licensee’s Information Security Program shall be designed to:\n(1) Protect the security and confidentiality of Nonpublic Information and the security of the Information System;"]
[1661,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 7. Power of Commissioner","A. The Commissioner shall have power to examine and investigate into the affairs of any Licensee to determine whether the Licensee has been or is engaged in any conduct in violation of this Act. This power is in addition to the powers which the Commissioner has under [insert applicable statutes governing the investigation or examination of insurers]. Any such investigation or examination shall be conducted pursuant to [insert applicable statutes governing the investigation or examination of insurers]. ","N/A"]
[1662,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 7. Power of Commissioner","\nB. Whenever the Commissioner has reason to believe that a Licensee has been or is engaged in conduct in this State which violates this Act, the Commissioner may take action that is necessary or appropriate to enforce the provisions of this Act.","N/A"]
[1663,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 8. Confidentiality","A. Any documents, materials or other information in the control or possession of the Department that are furnished by a Licensee or an employee or agent thereof acting on behalf of Licensee pursuant to Section 4I, Section 6B(2), (3), (4), (5), (8), (10), and (11), or that are obtained by the Commissioner in an investigation or examination pursuant to Section 7 of this Act shall be confidential by law and privileged, shall not be subject to [insert reference to state open records, freedom of information, sunshine or other appropriate law], shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. However, the Commissioner is authorized to use the documents, materials or other information in the furtherance of any regulatory or legal action brought as a part of the Commissioner’s duties.","N.A","N/A"]
[1664,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 8. Confidentiality","B. Neither the Commissioner nor any person who received documents, materials or other information while acting under the authority of the Commissioner shall be permitted or required to testify in any private civil action concerning any confidential documents, materials, or information subject to Section 8A.","N.A","N/A"]
[1665,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 8. Confidentiality","C. In order to assist in the performance of the Commissioner’s duties under this Act, the Commissioner:","(1) May share documents, materials or other information, including the confidential and privileged documents, materials or information subject to Section 8A, with other state, federal, and international regulatory agencies, with the National Association of Insurance Commissioners, its affiliates or subsidiaries, and with state, federal, and international law enforcement authorities, provided that the recipient agrees in writing to maintain the confidentiality and privileged status of the document, material or other information; (2) May receive documents, materials or information, including otherwise confidential and privileged documents, materials or information, from the National Association of Insurance Commissioners, its affiliates or subsidiaries and from regulatory and law enforcement officials of other foreign or domestic jurisdictions, and shall maintain as confidential or privileged any document, material or information received with notice or the understanding that it is confidential or privileged under the laws of the jurisdiction that is the source of the document, material or information; (3) May share documents, materials or other information subject to Section 8A, with a third-party consultant or vendor provided the consultant agrees in writing to maintain the confidentiality and privileged status of the document, material or other information; and (4) May enter into agreements governing sharing and use of information consistent with this subsection.","N/A"]
[1666,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 8. Confidentiality","D. No waiver of any applicable privilege or claim of confidentiality in the documents, materials, or information shall occur as a result of disclosure to the Commissioner under this section or as a result of sharing as authorized in Section 8C.","N.A","N/A"]
[1667,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 8. Confidentiality","E. Nothing in this Act shall prohibit the Commissioner from releasing final, adjudicated actions that are open to public inspection pursuant to [insert appropriate reference to state law] to a database or other clearinghouse service maintained by the National Association of Insurance Commissioners, its affiliates or subsidiaries.","N.A","N/A"]
[1668,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Each Member firm has a supervisory obligation to assess and prioritize the risks associated with the use of its information technology systems. In appropriate circumstances, personnel from a Member firm's business unit(s), information technology, back-office, risk management and internal audit, if applicable, may be included in performing this assessment.  Members should:","(6) know the devices connected to their network and network structure"]
[1669,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Each Member firm has a supervisory obligation to assess and prioritize the risks associated with the use of its information technology systems. In appropriate circumstances, personnel from a Member firm's business unit(s), information technology, back-office, risk management and internal audit, if applicable, may be included in performing this assessment.  Members should:","(1) maintain an inventory of critical information technology hardware with network connectivity, data transmission or data storage capability\n(2) an inventory of critical software with applicable versions"]
[1670,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Written Program","Principle: Each Member firm should establish and implement a governance framework that supports informed decision making and escalation within the firm to identify and manage information security risks.  In implementing an ISSP, each Member must adopt and enforce a written ISSP reasonably designed to provide safeguards, appropriate to the Member's size, complexity of operations, type of customers and counterparties, the sensitivity of the data accessible within its systems, and its electronic interconnectivity with other entities, to protect against security threats or hazards to their technology systems.  ","1) The Member's' ISSP should be approved, in writing, by the Member's Chief Executive Officer, Chief Technology Officer, or other executive level official.","GV.PL-1"]
[1671,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Written Program","Principle: Each Member firm should establish and implement a governance framework that supports informed decision making and escalation within the firm to identify and manage information security risks.  In implementing an ISSP, each Member must adopt and enforce a written ISSP reasonably designed to provide safeguards, appropriate to the Member's size, complexity of operations, type of customers and counterparties, the sensitivity of the data accessible within its systems, and its electronic interconnectivity with other entities, to protect against security threats or hazards to their technology systems.  ","2) Member's senior management should periodically provide sufficient information about the Member's ISSP to the \n(a) Member's board of directors or similar governing body, \n(b) the board's or governing body's delegate or \n(c) a committee of the board or body to enable it to monitor the Member's information security efforts.","GV.PL-1"]
[1672,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Review of Information Security Programs","Principle:  A Member should perform","(1) a regular review of its ISSP at least once every twelve months using either in-house staff with appropriate knowledge or by engaging an independent third-party information security specialist.","GV.PL-2"]
[1673,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Written Program","Principle: In order to develop and adopt appropriate ISSPs, Members may consider several resources available appropriate to their size, sophistication and role in the financial industry. For example, in developing procedures, NFA suggests that Members review","The cybersecurity best practices and standards promulgated by \n(1) the SANS Institute (SANS)\n(2) the Open Web Application Security Project (OWASP)\n(3) ISACA's Control Objectives for Information and Related Technology (COBIT) 5\n(4) the National Institute of Standards and Technology (NIST)\nNFA does not require a Member to utilize any of these resources in developing its ISSP, but each Member must formally adopt an ISSP appropriate for the Member's business.\n","GF.SF-2"]
[1674,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Review of Information Security Programs","Principle:  Members should monitor and regularly review the effectiveness of their ISSPs, including ","1) the efficacy of the safeguards deployed,\n2) make adjustments as appropriate.\n","GV.SP-2"]
[1675,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should also document and implement reasonable procedures to detect potential threats. These steps may include","(3) becoming members of threat/data sharing organizations such as the Financial Services Information Sharing and Analysis Center"]
[1676,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Each Member firm has a supervisory obligation to assess and prioritize the risks associated with the use of its information technology systems. In appropriate circumstances, personnel from a Member firm's business unit(s), information technology, back-office, risk management and internal audit, if applicable, may be included in performing this assessment.  Members should:","(3) identify the significant internal and external threats and vulnerabilities to at-risk data that is collected, maintained and disseminated, including\n(a) customer and counterparty PII\n(b) corporate records and financial information"]
[1677,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Each Member firm has a supervisory obligation to assess and prioritize the risks associated with the use of its information technology systems. In appropriate circumstances, personnel from a Member firm's business unit(s), information technology, back-office, risk management and internal audit, if applicable, may be included in performing this assessment.  Members should:","(4) assess the threats to and the vulnerability of their electronic infrastructure including any systems used to initiate, authorize, record, process and report transactions relating to customer funds, capital compliance, risk management and trading"]
[1678,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Generally speaking, threats include loss, destruction or theft of critical hardware containing at-risk data; insertion of viruses, spyware and other malware; and interception and compromising of electronic transmissions (e.g., email and payment processing systems). In assessing security risks, Members should:","(3) A Member's assessment should address: past internal and external security incidents at the firm to the extent applicable and within a reasonable time, consider known threats identified by the firm's: \n(a) critical third-party service providers\n(b) the industry \n(c) other organizations "]
[1679,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(2) establishing appropriate identity and access controls to a Member's systems and data\n(3) including media upon which information is stored"]
[1680,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(4) using complex passwords\n(5) changing them periodically;"]
[1681,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(1) protecting the Member's physical facility against unauthorized intrusion by imposing appropriate restrictions\n(a) on access to the facility\n(b) protections against the theft of equipment"]
[1682,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(2) establishing appropriate identity and access controls to a Member's systems and data\n(3) including media upon which information is stored"]
[1683,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Employee Training","Principle: A Member's ISSP should contain a","(1)  description of the Member's ongoing education and training relating to information security for all appropriate personnel.\n(2) This training program should be conducted for employees upon hiring and periodically during their employment and be appropriate to the security risks the Member faces as well as the composition of its workforce.\n(3) Members should consider including as training topics social engineering tactics and other general threats posed for system compromise and data loss."]
[1684,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(20) encrypting data in motion, (e.g., encrypting email attachments containing customer information or other sensitive information)"]
[1685,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(15) deploying encryption software to protect the data on equipment in the event of theft or loss of the equipment\n(16) using network segmentation\n(17) and network access controls;"]
[1686,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(13) using supported and current operating systems; alternatively, implement appropriate controls regarding the use of unsupported operating systems"]
[1687,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Generally speaking, threats include loss, destruction or theft of critical hardware containing at-risk data; insertion of viruses, spyware and other malware; and interception and compromising of electronic transmissions (e.g., email and payment processing systems). In assessing security risks, Members should:","(2) perform a vulnerability analysis, and decide how to manage the risks of these threats"]
[1688,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(6) using and maintaining up-to-date\n(a)  firewall\n(b) anti-virus\n(c) anti-malware software"]
[1689,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(10) using automatic software updating functionality, alternatively, \n(11) manually monitoring the availability of available software updates and installing updates\n(12) spot check to ensure that updates are applied when necessary"]
[1690,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Review of Information Security Programs","Principle:  A Member's review may include penetration testing of the firm's systems ","(1) the scope and timing of which is highly dependent upon the Member's size, business, technology, its electronic interconnectivity with other entities and the potential threats identified in its risk assessment."]
[1691,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(18) using secure software development practices if the Member develops its own software"]
[1692,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(14) regularly backing up systems and data as part of a sustainable disaster recovery and business continuity plan"]
[1693,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Response and Recovery for Events that Threaten the Security of the Electronic Systems","Principle: Members should create an incident response plan to provide a framework to","(1) manage detected security events or incidents\n(2) analyze their potential impact\n(3) take appropriate measures to contain and mitigate their threat\n"]
[1694,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Response and Recovery for Events that Threaten the Security of the Electronic Systems","Principle:  Members should consider in appropriate circumstances forming an incident response team responsible for ","(1) investigating an incident, \n(2) assessing its damage, \n(3) coordinating the internal and external response"]
[1695,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Response and Recovery for Events that Threaten the Security of the Electronic Systems","Principle:  the ISSP should contain a Member's procedures to","(1)  restore compromised systems and data\n(2) communicate with appropriate stakeholders and regulatory authorities\n(3)  incorporate lessons learned into the ISSP"]
[1696,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-4","Impact of events is determined",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Generally speaking, threats include loss, destruction or theft of critical hardware containing at-risk data; insertion of viruses, spyware and other malware; and interception and compromising of electronic transmissions (e.g., email and payment processing systems). In assessing security risks, Members should:","(1) estimate the severity of the potential threats"]
[1697,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should also document and implement reasonable procedures to detect potential threats. These steps may include","(1) utilizing network monitoring software"]
[1698,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should also document and implement reasonable procedures to detect potential threats. These steps may include","\n(2) watching for the presence on the Member's physical premises of unauthorized users"]
[1699,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-5","Unauthorized mobile code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.5.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Installation of software on operational systems"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(21) ensuring that mobile devices are subject to similar applicable safeguards"]
[1700,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Security Risk Analysis","Principle: Each Member firm has a supervisory obligation to assess and prioritize the risks associated with the use of its information technology systems. In appropriate circumstances, personnel from a Member firm's business unit(s), information technology, back-office, risk management and internal audit, if applicable, may be included in performing this assessment.  Members should:","(5) assess the threats posed through any applicable third-party \n(a) service providers \n(b) software"]
[1701,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Third-Party Service Providers","Principle: A Member's ISSP should address in its security risk assessment ","1) the risks posed by critical third-party service providers that have access to a Member's systems, \n2) operate outsourced systems for the Member or \n3) provide cloud-based services such as data storage or application software to the Member."]
[1702,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Third-Party Service Providers","Principle:  A Member should consider ","(1) using a risk based approach to manage the information security risks posed by these providers."]
[1703,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Third-Party Service Providers","Principle:  A Member should perform ","1) due diligence on a critical service provider's security practices\n2) avoid using third parties whose security standards are not comparable to the Member's standards in a particular area or activity."]
[1704,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Third-Party Service Providers","Principle:  Members should consider ","(1) including in their arrangements with critical third-party service providers appropriate measures that are designed to protect customer and firm confidential data."]
[1705,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Third-Party Service Providers","Principle:  Members should also consider adopting procedures to place appropriate access controls to their information systems and data upon third-party service providers","(1) procedures to restrict or remove, on a timely basis, a third-party service provider's access to their information systems once the service provider is no longer providing services."]
[1706,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(7) using supported and trusted software\n(8) alternatively, implement appropriate controls regarding the use of unsupported software"]
[1707,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(9) prevent the use of unauthorized software through the use of application whitelists"]
[1708,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should document and describe in their ISSPs the safeguards deployed in light of the identified and prioritized threats and vulnerabilities. Adopted safeguards will be highly dependent upon a Member's size, business, technology, electronic interconnectivity with other entities and the potential threats identified in its risk assessment. Examples of these safeguards may include:","(19) using web filtering technology to block access to inappropriate or malicious websites;"]
[1709,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Deployment of Protective Measures Against the Identified Threats and Vulnerabilities","Principle:  Members should also document and implement reasonable procedures to detect potential threats. These steps may include","(4) establishing procedures designed to identify unauthorized connections by employees to the Member's network."]
[1710,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Response and Recovery for Events that Threaten the Security of the Electronic Systems","Principle:  Members should consider","(1) Providing details of any detected threats to an industry-specific information sharing platform such as FS-ISAC."]
[1711,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"NFA","NFA \"9070 - NFA COMPLIANCE RULES 2-9, 2-36 AND 2-49: INFORMATION SYSTEMS SECURITY PROGRAMS\"","U.S","Response and Recovery for Events that Threaten the Security of the Electronic Systems","Principle:  A Member should consider including in its incident response plan","(1) a description of how the Member will address common types of potential incidents (e.g., unauthorized access, malicious code, denial of service and inappropriate usage)\n(2) including how it will communicate internally with an appropriate escalation procedure\n(3) and externally with customers/counterparties, regulators and law enforcement.\n"]
[1712,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(2) data governance and classification;","GV.PL-1"]
[1713,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(a) Chief Information Security Officer. Each Covered Entity shall designate a qualified individual responsible for overseeing and implementing the Covered Entity’s cybersecurity program and enforcing its cybersecurity policy (for purposes of this Part, “Chief Information Security Officer” or “CISO”). The CISO may be employed by the Covered Entity, one of its Affiliates or a Third Party Service Provider. To the extent this requirement is met using a Third Party Service Provider or an Affiliate, the Covered Entity shall:","(2) designate a senior member of the Covered Entity’s personnel responsible for direction and oversight of the Third Party Service Provider; and"]
[1714,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-1","The organization’s role in the supply chain is identified and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.3\nA.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.\n(d) All documentation and information relevant to the Covered Entity’s cybersecurity program shall be made available to the superintendent upon request.","N.A","DM.ED-2"]
[1715,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.\n(d) All documentation and information relevant to the Covered Entity’s cybersecurity program shall be made available to the superintendent upon request.","N.A","DM.ED-2"]
[1716,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.\n(d) All documentation and information relevant to the Covered Entity’s cybersecurity program shall be made available to the superintendent upon request.","N.A","DM.ED-2"]
[1717,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(a) Cybersecurity Program. Each Covered Entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity’s Information Systems.\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","N.A","GV.SP-1"]
[1718,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(1) information security;","GV.PL-1"]
[1719,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.\n(d) All documentation and information relevant to the Covered Entity’s cybersecurity program shall be made available to the superintendent upon request.","N.A","GV.SP-1"]
[1720,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(a) Chief Information Security Officer. Each Covered Entity shall designate a qualified individual responsible for overseeing and implementing the Covered Entity’s cybersecurity program and enforcing its cybersecurity policy (for purposes of this Part, “Chief Information Security Officer” or “CISO”). The CISO may be employed by the Covered Entity, one of its Affiliates or a Third Party Service Provider. To the extent this requirement is met using a Third Party Service Provider or an Affiliate, the Covered Entity shall:","(1) retain responsibility for compliance with this Part;","GV.RR-2"]
[1721,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.08 Application Security","(b) All such procedures, guidelines and standards shall be periodically reviewed, assessed and updated as necessary by the CISO (or a qualified designee) of the Covered Entity.","N.A","GV.PL-2"]
[1722,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.10 Cybersecurity Personnel and Intelligence","(a) Cybersecurity Personnel and Intelligence. In addition to the requirements set forth in 500.04(a), each Covered Entity shall:","(1) utilize qualified cybersecurity personnel of the Covered Entity, an Affiliate or a Third Party Service Provider sufficient to manage the Covered Entity’s cybersecurity risks and to perform or oversee the performance of the core cybersecurity functions specified in section 500.02(b)(1)-(6) of this Part;\n(2) provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks; and\n(3) verify that key cybersecurity personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures."]
[1723,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(4) representations and warranties addressing the Third Party Service Provider’s cybersecurity policies and procedures that relate to the security of the Covered Entity’s Information Systems or Nonpublic Information."]
[1724,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(c) Limited Exception. An agent, employee, representative or designee of a Covered Entity who is itself a Covered Entity need not develop its own Third Party Information Security Policy pursuant to this section if the agent, employee, representative or designee follows the policy of the Covered Entity that is required to comply with this Part.","N.A"]
[1725,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(a) Cybersecurity Program. Each Covered Entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity’s Information Systems.\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","N.A","GV.SP-1"]
[1726,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(b) Report. The CISO of each Covered Entity shall report in writing at least annually to the Covered Entity’s board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a Senior Officer of the Covered Entity responsible for the Covered Entity’s cybersecurity program. The CISO shall report on the Covered Entity’s cybersecurity program and material cybersecurity risks. The CISO shall consider to the extent applicable:","(1) the confidentiality of Nonpublic Information and the integrity and security of the Covered Entity’s Information Systems;","GV.RR-2"]
[1727,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(b) Report. The CISO of each Covered Entity shall report in writing at least annually to the Covered Entity’s board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a Senior Officer of the Covered Entity responsible for the Covered Entity’s cybersecurity program. The CISO shall report on the Covered Entity’s cybersecurity program and material cybersecurity risks. The CISO shall consider to the extent applicable:","(2) the Covered Entity’s cybersecurity policies and procedures;","GV.RR-2"]
[1728,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(b) Report. The CISO of each Covered Entity shall report in writing at least annually to the Covered Entity’s board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a Senior Officer of the Covered Entity responsible for the Covered Entity’s cybersecurity program. The CISO shall report on the Covered Entity’s cybersecurity program and material cybersecurity risks. The CISO shall consider to the extent applicable:","(3) material cyber risks to the Covered Entity;","GV.RR-2"]
[1729,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(b) Report. The CISO of each Covered Entity shall report in writing at least annually to the Covered Entity’s board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a Senior Officer of the Covered Entity responsible for the Covered Entity’s cybersecurity program. The CISO shall report on the Covered Entity’s cybersecurity program and material cybersecurity risks. The CISO shall consider to the extent applicable:","(4) overall effectiveness of the Covered Entity’s cybersecurity program; and","GV.RR-2"]
[1730,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(b) Report. The CISO of each Covered Entity shall report in writing at least annually to the Covered Entity’s board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a Senior Officer of the Covered Entity responsible for the Covered Entity’s cybersecurity program. The CISO shall report on the Covered Entity’s cybersecurity program and material cybersecurity risks. The CISO shall consider to the extent applicable:","(5) material Cybersecurity Events involving the Covered Entity during the time period addressed by the report.","GV.RR-2"]
[1731,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(4) representations and warranties addressing the Third Party Service Provider’s cybersecurity policies and procedures that relate to the security of the Covered Entity’s Information Systems or Nonpublic Information."]
[1732,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(13) risk assessment; and"]
[1733,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.","N.A"]
[1734,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(13) risk assessment; and"]
[1735,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.","N.A"]
[1736,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(13) risk assessment; and"]
[1737,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.","N.A"]
[1738,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(13) risk assessment; and"]
[1739,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.","N.A"]
[1740,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(b) The cybersecurity program shall be based on the Covered Entity’s Risk Assessment and designed to perform the following core cybersecurity functions\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","(1) identify and assess internal and external cybersecurity risks that may threaten the security or integrity of Nonpublic Information stored on the Covered Entity’s Information Systems;"]
[1741,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(13) risk assessment; and"]
[1742,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.","N.A"]
[1743,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(13) risk assessment; and"]
[1744,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.","N.A"]
[1745,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(b) The Risk Assessment shall be carried out in accordance with written policies and procedures and shall be documented. Such policies and procedures shall include:","(3) requirements describing how identified risks will be mitigated or accepted based on the Risk Assessment and how the cybersecurity program will address the risks."]
[1746,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(a) Cybersecurity Program. Each Covered Entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity’s Information Systems.\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","N.A","GV.SP-1"]
[1747,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(13) risk assessment; and","GV.PL-1"]
[1748,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered Entity’s Information Systems sufficient to inform the design of the cybersecurity program as required by this Part. Such Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations. The Covered Entity’s Risk Assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the Covered Entity’s business operations related to cybersecurity, Nonpublic Information collected or stored, Information Systems utilized and the availability and effectiveness of controls to protect Nonpublic Information and Information Systems.","N.A"]
[1749,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(b) The Risk Assessment shall be carried out in accordance with written policies and procedures and shall be documented. Such policies and procedures shall include:","(1) criteria for the evaluation and categorization of identified cybersecurity risks or threats facing the Covered Entity;","GV.RM-1"]
[1750,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.09 Risk Assessment","(b) The Risk Assessment shall be carried out in accordance with written policies and procedures and shall be documented. Such policies and procedures shall include:","(2) criteria for the assessment of the confidentiality, integrity, security and availability of the Covered Entity’s Information Systems and Nonpublic Information, including the adequacy of existing controls in the context of identified risks; and","GV.RM-1"]
[1751,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(12) vendor and Third Party Service Provider management;","DM.ED-4"]
[1752,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(a) Third Party Service Provider Policy. Each Covered Entity shall implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third Party Service Providers. Such policies and procedures shall be based on the Risk Assessment of the Covered Entity and shall address to the extent applicable:","(1) the identification and risk assessment of Third Party Service Providers;","DM.ED-5"]
[1753,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(a) Third Party Service Provider Policy. Each Covered Entity shall implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third Party Service Providers. Such policies and procedures shall be based on the Risk Assessment of the Covered Entity and shall address to the extent applicable:","(2) minimum cybersecurity practices required to be met by such Third Party Service Providers in order for them to do business with the Covered Entity;","DM.ED-6"]
[1754,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(a) Chief Information Security Officer. Each Covered Entity shall designate a qualified individual responsible for overseeing and implementing the Covered Entity’s cybersecurity program and enforcing its cybersecurity policy (for purposes of this Part, “Chief Information Security Officer” or “CISO”). The CISO may be employed by the Covered Entity, one of its Affiliates or a Third Party Service Provider. To the extent this requirement is met using a Third Party Service Provider or an Affiliate, the Covered Entity shall:","(3) require the Third Party Service Provider to maintain a cybersecurity program that protects the Covered Entity in accordance with the requirements of this Part.","DM.ED-4"]
[1755,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(a) Third Party Service Provider Policy. Each Covered Entity shall implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third Party Service Providers. Such policies and procedures shall be based on the Risk Assessment of the Covered Entity and shall address to the extent applicable:","(3) due diligence processes used to evaluate the adequacy of cybersecurity practices of such Third Party Service Providers; and","DM.ED-7"]
[1756,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(a) Third Party Service Provider Policy. Each Covered Entity shall implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third Party Service Providers. Such policies and procedures shall be based on the Risk Assessment of the Covered Entity and shall address to the extent applicable:","(4) periodic assessment of such Third Party Service Providers based on the risk they present and the continued adequacy of their cybersecurity practices.","DM.ED-7"]
[1757,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(3) asset inventory and device management;"]
[1758,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(a) Multi-Factor Authentication. Based on its Risk Assessment, each Covered Entity shall use effective controls, which may include Multi-Factor Authentication or Risk-Based Authentication, to protect against unauthorized access to Nonpublic Information or Information Systems.","N.A"]
[1759,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(b) Multi-Factor Authentication shall be utilized for any individual accessing the Covered Entity’s internal networks from an external network, unless the Covered Entity’s CISO has approved in writing the use of reasonably equivalent or more secure access controls.","N.A"]
[1760,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(3) asset inventory and device management;"]
[1761,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(10) physical security and environmental controls;"]
[1762,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(3) asset inventory and device management;"]
[1763,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(3) asset inventory and device management;"]
[1764,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.07 Access Privileges.","As part of its cybersecurity program, based on the Covered Entity’s Risk Assessment each Covered Entity shall limit user access privileges to Information Systems that provide access to Nonpublic Information and shall periodically review such access privileges.","N.A"]
[1765,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(a) Multi-Factor Authentication. Based on its Risk Assessment, each Covered Entity shall use effective controls, which may include Multi-Factor Authentication or Risk-Based Authentication, to protect against unauthorized access to Nonpublic Information or Information Systems.","N.A"]
[1766,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(b) Multi-Factor Authentication shall be utilized for any individual accessing the Covered Entity’s internal networks from an external network, unless the Covered Entity’s CISO has approved in writing the use of reasonably equivalent or more secure access controls.","N.A"]
[1767,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(3) asset inventory and device management;"]
[1768,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(7) systems and network security;"]
[1769,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(a) Multi-Factor Authentication. Based on its Risk Assessment, each Covered Entity shall use effective controls, which may include Multi-Factor Authentication or Risk-Based Authentication, to protect against unauthorized access to Nonpublic Information or Information Systems.","N.A"]
[1770,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.14 Training and Monitoring","(a) As part of its cybersecurity program, each Covered Entity shall","(2) provide for regular cybersecurity awareness training for all personnel that is updated to reflect risks identified by the Covered Entity in its Risk Assessment."]
[1771,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.10 Cybersecurity Personnel and Intelligence","(a) Cybersecurity Personnel and Intelligence. In addition to the requirements set forth in 500.04(a), each Covered Entity shall:","(1) utilize qualified cybersecurity personnel of the Covered Entity, an Affiliate or a Third Party Service Provider sufficient to manage the Covered Entity’s cybersecurity risks and to perform or oversee the performance of the core cybersecurity functions specified in section 500.02(b)(1)-(6) of this Part;\n(2) provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks; and\n(3) verify that key cybersecurity personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures."]
[1772,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(b) Multi-Factor Authentication shall be utilized for any individual accessing the Covered Entity’s internal networks from an external network, unless the Covered Entity’s CISO has approved in writing the use of reasonably equivalent or more secure access controls.","N.A"]
[1773,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.14 Training and Monitoring","(a) As part of its cybersecurity program, each Covered Entity shall","(2) provide for regular cybersecurity awareness training for all personnel that is updated to reflect risks identified by the Covered Entity in its Risk Assessment."]
[1774,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.04 Chief Information Security Officer","(a) Chief Information Security Officer. Each Covered Entity shall designate a qualified individual responsible for overseeing and implementing the Covered Entity’s cybersecurity program and enforcing its cybersecurity policy (for purposes of this Part, “Chief Information Security Officer” or “CISO”). The CISO may be employed by the Covered Entity, one of its Affiliates or a Third Party Service Provider. To the extent this requirement is met using a Third Party Service Provider or an Affiliate, the Covered Entity shall:","(3) require the Third Party Service Provider to maintain a cybersecurity program that protects the Covered Entity in accordance with the requirements of this Part."]
[1775,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.10 Cybersecurity Personnel and Intelligence","(b) A Covered Entity may choose to utilize an Affiliate or qualified Third Party Service Provider to assist in complying with the requirements set forth in this Part, subject to the requirements set forth in section 500.11 of this Part.","N.A"]
[1776,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.14 Training and Monitoring","(a) As part of its cybersecurity program, each Covered Entity shall","(2) provide for regular cybersecurity awareness training for all personnel that is updated to reflect risks identified by the Covered Entity in its Risk Assessment."]
[1777,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.14 Training and Monitoring","(a) As part of its cybersecurity program, each Covered Entity shall","(2) provide for regular cybersecurity awareness training for all personnel that is updated to reflect risks identified by the Covered Entity in its Risk Assessment."]
[1778,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(10) physical security and environmental controls;"]
[1779,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.10 Cybersecurity Personnel and Intelligence","(a) Cybersecurity Personnel and Intelligence. In addition to the requirements set forth in 500.04(a), each Covered Entity shall:","(1) utilize qualified cybersecurity personnel of the Covered Entity, an Affiliate or a Third Party Service Provider sufficient to manage the Covered Entity’s cybersecurity risks and to perform or oversee the performance of the core cybersecurity functions specified in section 500.02(b)(1)-(6) of this Part;\n(2) provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks; and\n(3) verify that key cybersecurity personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures."]
[1780,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.14 Training and Monitoring","(a) As part of its cybersecurity program, each Covered Entity shall","(2) provide for regular cybersecurity awareness training for all personnel that is updated to reflect risks identified by the Covered Entity in its Risk Assessment."]
[1781,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(11) customer data privacy;"]
[1782,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(2) the Third Party Service Provider’s policies and procedures for use of encryption as defined by section 500.15 to protect Nonpublic Information in transit and at rest;"]
[1783,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.15 Encryption of Nonpublic Information","(a) As part of its cybersecurity program, based on its Risk Assessment, each Covered Entity shall implement controls, including encryption, to protect Nonpublic Information held or transmitted by the Covered Entity both in transit over external networks and at rest.","(1) To the extent a Covered Entity determines that encryption of Nonpublic Information in transit over external networks is infeasible, the Covered Entity may instead secure such Nonpublic Information using effective alternative compensating controls reviewed and approved by the Covered Entity’s CISO."]
[1784,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(11) customer data privacy;"]
[1785,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(2) the Third Party Service Provider’s policies and procedures for use of encryption as defined by section 500.15 to protect Nonpublic Information in transit and at rest;"]
[1786,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.15 Encryption of Nonpublic Information","(a) As part of its cybersecurity program, based on its Risk Assessment, each Covered Entity shall implement controls, including encryption, to protect Nonpublic Information held or transmitted by the Covered Entity both in transit over external networks and at rest.","(2) To the extent a Covered Entity determines that encryption of Nonpublic Information at rest is infeasible, the Covered Entity may instead secure such Nonpublic Information using effective alternative compensating controls reviewed and approved by the Covered Entity’s CISO."]
[1787,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(5) business continuity and disaster recovery planning and resources;"]
[1788,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(6) systems operations and availability concerns;"]
[1789,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(11) customer data privacy;"]
[1790,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.06 Audit Trail","(a) Each Covered Entity shall securely maintain systems that, to the extent applicable and based on its Risk Assessment:","(1) are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity; and\n(2) include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity."]
[1791,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.06 Audit Trail","(a) Each Covered Entity shall securely maintain systems that, to the extent applicable and based on its Risk Assessment:","(1) are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity; and\n(2) include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity."]
[1792,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.05 Penetration Testing and Vulnerability Assessments","(a) The cybersecurity program for each Covered Entity shall include monitoring and testing, developed in accordance with the Covered Entity’s Risk Assessment, designed to assess the effectiveness of the Covered Entity’s cybersecurity program. The monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments, and shall be done periodically. Absent effective continuous monitoring, or other systems to detect, on an ongoing basis, changes in Information Systems that may create or indicate vulnerabilities, Covered Entities shall conduct:","(1) annual penetration testing of the Covered Entity’s Information Systems determined each given year based on relevant identified risks in accordance with the Risk Assessment; and"]
[1793,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.05 Penetration Testing and Vulnerability Assessments","(a) The cybersecurity program for each Covered Entity shall include monitoring and testing, developed in accordance with the Covered Entity’s Risk Assessment, designed to assess the effectiveness of the Covered Entity’s cybersecurity program. The monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments, and shall be done periodically. Absent effective continuous monitoring, or other systems to detect, on an ongoing basis, changes in Information Systems that may create or indicate vulnerabilities, Covered Entities shall conduct:","(2) bi-annual vulnerability assessments, including any systematic scans or reviews of Information Systems reasonably designed to identify publicly known cybersecurity vulnerabilities in the Covered Entity’s Information Systems based on the Risk Assessment."]
[1794,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(9) systems and application development and quality assurance;"]
[1795,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.08 Application Security","(a) Each Covered Entity’s cybersecurity program shall include written procedures, guidelines and standards designed to ensure the use of secure development practices for in-house developed applications utilized by the Covered Entity, and procedures for evaluating, assessing or testing the security of externally developed applications utilized by the Covered Entity within the context of the Covered Entity’s technology environment.","N.A"]
[1796,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.06 Audit Trail","(a) Each Covered Entity shall securely maintain systems that, to the extent applicable and based on its Risk Assessment:","(1) are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity; and\n(2) include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity."]
[1797,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.13 Limitations on Data Retention","As part of its cybersecurity program, each Covered Entity shall include policies and procedures for the secure disposal on a periodic basis of any Nonpublic Information identified in 500.01(g)(2)-(3) that is no longer necessary for business operations or for other legitimate business purposes of the Covered Entity, except where such information is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably feasible due to the manner in which the information is maintained.","N.A"]
[1798,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.15 Encryption of Nonpublic Information","(b) To the extent that a Covered Entity is utilizing compensating controls under (a) above, the feasibility of encryption and effectiveness of the compensating controls shall be reviewed by the CISO at least annually","N.A"]
[1799,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(4) access controls and identity management;"]
[1800,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(14) incident response."]
[1801,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(a) As part of its cybersecurity program, each Covered Entity shall establish a written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event materially affecting the confidentiality, integrity or availability of the Covered Entity’s Information Systems or the continuing functionality of any aspect of the Covered Entity’s business or operations.","N.A"]
[1802,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(1) the internal processes for responding to a Cybersecurity Event;"]
[1803,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(2) the goals of the incident response plan;"]
[1804,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.06 Audit Trail","(a) Each Covered Entity shall securely maintain systems that, to the extent applicable and based on its Risk Assessment:","(1) are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity; and\n(2) include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity."]
[1805,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.06 Audit Trail","(a) Each Covered Entity shall securely maintain systems that, to the extent applicable and based on its Risk Assessment:","(1) are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity; and\n(2) include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity."]
[1806,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.06 Audit Trail","(b) Each Covered Entity shall maintain records required by this section for not fewer than five years","N.A"]
[1807,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(b) The cybersecurity program shall be based on the Covered Entity’s Risk Assessment and designed to perform the following core cybersecurity functions\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","(2) use defensive infrastructure and the implementation of policies and procedures to protect the Covered Entity’s Information Systems, and the Nonpublic Information stored on those Information Systems, from unauthorized access, use or other malicious acts;"]
[1808,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(1) the Third Party Service Provider’s policies and procedures for access controls including its use of Multi-Factor Authentication as defined by section 500.12 to limit access to sensitive systems and Nonpublic Information;"]
[1809,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(b) The cybersecurity program shall be based on the Covered Entity’s Risk Assessment and designed to perform the following core cybersecurity functions\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","(3) detect Cybersecurity Events;"]
[1810,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.03 Cybersecurity Policy","(a) Cybersecurity Policy. Each Covered Entity shall implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity’s board of directors (or an appropriate committee thereof) or equivalent governing body, setting forth the Covered Entity’s policies and procedures for the protection of its Information Systems and Nonpublic Information stored on those Information Systems. The cybersecurity policy shall be based on the Covered Entity’s Risk Assessment and address the following areas to the extent applicable to the Covered Entity’s operations","(8) systems and network monitoring;"]
[1811,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.14 Training and Monitoring","(a) As part of its cybersecurity program, each Covered Entity shall","(1) implement risk-based policies, procedures and controls designed to monitor the activity of Authorized Users and detect unauthorized access or use of, or tampering with, Nonpublic Information by such Authorized Users; and"]
[1812,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(3) notice to be provided to the Covered Entity in the event of a Cybersecurity Event directly impacting the Covered Entity’s Information Systems or Non-public Information being held by the Third Party Service Provider; and"]
[1813,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.14 Training and Monitoring","(a) As part of its cybersecurity program, each Covered Entity shall","(1) implement risk-based policies, procedures and controls designed to monitor the activity of Authorized Users and detect unauthorized access or use of, or tampering with, Nonpublic Information by such Authorized Users; and"]
[1814,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.05 Penetration Testing and Vulnerability Assessments","(a) The cybersecurity program for each Covered Entity shall include monitoring and testing, developed in accordance with the Covered Entity’s Risk Assessment, designed to assess the effectiveness of the Covered Entity’s cybersecurity program. The monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments, and shall be done periodically. Absent effective continuous monitoring, or other systems to detect, on an ongoing basis, changes in Information Systems that may create or indicate vulnerabilities, Covered Entities shall conduct:","(2) bi-annual vulnerability assessments, including any systematic scans or reviews of Information Systems reasonably designed to identify publicly known cybersecurity vulnerabilities in the Covered Entity’s Information Systems based on the Risk Assessment."]
[1815,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(3) the definition of clear roles, responsibilities and levels of decision-making authority;"]
[1816,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(3) notice to be provided to the Covered Entity in the event of a Cybersecurity Event directly impacting the Covered Entity’s Information Systems or Non-public Information being held by the Third Party Service Provider; and"]
[1817,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(6) documentation and reporting regarding Cybersecurity Events and related incident response activities; and"]
[1818,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.17 Notices to Superintendent","(a) Notice of Cybersecurity Event. Each Covered Entity shall notify the superintendent as promptly as possible but in no event later than 72 hours from a determination that a Cybersecurity Event as follows has occurred:","(1) Cybersecurity Events of which notice is required to be provided to any government body, self-regulatory agency or any other supervisory body; and\n(2) Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operation(s) of the Covered Entity."]
[1819,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.17 Notices to Superintendent","(b) Annually each Covered Entity shall submit to the superintendent a written statement by February 15, in such form set forth as Appendix A, certifying that the Covered Entity is in compliance with the requirements set forth in this Part. Each Covered Entity shall maintain for examination by the Department all records, schedules and data supporting this certificate for a period of five years. To the extent a Covered Entity has identified areas, systems or processes that require material improvement, updating or redesign, the Covered Entity shalldocument the identification and the remedial efforts planned and underway to address such areas, systems or processes. Such documentation must be available for inspection by the superintendent.","N.A"]
[1820,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.\n(d) All documentation and information relevant to the Covered Entity’s cybersecurity program shall be made available to the superintendent upon request.","N.A"]
[1821,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.11 Third Party Service Provider Security Policy","(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to Third Party Service Providers including to the extent applicable guidelines addressing:","(3) notice to be provided to the Covered Entity in the event of a Cybersecurity Event directly impacting the Covered Entity’s Information Systems or Non-public Information being held by the Third Party Service Provider; and"]
[1822,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(4) external and internal communications and information sharing;"]
[1823,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.\n(d) All documentation and information relevant to the Covered Entity’s cybersecurity program shall be made available to the superintendent upon request.","N.A"]
[1824,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(7) the evaluation and revision as necessary of the incident response plan following a Cybersecurity Event."]
[1825,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(7) the evaluation and revision as necessary of the incident response plan following a Cybersecurity Event."]
[1826,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.16 Incident Response Plan","(b) Such incident response plan shall address the following areas","(5) identification of requirements for the remediation of any identified weaknesses in Information Systems and associated controls;"]
[1827,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(b) The cybersecurity program shall be based on the Covered Entity’s Risk Assessment and designed to perform the following core cybersecurity functions\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","(4) respond to identified or detected Cybersecurity Events to mitigate any negative effects;"]
[1828,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(b) The cybersecurity program shall be based on the Covered Entity’s Risk Assessment and designed to perform the following core cybersecurity functions\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","(6) fulfill applicable regulatory reporting obligations."]
[1829,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.02 Cybersecurity Program","(b) The cybersecurity program shall be based on the Covered Entity’s Risk Assessment and designed to perform the following core cybersecurity functions\n(c) A Covered Entity may meet the requirements of this Part by adopting a cybersecurity program maintained by an Affiliate, provided that the Affiliate’s cybersecurity program covers the Covered Entity’s Information Systems and Nonpublic Information and meets the requirements of this Part.","(5) recover from Cybersecurity Events and restore normal operations and services; and"]
[1830,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Physical devices and hardware within the bank are inventoried, stored and updated in a CMDB or equivalent"]
[1831,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Software and business applications (including version numbers) within the bank are inventoried, stored and updated in a CMDB or equivalent"]
[1832,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Types of data being created, stored or processed by IT assets are created, stored and updated in a CMDB or equivalent"]
[1833,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Maps of network resources, connections with external and mobile resources are created, stored and updated in a CMDB or equivalent"]
[1834,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","CMDB resources (e.g., hardware, devices, data, and software) are prioritized for protection based on their sensitivity/classification"]
[1835,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Information security roles and responsibilities for the entire workforce are established and aligned with internal roles and responsibilities"]
[1836,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Outsourced resources and services comply with the same requirements as inhouse resources and services (and processes are in place to manage that)"]
[1837,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","The bank’s place in critical infrastructure and its industry sector is identified and communicated"]
[1838,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Priorities for bank mission, objectives, and activities are established and communicated"]
[1839,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","The bank has a defined, approved and communicated information security strategy"]
[1840,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Dependencies and critical functions for delivery of critical services are established"]
[1841,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Resilience requirements to support delivery of critical services are established"]
[1842,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Bank's information security policy is defined and approved","GV.PL-1"]
[1843,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","The bank can rely on an adequate, qualified and certified workforce of information security Professionals"]
[1844,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Legal and regulatory requirements regarding information security (including privacy) are understood and managed","GV.PL-3"]
[1845,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","The board of directors and executive management are involved in information security and receives adequate management information/reporting"]
[1846,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Governance and risk management processes address information security risks"]
[1847,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Independent reviews are performed regularly and planning is in line with risk profile"]
[1848,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Information risk management is an integral part of enterprise risk management"]
[1849,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Virtualised environment have the same residual risk as their physical counterparts"]
[1850,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Asset vulnerabilities are identified and documented"]
[1851,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Threats, both internal and external, are identified and documented"]
[1852,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Potential business impacts and likelihoods are identified"]
[1853,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk"]
[1854,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Risk responses (accept, mitigate, transfer and avoid) are identified and prioritized by the bank and accepted by senior management"]
[1855,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Risk assessments are performed regularly and planning is in line with risk profile"]
[1856,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","Bank information risk management processes are established, managed, and agreed to by internal stakeholders"]
[1857,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Identities and credentials are managed for authorized devices and users (including join, work and leave)"]
[1858,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Logical access to assets is managed and protected"]
[1859,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Physical access to assets is managed and protected"]
[1860,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Remote access is managed and restricted to those networks/systems necessary"]
[1861,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Networks are segregated in \"zones of trust\" and traffic is filtered"]
[1862,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","All users are informed and trained about information security"]
[1863,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Information security personnel are continuously trained for their role in information security"]
[1864,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-2","Privileged users understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Privileged users, senior executives, security personnel and third-party stakeholders each understand their individual roles & responsibilities"]
[1865,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","The bank's customers are aware about their role in information security"]
[1866,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Data-at-rest and data-in-transit is adequately protected in line with the data classification policy"]
[1867,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","IDENTIFY","N.A","The bank has an asset management process in place"]
[1868,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Data assets are formally managed (in the CMDB) throughout removal, transfers, and disposal"]
[1869,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Adequate capacity to ensure availability is maintained"]
[1870,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Checking mechanisms are used to verify software and information integrity"]
[1871,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-7","The development and testing environment(s) are separate from the production environment",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Separation of development, testing and operational environments"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","The development, testing and acceptance environment(s) [DTAP] are separate from the production environment, and test data is protected"]
[1872,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","A baseline configuration of information technology systems is created and maintained"]
[1873,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","There is integration of security within IT architecture"]
[1874,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","A baseline configuration of information technology systems is created and maintained"]
[1875,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Systems are hardened, incorporating the principle of least functionality"]
[1876,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","A vulnerability management process is implemented, maintained and met"]
[1877,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Patch management processes are regularly performed"]
[1878,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","A process for a secure System Development Life Cycle is implemented"]
[1879,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Change management processes are in place"]
[1880,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Backups of information are conducted, maintained, and tested periodically (including full system recovery)"]
[1881,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-5","Policy and regulations regarding the physical operating environment for organizational assets are met",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.11.2.1\nA.11.2.2\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nEquipment siting and protection\nSupporting utilities\nCabling security"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Physical security policies are implemented and met"]
[1882,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Data is maintained and destroyed according to the data retention policy"]
[1883,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Business continuity, disaster recovery, crisis management and computer emergency response plans are in place, managed and tested"]
[1884,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Audit/log records are determined, documented, implemented, and reviewed in accordance with policy"]
[1885,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Removable media and mobile devices are protected and their use restricted according to policy"]
[1886,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Access permissions are managed and reviewed periodically, incorporating the principles of least privilege and segregation of duties"]
[1887,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-4","Communications and control networks are protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nInformation transfer policies and procedures"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Communications and control networks are protected (e.g., firewalls, switches and routers)"]
[1888,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","A baseline of expected network data flows is established and managed"]
[1889,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Anomalies in customer-initiated events are detected"]
[1890,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Detected events are analyzed to understand attack targets and methods and to determine the event impact"]
[1891,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Event data are aggregated and correlated from multiple sources and sensors in order to detect anomalies"]
[1892,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Event thresholds are established"]
[1893,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Protection against (Distributed) Denial of Services (DoS) attacks is in place"]
[1894,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","The information systems and assets are monitored to detect potential information security events"]
[1895,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Monitoring services are provided by internal or external service providers"]
[1896,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","The physical environment is monitored to detect potential security events"]
[1897,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Monitoring user activities, usage, connections, devices, and software is performed"]
[1898,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-4","Malicious code is detected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Monitoring is in place to detect malicious code"]
[1899,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Penetration tests and red teaming are required and performed regularly."]
[1900,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","DETECT","N.A","Event detection information is communicated to appropriate parties"]
[1901,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-3","Forensics are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Collection of evidence"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Forensics are performed"]
[1902,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-4","Incidents are categorized consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Incidents are categorized/prioritized consistent with response plans"]
[1903,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Personnel know their roles and order of operations when a response is needed"]
[1904,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Information is shared consistent with response plans"]
[1905,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Information sharing occurs with external stakeholders to achieve broader information security situational awareness"]
[1906,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Computer emergency response plans incorporate lessons learned"]
[1907,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Computer emergency response strategies are updated"]
[1908,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-1","Incidents are contained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Incidents are contained in a timely manner"]
[1909,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-2","Incidents are mitigated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nResponse to information security incidents"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Incidents are mitigated in a timely manner"]
[1910,"RS","4 - RESPOND ","RS.MI","Mitigation","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Vulnerabilities identified as a result of an incident are mitigated or documented as accepted risks and monitored"]
[1911,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","Computer emergency response plans are in place and are executed during or after an event"]
[1912,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RESPOND","N.A","A crisis management bankis in place and their members are regularly trained"]
[1913,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","PROTECT","N.A","Brand protection services are procured"]
[1914,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-2","Reputation after an event is repaired",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RECOVER","N.A","Public relations are managed and efforts to repair reputation are performed"]
[1915,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RECOVER","N.A","Recovery activities are communicated to relevant internal and external stakeholders"]
[1916,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RECOVER","N.A","Recovery plans incorporate lessons learned"]
[1917,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RECOVER","N.A","Recovery strategies are updated"]
[1918,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"Singapore - SAMA","Singapore - SAMA \"Information Security Survey - 2016\"","EMEA","RECOVER","N.A","Recovery plan (e.g., Incident Recovery, Disaster Recovery, Business Continuity) is executed during or after an event"]
[1919,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Policies, Procedures and Processes","Has the Bank identified and classified its assets as per different levels of criticality?"]
[1920,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Policies, Procedures and Processes","With regard to (29) above, has senior management determined the level of support required to safeguard those assets?"]
[1921,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Human Resources","Does the Bank have adequate staffing levels for Information Security?"]
[1922,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Human Resources","What is the overall percentage of the following staff in comparison to the total staff complement?\n  a. Permanent IT staff complement\n  b. Permanent Information Security staff complement\n  c. Permanent Cybersecurity staff complement\n  d. IT staff consultants and contractors\n  e. Information Security consultants and contractors\n  f. Cybersecurity consultants and contractors"]
[1923,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Policies, Procedures and Processes","Has the bank assigned responsibility for each security policy and procedure to specific individuals?"]
[1924,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Policies, Procedures and Processes","How does each policy “owner” stay current with latest developments in their area of responsibility with specific reference to the policy?"]
[1925,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Policies, Procedures and Processes","Has the Bank established the applicability each security policy and procedure to specific environments and implemented processes to measure compliance thereto? "]
[1926,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Policies, Procedures and Processes","What is the Bank's review cycle of each security policy and procedure to ensure its continued suitability, adequacy and effectiveness?"]
[1927,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-1","The organization’s role in the supply chain is identified and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.3\nA.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Human Resources","Where does the Bank's information security division report to?"]
[1928,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","Over the coming 3 years, do you expect that the bank's IT budget will:"]
[1929,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","Rank, from 1 to 6, what will be the main causes for IT spend, from the list, over the next year with 1 being most important and 6 the least important."]
[1930,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","How is the bank's IT budget approximately split between run the bank, grow the bank, and transform the bank expenses in terms of percentages?"]
[1931,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","Which of the following will likely limit (at least to some extent) the bank's ability to deliver on IT infrastructure investments over the coming 12 months? \n\nPlease rank the Bank's selection in their order of priority from 1 to 7, with 1 being most important."]
[1932,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Strategy","Alignment to corporate strategy","Is the ICT security program aligned to business objectives?"]
[1933,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Strategy","Alignment to corporate strategy","Describe the current state of the Bank's security objectives and strategies?"]
[1934,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Governance Structures","Indicate which of the IT governance structures referred to in (21) above do following stakeholders participate?, (i) Chief Information Officer, (ii) Chief Executive Officer, (iii) Chief Financial Officer, (iv) Chief Information Security Officer"]
[1935,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Governance Structures","Indicate how frequently would the following committees receive Information Security and/or cybersecurity status updates?(i) Sub-board IT committee(ii) Executive management IT committee(iii) Operational IT committee(iv) Cyber-risk IT committee(v) Other - specify"]
[1936,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Governance Structures","In instances where the below-mentioned individuals are not part of the above IT governance committees referred to in (21) above, then indicate how frequently would they receive Information Security and/or cybersecurity updates?(i) Chief Information Officer(ii) Chief Executive Officer(iii) Chief Financial Officer(iv) Chief Information Security Officer"]
[1937,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","IT Governance","The bank has defined processes to ensure reporting and escalation on all IT issues and statuses, including those related to IT governance, IT risk and the other IT processes covered in this questionnaire, in order to ensure management oversight and timely action. An IT governance function within the bank consolidates all issues and remedial actions into a consolidated management context for reporting to the board."]
[1938,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-4","Dependencies and critical functions for delivery of critical services are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.2\nA.11.2.3\nA.12.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Supporting utilities\nCabling security\nCapacity management"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","Which year was the bank's current core banking solution implemented?"]
[1939,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Business Continuity","BCPs are based on business impact assessments (BIAs) and address requirements for resilience, alternative processing and recovery capability of all critical services. The plans also cover usage guidelines, roles and responsibilities, procedures, communication processes, and the testing approach. "]
[1940,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Strategy","Alignment to corporate strategy","Does the Bank have a documented Information Security strategy including cybersecurity?"]
[1941,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Strategy","Information Security Planning","Which of the following best describes the Bank's Information Security strategy in relation to emerging risks?"]
[1942,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Strategy","Information Security Planning","Which of the following factors best characterises the primary challenges implementing Information Security at the Bank?\n\nPlease rank the Bank's selection in their order of priority from 1 to 5, with 1 being most important."]
[1943,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Framework","Artefacts and Toolset","Which of the following does the Bank’s Information Security framework include?"]
[1944,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Policies, Procedures and Processes","Does the information security policy have the support of senior management, including the Board of Directors?"]
[1945,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Emerging technologies","Does the Bank have policies and procedures in place to mitigate the Information Security risks associated with the use of the following?(i) Mobile devices (e.g. tablets and smartphones)(ii) Social media(iii) Cloud computing"]
[1946,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Policy","Emerging technologies","Are there any envisaged changes in the foreseeable future regard to (35) above? If yes, please provide more detail.(i) Mobile devices (e.g. tablets and smartphones)(ii) Social media(iii) Cloud computing"]
[1947,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Internal and External Auditors","Has the Bank’s internal and /or external auditors established whether the information security policies, procedures, processes and standards are efficient, economic and fit for purpose?"]
[1948,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","Has the availability of IT skills hampered the bank's ability to support and improve its IT infrastructure over the last 12 months?"]
[1949,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Internal and External Auditors","Has the Bank’s internal and /or external auditors examined the information security systems management (ISMS) to establish whether it meet stated security requirements based on the nature, size and operations of the Bank?"]
[1950,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","IT Governance","The bank obtains independent assurance (internal or external) on the conformance of IT with relevant laws and regulations; the bank’s policies, standards and procedures; generally accepted practices; and the effective and efficient performance of IT. The processes listed in this questionnaire are considered during risk-based planning of the assurance programme(s)."]
[1951,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Governance Structures","Which of the following IT governance structures have been established by the Bank to coordinate the Information Security and cybersecurity activities including IT risk management?"]
[1952,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Penetration Testing","What is the maturity level of the Cyber Security Program?"]
[1953,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","Which department is responsible for managing the bank's Information Security budget?"]
[1954,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","What percentage of the Bank's budget for both CAPEX and OPEX is allocated to information security, including cyber security?"]
[1955,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","Which of the following describes the Bank's total Information Security budget in the past three financial years?"]
[1956,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","Which of the following describes the Bank's total planned Information Security budget in the next three financial years?"]
[1957,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","Which of the following issues or factors are driving the Bank's Information Security spending?\n\nPlease rank the Bank's selection in their order of priority from 1 to 6, with 1 being most important."]
[1958,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","Does the Bank have any external insurance policies to help manage cyber security risks? If yes, what does it cover? If no, is there Directors’ or Officers’ exposure and coverage?"]
[1959,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","With regard to (49) above, does the Bank have any Directors’ or Officers’ exposure and coverage?"]
[1960,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Budget and Costs","Has the Bank budgeted for or is the bank holding capital (scenario) for a cyber-security event?"]
[1961,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Internal and External Auditors","Has the Bank considered Information Security certification and accreditation to ensure that required security measures have been implemented will achieve the intended level of protection?"]
[1962,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","IT Governance","The bank has an established IT governance framework which is aligned with the overall enterprise governance and control environment within the bank. The framework is based on and refers to relevant IT process and control frameworks. The IT governance framework assigns accountability and provides for practices in order to avoid a breakdown in internal control and oversight. In addition the IT governance framework addresses compliance with relevant laws and regulations. "]
[1963,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Internal and External Auditors","What were major deficiencies identified in the past financial year?"]
[1964,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-2","Organizational risk tolerance is determined and clearly expressed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2\n6.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nInformation security risk treatment"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","IT Governance","The bank has defined its IT risk appetite and it has been approved by the board. The bank has embedded risk management responsibilities within the bank, and the business as well as IT regularly assess and report IT-related risks and their impact in a way that makes the bank's IT risk position transparent to all stakeholders."]
[1965,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Governance","Human Resources","Does the Bank have a dedicated Information Security executive?"]
[1966,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Strategy","Background information","What is the total value of the IT assets on the balance sheet held by the Bank in rand values?"]
[1967,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Strategy","Background information","How is the Bank's IT system managed?"]
[1968,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Capacity management","The bank has created availability, performance and capacity baselines which are used in assessing current availability, performance and capacity."]
[1969,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Capacity management","IT infrastructure investments take into consideration future availability, performance and capacity requirements and ensure that cost-justifiable capacity and performance are available to support business needs and deliver against requirements. "]
[1970,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Capacity management","The bank monitors, measures, analyses, reviews and reports on availability, capacity and performance. Deviations from baselines as well as trend reporting are used to identify significant issues which the bank uses to initiate actions, where necessary, and all outstanding issues are followed up."]
[1971,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Enterprise Architecture","The bank has established and maintains an enterprise architecture (EA) vision to define a common architecture which describes both the baseline and target architectures. "]
[1972,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Enterprise Architecture","The bank's EA vision is aligned with its business objectives and is moving the bank towards an agile and resilient IT infrastructure. "]
[1973,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Enterprise Architecture","The bank has defined and maintains a reference architecture which described the current and target architecture for the business, information, data, application and technology domains."]
[1974,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Enterprise Architecture","The bank's reference architecture is used to rationalise the gaps between the baseline and target architectures.  In addition, IT-enabled investment programmes are aligned with the reference architecture in collaboration with key stakeholders from both business and IT. "]
[1975,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Configuration management","The bank has established configuration procedures to support management and logging of all changes to the configuration database. These procedures are integrated with the change management, incident management and problem management procedures."]
[1976,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Business Continuity","The bank tests its BCPs and DRPs on a regular basis to ensure that business, including IT systems, can be effectively recovered within recovery time objectives while shortcomings are addressed in order for plans to remain relevant. Testing entails careful preparation, documentation, reporting of test results and depending on the results, implementation of an action plans. "]
[1977,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Penetration Testing","Does the Bank conduct penetration testing?"]
[1978,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Penetration Testing","Who conducts penetration testing?"]
[1979,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Penetration Testing","What type of penetration testing had been conducted?"]
[1980,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Penetration Testing","How frequently is penetration testing undertaken?"]
[1981,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Penetration Testing","Which key applications are included in penetration testing?"]
[1982,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Management","Penetration Testing","What were the results of the last penetration testing conducted?"]
[1983,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Life cycle management","The bank manages IT infrastructure through its life cycle to make sure that its use delivers value at optimal cost, it remain operational (fit for purpose) as well as being reliable and available."]
[1984,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Change management","The bank has developed a change management policy with supporting procedures which are used to handle all requests (including maintenance and patches) in a standardised manner including changes to applications, procedures, processes, systems and services, as well as the underlying platforms."]
[1985,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Change management","Changes are tested independently in accordance with the defined test plan prior to migration to the operational environment. Testing considers performance, capacity and availability scenarios. "]
[1986,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Change management","The bank has procedures in place to manage the promotion to production of changes based on the severity of the change i.e. normal vs. emergency. Promotion to production happens after testing and the procedure includes: a controlled handover of the changed system to operations, an implementation plan, and approval from key stakeholders. A back out plan forms part of the implementation plan. "]
[1987,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Change management","The banks change management procedures specifically caters for emergency changes. The procedures include defining, declaring, assessing, authorising and recording of an emergency change. All emergency changes are appropriately authorised, documented and revoked after the change has been applied. Post-implementation reviews are conducted of emergency changes and include relevant stakeholders, and consider things like further application system maintenance, impact on development and test environments, application software development quality, documentation and manuals, and data integrity."]
[1988,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-3","Configuration change control processes are in place",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Change management","The bank tracks and reports the status of changes and changes are reported on, including verifying that approved changes are implemented as planned. After changes are implemented system and user documentation is updated accordingly. "]
[1989,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Business Continuity","Procedures are defined and implemented for backup and restoration of systems, applications, data and documentation in line with business requirements and the continuity planning."]
[1990,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Business Continuity","The bank develops Business Continuity Plans (BCPs) based on its Business Continuity Management (BCM) policy and framework which are designed to reduce the impact of a major disruption on key business functions and processes."]
[1991,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Business Continuity","Disaster Recovery Plans (DRPs) are developed in line with BCPs and are aligned to the recovery time objectives and recovery point objectives as determined in the BIAs as well as the criticality prioritisation of different process and/or systems within the bank. "]
[1992,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","Does the bank have plans to start replacing its core banking or any of its top 5 key IT systems within the foreseeable future? If yes, is the start date within:"]
[1993,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","If the bank is currently replacing its core banking and / or one of its top 5 key IT systems, how is the project tracking in terms of budget: "]
[1994,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","General questions","Spending","If the bank is currently replacing its core banking and / or one of its top 5 key IT systems, how is the project tracking in terms of timelines: "]
[1995,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Configuration management","The bank has a central repository and supporting tool used to maintain a record of all relevant information on configuration items. The repository includes all assets and is used to log changes to the configuration of these assets and enable monitoring of changes. The bank maintains baseline configurations for systems and services within the bank. "]
[1996,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Information Security Framework","Artefacts and Toolset","What is the maturity level of the following security technologies deployed in the Bank?(i) Anti-virus software(ii) Malicious code detection tools (spyware and adware)(iii) Firewalls(iv) Server-based access control lists(v) Intrusion detection tools(vi) Intrusion prevention systems(vii) Vulnerability scanning tools(viii) Data loss prevention (DLP) tools(ix) Tools to discover unauthorised devices(x) Security event correlation tools(xi) Encryption for data in transit(xii) Encrypted files(xiii) Reusable account/login passwords(xiv) Smart cards/other one-time password tokens(xv) Public key infrastructure systems(xvi) Biometrics"]
[1997,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-4","Incidents are categorized consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Assessment of and decision on information security events"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Incident management","Service desk procedures are established to ensure that incidents are classified and logged accurately and those that cannot be resolved immediately are appropriately escalated. The bank's procedures include assigning ownership of and priorities to incidents and ensure that they are tracked until resolution. "]
[1998,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Incident management","The bank has defined and communicated the characteristics of potential incidents so they are properly classified and treated by the incident and problem management process. This includes the classification of incidents according to which they are handled in the incident management process. "]
[1999,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"South Africa - SARB","South Africa - South Africa Reserve Bank \"IT Questionnaire - 2016\"","EMEA","Assurance","Incident management","The bank analyses recorded incidents and trends in order to provide input into continual improvement processes."]
[2000,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","3. Data Loss Prevention","N.A","• Firm policies and procedures related to enterprise data loss prevention and information related to the following:\n\no Data mapping, with particular emphasis on understanding information ownership and how the firm documents or evidences personally identifiable  information (“PII”); \n"]
[2001,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value","A.08.2.1","Classification of information","SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","3. Data Loss Prevention","N.A","• Firm policies related to data classification,  including:  information  regarding the types of data classification;  the risk level (e.g., low, medium, or high) associated with each data classification;  the factors considered when classifying data; and how the factors and risks are considered when the firm makes data classification  determinations.\n"]
[2002,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","B. Whenever the Commissioner has reason to believe that a Licensee has been or is engaged in conduct in this State which violates this Act, the Commissioner may take action that is necessary or appropriate to enforce the provisions of this Act.","Firm policies and procedures related to the following:\n• Information regarding the firm’s Chief Information Security Officer (“CISO”) or equivalent position, and other employees responsible for cybersecurity matters.\n"]
[2003,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","N.A","Firm policies and procedures related to the following:\n• Information regarding the firm’s organizational structure, particularly information regarding the positions and departments responsible for cybersecurity-related matters and where they fit within the firm’s organization or hierarchy.\n","GV.RR-1"]
[2004,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Information regarding written contingency plans the firm has with its vendors concerning, for instance, conflicts of interest, bankruptcy, or other issues that might put the vendor out of business or in financial difficulty.\n","DM.BE-3"]
[2005,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","N.A","Firm policies and procedures related to the following:\n• Board minutes and briefing materials, if applicable, regarding: cyber-related risks; cybersecurity incident response planning; actual cybersecurity incidents; and cybersecurity-related matters involving vendors.\n","GV.SP-1"]
[2006,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","N.A","• Information regarding the firm’s periodic risk assessments to identify cybersecurity threats, vulnerabilities,  and potential business and compliance consequences, if applicable, and any related findings and responsive remediation efforts taken.\n","GV.RM-1"]
[2007,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information related to any internal audit conducted by the firm that covered access rights and controls.\n","GV.AU-1"]
[2008,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding the amount of actual customer losses associated with cyber incidents, as well as information on the following:\n\no The amount of customer losses reimbursed by the firm;\n","GV.SP-2"]
[2009,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding the amount of actual customer losses associated with cyber incidents, as well as information on the following:\n\no Whether the firm had cybersecurity  insurance coverage, including  the types of incidents the insurance covered;","GV.SP-2, GV.RM-1"]
[2010,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding the amount of actual customer losses associated with cyber incidents, as well as information on the following:\n\no Whether any insurance claims related to cyber events were filed;\n","GV.SP-2, GV.RM-1"]
[2011,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding the amount of actual customer losses associated with cyber incidents, as well as information on the following:\n\no The amount of cyber-related losses recovered pursuant to the firm’s cybersecurity insurance coverage.\n","GV.SP-2, GV.RM-1"]
[2012,"ID","1 - IDENTIFY ","ID.RM","Supply Chain Risk Management","ID.SC-4","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Firm policies and procedures related to third-party vendors, such as those addressing the following:\n\no Due diligence with regard to vendor selection;\n","DM.ED-7"]
[2013,"ID","1 - IDENTIFY ","ID.RM","Supply Chain Risk Management","ID.SC-3","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Firm policies and procedures related to third-party vendors, such as those addressing the following:\n\no Contracts, agreements, and the related approval process;\n","DM.ED-6"]
[2014,"ID","1 - IDENTIFY ","ID.RM","Supply Chain Risk Management","ID.SC-3","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Firm policies and procedures related to third-party vendors, such as those addressing the following:\n\no Any risk assessments, risk management, and performance measurements and reports required of vendors.\n","DM.ED-6"]
[2015,"ID","1 - IDENTIFY ","ID.RM","Supply Chain Risk Management","ID.SC-3","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Sample documents or notices required of third-party vendors, such as those required prior to any significant  changes to the third-party vendors’ systems, components, or services that could potentially  have security impacts to the firm and the firm’s data containing PII.","DM.ED-6"]
[2016,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information related to the systems or applications  for which the firm uses multi-factor authentication  for employee and customer access as well as documentation  evidencing implementation  of any related policies  and procedures and information  on systems or applications  for which the firm does not use multi-factor  authentication.\n"]
[2017,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures related to verification  of the authenticity of customer requests to transfer funds."]
[2018,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures regarding devices used to access the firm’s system externally (i.e., firm-issued and personal devices), including those addressing the encryption of such devices and the firm’s ability to remotely monitor, track, and deactivate remote devices. "]
[2019,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information related to any reviews of employee access rights and restrictions with respect to job-specific  resources within the network and any related documentation.\n"]
[2020,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information related to any reviews of employee access rights and restrictions with respect to job-specific  resources within the network and any related documentation.\n"]
[2021,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures regarding access by unauthorized persons to firm network resources and devices and user access restrictions (e.g., access control policy, acceptable use policy, administrative  management of systems, and corporate information  security policy), including  those addressing the following:\n\no Updating or terminating access rights based on personnel or system changes\n"]
[2022,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information demonstrating the implementation  of firm policies and procedures related to employee access rights and controls, such as the following:\n\no Documentation evidencing  the tracking of employee access rights, changes to those access rights, and any manager approvals for those changes;\n\n"]
[2023,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures regarding system notifications  to users, including employees and customers, of appropriate usage obligations  when logging  into the firm’s system (e.g., log-on banners, warning messages, or acceptable use notifications)  and sample documentation  evidencing  implementation  of these policies  and procedures."]
[2024,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","5. Training","N.A","• Information with respect to training  provided by the firm to its employees regarding information  security and risks, including the training method (e.g., in person, computer- based learning, or email alerts); dates, topics, and groups of participating  employees; and any written guidance or materials provided.\n"]
[2025,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","5. Training","N.A","• Information regarding training provided by the firm to third-party vendors or business partners related to information  security.\n"]
[2026,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","N.A","Firm policies and procedures related to the following:\n\no Protection of broker-dealer customer and/or investment adviser client (hereinafter “customer”) records and information, including those designed to secure customer documents and information, protect against anticipated threats to customer information, and protect against unauthorized access to customer accounts or information. \n"]
[2027,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","3. Data Loss Prevention","N.A","• Firm policies and procedures related to enterprise data loss prevention and information related to the following \n\no The systems, utilities,  and tools used to prevent, detect, and monitor data loss as it relates to PII and access to customer accounts, including a description of the functions and source of these resources"]
[2028,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","3. Data Loss Prevention","N.A","• Firm policies and procedures related to monitoring  exfiltration  and unauthorized distribution  of sensitive information  outside of the firm through various distribution channels (e.g., email, physical media, hard copy, or web-based file transfer programs) and any documentation  evidencing this monitoring.\n"]
[2029,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding the firm’s process for conducting tests or exercises of its incident response plan, including  the frequency of, and reports from, such testing and any responsive remediation efforts taken, if applicable.\n"]
[2030,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures regarding access by unauthorized persons to firm network resources and devices and user access restrictions (e.g., access control policy, acceptable use policy, administrative  management of systems, and corporate information  security policy), including  those addressing the following:\n\no Updating or terminating access rights based on personnel or system changes\n"]
[2031,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information demonstrating the implementation  of firm policies and procedures related to employee access rights and controls, such as the following:\n\no Information related to former employees’ last date of employment  and the date their access to the firm’s systems was terminated; and\n"]
[2032,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information demonstrating the implementation  of firm policies and procedures related to employee access rights and controls, such as the following:\n\no Information related to current employees who have been reassigned by the firm to a new group or function, including  their date of reassignment and the date their access to the firm’s systems was modified.\n"]
[2033,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","N.A","Firm policies and procedures related to the following:\n\no Patch management practices, including those regarding the prompt installation of critical patches and the documentation evidencing such actions.\n"]
[2034,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","N.A","• Information regarding the firm’s vulnerability  scans and any related findings  and responsive remediation efforts taken.\n"]
[2035,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Firm policies and procedures or the firm’s business continuity  of operations plan that address mitigation  of the effects of a cybersecurity incident and/or recovery from such an incident, including  policies  regarding cybersecurity incident response and responsibility for losses associated with attacks or intrusions  impacting clients."]
[2036,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures related to log-in  attempts, log-in  failures, lockouts, and unlocks or resets for perimeter-facing systems and information  regarding the process the firm uses to enforce these policies and procedures and to review perimeter-facing systems, for failed log-in attempts, deactivation of access, dormant user accounts, and unauthorized  log-in  attempts."]
[2037,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures regarding access by unauthorized persons to firm network resources and devices and user access restrictions (e.g., access control policy, acceptable use policy, administrative  management of systems, and corporate information  security policy), including  those addressing the following:\n\no Establishing  employee access rights, including  the employee’s role or group membership\n"]
[2038,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Firm policies and procedures regarding access by unauthorized persons to firm network resources and devices and user access restrictions (e.g., access control policy, acceptable use policy, administrative  management of systems, and corporate information  security policy), including  those addressing the following:\n\no Any management approval required for changes to access rights or controls.\n"]
[2039,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information demonstrating the implementation  of firm policies and procedures related to employee access rights and controls, such as the following:\n\no Documentation evidencing  the tracking of employee access rights, changes to those access rights, and any manager approvals for those changes;\n\n"]
[2040,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information related to instances in which system users, including  employees, customers, and vendors, received entitlements or access to firm data, systems, or reports in contravention of the firm’s policies or practices or without required authorization  as well as information  related to any remediation  efforts undertaken in response.\n"]
[2041,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Information regarding third-party vendors with access to the firm’s network or data, including the services provided and contractual terms related to accessing firm networks or data.\n"]
[2042,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Access to networks and network services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Information regarding third-party vendors that facilitate the mitigation of cybersecurity risks by means related to access controls, data loss prevention, and management of PII, including a description of the services each vendor provides to the firm and contractual terms included in vendor contracts involving  cybersecurity-related services.\n"]
[2043,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding system-generated alerts related to data loss of sensitive information  or confidential customer records and information,  including  any related findings  and any responsive remediation efforts taken.\n"]
[2044,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","4. Vendor Management","N.A","• Firm policies and procedures related to third-party vendors, such as those addressing the following:\n\no Supervision,  monitoring, tracking, and access control\n"]
[2045,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","1. Governance and Risk Assessment (GRA)","N.A","• Information regarding the firm’s policies  related to penetration testing, whether conducted by or on behalf of the firm, and any related findings  and responsive remediation efforts taken.\n"]
[2046,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information related to customer complaints  received by the firm related to customer access, including  a description of the resolution of the complaints  and any remediation efforts undertaken in response.\n"]
[2047,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding incidents of unauthorized internal or external distributions  of PII, including the date of the incidents, discovery process, escalation, and any responsive remediation efforts taken.\n"]
[2048,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","6. Incident Response","N.A","• Information regarding successful unauthorized internal or external incidents related to access, including  the date of the incidents, discovery process, escalation, and any responsive remediation efforts taken.\n"]
[2049,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","c.1) Formal policies and procedures should be established for information security and data classification in order to classify data based on its level of sensitivity value and criticality to LCs. "]
[2050,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","I) Establish a strong governance framework to supervise cybersecurity management","I) Establish a strong governance framework to supervise cybersecurity management","a. Designated resources should be adequately allocated to operate, govern and audit the controls in place to mitigate cybersecurity risks."]
[2051,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","I) Establish a strong governance framework to supervise cybersecurity management","I) Establish a strong governance framework to supervise cybersecurity management","b1. Cybersecurity topics should be included as a regular agenda item in senior management level meetings in order to set the direction and cybersecurity strategy for LCs. ","GV.SF-1"]
[2052,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.2},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security objectives and planning to achieve them"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","c) Management should supervise the implementation of improvement initiatives when deficiencies are identified during cybersecurity risk assessment. Implementation timeline and milestones at a more granular level for each of the improvement initiatives should be defined. Management should make enquiries where there is any delayed implementation of improvement initiatives or prolonged period of implementation timelines."]
[2053,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","II) Implement a formalized cybersecurity management process for service providers","II) Implement a formalized cybersecurity management process for service providers","a. Cybersecurity risk management for service providers should be formalized and integrated into the LCs’ cybersecurity control frameworks."]
[2054,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","II) Implement a formalized cybersecurity management process for service providers","II) Implement a formalized cybersecurity management process for service providers","b. it is also crucial for the LCs to incorporate cybersecurity requirements in the agreements with service providers and to perform on-going cybersecurity risk assessments or on-site audits when necessary throughout the engagements."]
[2055,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","a) Cybersecurity risk assessment, including cybersecurity control gap analysis and benchmarking exercises, should be regularly conducted, with coverage of cybersecurity controls over both Internet-facing and internal systems/environments, taking into consideration the latest cybersecurity threat landscape. Such cybersecurity controls should also be adequately designed and regularly tested."]
[2056,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-3","Remote access is managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.2.2\nA.13.1.1\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Teleworking\nNetwork controls\nInformation transfer policies and procedures"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VIII) Reinforce user access controls to ensure access to information is only granted to users on a need-to-know basis","VIII) Reinforce user access controls to ensure access to information is only granted to users on a need-to-know basis","b) Measures (e.g. virtual private network connection and two-factor authentication) should be taken for securing remote access from external networks to LCs’ internal networks."]
[2057,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","III) Enhance security architecture to guard against advanced cyber-attacks","III) Enhance security architecture to guard against advanced cyber-attacks","Operating Systems\nd. In order to protect computers and networks from cyber-attacks by malicious applications (e.g. some sophisticated malwares might not be effectively detected by anti-virus software), privileged user access to the operating system should be restricted to prevent installation of malicious applications, unauthorized manipulation of system configurations or removal of security tools in the users’ computers. LCs may also consider strengthening the control environment by implementing additional safeguards (e.g. application whitelisting) to prevent execution of unauthorized applications on users’ computers."]
[2058,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VIII) Reinforce user access controls to ensure access to information is only granted to users on a need-to-know basis","VIII) Reinforce user access controls to ensure access to information is only granted to users on a need-to-know basis","a) User access controls, including privileged users and recertification process, should be enforced to ensure user access rights are granted on a need-to-know basis with segregation of incompatible duties in place so that only appropriate personnel are authorized to access the data and information required for their job duties."]
[2059,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.1.1\nA.13.1.3\nA.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Network controls\nSegregation in networks\nInformation transfer policies and procedures"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","III) Enhance security architecture to guard against advanced cyber-attacks","III) Enhance security architecture to guard against advanced cyber-attacks","c1) Security zones (e.g. demilitarized zone) should be considered within LCs’ networks for compartmenting systems and components according to their required level of cybersecurity protection (e.g. sensitivity of information resided in/processed by the systems)"]
[2060,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VIII) Reinforce user access controls to ensure access to information is only granted to users on a need-to-know basis","VIII) Reinforce user access controls to ensure access to information is only granted to users on a need-to-know basis","a) User access controls, including privileged users and recertification process, should be enforced to ensure user access rights are granted on a need-to-know basis with segregation of incompatible duties in place so that only appropriate personnel are authorized to access the data and information required for their job duties."]
[2061,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","I) Establish a strong governance framework to supervise cybersecurity management","I) Establish a strong governance framework to supervise cybersecurity management","b2.  Regular evaluation of staff’s understanding and compliance with LCs’ policies should be conducted to ensure the alignment of staff’s behaviour with the LCs’ cybersecurity strategy."]
[2062,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","I) Establish a strong governance framework to supervise cybersecurity management","I) Establish a strong governance framework to supervise cybersecurity management","c. Cybersecurity awareness training should be regularly provided to all staff, from senior to junior levels, and service providers, if applicable, followed by assessments (e.g. a simulated phishing exercise) to assess whether staff and/or service providers are equipped with a strong cybersecurity awareness culture."]
[2063,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","a.1) Data protection programs should be established to ensure the data flow of sensitive information has been defined, identified, documented and protected"]
[2064,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","a.2) The deployment of data protection processes and technologies (e.g. Data Loss Prevention solutions) should provide adequate coverage for the identified data flows and trigger appropriate responses (e.g. block exchange of restricted data, suspend transfer of potential confidential data or escalate suspicious data transfer activities to designated personnel, etc.) according to the sensitivity of data."]
[2065,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","e.1) Mobile secure containers should be implemented in staff’s mobile devices to create an encrypted environment and separate the firms’ applications and information from other personal data and applications in mobile devices. Data wipe-out functions should be enforced to remove the firms’ applications and information when the loss of mobile device is reported."]
[2066,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","e.2) Data wipe-out functions should be enforced to remove the firms’ applications and information when the loss of mobile device is reported."]
[2067,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","c.2) Data protection and baseline security controls should be established and determined based on the data classification to ensure sufficient controls are applied to meet the protection needs. "]
[2068,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","b) The contingency plan with emergencies and disruptions related to cyber-attacks should be periodically tested covering the end-to-end cyber crisis management process with local stakeholders’ involvement to ensure the plan is viable and adequate to deal with cybersecurity incidents."]
[2069,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","c) Disaster recovery drill for mission critical systems should be performed to validate the switch over capabilities of IT components in the event of emergency."]
[2070,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","b) Simulations of real-life cyber-attack scenarios (e.g. in a form of “red team versus blue team” in which red team would launch the cyber-attacks and blue team should defend the cyber-attacks and protect the systems and networks of the LCs) and the latest trends of cyber-attacks should be carried out to validate the effectiveness of the cyber-attacks defence mechanisms."]
[2071,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-12","A vulnerability management plan is developed and implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nCompliance with security policies and standards"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","d) Vulnerability and security patch management process and procedures to implement bug fixes or upgrade for technologies should be formalized to remediate vulnerabilities identified in a timely fashion. Sufficient risk assessment and testing should be conducted before applying security patches to prevent unexpected system and business disruption."]
[2072,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","III) Enhance security architecture to guard against advanced cyber-attacks","III) Enhance security architecture to guard against advanced cyber-attacks","Process\na. Cybersecurity should be considered in the software development life cycle (“SDLC”) to allow early identification and remediation of security vulnerabilities prior to the launch of software (e.g. involve security specialists at the beginning of the planning stage, assess the protection needs and security requirements in the collection of system requirements stage, adopt security best practices in the design and implementation stages, perform security acceptance test in the testing stage, etc)."]
[2073,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","d) All backup tapes should be encrypted and protected physically (e.g. use of locked box for storage transportation) to ensure secure storage and transportation between locations."]
[2074,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","c.3) Furthermore, formal data disposal and physical device destruction procedures should be established for disposing of confidential documents and physical devices to prevent data leakage."]
[2075,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VI) Enhance incident and crisis management procedures with more details of latest cyber-attack scenarios","VI) Enhance incident and crisis management procedures with more details of latest cyber-attack scenarios","a) Incident response plan and crisis management procedures should include cyber-attack scenarios which might seriously affect the business operations of LCs (e.g. loss of data, simultaneous attacks to both primary and backup IT infrastructures) and be tested by regular drills or simulation exercises to ensure all key stakeholders (including relevant representatives from the local business) have a good understanding of the cybersecurity incident and crisis handling procedures."]
[2076,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","a.1) A written contingency plan to cope with emergencies and disruptions due to cyber-attacks should be established. "]
[2077,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","d) Recertification should be performed periodically on removable media access (e.g. removable hard disk) to monitor and restrict data exchange through the use of removable media according to a need-to-have basis."]
[2078,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","IV) Formulate information protection programs to ensure sensitive information flow is protected","IV) Formulate information protection programs to ensure sensitive information flow is protected","b) LCs should tailor the solutions and their underlying parameters to enable detection of malicious activities by behavioural monitoring (e.g. monitoring the data exfiltration over certain types of information, such as customer identifiers, source codes and large volume of encrypted files, after normal office hours) by taking into consideration different types of cyber-attacks and applicable regulatory requirements."]
[2079,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","III) Enhance security architecture to guard against advanced cyber-attacks","III) Enhance security architecture to guard against advanced cyber-attacks","Network\nb. Multi-tier network defences (e.g. firewall, Intrusion Detection System, Intrusion Prevention System and access controls on network level) and multi-layered security covering physical perimeters, network, operating systems, applications and data (e.g. internal network monitoring, application whitelisting1, restriction of channels for data transfer and email encryption, etc) should be implemented to enforce on-going monitoring and timely detection of abnormal system/network activities and user behaviour so as to mitigate the risk of advanced and persistent attacks."]
[2080,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","e) Effective controls should be implemented to prevent and detect any unauthorized devices being connected to LCs’ networks to access sensitive information or launch cyber-attacks within LCs’ networks."]
[2081,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","V) Strengthen threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities","f) Anti-distributed denial of service (“DDoS”) mechanisms should be deployed to prevent DDoS attacks by filtering high volume and suspicious incoming traffic/cyber-attacks."]
[2082,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","III) Enhance security architecture to guard against advanced cyber-attacks","III) Enhance security architecture to guard against advanced cyber-attacks","c2) Control mechanisms should be in place to monitor, detect and restrict the connections established for unauthorized data transfer between different security zones."]
[2083,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"Hong Kong - SFC","HK SFC \"Circular to All Licensed Corporations on Cybersecurity\"","APAC","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","VII) Establish adequate backup arrangements and a written contingency plan with the incorporation of the latest cybersecurity landscape","a.2) Review and update of the written contingency plan should be performed regularly to ensure the latest cyber-attack scenarios and the corresponding contingency handling procedures are incorporated into the contingency plan."]
[2084,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(a) Multi-Factor Authentication. Based on its Risk Assessment, each Covered Entity shall use effective controls, which may include Multi-Factor Authentication or Risk-Based Authentication, to protect against unauthorized access to Nonpublic Information or Information Systems.","N.A"]
[2085,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"NYDFS","NYDFS \"23 NYCRR 500 - Cybersecurity Requirements for Financial Services Companies\"","U.S","Section 500.12 Multi-Factor Authentication","(b) Multi-Factor Authentication shall be utilized for any individual accessing the Covered Entity’s internal networks from an external network, unless the Covered Entity’s CISO has approved in writing the use of reasonably equivalent or more secure access controls.","N.A"]
[2086,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"FINRA","FINRA \"Report on Cybersecurity Practices\"","U.S","Technical Controls","Principle: Firms should implement technical controls to protect Firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:","a) Implementing a defense-in-depth strategy, with multiple independent security controls strategically throughout their information technology systems.\nb) Selecting controls appropriate to the Firm’s technology and threat environment, for example:\n\n- identity and access management.\n- data encryption.\n- penetration testing.\nThe three areas cited here are illustrative of possible control areas."]
[2087,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","3. Require secure passwords and\nauthentication","Store passwords securely","Businesses also may want to consider other protections\n– two-factor authentication, for example – that can help protect against password\ncompromises. "]
[2088,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Protection","Protection of processes and assets","Strong ICT controls. FMIs should consistently maintain a strong ICT control environment, this being a fundamental and critical component of an FMI’s overall cyber resilience. \n(A) Protecting information. Implementing appropriate measures to protect information (both in transit and at rest), commensurate with the criticality and sensitivity of the information held by and transmitted through the FMI. This should include, but not be restricted to, appropriate encryption (eg, end-to-end encryption), authentication (eg, multifactor authentication) and access control."]
[2089,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"SEC","SEC \"OCIE’s 2015 Cybersecurity Examination Initiative\"","U.S","2. Access Rights and Controls (ARC)","N.A","• Information related to the systems or applications  for which the firm uses multi-factor authentication  for employee and customer access as well as documentation  evidencing implementation  of any related policies  and procedures and information  on systems or applications  for which the firm does not use multi-factor  authentication.\n"]
[2090,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Identification and authentication are required and managed for access to systems, applications, and hardware. (FFIEC Information Security Booklet, page 21)"]
[2091,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Authentication controls of both the user and application."]
[2092,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Authentication and authorization. A financial institution should have a process for authenticating users of MFS to protect customers against fraudulent transactions or malicious activities. Depending on the technology used and associated level of risk, financial institutions may consider biometric (e.g., voice, fingerprint, facial recognition) or out-of-band19 authentication processes. The financial institution should not use mobile payment applications that rely on less secure (e.g., single factor) methods of authentication."]
[2093,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","C. Risks  Associated  With  Remote  Customer  or  Counterparty  Access  and  Funds Transfer Requests\n(CAFTR)","N.A","2.      Methods employed for customer or counterparty authentication, including multi-factor authentication, for on-line account access and transactions."]
[2094,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"G7","G7 \"G7 Fundamental Elements of Cybersecurity for The Financial Sector\"","G7 Members","Element 7: Information Sharing","N.A","Engage in the timely sharing of reliable, actionable cybersecurity information with internal and external stakeholders (including entities and public authorities within and outside the financial sector) on threats, vulnerabilities, incidents, and responses to enhance defenses, limit damage, increase situational awareness, and broaden learning"]
[2095,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"China - CBRC","China Banking Regulatory Commission \"Information Security Survey - 2016\"","APAC","10. Website and internet service system security","Security technical inspections","10.6.2a. If there is a vulnerability found, does the firm produce a report on it? Does the firm has remediation plan and remediate in time? Does the firm conduct re-test on the issues found and keep the records?\n\n10.6.2b. If yes, please specify."]
[2096,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FTC","FTC \"Start with Security, A Guide for Business: Lessons Learned from FTC Cases\"","U.S","9. Put procedures in place to keep your\nsecurity current and address vulnerabilities\nthat may arise","Heed credible security warnings and move quickly to fix them","When vulnerabilities come to your attention, listen carefully and then get a move on"]
[2097,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CPMI-IOSCO","CPMI-IOSCO \"Guidance on cyber resilience for financial market infrastructures\"","N.A","Detection","Detecting a cyber attack","Comprehensive scope of monitoring. An FMI should monitor relevant internal and external factors, including business line and administrative functions and transactions. The FMI should seek to detect both publicly known vulnerabilities and vulnerabilities that are not yet publicly known, such as so-called zero-day exploits, through a combination of signature monitoring for known vulnerabilities and behaviourally based detection mechanisms. Detection capabilities should also address misuse of access by service providers or other trusted agents, potential insider threats and other advanced threat activity"]
[2098,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","5: Cyber Incident Management and Resilience","Escalation and Reporting","Criteria have been established for escalating cyber incidents or vulnerabilities to the board and senior management based on the potential impact and criticality of the risk."]
[2099,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","4: External Dependency Management","Relationship Management","Responsibility for notification of direct and indirect security incidents and vulnerabilities is documented in contracts or service-level agreements (SLAs)."]
[2100,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","2: Threat Intelligence & Collaboration","Threat Intelligence","The institution belongs or subscribes to a threat and vulnerability information sharing source(s) that provides information on threats (e.g., Financial Services Information Sharing and Analysis Center [FS-ISAC], U.S. Computer Emergency Readiness Team [US-CERT]). (FFIEC E- Banking Work Program, page 28)"]
[2101,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Processes are in place to mitigate vulnerabilities identified as part of the secure development of systems and applications."]
[2102,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Cybersecurity Assessment Tool","U.S","3: Cybersecurity Controls","Preventative Controls","Vulnerabilities identified through a static code analysis are remediated before implementing newly developed or changed applications into production."]
[2103,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC Appx. E - \"IT Examination Handbook - Retail Payment Systems Booklet - Appendix E: Mobile Financial Services\"","U.S","Risk Mitigation","Operational Risk Mitigation","Maintaining awareness of vulnerabilities through online forums, vendor sites, and U.S. Computer Emergency Readiness Team (US-CERT) or Financial Services-Information Sharing and Analysis Center (FS-ISAC) alerts. The vulnerabilities may affect unpatched and unsupported operating system versions. Take a risk-based approach when offering MFS to customers using unpatched and unsupported operating system versions and recommend to customers that they upgrade to more secure software, operating systems, and devices when appropriate."]
[2104,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC","CFTC \"Cybersecurity Exam - 2016\"","U.S","A. Identification of Cybersecurity Governance and Policies and Procedures\n(CGPP)","N.A","13.      Firm subscriptions to and use of threat and vulnerability information sharing sources(s) (e.g., the Financial Services – Information Sharing and Analysis Center (FS-ISAC))."]
[2105,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2106,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2107,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-5","Incident alert thresholds are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2108,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2109,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2110,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2111,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-2","Detection activities comply with all applicable requirements",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Privacy and protection of personally identifiable information"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2112,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Identifying Red Flags","N.A","(a) Risk Factors. A financial institution or creditor should consider the following factors in identifying relevant Red Flags for covered accounts, as appropriate:\n(1) Incidents of identity theft that the financial institution or creditor has experienced;\n(2) Methods of identity theft that the financial institution or creditor has identified that reflect changes in identity theft risks; and\n"]
[2113,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Methods for Administering the Program","N.A","(a) Oversight of Program. Oversight by the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management should include:\n(1) Assigning specific responsibility for the Program's implementation;\n(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §248.201; and\n(3) Approving material changes to the Program as necessary to address changing identity theft risks.\n(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the financial institution or creditor with §248.201.\n(2) Contents of report. The report should address material matters related to the Program and evaluate issues such as: The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Program.\n(c) Oversight of service provider arrangements. Whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. For example, a financial institution or creditor could require the service provider by contract to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities, and either report the Red Flags to the financial institution or creditor, or to take appropriate steps to prevent or mitigate identity theft.\n"]
[2114,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value","A.08.2.1","Classification of information","CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Methods for Administering the Program","N.A","(a) Oversight of Program. Oversight by the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management should include:\n(1) Assigning specific responsibility for the Program's implementation;\n(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §248.201; and\n(3) Approving material changes to the Program as necessary to address changing identity theft risks.\n(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the financial institution or creditor with §248.201.\n(2) Contents of report. The report should address material matters related to the Program and evaluate issues such as: The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Program.\n(c) Oversight of service provider arrangements. Whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. For example, a financial institution or creditor could require the service provider by contract to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities, and either report the Red Flags to the financial institution or creditor, or to take appropriate steps to prevent or mitigate identity theft.\n"]
[2115,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Methods for Administering the Program","N.A","(a) Oversight of Program. Oversight by the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management should include:\n(1) Assigning specific responsibility for the Program's implementation;\n(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §248.201; and\n(3) Approving material changes to the Program as necessary to address changing identity theft risks.\n(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the financial institution or creditor with §248.201.\n(2) Contents of report. The report should address material matters related to the Program and evaluate issues such as: The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Program.\n(c) Oversight of service provider arrangements. Whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. For example, a financial institution or creditor could require the service provider by contract to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities, and either report the Red Flags to the financial institution or creditor, or to take appropriate steps to prevent or mitigate identity theft.\n","GV.SF-1"]
[2116,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-4","Governance and risk management processes address cybersecurity risks",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.1\n5.2\n5.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Methods for Administering the Program","N.A","(a) Oversight of Program. Oversight by the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management should include:\n(1) Assigning specific responsibility for the Program's implementation;\n(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §248.201; and\n(3) Approving material changes to the Program as necessary to address changing identity theft risks.\n(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the financial institution or creditor with §248.201.\n(2) Contents of report. The report should address material matters related to the Program and evaluate issues such as: The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Program.\n(c) Oversight of service provider arrangements. Whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. For example, a financial institution or creditor could require the service provider by contract to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities, and either report the Red Flags to the financial institution or creditor, or to take appropriate steps to prevent or mitigate identity theft.\n","GV-SF-3"]
[2117,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Methods for Administering the Program","N.A","(a) Oversight of Program. Oversight by the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management should include:\n(1) Assigning specific responsibility for the Program's implementation;\n(2) Reviewing reports prepared by staff regarding compliance by the financial institution or creditor with §248.201; and\n(3) Approving material changes to the Program as necessary to address changing identity theft risks.\n(b) Reports. (1) In general. Staff of the financial institution or creditor responsible for development, implementation, and administration of its Program should report to the board of directors, an appropriate committee of the board, or a designated employee at the level of senior management, at least annually, on compliance by the financial institution or creditor with §248.201.\n(2) Contents of report. The report should address material matters related to the Program and evaluate issues such as: The effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Program.\n(c) Oversight of service provider arrangements. Whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. For example, a financial institution or creditor could require the service provider by contract to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities, and either report the Red Flags to the financial institution or creditor, or to take appropriate steps to prevent or mitigate identity theft.\n"]
[2118,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Updating the Program","N.A","Financial institutions and creditors should update the Program (including the Red Flags determined to be relevant) periodically, to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft, based on factors such as:\n(a) The experiences of the financial institution or creditor with identity theft;\n(b) Changes in methods of identity theft;\n(c) Changes in methods to detect, prevent, and mitigate identity theft;\n(d) Changes in the types of accounts that the financial institution or creditor offers or maintains; and\n(e) Changes in the business arrangements of the financial institution or creditor, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements.","GV.SF-1"]
[2119,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Updating the Program","N.A","Financial institutions and creditors should update the Program (including the Red Flags determined to be relevant) periodically, to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft, based on factors such as:\n(a) The experiences of the financial institution or creditor with identity theft;\n(b) Changes in methods of identity theft;\n(c) Changes in methods to detect, prevent, and mitigate identity theft;\n(d) Changes in the types of accounts that the financial institution or creditor offers or maintains; and\n(e) Changes in the business arrangements of the financial institution or creditor, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements."]
[2120,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Updating the Program","N.A","Financial institutions and creditors should update the Program (including the Red Flags determined to be relevant) periodically, to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft, based on factors such as:\n(a) The experiences of the financial institution or creditor with identity theft;\n(b) Changes in methods of identity theft;\n(c) Changes in methods to detect, prevent, and mitigate identity theft;\n(d) Changes in the types of accounts that the financial institution or creditor offers or maintains; and\n(e) Changes in the business arrangements of the financial institution or creditor, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements."]
[2121,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Updating the Program","N.A","Financial institutions and creditors should update the Program (including the Red Flags determined to be relevant) periodically, to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft, based on factors such as:\n(a) The experiences of the financial institution or creditor with identity theft;\n(b) Changes in methods of identity theft;\n(c) Changes in methods to detect, prevent, and mitigate identity theft;\n(d) Changes in the types of accounts that the financial institution or creditor offers or maintains; and\n(e) Changes in the business arrangements of the financial institution or creditor, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements."]
[2122,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Updating the Program","N.A","Financial institutions and creditors should update the Program (including the Red Flags determined to be relevant) periodically, to reflect changes in risks to customers or to the safety and soundness of the financial institution or creditor from identity theft, based on factors such as:\n(a) The experiences of the financial institution or creditor with identity theft;\n(b) Changes in methods of identity theft;\n(c) Changes in methods to detect, prevent, and mitigate identity theft;\n(d) Changes in the types of accounts that the financial institution or creditor offers or maintains; and\n(e) Changes in the business arrangements of the financial institution or creditor, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements."]
[2123,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-1","Notifications from detection systems are investigated ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.3\nA.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nAdministrator and operator logs\nResponse to information security incidents"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Preventing and Mitigating Identity Theft","N.A","The Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account records held by the financial institution, creditor, or third party, or notice that a customer has provided information related to a covered account held by the financial institution or creditor to someone fraudulently claiming to represent the financial institution or creditor or to a fraudulent Web site. Appropriate responses may include the following:\n(h) Notifying law enforcement; or\n(i) Determining that no response is warranted under the particular circumstances.\n"]
[2124,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Preventing and Mitigating Identity Theft","N.A","The Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account records held by the financial institution, creditor, or third party, or notice that a customer has provided information related to a covered account held by the financial institution or creditor to someone fraudulently claiming to represent the financial institution or creditor or to a fraudulent Web site. Appropriate responses may include the following:\n(h) Notifying law enforcement; or\n(i) Determining that no response is warranted under the particular circumstances.\n"]
[2125,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Preventing and Mitigating Identity Theft","N.A","The Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account records held by the financial institution, creditor, or third party, or notice that a customer has provided information related to a covered account held by the financial institution or creditor to someone fraudulently claiming to represent the financial institution or creditor or to a fraudulent Web site. Appropriate responses may include the following:\n(h) Notifying law enforcement; or\n(i) Determining that no response is warranted under the particular circumstances.\n"]
[2126,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-3","Information is shared consistent with response plans",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Preventing and Mitigating Identity Theft","N.A","The Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account records held by the financial institution, creditor, or third party, or notice that a customer has provided information related to a covered account held by the financial institution or creditor to someone fraudulently claiming to represent the financial institution or creditor or to a fraudulent Web site. Appropriate responses may include the following:\n(h) Notifying law enforcement; or\n(i) Determining that no response is warranted under the particular circumstances.\n"]
[2127,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"CFTC-SEC","CFTC-SEC \"Regulation S-ID: Identity Theft Red Flags\"","U.S","Preventing and Mitigating Identity Theft","N.A","The Program's policies and procedures should provide for appropriate responses to the Red Flags the financial institution or creditor has detected that are commensurate with the degree of risk posed. In determining an appropriate response, a financial institution or creditor should consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account records held by the financial institution, creditor, or third party, or notice that a customer has provided information related to a covered account held by the financial institution or creditor to someone fraudulently claiming to represent the financial institution or creditor or to a fraudulent Web site. Appropriate responses may include the following:\n(h) Notifying law enforcement; or\n(i) Determining that no response is warranted under the particular circumstances.\n"]
[2128,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-2","The physical environment is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nSecuring offices, rooms and facilities"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2129,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information","GV.PL-3"]
[2130,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2131,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1\nA.15.1.2\nA.15.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information","DM.ED-6"]
[2132,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2133,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2134,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2135,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2136,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2137,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/I","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\ni) insure the security and confidentiality of customer records and information"]
[2138,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information"]
[2139,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information"]
[2140,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information"]
[2141,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information"]
[2142,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information","GV.PL-1"]
[2143,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information"]
[2144,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information"]
[2145,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/II","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n\n(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information","GV.RM-1"]
[2146,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/III","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer"]
[2147,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/III","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer"]
[2148,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/III","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer","GV.PL-3"]
[2149,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/III","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer"]
[2150,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/III","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer"]
[2151,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/III","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer"]
[2152,"PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"},"SEC","SEC \"Regulation S-P\"","U.S","Safeguard Procedures/III","N.A"," to establish appropriate standards for financial institutions relating to administrative, technical, and physical safeguards to protect customer records and information:\n\n(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer"]
[2153,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2154,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2155,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2156,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2157,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2158,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-5","Detection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2159,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-3","Detection processes are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.8"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"System security testing"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2160,"DE","3 - DETECT ","DE.DP","Detection Processes","DE.DP-4","Event detection information is communicated to appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Reporting information security events"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2161,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.1\n4.2\n4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures.","GV.SF-1"]
[2162,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2163,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2164,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2165,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures.","DM.ED-2"]
[2166,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2167,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2168,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2169,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2170,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-5","Protections against data leaks are implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2171,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2172,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2173,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2174,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2175,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2176,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2177,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-8","Effectiveness of protection technologies is shared with appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2178,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-5","Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.2\nA.17.2.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Implementing information security continuity\nAvailability of information processing facilities"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2179,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2180,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.2\nA.11.2.4\nA.11.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical entry controls\nEquipment maintenance\nRemoval of assets"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2181,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2182,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-2","Recovery strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2183,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2184,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2185,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-1","Response plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2186,"RS","4 - RESPOND ","RS.IM","Improvements","RS.IM-2","Response strategies are updated",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2187,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures."]
[2188,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1001","N.A","§ 242.1001 Obligations related to policies and procedures of SCI entities.\n(a)Capacity, integrity, resiliency, availability, and security.\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.\n\n(2) Policies and procedures required by paragraph (a)(1) of this section shall include, at a minimum:\n\n(i) The establishment of reasonable current and future technological infrastructure capacity planning estimates;\n\n(ii) Periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner;\n\n(iii) A program to review and keep current systems development and testing methodology for such systems;\n\n(iv) Regular reviews and testing, as applicable, of such systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters;\n\n(v) Business continuity and disaster recovery plans that include maintaining backup and recovery capabilities sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption;\n\n(vi) Standards that result in such systems being designed, developed, tested, maintained, operated, and surveilled in a manner that facilitates the successful collection, processing, and dissemination of market data; and\n\n(vii) Monitoring of such systems to identify potential SCI events.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (a), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) For purposes of this paragraph (a), such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization. Compliance with such current SCI industry standards, however, shall not be the exclusive means to comply with the requirements of this paragraph (a).\n\n(b)Systems compliance.\n\n(1) Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems operate in a manner that complies with the Act and the rules and regulations thereunder and the entity's rules and governing documents, as applicable.\n\n(2) Policies and procedures required by paragraph (b)(1) of this section shall include, at a minimum:\n\n(i) Testing of all SCI systems and any changes to SCI systems prior to implementation;\n\n(ii) A system of internal controls over changes to SCI systems;\n\n(iii) A plan for assessments of the functionality of SCI systems designed to detect systems compliance issues, including by responsible SCI personnel and by personnel familiar with applicable provisions of the Act and the rules and regulations thereunder and the SCI entity's rules and governing documents; and\n\n(iv) A plan of coordination and communication between regulatory and other personnel of the SCI entity, including by responsible SCI personnel, regarding SCI systems design, changes, testing, and controls designed to detect and prevent systems compliance issues.\n\n(3) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by this paragraph (b), and take prompt action to remedy deficiencies in such policies and procedures.\n\n(4) Safe harbor from liability for individuals. Personnel of an SCI entity shall be deemed not to have aided, abetted, counseled, commanded, caused, induced, or procured the violation by an SCI entity of this paragraph (b) if the person:\n\n(i) Has reasonably discharged the duties and obligations incumbent upon such person by the SCI entity's policies and procedures; and\n\n(ii) Was without reasonable cause to believe that the policies and procedures relating to an SCI system for which such person was responsible, or had supervisory responsibility, were not established, maintained, or enforced in accordance with this paragraph (b) in any material respect.\n\n(c)Responsible SCI personnel.\n\n(1) Each SCI entity shall establish, maintain, and enforce reasonably designed written policies and procedures that include the criteria for identifying responsible SCI personnel, the designation and documentation of responsible SCI personnel, and escalation procedures to quickly inform responsible SCI personnel of potential SCI events.\n\n(2) Each SCI entity shall periodically review the effectiveness of the policies and procedures required by paragraph (c)(1) of this section, and take prompt action to remedy deficiencies in such policies and procedures.","DM.RS-2"]
[2189,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"SEC","SEC \"Regulation SCI\"","U.S","Rule 1002","N.A","§ 242.1002 Obligations related to SCI events.\n(a)Corrective action. Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, each SCI entity shall begin to take appropriate corrective action which shall include, at a minimum, mitigating potential harm to investors and market integrity resulting from the SCI event and devoting adequate resources to remedy the SCI event as soon as reasonably practicable.\n\n(b)Commission notification and recordkeeping of SCI events. Each SCI entity shall:\n\n(1) Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, notify the Commission of such SCI event immediately;\n\n(2) Within 24 hours of any responsible SCI personnel having a reasonable basis to conclude that the SCI event has occurred, submit a written notification pertaining to such SCI event to the Commission, which shall be made on a good faith, best efforts basis and include:\n\n(i) A description of the SCI event, including the system(s) affected; and\n\n(ii) To the extent available as of the time of the notification: The SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; the potential impact of the SCI event on the market; a description of the steps the SCI entity has taken, is taking, or plans to take, with respect to the SCI event; the time the SCI event was resolved or timeframe within which the SCI event is expected to be resolved; and any other pertinent information known by the SCI entity about the SCI event;\n\n(3) Until such time as the SCI event is resolved and the SCI entity's investigation of the SCI event is closed, provide updates pertaining to such SCI event to the Commission on a regular basis, or at such frequency as reasonably requested by a representative of the Commission, to correct any materially incorrect information previously provided, or when new material information is discovered, including but not limited to, any of the information listed in paragraph (b)(2)(ii) of this section;\n\n(4)\n\n(i)\n\n(A) If an SCI event is resolved and the SCI entity's investigation of the SCI event is closed within 30 calendar days of the occurrence of the SCI event, then within five business days after the resolution of the SCI event and closure of the investigation regarding the SCI event, submit a final written notification pertaining to such SCI event to the Commission containing the information required in paragraph (b)(4)(ii) of this section.\n\n(B)(1) If an SCI event is not resolved or the SCI entity's investigation of the SCI event is not closed within 30 calendar days of the occurrence of the SCI event, then submit an interim written notification pertaining to such SCI event to the Commission within 30 calendar days after the occurrence of the SCI event containing the information required in paragraph (b)(4)(ii) of this section, to the extent known at the time.\n\n(2) Within five business days after the resolution of such SCI event and closure of the investigation regarding such SCI event, submit a final written notification pertaining to such SCI event to the Commission containing the information required in paragraph (b)(4)(ii) of this section.\n\n(ii) Written notifications required by paragraph (b)(4)(i) of this section shall include:\n\n(A) A detailed description of: The SCI entity's assessment of the types and number of market participants affected by the SCI event; the SCI entity's assessment of the impact of the SCI event on the market; the steps the SCI entity has taken, is taking, or plans to take, with respect to the SCI event; the time the SCI event was resolved; the SCI entity's rule(s) and/or governing document(s), as applicable, that relate to the SCI event; and any other pertinent information known by the SCI entity about the SCI event;\n\n(B) A copy of any information disseminated pursuant to paragraph (c) of this section by the SCI entity to date regarding the SCI event to any of its members or participants; and\n\n(C) An analysis of parties that may have experienced a loss, whether monetary or otherwise, due to the SCI event, the number of such parties, and an estimate of the aggregate amount of such loss.\n\n(5) The requirements of paragraphs (b)(1) through (4) of this section shall not apply to any SCI event that has had, or the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity's operations or on market participants. For such events, each SCI entity shall:\n\n(i) Make, keep, and preserve records relating to all such SCI events; and\n\n(ii) Submit to the Commission a report, within 30 calendar days after the end of each calendar quarter, containing a summary description of such systems disruptions and systems intrusions, including the SCI systems and, for systems intrusions, indirect SCI systems, affected by such systems disruptions and systems intrusions during the applicable calendar quarter.\n\n(c)Dissemination of SCI events.\n\n(1) Each SCI entity shall:\n\n(i) Promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the following information about such SCI event:\n\n(A) The system(s) affected by the SCI event; and\n\n(B) A summary description of the SCI event; and\n\n(ii) When known, promptly further disseminate the following information about such SCI event:\n\n(A) A detailed description of the SCI event;\n\n(B) The SCI entity's current assessment of the types and number of market participants potentially affected by the SCI event; and\n\n(C) A description of the progress of its corrective action for the SCI event and when the SCI event has been or is expected to be resolved; and\n\n(iii) Until resolved, provide regular updates of any information required to be disseminated under paragraphs (c)(1)(i) and (ii) of this section.\n\n(2) Each SCI entity shall, promptly after any responsible SCI personnel has a reasonable basis to conclude that a SCI event that is a systems intrusion has occurred, disseminate a summary description of the systems intrusion, including a description of the corrective action taken by the SCI entity and when the systems intrusion has been or is expected to be resolved, unless the SCI entity determines that dissemination of such information would likely compromise the security of the SCI entity's SCI systems or indirect SCI systems, or an investigation of the systems intrusion, and documents the reasons for such determination.\n\n(3) The information required to be disseminated under paragraphs (c)(1) and (2) of this section promptly after any responsible SCI personnel has a reasonable basis to conclude that an SCI event has occurred, shall be promptly disseminated by the SCI entity to those members or participants of the SCI entity that any responsible SCI personnel has reasonably estimated may have been affected by the SCI event, and promptly disseminated to any additional members or participants that any responsible SCI personnel subsequently reasonably estimates may have been affected by the SCI event; provided, however, that for major SCI events, the information required to be disseminated under paragraphs (c)(1) and (2) of this section shall be promptly disseminated by the SCI entity to all of its members or participants.\n\n(4) The requirements of paragraphs (c)(1) through (3) of this section shall not apply to:\n\n(i) SCI events to the extent they relate to market regulation or market surveillance systems; or\n\n(ii) Any SCI event that has had, or the SCI entity reasonably estimates would have, no or a de minimis impact on the SCI entity's operations or on market participants."]
[2190,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2191,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2192,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2193,"ID","1 - IDENTIFY ","ID.BE","Business Environment","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security.","DM.BE-3"]
[2194,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2195,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security.","GV.PL-1"]
[2196,"ID","1 - IDENTIFY ","ID.GV","Governance","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security.","GV.PL-3"]
[2197,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.2.1\nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Monitoring and review of supplier services\nManaging changes to supplier services"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security.","DM.ED-7"]
[2198,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2199,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security.","DM.ED-2"]
[2200,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-1","Data-at-rest is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2201,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-2","Data-in-transit is protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2202,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-4","Adequate capacity to ensure availability is maintained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Capacity management"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2203,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2204,"PR","2 - PROTECT ","PR.DS","Data Security","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2205,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2206,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-6","Data is destroyed according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2207,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2208,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2209,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-10","Response and recovery plans are tested",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2210,"PR","2 - PROTECT ","PR.MA","Maintenance","PR.MA-2","Remote maintenance of organizational assets is approved, logged, and performed in a mannerthat prevents unauthorized access",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.2.4\nA.15.1.1\nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nInformation security policy for supplier relationships\nMonitoring and review of supplier services"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2211,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-2","Removable media is protected and its use restricted according to policy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2212,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-5","Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.2\nA.17.2.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Implementing information security continuity\nAvailability of information processing facilities"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2213,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2214,"RC","5 - RECOVER ","RC.IM","Improvements","RC.IM-1","Recovery plans incorporate lessons learned",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Nonconformity and corrective action"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2215,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"SEC","SEC \"Regulation FD\"","U.S",null,"N.A","Companies should consider the materiality of cybersecurity risks and incidents when preparing the disclosure that is required in registration statements under the Securities Act of 1933 (“Securities Act”) and the Securities Exchange Act of 1934 (“Exchange Act”), and periodic and current reports under the Exchange Act."]
[2216,"RC","5 - RECOVER ","RC.CO","Communications","RC.CO-1","Public relations are managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2217,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2218,"ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security.","GV.RM-1"]
[2219,"RC","5 - RECOVER ","RC.RP","Recovery Planning","RC.RP-1","Recovery plan is executed during or after cybersecurity incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security."]
[2220,"ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.17.1.3 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Verify, review and evaluate information security continuity"},"SEC","SEC \"Regulation SDR\"","U.S","Rule 13n-6","N.A","Every security-based swap data repository, with respect to those systems that support or are integrally related to the performance of its activities, shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its systems provide adequate levels of capacity, integrity, resiliency, availability, and security.","DM.RS-2"]
[2221,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"SEC","SEC \"Regulation FD\"","U.S","Selective Disclosure","N.A","§ 243.100 General rule regarding selective disclosure.\n(a) Whenever an issuer, or any person acting on its behalf, discloses any material nonpublic information regarding that issuer or its securities to any person described in paragraph (b)(1) of this section, the issuer shall make public disclosure of that information as provided in § 243.101(e):\n\n(1) Simultaneously, in the case of an intentional disclosure; and\n\n(2) Promptly, in the case of a non-intentional disclosure.\n\n(b)\n\n(1) Except as provided in paragraph (b)(2) of this section, paragraph (a) of this section shall apply to a disclosure made to any person outside the issuer:\n\n(i) Who is a broker or dealer, or a person associated with a broker or dealer, as those terms are defined in Section 3(a) of the Securities Exchange Act of 1934 ( 15 U.S.C. 78c(a));\n\n(ii) Who is an investment adviser, as that term is defined in Section 202(a)(11) of the Investment Advisers Act of 1940 ( 15 U.S.C. 80b-2(a)(11)); an institutional investment manager, as that term is defined in Section 13(f)(6) of the Securities Exchange Act of 1934 ( 15 U.S.C. 78m(f)(6)), that filed a report on Form 13F ( 17 CFR 249.325) with the Commission for the most recent quarter ended prior to the date of the disclosure; or a person associated with either of the foregoing. For purposes of this paragraph, a “person associated with an investment adviser or institutional investment manager” has the meaning set forth in Section 202(a)(17) of the Investment Advisers Act of 1940 ( 15 U.S.C. 80b-2(a)(17)), assuming for these purposes that an institutional investment manager is an investment adviser;\n\n(iii) Who is an investment company, as defined in Section 3 of the Investment Company Act of 1940 ( 15 U.S.C. 80a-3), or who would be an investment company but for Section 3(c)(1) ( 15 U.S.C. 80a-3(c)(1)) or Section 3(c)(7) ( 15 U.S.C. 80a-3(c)(7)) thereof, or an affiliated person of either of the foregoing. For purposes of this paragraph, “ affiliated person” means only those persons described in Section 2(a)(3)(C), (D), (E), and (F) of the Investment Company Act of 1940 ( 15 U.S.C. 80a-2(a)(3)(C), (D), (E), and (F)), assuming for these purposes that a person who would be an investment company but for Section 3(c)(1) ( 15 U.S.C. 80a-3(c)(1)) or Section 3(c)(7) ( 15 U.S.C. 80a-3(c)(7)) of the Investment Company Act of 1940 is an investment company; or\n\n(iv) Who is a holder of the issuer's securities, under circumstances in which it is reasonably foreseeable that the person will purchase or sell the issuer's securities on the basis of the information.\n\n(2) Paragraph (a) of this section shall not apply to a disclosure made:\n\n(i) To a person who owes a duty of trust or confidence to the issuer (such as an attorney, investment banker, or accountant);\n\n(ii) To a person who expressly agrees to maintain the disclosed information in confidence;\n\n(iii) In connection with a securities offering registered under the Securities Act, other than an offering of the type described in any of Rule 415(a)(1)(i) through (vi) under the Securities Act ( § 230.415(a)(1)(i) through (vi) of this chapter) (except an offering of the type described in Rule 415(a)(1)(i) under the Securities Act ( § 230.415(a)(1)(i) of this chapter) also involving a registered offering, whether or not underwritten, for capital formation purposes for the account of the issuer (unless the issuer's offering is being registered for the purpose of evading the requirements of this section)), if the disclosure is by any of the following means:\n\n(A) A registration statement filed under the Securities Act, including a prospectus contained therein;\n\n(B) A free writing prospectus used after filing of the registration statement for the offering or a communication falling within the exception to the definition of prospectus contained in clause (a) of section 2(a)(10) of the Securities Act;\n\n(C) Any other Section 10(b) prospectus;\n\n(D) A notice permitted by Rule 135 under the Securities Act ( § 230.135 of this chapter);\n\n(E) A communication permitted by Rule 134 under the Securities Act ( § 230.134 of this chapter); or\n\n(F) An oral communication made in connection with the registered securities offering after filing of the registration statement for the offering under the Securities Act."]
[2222,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":7.4},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Communication"},"SEC","SEC \"Regulation FD\"","U.S","Selective Disclosure","N.A","§ 243.100 General rule regarding selective disclosure.\n(a) Whenever an issuer, or any person acting on its behalf, discloses any material nonpublic information regarding that issuer or its securities to any person described in paragraph (b)(1) of this section, the issuer shall make public disclosure of that information as provided in § 243.101(e):\n\n(1) Simultaneously, in the case of an intentional disclosure; and\n\n(2) Promptly, in the case of a non-intentional disclosure.\n\n(b)\n\n(1) Except as provided in paragraph (b)(2) of this section, paragraph (a) of this section shall apply to a disclosure made to any person outside the issuer:\n\n(i) Who is a broker or dealer, or a person associated with a broker or dealer, as those terms are defined in Section 3(a) of the Securities Exchange Act of 1934 ( 15 U.S.C. 78c(a));\n\n(ii) Who is an investment adviser, as that term is defined in Section 202(a)(11) of the Investment Advisers Act of 1940 ( 15 U.S.C. 80b-2(a)(11)); an institutional investment manager, as that term is defined in Section 13(f)(6) of the Securities Exchange Act of 1934 ( 15 U.S.C. 78m(f)(6)), that filed a report on Form 13F ( 17 CFR 249.325) with the Commission for the most recent quarter ended prior to the date of the disclosure; or a person associated with either of the foregoing. For purposes of this paragraph, a “person associated with an investment adviser or institutional investment manager” has the meaning set forth in Section 202(a)(17) of the Investment Advisers Act of 1940 ( 15 U.S.C. 80b-2(a)(17)), assuming for these purposes that an institutional investment manager is an investment adviser;\n\n(iii) Who is an investment company, as defined in Section 3 of the Investment Company Act of 1940 ( 15 U.S.C. 80a-3), or who would be an investment company but for Section 3(c)(1) ( 15 U.S.C. 80a-3(c)(1)) or Section 3(c)(7) ( 15 U.S.C. 80a-3(c)(7)) thereof, or an affiliated person of either of the foregoing. For purposes of this paragraph, “ affiliated person” means only those persons described in Section 2(a)(3)(C), (D), (E), and (F) of the Investment Company Act of 1940 ( 15 U.S.C. 80a-2(a)(3)(C), (D), (E), and (F)), assuming for these purposes that a person who would be an investment company but for Section 3(c)(1) ( 15 U.S.C. 80a-3(c)(1)) or Section 3(c)(7) ( 15 U.S.C. 80a-3(c)(7)) of the Investment Company Act of 1940 is an investment company; or\n\n(iv) Who is a holder of the issuer's securities, under circumstances in which it is reasonably foreseeable that the person will purchase or sell the issuer's securities on the basis of the information.\n\n(2) Paragraph (a) of this section shall not apply to a disclosure made:\n\n(i) To a person who owes a duty of trust or confidence to the issuer (such as an attorney, investment banker, or accountant);\n\n(ii) To a person who expressly agrees to maintain the disclosed information in confidence;\n\n(iii) In connection with a securities offering registered under the Securities Act, other than an offering of the type described in any of Rule 415(a)(1)(i) through (vi) under the Securities Act ( § 230.415(a)(1)(i) through (vi) of this chapter) (except an offering of the type described in Rule 415(a)(1)(i) under the Securities Act ( § 230.415(a)(1)(i) of this chapter) also involving a registered offering, whether or not underwritten, for capital formation purposes for the account of the issuer (unless the issuer's offering is being registered for the purpose of evading the requirements of this section)), if the disclosure is by any of the following means:\n\n(A) A registration statement filed under the Securities Act, including a prospectus contained therein;\n\n(B) A free writing prospectus used after filing of the registration statement for the offering or a communication falling within the exception to the definition of prospectus contained in clause (a) of section 2(a)(10) of the Securities Act;\n\n(C) Any other Section 10(b) prospectus;\n\n(D) A notice permitted by Rule 135 under the Securities Act ( § 230.135 of this chapter);\n\n(E) A communication permitted by Rule 134 under the Securities Act ( § 230.134 of this chapter); or\n\n(F) An oral communication made in connection with the registered securities offering after filing of the registration statement for the offering under the Securities Act."]
[2223,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"5.3\nA.06.1.1\nA.07.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Governance of the Information Security Program","Management should promote effective IT governance by doing the following:\n\nEstablishing an information security culture that promotes an effective information security program and the role of all employees in protecting the institution's information and systems.\nClearly defining and communicating information security responsibilities and accountability throughout the institution.\nProviding adequate resources to effectively support the information security program.","GV.SF-1"]
[2224,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC IT Handbook","U.S","Information Security"," Information Security Program Management","Management should develop and implement an information security program that does the following:\n\nSupports the institution's IT risk management (ITRM) process by identifying threats, measuring risk, defining information security requirements, and implementing controls.","GV.SF-2"]
[2225,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC IT Handbook","U.S","Information Security"," Information Security Program Management","Management should integrate the information security program with the institution's lines of business and support functions. An integrated program provides management the ability to assess the likelihood and potential damage to the institution from an incident, identify the root cause(s) of the incident, and implement controls to address identified issues.","GV.SF-3"]
[2226,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC IT Handbook","U.S","Information Security"," Information Security Program Management","The risk measurement process should be used to understand the institution’s inherent risk and\ndetermine the risk associated with different threats. ","GV.RM-1"]
[2227,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Measurement","Management should use its measurement of\nthe risks to guide its recommendations for and use of mitigating controls.","GV.RM-2"]
[2228,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},4.0999999999999996,"Understanding the organization and its context","FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Measurement","Management should integrate the information security program with the institution's lines of business and support functions.","GV.RM-3"]
[2229,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Policies, Standards, and Procedures","Information security policies, standards, and procedures should define the institution's control environment through a governance structure and provide descriptions of required, expected, and prohibited activities","GV.PL-1"]
[2230,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.GV-1","Organizational information security policy is established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"4.4\n5.2\nA.05.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security management system\nPolicy\nPolicies for information security"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Policies, Standards, and Procedures","Policies, standards, and procedures should also specify the mechanisms through which responsibilities can be met. In addition, they should provide guidance on acquiring, designing, implementing, configuring, operating, maintaining, and auditing information systems.","GV.PL-2"]
[2231,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},5.2,"Policy","FFIEC","FFIEC IT Handbook","U.S","Information Security","Policies, Standards, and Procedures","Key attributes that contribute to the success of information security policies, standards, and procedures include the following: Flexibility to address changes in the environment and\nAnnual board review and approval.","GV.SP-1"]
[2232,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},9.3000000000000007,"Management review","FFIEC","FFIEC IT Handbook","U.S","Information Security","Assurance Reporting","Security reporting should be to individuals with authority and responsibility to act on the reports and to those accountable for the outcomes, as well as those responsible for advising or influencing risk decisions. Reporting should trigger appropriate, timely, and reliable escalation and response procedures. ","GV.SP-2"]
[2233,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Identification","Management should develop and implement a process to identify risk.","GV.IR-1"]
[2234,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"9.3\n10.2","Management review\nContinual improvement","FFIEC","FFIEC IT Handbook","U.S","Information Security"," Information Security Program Effectiveness","The information security program should be subject to periodic review to ensure continual improvement in the program's effectiveness.","GV.AU-1"]
[2235,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"9.3\n10.2","Management review\nContinual improvement","FFIEC","FFIEC IT Handbook","U.S","Information Security"," Information Security Program Effectiveness","Periodic reviews should address the program in the context of the environment in which the program now operates, both within the institution and outside. Lessons learned from experience, audit findings, and other indicators of opportunities for improvement should be identified and the program changed as appropriate.\n\n ","GV.AU-3"]
[2236,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Mitigation","Management should incorporate available information on cyber events into the institution's information security program. Additionally, management should develop, maintain, and update a repository of cybersecurity threat and vulnerability information that may be used in conducting risk assessments and provide updates to senior management and the board on cyber risk trends.","GV.TE-2"]
[2237,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Inventory and Classification of Assets","Management should maintain and keep updated an inventory of technology assets that classifies\nthe sensitivity and criticality of those assets, including hardware","ID.AM-1"]
[2238,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Inventory and Classification of Assets"," Management should use this classification to implement controls required to safeguard\nthe institution’s physical and information assets.","ID.AM-5"]
[2239,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Policies, Standards, and Procedures"," Policies, standards, and procedures that address the information security\nprogram should describe the roles of the information security department, lines of business, and\nIT organization in administering the information security program. ","ID.AM-6"]
[2240,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Vulnerabilities","Management should assess whether the institution has processes and procedures in place to\nidentify and maintain a catalogue of relevant vulnerabilities, determine which pose a significant\nrisk to the institution, and effectively mitigate and monitor the risks posed by those\nvulnerabilities","ID.RA-1"]
[2241,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with special interest groups"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Security Operations","Management should establish defined processes and appropriate governance to facilitate the\nperformance of security operations including Analysis of threat intelligence from external sources.","ID.RA-2"]
[2242,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-3","Threats, both internal and external, are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Mitigation","Management should also obtain, analyze, and respond to information from various sources (e.g.,\nFinancial Services Information Sharing and Analysis Center [FS-ISAC]) on cyber threats and\nvulnerabilities that may affect the institution.","ID.RA-3"]
[2243,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-4","Potential business impacts and likelihoods are identified",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Information Security Program Management","Management should integrate the information security program with the institution’s lines of\nbusiness and support functions. An integrated program provides management the ability to assess\nthe likelihood and potential damage to the institution from an incident, identify the root cause(s)\nof the incident, and implement controls to address identified issues.\n","ID.RA-4"]
[2244,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Identification","Risk identification should produce groupings of threats,\nincluding significant cybersecurity threats.","ID.RA-5"]
[2245,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Mitigation","Once management has identified and measured the risks, it should develop and implement an\nappropriate plan to mitigate those risks","ID.RA-6"]
[2246,"PR","2 - PROTECT ","PR-AC","Identity Management and Access Control","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Logical Access","Management should have an effective process to administer logical security access rights for the\nnetwork, operating systems, applications, databases, and network devices,","PR.AC-1"]
[2247,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Mitigating Interconnectivity Risk","Management should maintain network and connectivity diagrams and data flow charts to ensure\nadequacy of layered controls and to facilitate more timely recovery and restoration of systems\nwhen incidents occur.","DE.AE-1"]
[2248,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-2","Detected events are analyzed to understand attack targets and methods",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.16.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nAssessment of and decision on information security events"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Mitigation","Management should incorporate available\ninformation on cyber events into the institution’s information security program","DE.AE-2"]
[2249,"DE","3 - DETECT ","DE.AE","Anomalies and Events","DE.AE-3","Event data are collected and correlated from multiple sources and sensors",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Risk Measurement","Threat analysis tools assist in understanding and supporting the measurement of information security-related risks. Such tools can include event trees, attack trees,kill chains, and other security-related schemata. These tools help management deconstruct an event into stages,\nbetter understand the event, identify the most effective and efficient means of mitigating risk, and improve the information security program.","DE.AE-3"]
[2250,"DE","3 - DETECT ","DE.AE","Security Continuous Monitoring ","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Network Controls","The institution’s should use tools used to enforce and detect perimeter protection include routers, firewalls, intrusion\ndetection systems (IDS) and intrusion prevention systems, proxies, gateways, jump boxes,25\ndemilitarized zones, virtual private networks (VPN), virtual LANs (VLAN), log monitoring and\nnetwork traffic inspecting systems, data loss prevention (DLP) systems, and access control lists.","DE.CM-1"]
[2251,"DE","3 - DETECT ","DE.AE","Security Continuous Monitoring ","DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Network Controls","Network monitoring systems should be configured to\ndetect the addition of new devices","DE.CM-7"]
[2252,"DE","3 - DETECT ","DE.AE","Security Continuous Monitoring ","DE.CM-8","Vulnerability scans are performed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Network Controls"," Institutions can use automated vulnerability scanners to scan their computer systems\nfor known security exposures, as well as services available from third parties, such as the Mitre\nCorporation’s Common Vulnerability and Exposures (CVE),\n14 to track vulnerabilities.","DE.CM-8"]
[2253,"RS","4 - RESPOND ","RS.RP","Response Planning","RS.RP-1","Response plan is executed during or after an incident",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Response to information security incidents"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Incident Response","Management should have an incident response program.61 The goal of incident response is to\nminimize damage to the institution and its customers. The institution’s program should have\ndefined protocols to declare and respond to an identified incident","RS.RP-1"]
[2254,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-1","Personnel know their roles and order of operations when a response is needed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1 \nA.16.1.1 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nResponsibilities and procedures"},"FFIEC","FFIEC IT Handbook","U.S","Information Security","Business Continuity Considerations","Identify personnel who will have critical information security roles during a disaster, and train\npersonnel in those roles.\n• Define information security ","RS.CO-1"]
[2255,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},9.1999999999999993,"Internal audit","FFIEC","FFIEC IT Handbook","U.S","Audit","IT Audit Roles and Responsibilities","To meet its responsibility of providing an independent audit function with sufficient\nresources to ensure adequate IT coverage, the board of directors or its audit committee\nshould:\nAudit Booklet\nPage 2\n• Provide an internal audit function capable of evaluating IT controls,\n• Engage outside consultants or auditors to perform the internal audit function, or\n• Use a combination of both m","GV.AU-1"]
[2256,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},9.1999999999999993,"Internal audit","FFIEC","FFIEC IT Handbook","U.S","Audit","IT Audit Roles and Responsibilities 2\n","The examiner should  consider the institution's ability to\npromptly detect and report significant risks to the board of directors and senior\nmanagement. Examiners should\nconsider the following issues when evaluating the IT audit function:\n\n• Identification of the IT audit universe, risk assessment, scope, and frequency of IT\naudits;\n• Processes in place to ensure timely tracking and resolution of reported weaknesses;\nand\n• Documentation of IT audits, including work papers, audit reports, and follow-up","GV.AU-3"]
[2257,"PR","2 - PROTECT ","PR-IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"FFIEC","FFIEC IT Handbook","U.S","Business Continuity Planning","Cyber Resilience\n","The financial institution and TSP should take steps to\nensure that replicated backup data cannot be destroyed or corrupted in an attack on\nproduction data. If data are replicated in near real time, the financial institution and\nservice provider should consider the vulnerability of their backup systems to an attack\nthat impacts both simultaneously. ","PR.IP-4"]
[2258,"PR","2 - PROTECT ","PR-IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"FFIEC","FFIEC IT Handbook","U.S","Business Continuity Planning","Cyber Resilience\n","The ability of financial institutions and TSPs to respond effectively to a cyber attack is\ncritical to business resilience. The financial institution should consider the following\nmitigating controls:\n\nEnhanced disaster recovery planning to include the possibility of simultaneous\nattacks;\n• Enhanced incident response plans reflecting the current threat landscape;","PR.IP-9"]
[2259,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"5.1\n5.3","Leadership and commitment\nOrganizational roles, responsibilities and authorities","FFIEC","FFIEC IT Handbook","U.S","Management","Governance","Financial institution boards of directors should oversee, while senior management should implement, a governance structure that includes the following:\n•Effective IT governance.\n•Appropriate oversight of IT activities.\n•Comprehensive IT management, including the various roles played by management.\n•Effective enterprise architecture","GV.SF-1"]
[2260,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"5.1\n5.3","Leadership and commitment\nOrganizational roles, responsibilities and authorities","FFIEC","FFIEC IT Handbook","U.S","Management","Board of Directors Oversight","The board should approve the IT strategic plan, information security program, and other IT-related policies. To carry out their responsibilities, board members should understand IT activities and risks. The board or a board committee should perform the following:\n•Review and approve an IT strategic plan that aligns with the overall business strategy and includes an information security strategy to protect the institution from ongoing and emerging threats, including those related to cybersecurity.\n•Promote effective IT governance.\n•Oversee processes for approving the institution's third-party providers, including the third parties' financial condition, business resilience, and IT security posture.\n•Oversee and receive updates on major IT projects, IT budgets, IT priorities, and overall IT performance. The board of directors may need to approve critical projects and activities, such as expanding the institution's product line to include mobile financial services.\n•Oversee the adequacy and allocation of IT resources for funding and personnel.\n•Approve policies to escalate and report significant security incidents to the board of directors, steering committee, government agencies, and law enforcement, as appropriate.\n•Hold management accountable for identifying, measuring, and mitigating IT risks.\n•Provide for independent, comprehensive, and effective audit coverage of IT controls.","GV.SF-1"]
[2261,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","IT Responsibilities and Functions","As part of the governance structure, financial institution management should ensure development, implementation, and maintenance of the following:\n•An effective IT risk management structure.\n•A comprehensive information security program.\n•A formal project management process.\n•An enterprise-wide business continuity planning function.\n•An accurate and timely process for information systems reporting.","GV.SF-1"]
[2262,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Management","Financial institution management should understand and evaluate risk across the institution, including the definitions and categories of risk. Risk is the potential that events, expected or unanticipated, may have an adverse effect on a financial institution's earnings, capital, or reputation. For regulatory purposes, risk is categorized as operational, liquidity, interest rate, credit, price, reputation, strategic, and compliance (legal). Although financial institution management should be aware of all potential risks as part of its overall risk management program, operational risk is the primary risk associated with IT.","GV.SF-2"]
[2263,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"5.1\n5.3","Leadership and commitment\nOrganizational roles, responsibilities and authorities","FFIEC","FFIEC IT Handbook","U.S","Management","Governance","Financial institution boards of directors should oversee, while senior management should implement, a governance structure that includes the following:\n•Effective IT governance.\n•Appropriate oversight of IT activities.\n•Comprehensive IT management, including the various roles played by management.\n•Effective enterprise architecture","GV.SF-3"]
[2264,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Governance","IT governance is \"an integral part of governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategies and objectives.\" [1] IT governance objectives are to ensure that IT generates business value for the institution and to mitigate the risks posed by using technology.","GV.SF-3"]
[2265,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Management","Financial institution management should understand and evaluate risk across the institution, including the definitions and categories of risk. Risk is the potential that events, expected or unanticipated, may have an adverse effect on a financial institution's earnings, capital, or reputation. For regulatory purposes, risk is categorized as operational, liquidity, interest rate, credit, price, reputation, strategic, and compliance (legal). Although financial institution management should be aware of all potential risks as part of its overall risk management program, operational risk is the primary risk associated with IT.","GV.SF-4"]
[2266,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"9.1\n9.3","Monitoring, measurement, analysis and evaluation\nManagement review","FFIEC","FFIEC IT Handbook","U.S","Management","Monitoring and Reporting","Financial institution management should ensure satisfactory monitoring and reporting of IT activities and risk. These practices should include the following:\n•Developing metrics to measure performance, efficiency, and compliance with policy.\n•Developing benchmarks for reviewing performance.\n•Establishing and reviewing service level agreements (SLA) with critical third-party providers.\n•Developing, implementing, and monitoring a process to measure IT compliance with established policies, standards, and practices.\n•Evaluating the effectiveness of mitigation strategies and controls.\n•Implementing a quality control or quality assurance program to monitor and test systems and applications.\n•Implementing timely and effective reporting processes.","GV.RM-3"]
[2267,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","Risk Mitigation","Financial institution management should implement effective control and risk transfer practices as part of its overall IT risk mitigation strategy. These practices should include the following:\n•Establishing, implementing, and enforcing IT policies, standards, and procedures.\n•Documenting policies for hiring and training personnel.\n•Implementing internal controls for information security risks.\n•Establishing and implementing effective cybersecurity controls.\n•Developing and testing formal business continuity plans.\n•Establishing and implementing a well-managed and controlled software development and acquisition function.\n•Controlling, managing, and monitoring an IT operations function.\n•Reviewing insurance for IT operations, including cyber insurance.\n•Developing an effective third-party management program.","GV.RM-3"]
[2268,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Risk Management","Financial institution management should develop an effective ITRM process that supports the broader risk management process. As part of the ITRM process, management should perform the following:\n•Identify risks to information and technology assets within the financial institution or controlled by third-party providers.\n•Measure the level of risk.\n•Mitigate the risks to an acceptable residual risk level in conformance with the board's risk appetite.\n•Monitor changing risk levels and report the results of the process to the board and senior management.","GV.RM-1"]
[2269,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":6.1},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Actions to address risks and opportunities"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Risk Management","Financial institution management should develop an effective ITRM process that supports the broader risk management process. As part of the ITRM process, management should perform the following:\n•Identify risks to information and technology assets within the financial institution or controlled by third-party providers.\n•Measure the level of risk.\n•Mitigate the risks to an acceptable residual risk level in conformance with the board's risk appetite.\n•Monitor changing risk levels and report the results of the process to the board and senior management.","GV.RM-2"]
[2270,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},4.0999999999999996,"Understanding the organization and its context","FFIEC","FFIEC IT Handbook","U.S","Management","Risk Management","Financial institution management should understand and evaluate risk across the institution, including the definitions and categories of risk. Risk is the potential that events, expected or unanticipated, may have an adverse effect on a financial institution's earnings, capital, or reputation. For regulatory purposes, risk is categorized as operational, liquidity, interest rate, credit, price, reputation, strategic, and compliance (legal). Although financial institution management should be aware of all potential risks as part of its overall risk management program, operational risk is the primary risk associated with IT.","GV.PL-2"]
[2271,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","IT Responsibilities and Functions","As part of the governance structure, financial institution management should ensure development, implementation, and maintenance of the following:\n•An effective IT risk management structure.\n•A comprehensive information security program.\n•A formal project management process.\n•An enterprise-wide business continuity planning function.\n•An accurate and timely process for information systems reporting.","GV.PL-2"]
[2272,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},5.0999999999999996,"Leadership and commitment","FFIEC","FFIEC IT Handbook","U.S","Management","IT Governance","IT governance is \"an integral part of governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategies and objectives.\" [1] IT governance objectives are to ensure that IT generates business value for the institution and to mitigate the risks posed by using technology.","GV.RR-2"]
[2273,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","IT Responsibilities and Functions","As part of the governance structure, financial institution management should ensure development, implementation, and maintenance of the following:\n•An effective IT risk management structure.\n•A comprehensive information security program.\n•A formal project management process.\n•An enterprise-wide business continuity planning function.\n•An accurate and timely process for information systems reporting.","GV.RR-2"]
[2274,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","ID.RA-1","Asset vulnerabilities are identified and documented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.6.1\nA.18.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Management of technical vulnerabilities\nTechnical compliance review"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Identification","Financial institution management should maintain a risk identification process that is coordinated and consistent throughout the institution. Risk identification includes ongoing data collection from existing activities and new initiatives."]
[2275,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","Monitoring and Reporting","Financial institution management should ensure satisfactory monitoring and reporting of IT activities and risk. These practices should include the following:\n•Developing metrics to measure performance, efficiency, and compliance with policy.\n•Developing benchmarks for reviewing performance.\n•Establishing and reviewing service level agreements (SLA) with critical third-party providers.\n•Developing, implementing, and monitoring a process to measure IT compliance with established policies, standards, and practices.\n•Evaluating the effectiveness of mitigation strategies and controls.\n•Implementing a quality control or quality assurance program to monitor and test systems and applications.\n•Implementing timely and effective reporting processes.","GV.SP-2"]
[2276,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","IT Responsibilities and Functions","As part of the governance structure, financial institution management should ensure development, implementation, and maintenance of the following:\n•An effective IT risk management structure.\n•A comprehensive information security program.\n•A formal project management process.\n•An enterprise-wide business continuity planning function.\n•An accurate and timely process for information systems reporting.","GV.IR-1"]
[2277,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","IT Responsibilities and Functions","As part of the governance structure, financial institution management should ensure development, implementation, and maintenance of the following:\n•An effective IT risk management structure.\n•A comprehensive information security program.\n•A formal project management process.\n•An enterprise-wide business continuity planning function.\n•An accurate and timely process for information systems reporting.","GV.TE-1"]
[2278,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Risk Management","Financial institution management should develop an effective ITRM process that supports the broader risk management process. As part of the ITRM process, management should perform the following:\n•Identify risks to information and technology assets within the financial institution or controlled by third-party providers.\n•Measure the level of risk.\n•Mitigate the risks to an acceptable residual risk level in conformance with the board's risk appetite.\n•Monitor changing risk levels and report the results of the process to the board and senior management.","GV.IR-1"]
[2279,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Risk Management","Financial institution management should develop an effective ITRM process that supports the broader risk management process. As part of the ITRM process, management should perform the following:\n•Identify risks to information and technology assets within the financial institution or controlled by third-party providers.\n•Measure the level of risk.\n•Mitigate the risks to an acceptable residual risk level in conformance with the board's risk appetite.\n•Monitor changing risk levels and report the results of the process to the board and senior management.","GV.IR-2"]
[2280,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Governance","IT governance is \"an integral part of governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategies and objectives.\" [1] IT governance objectives are to ensure that IT generates business value for the institution and to mitigate the risks posed by using technology.","GV.IR-3"]
[2281,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-1","Physical devices and systems within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Identification","Financial institution management should maintain a risk identification process that is coordinated and consistent throughout the institution. Risk identification includes ongoing data collection from existing activities and new initiatives."]
[2282,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-2","Software platforms and applications within the organization are inventoried",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.1.1\nA.08.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Inventory of assets\nOwnership of assets"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Identification","Financial institution management should maintain a risk identification process that is coordinated and consistent throughout the institution. Risk identification includes ongoing data collection from existing activities and new initiatives."]
[2283,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-3","Organizational communication and data flows are mapped",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.13.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information transfer policies and procedures"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Identification","Financial institution management should maintain a risk identification process that is coordinated and consistent throughout the institution. Risk identification includes ongoing data collection from existing activities and new initiatives."]
[2284,"ID","1 - IDENTIFY ","ID.AM","Asset Management","N.A - Governance",{"$error":"#N/A"},"Entire ISO/IEC 27001","Entire ISO/IEC 27001","FFIEC","FFIEC IT Handbook","U.S","Management","IT Responsibilities and Functions","As part of the governance structure, financial institution management should ensure development, implementation, and maintenance of the following:\n•An effective IT risk management structure.\n•A comprehensive information security program.\n•A formal project management process.\n•An enterprise-wide business continuity planning function.\n•An accurate and timely process for information systems reporting."]
[2285,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Risk Management","Financial institution management should develop an effective ITRM process that supports the broader risk management process. As part of the ITRM process, management should perform the following:\n•Identify risks to information and technology assets within the financial institution or controlled by third-party providers.\n•Measure the level of risk.\n•Mitigate the risks to an acceptable residual risk level in conformance with the board's risk appetite.\n•Monitor changing risk levels and report the results of the process to the board and senior management."]
[2286,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"8.2\nA.12.6.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk assessment\nManagement of technical vulnerabilities"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Measurement","Financial institution management should develop risk measurement processes that include the following elements:\n•Measuring risk using qualitative, quantitative, or a hybrid of methods.\n•Recognizing that risks do not exist in isolation.\n•Prioritizing the risks based on the results of risk measurement."]
[2287,"ID","1 - IDENTIFY ","ID.RA","Risk Assessment","ID.RA-6","Risk responses are identified and prioritized",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"6.1.3\n8.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security risk treatment\nInformation security risk treatment"},"FFIEC","FFIEC IT Handbook","U.S","Management","Monitoring and Reporting","Financial institution management should ensure satisfactory monitoring and reporting of IT activities and risk. These practices should include the following:\n•Developing metrics to measure performance, efficiency, and compliance with policy.\n•Developing benchmarks for reviewing performance.\n•Establishing and reviewing service level agreements (SLA) with critical third-party providers.\n•Developing, implementing, and monitoring a process to measure IT compliance with established policies, standards, and practices.\n•Evaluating the effectiveness of mitigation strategies and controls.\n•Implementing a quality control or quality assurance program to monitor and test systems and applications.\n•Implementing timely and effective reporting processes."]
[2288,"PR","2 - PROTECT ","PR.AC","Identity Management and Access Control","PR.AC-2","Physical access to assets is managed and protected",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Mitigation","Financial institution management should implement effective control and risk transfer practices as part of its overall IT risk mitigation strategy. These practices should include the following:\n•Establishing, implementing, and enforcing IT policies, standards, and procedures.\n•Documenting policies for hiring and training personnel.\n•Implementing internal controls for information security risks.\n•Establishing and implementing effective cybersecurity controls.\n•Developing and testing formal business continuity plans.\n•Establishing and implementing a well-managed and controlled software development and acquisition function.\n•Controlling, managing, and monitoring an IT operations function.\n•Reviewing insurance for IT operations, including cyber insurance.\n•Developing an effective third-party management program."]
[2289,"PR","2 - PROTECT ","PR.AC","Identity Management and Access Control","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Mitigation","Financial institution management should implement effective control and risk transfer practices as part of its overall IT risk mitigation strategy. These practices should include the following:\n•Establishing, implementing, and enforcing IT policies, standards, and procedures.\n•Documenting policies for hiring and training personnel.\n•Implementing internal controls for information security risks.\n•Establishing and implementing effective cybersecurity controls.\n•Developing and testing formal business continuity plans.\n•Establishing and implementing a well-managed and controlled software development and acquisition function.\n•Controlling, managing, and monitoring an IT operations function.\n•Reviewing insurance for IT operations, including cyber insurance.\n•Developing an effective third-party management program."]
[2290,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-5","Physical and information security personnel understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Mitigation","Financial institution management should implement effective control and risk transfer practices as part of its overall IT risk mitigation strategy. These practices should include the following:\n•Establishing, implementing, and enforcing IT policies, standards, and procedures.\n•Documenting policies for hiring and training personnel.\n•Implementing internal controls for information security risks.\n•Establishing and implementing effective cybersecurity controls.\n•Developing and testing formal business continuity plans.\n•Establishing and implementing a well-managed and controlled software development and acquisition function.\n•Controlling, managing, and monitoring an IT operations function.\n•Reviewing insurance for IT operations, including cyber insurance.\n•Developing an effective third-party management program."]
[2291,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Mitigation","Financial institution management should implement effective control and risk transfer practices as part of its overall IT risk mitigation strategy. These practices should include the following:\n•Establishing, implementing, and enforcing IT policies, standards, and procedures.\n•Documenting policies for hiring and training personnel.\n•Implementing internal controls for information security risks.\n•Establishing and implementing effective cybersecurity controls.\n•Developing and testing formal business continuity plans.\n•Establishing and implementing a well-managed and controlled software development and acquisition function.\n•Controlling, managing, and monitoring an IT operations function.\n•Reviewing insurance for IT operations, including cyber insurance.\n•Developing an effective third-party management program."]
[2292,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-4","Senior executives understand roles and responsibilities",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.1\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security roles and responsibilities\nInformation security awareness, education and training"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Governance","IT governance is \"an integral part of governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategies and objectives.\" [1] IT governance objectives are to ensure that IT generates business value for the institution and to mitigate the risks posed by using technology."]
[2293,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-7","Protection processes are continuously improved",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":10.199999999999999},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Continuous Improvement"},"FFIEC","FFIEC IT Handbook","U.S","Management","Monitoring and Reporting","Financial institution management should ensure satisfactory monitoring and reporting of IT activities and risk. These practices should include the following:\n•Developing metrics to measure performance, efficiency, and compliance with policy.\n•Developing benchmarks for reviewing performance.\n•Establishing and reviewing service level agreements (SLA) with critical third-party providers.\n•Developing, implementing, and monitoring a process to measure IT compliance with established policies, standards, and practices.\n•Evaluating the effectiveness of mitigation strategies and controls.\n•Implementing a quality control or quality assurance program to monitor and test systems and applications.\n•Implementing timely and effective reporting processes."]
[2294,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-8","Effectiveness of protection technologies is shared with appropriate parties",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"FFIEC","FFIEC IT Handbook","U.S","Management","Monitoring and Reporting","Financial institution management should ensure satisfactory monitoring and reporting of IT activities and risk. These practices should include the following:\n•Developing metrics to measure performance, efficiency, and compliance with policy.\n•Developing benchmarks for reviewing performance.\n•Establishing and reviewing service level agreements (SLA) with critical third-party providers.\n•Developing, implementing, and monitoring a process to measure IT compliance with established policies, standards, and practices.\n•Evaluating the effectiveness of mitigation strategies and controls.\n•Implementing a quality control or quality assurance program to monitor and test systems and applications.\n•Implementing timely and effective reporting processes."]
[2295,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.07.1.1\nA.07.3.1\nA.08.1.4"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Screening\nTermination or change of employment responsibilities\nReturn of assets"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Mitigation","Financial institution management should implement effective control and risk transfer practices as part of its overall IT risk mitigation strategy. These practices should include the following:\n•Establishing, implementing, and enforcing IT policies, standards, and procedures.\n•Documenting policies for hiring and training personnel.\n•Implementing internal controls for information security risks.\n•Establishing and implementing effective cybersecurity controls.\n•Developing and testing formal business continuity plans.\n•Establishing and implementing a well-managed and controlled software development and acquisition function.\n•Controlling, managing, and monitoring an IT operations function.\n•Reviewing insurance for IT operations, including cyber insurance.\n•Developing an effective third-party management program."]
[2296,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Identification","Financial institution management should maintain a risk identification process that is coordinated and consistent throughout the institution. Risk identification includes ongoing data collection from existing activities and new initiatives.","DM.ID-1"]
[2297,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Governance","IT governance is \"an integral part of governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategies and objectives.\" [1] IT governance objectives are to ensure that IT generates business value for the institution and to mitigate the risks posed by using technology.","DM.ID-2"]
[2298,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","Information Security","Management should protect information and technology assets to ensure operational continuity, financial viability, and the trust of customers.\nThe board of directors is responsible for overseeing the development, implementation, management, and maintenance of the institution's information security program. This oversight includes assigning specific responsibility and accountability for the program's implementation and reviewing reports from management. The board should provide management with guidance, review the effectiveness of management's actions, and annually approval written information security policies and a written information security program. Key elements that should be addressed in the information security program include the following:\n•Central oversight and coordination.\n•Areas of responsibility.\n•Risk measurement.\n•Implementation of controls.\n•Monitoring and testing of effectiveness of controls.\n•Reporting.\n•Acceptable residual risk.\nThe information security program should be coordinated across the institution. To ensure the effectiveness of the information security program throughout the institution, management should have a process to hold staff accountable for complying with the information security program. Institution management should perform the following:\n•Develop and implement processes to identify and protect against security events and incidents.\n•Develop, implement, and periodically test incident response procedures, which should address escalation, remediation, and reporting of events and incidents.\n•Develop and implement a threat intelligence and collaboration process to identify and respond to information on threats and vulnerabilities.\n•Consider information security risks when developing, implementing, or updating products.\n•Ensure that products are developed or updated in accordance with established information security policies and procedures.\n•Perform penetration tests before launching or making significant changes to critical systems, including Internet- and client-facing applications. Management should review all findings and develop processes to ensure the timely remediation of issues identified by the tests.\n•Conduct initial due diligence and ongoing monitoring to fully understand the types of connections and mitigating controls in place between the financial institution and its third-party providers. In conjunction with this, management should require by contract that the third-party providers notify the institution of the use of any subcontractors or changes to subcontractor relationships. [1]\n•Implement a governance process to establish, monitor, maintain, and test controls to mitigate interconnectivity risk.\n•Develop a policy for escalating and reporting security incidents to the board, government agencies, law enforcement, and the institution's primary federal and state regulator based on thresholds defined by the financial institution and applicable legal requirements. Relevant thresholds could include significant financial impact, significant operational downtime, operational or system breach, or loss of critical infrastructure.","DM.ED-5"]
[2299,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","Information Security","Management should protect information and technology assets to ensure operational continuity, financial viability, and the trust of customers.\nThe board of directors is responsible for overseeing the development, implementation, management, and maintenance of the institution's information security program. This oversight includes assigning specific responsibility and accountability for the program's implementation and reviewing reports from management. The board should provide management with guidance, review the effectiveness of management's actions, and annually approval written information security policies and a written information security program. Key elements that should be addressed in the information security program include the following:\n•Central oversight and coordination.\n•Areas of responsibility.\n•Risk measurement.\n•Implementation of controls.\n•Monitoring and testing of effectiveness of controls.\n•Reporting.\n•Acceptable residual risk.\nThe information security program should be coordinated across the institution. To ensure the effectiveness of the information security program throughout the institution, management should have a process to hold staff accountable for complying with the information security program. Institution management should perform the following:\n•Develop and implement processes to identify and protect against security events and incidents.\n•Develop, implement, and periodically test incident response procedures, which should address escalation, remediation, and reporting of events and incidents.\n•Develop and implement a threat intelligence and collaboration process to identify and respond to information on threats and vulnerabilities.\n•Consider information security risks when developing, implementing, or updating products.\n•Ensure that products are developed or updated in accordance with established information security policies and procedures.\n•Perform penetration tests before launching or making significant changes to critical systems, including Internet- and client-facing applications. Management should review all findings and develop processes to ensure the timely remediation of issues identified by the tests.\n•Conduct initial due diligence and ongoing monitoring to fully understand the types of connections and mitigating controls in place between the financial institution and its third-party providers. In conjunction with this, management should require by contract that the third-party providers notify the institution of the use of any subcontractors or changes to subcontractor relationships. [1]\n•Implement a governance process to establish, monitor, maintain, and test controls to mitigate interconnectivity risk.\n•Develop a policy for escalating and reporting security incidents to the board, government agencies, law enforcement, and the institution's primary federal and state regulator based on thresholds defined by the financial institution and applicable legal requirements. Relevant thresholds could include significant financial impact, significant operational downtime, operational or system breach, or loss of critical infrastructure.","DM.BE-2"]
[2300,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","Enterprise Architecture","An effective EA program can result in the following:\n•Enhanced interoperability from using IT to drive business adaptability.\n•Closer partnership between business and IT groups.\n•Improved focus on the institution's goals.\n•Reduced numbers of failed IT systems.\n•Reduced complexity of IT systems.\n•Improved agility of IT systems.\n•Closer alignment between IT deliverables and business requirements.\n•Assurance that all software, including operating systems, is current and vendor supported.\n•Improved morale, as more staff members see a direct correlation between their work and the institution's success\nTo effectively implement an EA program, the institution should analyze the risks and potential impact of threats to all of the institution's activities. A comprehensive EA program based on prudent practices can help an institution better develop processes to manage IT issues and identify, measure, and mitigate technology-based risks and threats.","DM.RS-2"]
[2301,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","IT Risk Management","Financial institution management should develop an effective ITRM process that supports the broader risk management process. As part of the ITRM process, management should perform the following:\n•Identify risks to information and technology assets within the financial institution or controlled by third-party providers.\n•Measure the level of risk.\n•Mitigate the risks to an acceptable residual risk level in conformance with the board's risk appetite.\n•Monitor changing risk levels and report the results of the process to the board and senior management.","DM.RS-2"]
[2302,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Identification","Financial institution management should maintain a risk identification process that is coordinated and consistent throughout the institution. Risk identification includes ongoing data collection from existing activities and new initiatives.","DM.ED-1"]
[2303,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Measurement","Financial institution management should develop risk measurement processes that include the following elements:\n•Measuring risk using qualitative, quantitative, or a hybrid of methods.\n•Recognizing that risks do not exist in isolation.\n•Prioritizing the risks based on the results of risk measurement.","DM.ED-1"]
[2304,"N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"FFIEC","FFIEC IT Handbook","U.S","Management","Risk Mitigation","Financial institution management should implement effective control and risk transfer practices as part of its overall IT risk mitigation strategy. These practices should include the following:\n•Establishing, implementing, and enforcing IT policies, standards, and procedures.\n•Documenting policies for hiring and training personnel.\n•Implementing internal controls for information security risks.\n•Establishing and implementing effective cybersecurity controls.\n•Developing and testing formal business continuity plans.\n•Establishing and implementing a well-managed and controlled software development and acquisition function.\n•Controlling, managing, and monitoring an IT operations function.\n•Reviewing insurance for IT operations, including cyber insurance.\n•Developing an effective third-party management program.","DM.ED-1"]
[null,"N.A - Governance","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","A. Implementation of an Information Security Program","Commensurate with the size and complexity of the Licensee, the nature and scope of the Licensee’s activities, including its use of Third-Party Service Providers, and the sensitivity of the Nonpublic Information used by the Licensee or in the Licensee’s possession, custody or control, each Licensee shall develop, implement, and maintain a comprehensive written Information Security Program based on the Licensee’s Risk Assessment and that contains administrative, technical, and physical safeguards for the protection of Nonpublic Information and the Licensee’s Information System.","DM.ED-2"]
[null,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","C. Risk Assessment","The Licensee shall:\n...\n(2) Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration or destruction of Nonpublic Information, including the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third-Party Service Providers;","N/A"]
[null,"N.A - Governance","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","(1) Design its Information Security Program to mitigate the identified risks,\ncommensurate with the size and complexity of the Licensee’s activities,\nincluding its use of Third-Party Service Providers, and the sensitivity of the\nNonpublic Information used by the Licensee or in the Licensee’s possession,\ncustody, or control.","DM.ED-2"]
[null,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures.\n...\n(e) Adopt secure development practices for in-house developed applications utilized by the Licensee and procedures for evaluating, assessing or testing the security of externally developed applications utilized by the Licensee;","N/A"]
[null,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-2","A System Development Life Cycle to manage systems is implemented",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures.\n...\n(e) Adopt secure development practices for in-house developed applications utilized by the Licensee and procedures for evaluating, assessing or testing the security of externally developed applications utilized by the Licensee;","N/A"]
[null,"ID","1 - IDENTIFY ","ID.AM","Asset Management","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.08.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Classification of information"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures.\n...\n(e) Identify and manage the data, personnel, devices, systems, and\nfacilities that enable the organization to achieve business purposes in accordance with their relative importance to business objectives and the organization’s risk strategy;"]
[null,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures.\n...\n(i) Include audit trails within the Information Security Program designed to detect and respond to Cybersecurity Events and designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Licensee;","N/A"]
[null,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-4","Backups of information are conducted, maintained, and tested periodically",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.3.1\nA.17.1.2\nA.17.1.3"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n...\n(2) Determine which security measures listed below are appropriate and implement such security measures.\n...\n(i) Include audit trails within the Information Security Program designed to detect and respond to Cybersecurity Events and designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Licensee;","N/A"]
[null,"N.A","N.A","No Direct NIST Function ID","N.A","No Direct NIST Subcategory ID",{"$error":"#N/A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"N.A"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"No Direct ISO Mapping"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","I. Annual Certification to Commissioner of Domiciliary State","Annually, each insurer domiciled in this State shall submit to the Commissioner, a written statement by February 15, certifying that the insurer is in compliance with the requirements set forth in Section 4 of this Act. Each insurer shall maintain for examination by the Department all records, schedules and data supporting this certificate for a period of five years. To the extent an insurer has identified areas, systems, or processes that require material improvement, updating or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address such areas, systems or processes. Such documentation must be available for inspection by the Commissioner."]
[null,"PR","2 - PROTECT ","PR.AT","Awareness and Training","PR.AT-1","All users are informed and trained",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"7.3\nA.07.2.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Awareness\nInformation security awareness, education and training"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","D. Risk Management","Based on its Risk Assessment, the Licensee shall:\n…\n(3) Provide its personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified by the Licensee in the Risk Assessment.","N/A"]
[null,"PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.1\nA.17.1.1\nA.17.1.2"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 4. Information Security Program","H. Incident Response Plan","(1) As part of its Information Security Program, each Licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event that compromises the confidentiality, integrity, or availability of Nonpublic Information in its possession, the Licensee’s Information Systems, or the continuing functionality of any aspect of the Licensee’s business or operations.\n(2) Such incident response plan shall address the following areas:\n(a) The internal process for responding to a Cybersecurity Event;\n(b) The goals of the incident response plan;\n(c) The definition of clear roles, responsibilities and levels of decisionmaking authority;\n(d) External and internal communications and information sharing;\n(e) Identification of requirements for the remediation of any identified weaknesses in Information Systems and associated controls;\n(f) Documentation and reporting regarding Cybersecurity Events and related incident response activities; and\n(g) The evaluation and revision as necessary of the incident response plan following a Cybersecurity Event."]
[null,"RS","4 - RESPOND ","RS.AN","Analysis","RS.AN-2","The impact of the incident is understood",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.16.1.6"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Learning from information security incidents"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","B. During the investigation, the Licensee, or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall, at a minimum determine as much of the following information as possible:","(1) Determine whether a Cybersecurity Event has occurred;"]
[null,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.14.2.7 \nA.15.2.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Outsourced development\nMonitoring and review of supplier services"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","B. During the investigation, the Licensee, or an outside vendor and/or service provider designated to act on behalf of the Licensee, shall, at a minimum determine as much of the following information as possible:","If the Licensee learns that a Cybersecurity Event has or may have occurred in system maintained by a Third-Party Service Provider, the Licensee will complete the steps listed in Section 5B above or confirm and document that the Third-Party Service Provider has completed those steps."]
[null,"DE","3 - DETECT ","DE.CM","Security Continuous Monitoring","DE.CM-1","The network is monitored to detect potential cybersecurity events",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","D. The Licensee shall maintain records concerning all Cybersecurity Events for a period of at least five years from the date of the Cybersecurity Event and shall produce those records upon demand of the Commissioner.","N/A","N/A"]
[null,"PR","2 - PROTECT ","PR.PT","Protective Technology","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1"},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 5. Investigation of a Cybersecurity Event","D. The Licensee shall maintain records concerning all Cybersecurity Events for a period of at least five years from the date of the Cybersecurity Event and shall produce those records upon demand of the Commissioner.","N/A","N/A"]
[null,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 6. Notification of a Cybersecurity Incident","A. Notification to the Commissioner","Each Licensee shall notify the Commissioner as promptly as possible but in no event later than 72 hours from a determination that a Cybersecurity Event has occurred when either of the following criteria has been met:\n(1) This State is the Licensee’s state of domicile, in the case of an insurer, or this State is the Licensee’s home state, in the case of a producer, as those terms are defined in [insert reference to Producer Licensing Model Act]; or\n(2) The Licensee reasonably believes that the Nonpublic Information involved is of 250 or more Consumers residing in this State and that is either of the following:\n(a) A Cybersecurity Event impacting the Licensee of which notice is required to be provided to any government body, self-regulatory agency or any other supervisory body pursuant to any state or federal law; or\n(b) A Cybersecurity Event that has a reasonable likelihood of materially harming:\n(i) Any Consumer residing in this State; or\n(ii) Any material part of the normal operation(s) of the Licensee. \n\nB. The Licensee shall provide as much of the following information as possible. The Licensee shall provide the information in electronic form as directed by the Commissioner. The Licensee shall have a continuing obligation to update and supplement initial and subsequent notifications to the Commissioner concerning the Cybersecurity Event.\n(1) Date of the Cybersecurity Event;\n(2) Description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of Third-Party Service Providers, if any;\n(3) How the Cybersecurity Event was discovered;\n(4) Whether any lost, stolen, or breached information has been recovered and if so, how this was done;\n(5) The identity of the source of the Cybersecurity Event;\n(6) Whether Licensee has filed a police report or has notified any regulatory, government or law enforcement agencies and, if so, when such notification was provided;\n(7) Description of the specific types of information acquired without authorization. Specific types of information means particular data elements including, for example, types of medical information, types of financial information or types of information allowing identification of the Consumer;\n(8) The period during which the Information System was compromised by the Cybersecurity Event;\n(9) The number of total Consumers in this State affected by the Cybersecurity Event. The Licensee shall provide the best estimate in the initial report to the Commissioner and update this estimate with each subsequent report to the Commissioner pursuant to this section;\n(10) The results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed;\n(11) Description of efforts being undertaken to remediate the situation which permitted the Cybersecurity Event to occur;\n(12) A copy of the Licensee’s privacy policy and a statement outlining the steps the Licensee will take to investigate and notify Consumers affected by the Cybersecurity Event; and\n(13) Name of a contact person who is both familiar with the Cybersecurity Event and authorized to act for the Licensee."]
[null,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 6. Notification of a Cybersecurity Incident","E. Notice Regarding Cybersecurity Events of Reinsurers to Insurers","(1) (a) In the case of a Cybersecurity Event involving Nonpublic Information that is used by the Licensee that is acting as an assuming insurer or in the possession, custody or control of a Licensee that is acting as an assuming insurer and that does not have a direct contractual relationship with the affected Consumers, the assuming insurer shall notify its affected ceding insurers and the Commissioner of its state of domicile within 72 hours of making the determination that a Cybersecurity Event has occurred. \n(b) The ceding insurers that have a direct contractual relationship with affected Consumers shall fulfill the consumer notification requirements imposed under [insert the state’s breach notification law] and any other notification requirements relating to a Cybersecurity Event imposed under Section 6. \n(2) (a) In the case of a Cybersecurity Event involving Nonpublic Information that is in the possession, custody or control of a Third-Party Service Provider of a Licensee that is an assuming insurer, the assuming insurer shall notify its affected ceding insurers and the Commissioner of its state of domicile within 72 hours of receiving notice from its Third-Party Service Provider that a Cybersecurity Event has occurred. \n(b) The ceding insurers that have a direct contractual relationship with affected Consumers shall fulfill the consumer notification requirements imposed under [insert the state’s breach notification Model Regulation Service—4th Quarter 2017 © 2017 National Association of Insurance Commissioners 668-11 law] and any other notification requirements relating to a Cybersecurity Event imposed under Section 6."]
[null,"RS","4 - RESPOND ","RS.CO","Communications","RS.CO-2","Incidents are reported consistent with established criteria",{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Control],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"A.06.1.3 \nA.16.1.2 "},{"$f":"INDEX(NIST_TO_ISO[ISO/IEC 27001 Objective],MATCH(Table17[[#This Row],[NIST Subcategory ID]],NIST_TO_ISO[Subcategory ID],0))","v":"Contact with authorities\nReporting information security events"},"NAIC","NAIC - INSURANCE DATA SECURITY MODEL LAW (Q4 2017)","U.S","Section 6. Notification of a Cybersecurity Incident","F. Notice Regarding Cybersecurity Events of Insurers to Producers of Record ","In the case of a Cybersecurity Event involving Nonpublic Information that is in the possession, custody or control of a Licensee that is an insurer or its Third-Party Service Provider and for which a Consumer accessed the insurer’s services through an independent insurance producer, the insurer shall notify the producers of record of all affected Consumers as soon as practicable as directed by the Commissioner. The insurer is excused from this obligation for those instances in which it does not have the current producer of record information for any individual Consumer."]

{"sheet":"NIST to ISO|IEC 27001","index":14,"n_rows":117,"n_cols":9,"rows_kept":117,"cut":false,"hidden":false,"merged":[]}
[]
["Proprietary"]
["NIST to ISO/IEC 27001 Mapping"]
[]
["Function ID","Function","Category ID","Category","Category Description","Subcategory ID","Subcategory","ISO/IEC 27001 Control","ISO/IEC 27001 Objective"]
["ID","1 - IDENTIFY ","ID.AM","Asset Management","The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk\nstrategy.","ID.AM-1","Physical devices and systems within the organization are inventoried","A.08.1.1\nA.08.1.2","Inventory of assets\nOwnership of assets"]
["ID","1 - IDENTIFY ","ID.AM","Asset Management","The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk\nstrategy.","ID.AM-2","Software platforms and applications within the organization are inventoried","A.08.1.1\nA.08.1.2","Inventory of assets\nOwnership of assets"]
["ID","1 - IDENTIFY ","ID.AM","Asset Management","The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk\nstrategy.","ID.AM-3","Organizational communication and data flows are mapped","A.13.2.1","Information transfer policies and procedures"]
["ID","1 - IDENTIFY ","ID.AM","Asset Management","The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk\nstrategy.","ID.AM-4","External information systems are catalogued","A.11.2.6","Security of equipment and assets off-premises"]
["ID","1 - IDENTIFY ","ID.AM","Asset Management","The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk\nstrategy.","ID.AM-5","Resources (e.g., hardware, devices, data, time and software) are prioritized based on their classification, criticality, and business value","A.08.2.1","Classification of information"]
["ID","1 - IDENTIFY ","ID.AM","Asset Management","The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk\nstrategy.","ID.AM-6","Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established","A.06.1.1","Information security roles and responsibilities"]
["ID","1 - IDENTIFY ","ID.BE","Business Environment","The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","ID.BE-1","The organization’s role in the supply chain is identified and communicated","A.15.1.3\nA.15.2.1\nA.15.2.2","Information and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"]
["ID","1 - IDENTIFY ","ID.BE","Business Environment","The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","ID.BE-2","The organization’s place in critical infrastructure and its industry sector is identifiedand communicated","4.1\n4.2\n4.3","Understanding the organization and its context\nUnderstanding the needs and expectations of interested parties\nDetermining the scope of the information security management system"]
["ID","1 - IDENTIFY ","ID.BE","Business Environment","The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","ID.BE-3","Priorities for organizational mission, objectives, and activities are established and communicated",6.2,"Information security objectives and planning to achieve them"]
["ID","1 - IDENTIFY ","ID.BE","Business Environment","The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","ID.BE-4","Dependencies and critical functions for delivery of critical services are established","A.11.2.2\nA.11.2.3\nA.12.1.3","Supporting utilities\nCabling security\nCapacity management"]
["ID","1 - IDENTIFY ","ID.BE","Business Environment","The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","ID.BE-5","Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)","A.11.1.4\nA.17.1.1\nA.17.1.2\nA.17.2.1","Protecting against external and environmental threats\nPlanning information security continuity\nImplementing information security continuity\nAvailability of information processing facilities"]
["ID","1 - IDENTIFY ","ID.GV","Governance","The policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.","ID.GV-1","Organizational information security policy is established","4.4\n5.2\nA.05.1.1","Information security management system\nPolicy\nPolicies for information security"]
["ID","1 - IDENTIFY ","ID.GV","Governance","The policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.","ID.GV-2","Information security roles & responsibilities are coordinated and aligned with internal roles and external partners","5.3\nA.06.1.1\nA.07.2.1","Organizational roles, responsibilities, and authorities\nInformation security roles and responsibilities\nManagement responsibilities"]
["ID","1 - IDENTIFY ","ID.GV","Governance","The policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.","ID.GV-3","Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed","A.18.1.1\nA.18.1.2\nA.18.1.3\nA.18.1.4\nA.18.1.5","Identification of applicable legislation and contractual requirements\nIntellectual property rights\nProtection of records\nPrivacy and protection of personally identifiable information\nRegulation of cryptographic controls"]
["ID","1 - IDENTIFY ","ID.GV","Governance","The policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.","ID.GV-4","Governance and risk management processes address cybersecurity risks","5.1\n5.2\n5.3","Leadership and commitment\nPolicy\nOrganizational roles, responsibilities and authorities"]
["ID","1 - IDENTIFY ","ID.RA","Risk Assessment","The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-1","Asset vulnerabilities are identified and documented","A.12.6.1\nA.18.2.3","Management of technical vulnerabilities\nTechnical compliance review"]
["ID","1 - IDENTIFY ","ID.RA","Risk Assessment","The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-2","Cyber threat intelligence and vulnerability information is received from information sharing forums and sources","A.06.1.4","Contact with special interest groups"]
["ID","1 - IDENTIFY ","ID.RA","Risk Assessment","The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-3","Threats, both internal and external, are identified and documented","6.1.2","Information security risk assessment"]
["ID","1 - IDENTIFY ","ID.RA","Risk Assessment","The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-4","Potential business impacts and likelihoods are identified","6.1.2","Information security risk assessment"]
["ID","1 - IDENTIFY ","ID.RA","Risk Assessment","The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-5","Threats, vulnerabilities, likelihoods, and impacts are used to determine risk","8.2\nA.12.6.1","Information security risk assessment\nManagement of technical vulnerabilities"]
["ID","1 - IDENTIFY ","ID.RA","Risk Assessment","The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-6","Risk responses are identified and prioritized","6.1.3\n8.3","Information security risk treatment\nInformation security risk treatment"]
["ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.","ID.RM-1","Risk management processes are established, managed, and agreed to by organizational stakeholders",6.1,"Actions to address risks and opportunities"]
["ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.","ID.RM-2","Organizational risk tolerance is determined and clearly expressed","6.1.2\n6.1.3","Information security risk assessment\nInformation security risk treatment"]
["ID","1 - IDENTIFY ","ID.RM","Risk Management Strategy","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.","ID.RM-3","The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis","N.A","No Direct ISO Mapping"]
["ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","ID.SC-1","Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders","A.15.1.1 \nA.15.1.2 \nA.15.1.3 \nA.15.2.1 \nA.15.2.2","Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain\nMonitoring and review of supplier services\nManaging changes to supplier services"]
["ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","ID.SC-2"," Identify, prioritize and assess suppliers and partners of critical information systems, components and services using a cyber supply chain risk assessment process","A.15.2.1 \nA.15.2.2","Monitoring and review of supplier services\nManaging changes to supplier services"]
["ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","ID.SC-3"," Suppliers and partners are required by contract to implement appropriate measures designed to meet the objectives of the Information Security program or Cyber Supply Chain Risk Management Plan.","A.15.1.1\nA.15.1.2\nA.15.1.3","Equipment maintenance\nAddressing security within supplier agreements\nInformation and communication technology supply chain"]
["ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","ID.SC-4","Suppliers and third-party partners are routinely assessed to confirm that they are meeting their contractual obligations. Reviews of audits, summaries of test results, or other equivalent evaluations of suppliers/providers are conducted ","A.15.2.1\nA.15.2.2","Monitoring and review of supplier services\nManaging changes to supplier services"]
["ID","1 - IDENTIFY ","ID.SC","Supply Chain Risk Management","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","ID.SC-5","Response and recovery planning and testing are conducted with critical suppliers/providers","A.17.1.3 ","Verify, review and evaluate information security continuity"]
["PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control"," Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-1","Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes","A.09.2.1\nA.09.2.2\nA.09.2.4\nA.09.3.1\nA.09.4.2\nA.09.4.3","User registration and de-registration\nUser access provisioning\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system"]
["PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control"," Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-2","Physical access to assets is managed and protected","A.11.1.1\nA.11.1.2\nA.11.1.4\nA.11.1.6\nA.11.2.3","Physical security perimeter\nPhysical entry controls\nProtecting against external and environmental threats\nDelivery and loading areas\nCabling security"]
["PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control"," Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-3","Remote access is managed","A.06.2.2\nA.13.1.1\nA.13.2.1","Teleworking\nNetwork controls\nInformation transfer policies and procedures"]
["PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control"," Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-4","Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties","A.06.1.2\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4","Segregation of duties\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs"]
["PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control"," Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-5","Network integrity is protected, incorporating network segregation where appropriate","A.13.1.1\nA.13.1.3\nA.13.2.1","Network controls\nSegregation in networks\nInformation transfer policies and procedures"]
["PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control"," Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-6","Identities are proofed and bound to credentials, and asserted in interactions when appropriate","A.6.1.2 \nA.7.1.1 \nA.9.1.2 \nA.9.2.2 \nA.9.2.3 \nA.9.2.5 \nA.9.2.6 \nA.9.4.1 \nA.9.4.4","Segregation of duties\nScreening\nAccess to networks and network services\nUser access provisioning\nManagement of privileged access rights\nReview of user access rights\nRemoval or adjustment of access rights\nInformation access restriction\nUse of privileged utility programs"]
["PR","2 - PROTECT ","PR.AC","Identity Management, Authentication and Access Control"," Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.","PR.AC-7","Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the\ntransaction (e.g., individuals’ security and privacy risks and other organizational risks) \n","A.9.2.1\nA.9.2.4\nA.9.3.1\nA.9.4.2\nA.9.4.3\nA.18.1.4","User registration and de-registration\nManagement of secret authentication information of users\nUse of secret authentication information\nSecure log-on procedures\nPassword management system\nPrivacy and protection of personally identifiable information"]
["PR","2 - PROTECT ","PR.AT","Awareness and Training","The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-1","All users are informed and trained","7.3\nA.07.2.2","Awareness\nInformation security awareness, education and training"]
["PR","2 - PROTECT ","PR.AT","Awareness and Training","The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-2","Privileged users understand roles and responsibilities","A.06.1.1\nA.07.2.2","Information security roles and responsibilities\nInformation security awareness, education and training"]
["PR","2 - PROTECT ","PR.AT","Awareness and Training","The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-3","Third-party stakeholders (e.g., suppliers, customers, partners) understand roles and responsibilities","A.06.1.1\nA.07.2.2","Information security roles and responsibilities\nInformation security awareness, education and training"]
["PR","2 - PROTECT ","PR.AT","Awareness and Training","The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-4","Senior executives understand roles and responsibilities","A.06.1.1\nA.07.2.2","Information security roles and responsibilities\nInformation security awareness, education and training"]
["PR","2 - PROTECT ","PR.AT","Awareness and Training","The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-5","Physical and information security personnel understand roles and responsibilities","A.06.1.1\nA.07.2.2","Information security roles and responsibilities\nInformation security awareness, education and training"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-1","Data-at-rest is protected","7.5.3\nA.08.2.3\nA.10.1.1\nA.08.18.1.4","Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nPrivacy and protection of personally identifiable information"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-2","Data-in-transit is protected","7.5.3\nA.08.2.3\nA.10.1.1\nA.13.1.1\nA.13.2.1\nA.13.2.3\nA.14.1.2\nA.14.1.3\nA.18.1.4","Control of documented information\nHandling of assets\nPolicy on the use of cryptographic controls\nNetwork controls\nInformation transfer policies and procedures\nElectronic messaging\nSecuring application services on public networks\nProtecting application services transactions\nPrivacy and protection of personally identifiable information"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-3","Assets are formally managed throughout removal, transfers, and disposition","7.5.3\nA.08.2.3\nA.08.3.1\nA.08.3.2\nA.08.3.3\nA.11.2.7","Control of documented information\nHandling of assets\nManagement of removable media\nDisposal of media\nPhysical media transfer\nSecure disposal or re-use of equipment"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-4","Adequate capacity to ensure availability is maintained","A.12.3.1","Capacity management"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-5","Protections against data leaks are implemented","A.06.1.2\nA.07.1.1\nA.07.1.2\nA.07.3.1\nA.08.2.2\nA.08.2.3\nA.09.1.1\nA.09.1.2\nA.09.2.3\nA.09.4.1\nA.09.4.4\nA.09.4.5\nA.13.1.3\nA.13.2.1\nA.13.2.3\nA.13.2.4\nA.14.1.2\nA.14.1.3","Segregation of duties\nScreening\nTerms and conditions of employment\nTermination or change of employment responsibilities\nLabelling of information\nHandling of assets\nAccess control policy\nAccess to networks and network services\nManagement of privileged access rights\nInformation access restriction\nUse of privileged utility programs\nAccess control to program source code\nSegregation in networks\nInformation transfer policies and procedures\nElectronic messaging\nConfidentiality or non-disclosure agreements\nSecuring application services on public networks\nProtecting application services transactions"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-6","Integrity checking mechanisms are used to verify software, firmware, and information integrity","A.12.2.1\nA.12.5.1\nA.14.1.2\nA.14.1.3","Controls against malware\nInstallation of software on operational systems\nSecuring application services on public networks\nProtecting application services transactions"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-7","The development and testing environment(s) are separate from the production environment","A.12.1.4","Separation of development, testing and operational environments"]
["PR","2 - PROTECT ","PR.DS","Data Security","Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-8","Integrity checking mechanisms are used to verify hardware integrity","A.11.2.4","Equipment maintenance"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-1","A baseline configuration of information technology/industrial control systems is created and maintained incorporating appropriate security principles (e.g. concept of least functionality)","A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4","Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-2","A System Development Life Cycle to manage systems is implemented","A.06.1.5\nA.14.1.1\nA.14.2.1\nA.14.2.5","Information security in project management\nInformation security requirements analysis and specification\nSecure development policy\nSecure system engineering principles"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-3","Configuration change control processes are in place","A.12.1.2\nA.12.5.1\nA.12.6.2\nA.14.2.2\nA.14.2.3\nA.14.2.4","Change management\nInstallation of software on operational systems\nRestrictions on software installation\nSystem change control procedures\nTechnical review of applications after operating platform changes\nRestrictions on changes to software packages"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-4","Backups of information are conducted, maintained, and tested periodically","A.12.3.1\nA.17.1.2\nA.17.1.3","Information backup\nImplementing information security continuity\nVerify, review and evaluate information security continuity"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-5","Policy and regulations regarding the physical operating environment for organizational assets are met","A.11.1.4\nA.11.2.1\nA.11.2.2\nA.11.2.3","Protecting against external and environmental threats\nEquipment siting and protection\nSupporting utilities\nCabling security"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-6","Data is destroyed according to policy","A.08.2.3\nA.08.3.1\nA.08.3.2\nA.11.2.7","Handling of assets\nManagement of removable media\nDisposal of media\nSecure disposal or re-use of equipment"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-7","Protection processes are continuously improved",10.199999999999999,"Continuous Improvement"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-8","Effectiveness of protection technologies is shared with appropriate parties","A.16.1.6","Learning from information security incidents"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-9","Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed","A.16.1.1\nA.17.1.1\nA.17.1.2","Responsibilities and procedures\nPlanning information security continuity\nImplementing information security continuity"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-10","Response and recovery plans are tested","A.17.1.3","Verify, review and evaluate information security continuity"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-11","Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)","A.07.1.1\nA.07.3.1\nA.08.1.4","Screening\nTermination or change of employment responsibilities\nReturn of assets"]
["PR","2 - PROTECT ","PR.IP","Information Protection Processes and Procedures","Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-12","A vulnerability management plan is developed and implemented","A.12.6.1\nA.18.2.2","Management of technical vulnerabilities\nCompliance with security policies and standards"]
["PR","2 - PROTECT ","PR.MA","Maintenance","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","PR.MA-1","Maintenance and repair of organizational assets are performed and logged in a timely manner, with approved and controlled tools","A.11.1.2\nA.11.2.4\nA.11.2.5","Physical entry controls\nEquipment maintenance\nRemoval of assets"]
["PR","2 - PROTECT ","PR.MA","Maintenance","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","PR.MA-2","Remote maintenance of organizational assets is approved, logged, and performed in a mannerthat prevents unauthorized access","A.11.2.4\nA.15.1.1\nA.15.2.1","Equipment maintenance\nInformation security policy for supplier relationships\nMonitoring and review of supplier services"]
["PR","2 - PROTECT ","PR.PT","Protective Technology","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","PR.PT-1","Audit/log records are determined, documented, implemented, and reviewed in accordance withpolicy","A.12.4.1\nA.12.4.2\nA.12.4.3\nA.12.4.4\nA.12.7.1","Event logging\nProtection of log information\nAdministrator and operator logs\nClock synchronisation\nInformation systems audit controls"]
["PR","2 - PROTECT ","PR.PT","Protective Technology","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","PR.PT-2","Removable media is protected and its use restricted according to policy","A.08.2.2\nA.08.2.3\nA.08.3.1\nA.08.3.3\nA.11.2.9","Labelling of information\nHandling of assets\nManagement of removable media\nPhysical media transfer\nClear desk and clear screen policy"]
["PR","2 - PROTECT ","PR.PT","Protective Technology","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","PR.PT-3","The principle of least functionality is incorporated by configuring systems to provide only essential capabilities","A.09.1.2","Access to networks and network services"]
["PR","2 - PROTECT ","PR.PT","Protective Technology","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","PR.PT-4","Communications and control networks are protected","A.13.1.1\nA.13.2.1","Network controls\nInformation transfer policies and procedures"]
["PR","2 - PROTECT ","PR.PT","Protective Technology","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","PR.PT-5","Systems operate in pre-defined functional states to achieve availability (e.g. under duress, under attack, during recovery, normal operations).","A.17.1.2\nA.17.2.1 ","Implementing information security continuity\nAvailability of information processing facilities"]
["DE","3 - DETECT ","DE.AE","Anomalies and Events",{"$error":"#N/A"},"DE.AE-1","A baseline of network operations and expected data flows for users and systems is established and managed","A.13.2.1","Information transfer policies and procedures"]
["DE","3 - DETECT ","DE.AE","Anomalies and Events",{"$error":"#N/A"},"DE.AE-2","Detected events are analyzed to understand attack targets and methods","A.16.1.1\nA.16.1.4","Responsibilities and procedures\nAssessment of and decision on information security events"]
["DE","3 - DETECT ","DE.AE","Anomalies and Events",{"$error":"#N/A"},"DE.AE-3","Event data are collected and correlated from multiple sources and sensors","N.A","No Direct ISO Mapping"]
["DE","3 - DETECT ","DE.AE","Anomalies and Events",{"$error":"#N/A"},"DE.AE-4","Impact of events is determined","A.16.1.4","Assessment of and decision on information security events"]
["DE","3 - DETECT ","DE.AE","Anomalies and Events",{"$error":"#N/A"},"DE.AE-5","Incident alert thresholds are established","N.A","No Direct ISO Mapping"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-1","The network is monitored to detect potential cybersecurity events","A.12.4.1","Event logging"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-2","The physical environment is monitored to detect potential cybersecurity events","A.11.1.2\nA.11.1.3","Physical entry controls\nSecuring offices, rooms and facilities"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-3","Personnel activity is monitored to detect potential cybersecurity events","A.12.4.1","Event logging"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-4","Malicious code is detected","A.12.2.1","Controls against malware"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-5","Unauthorized mobile code is detected","A.12.5.1","Installation of software on operational systems"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-6","External service provider activity is monitored to detect potential cybersecurity events","A.14.2.7 \nA.15.2.1","Outsourced development\nMonitoring and review of supplier services"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-7","Monitoring for unauthorized personnel, connections, devices, and software is performed","A.12.4.1","Event logging"]
["DE","3 - DETECT ","DE.CM","Security Continuous Monitoring",{"$error":"#N/A"},"DE.CM-8","Vulnerability scans are performed","A.12.6.1","Management of technical vulnerabilities"]
["DE","3 - DETECT ","DE.DP","Detection Processes",{"$error":"#N/A"},"DE.DP-1","Roles and responsibilities for detection are well defined to ensure accountability","A.06.1.1","Information security roles and responsibilities"]
["DE","3 - DETECT ","DE.DP","Detection Processes",{"$error":"#N/A"},"DE.DP-2","Detection activities comply with all applicable requirements","A.18.1.4","Privacy and protection of personally identifiable information"]
["DE","3 - DETECT ","DE.DP","Detection Processes",{"$error":"#N/A"},"DE.DP-3","Detection processes are tested","A.14.2.8","System security testing"]
["DE","3 - DETECT ","DE.DP","Detection Processes",{"$error":"#N/A"},"DE.DP-4","Event detection information is communicated to appropriate parties","A.16.1.2","Reporting information security events"]
["DE","3 - DETECT ","DE.DP","Detection Processes",{"$error":"#N/A"},"DE.DP-5","Detection processes are continuously improved","A.16.1.6","Learning from information security incidents"]
["RS","4 - RESPOND ","RS.RP","Response Planning","Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.","RS.RP-1","Response plan is executed during or after an incident","A.16.1.5","Response to information security incidents"]
["RS","4 - RESPOND ","RS.CO","Communications"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.CO-1","Personnel know their roles and order of operations when a response is needed","A.06.1.1 \nA.16.1.1 ","Information security roles and responsibilities\nResponsibilities and procedures"]
["RS","4 - RESPOND ","RS.CO","Communications"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.CO-2","Incidents are reported consistent with established criteria","A.06.1.3 \nA.16.1.2 ","Contact with authorities\nReporting information security events"]
["RS","4 - RESPOND ","RS.CO","Communications"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.CO-3","Information is shared consistent with response plans","A.16.1.2","Reporting information security events"]
["RS","4 - RESPOND ","RS.CO","Communications"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.CO-4","Coordination with stakeholders occurs consistent with response plans",7.4,"Communication"]
["RS","4 - RESPOND ","RS.CO","Communications"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.CO-5","Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness",7.4,"Communication"]
["RS","4 - RESPOND ","RS.AN","Analysis"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-1","Notifications from detection systems are investigated ","A.12.4.1\nA.12.4.3\nA.16.1.5","Event logging\nAdministrator and operator logs\nResponse to information security incidents"]
["RS","4 - RESPOND ","RS.AN","Analysis"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-2","The impact of the incident is understood","A.16.1.6","Learning from information security incidents"]
["RS","4 - RESPOND ","RS.AN","Analysis"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-3","Forensics are performed","A.16.1.7","Collection of evidence"]
["RS","4 - RESPOND ","RS.AN","Analysis"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-4","Incidents are categorized consistent with response plans","A.16.1.4","Assessment of and decision on information security events"]
["RS","4 - RESPOND ","RS.AN","Analysis"," Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-5","Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.\ninternal testing, security bulletins, or security researchers) ","N.A","No Direct ISO Mapping"]
["RS","4 - RESPOND ","RS.MI","Mitigation","Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.","RS.MI-1","Incidents are contained","A.16.1.5","Response to information security incidents"]
["RS","4 - RESPOND ","RS.MI","Mitigation","Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.","RS.MI-2","Incidents are mitigated","A.12.2.1\nA.16.1.5","Controls against malware\nResponse to information security incidents"]
["RS","4 - RESPOND ","RS.MI","Mitigation","Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.","RS.MI-3","Newly identified vulnerabilities are mitigated or documented as accepted risks","A.12.6.1","Management of technical vulnerabilities"]
["RS","4 - RESPOND ","RS.IM","Improvements","Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.","RS.IM-1","Response plans incorporate lessons learned","A.16.1.6","Learning from information security incidents"]
["RS","4 - RESPOND ","RS.IM","Improvements","Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.","RS.IM-2","Response strategies are updated",10.1,"Nonconformity and corrective action"]
["RC","5 - RECOVER ","RC.RP","Recovery Planning","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","RC.RP-1","Recovery plan is executed during or after cybersecurity incident","A.16.1.5","Response to information security incidents"]
["RC","5 - RECOVER ","RC.IM","Improvements","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","RC.IM-1","Recovery plans incorporate lessons learned",10.1,"Nonconformity and corrective action"]
["RC","5 - RECOVER ","RC.IM","Improvements","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","RC.IM-2","Recovery strategies are updated",10.1,"Nonconformity and corrective action"]
["RC","5 - RECOVER ","RC.CO","Communications","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","RC.CO-1","Public relations are managed","N.A","No Direct ISO Mapping"]
["RC","5 - RECOVER ","RC.CO","Communications","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","RC.CO-2","Reputation after an event is repaired","N.A","No Direct ISO Mapping"]
["RC","5 - RECOVER ","RC.CO","Communications","Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","RC.CO-3","Recovery activities are communicated to internal stakeholders and executive and management teams",7.4,"Communication"]
["N.A","N.A","No Direct NIST Function ID","N.A","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","No Direct NIST Subcategory ID",{"$error":"#N/A"},"N.A","No Direct ISO Mapping"]
["N.A - Audit","N.A - Audit","N.A - Audit","N.A - Audit","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","N.A - Audit",{"$error":"#N/A"},"N.A","No Direct ISO Mapping"]
["N.A - External Dependency Management","N.A - External Dependency Management","N.A - External Dependency Management","N.A - External Dependency Management","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","N.A - External Dependency Management",{"$error":"#N/A"},"N.A","No Direct ISO Mapping"]
["N.A - Governance","N.A - Governance","N.A - Governance","N.A - Governance","The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has in place the processes to identify, assess and manage supply chain risks.","N.A - Governance",{"$error":"#N/A"},"N.A","No Direct ISO Mapping"]

{"sheet":"Glossary Terms and Defs","index":15,"n_rows":26,"n_cols":13,"rows_kept":26,"cut":false,"hidden":false,"merged":[[3,0,3,11]]}
[]
["Proprietary"]
["This glossary defines selected terms used in the Profile.  It used references from financial services regulatory sources, international standards, NIST guidelines and additional sources. This glossary is not all-inclusive or exhaustive.  The goal is for the Profile terms to be aligned with international efforts to provide a comprehensive cyber lexicon for the financial services sector and will be updated accordingly."]
["The CRI Profile v1.2 - Glossary of Key Terms and Selected Definitions"]
[]
["Term","Definition Selected and\nRationale for Selection","1. FFIEC IT Examination Handbook","2. CPMI-IOSCO","3. NYDFS","4. FSB","5. ISO Guide 73","6.  NIST IR 7298","7. Institute of Risk Management","8. ISACA","9. DHS Risk Lexicon - 2010","10. RFC 4949","11. Other"]
["Critical Infrastructure","NIST IR Definition, but generalized for any nation beyond that of the US.  It would read:\n\nSystem and assets, whether physical or virtual, so vital to a nation that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.","The systems and assets, whether physical or virtual, that are so vital that the incapacity or destruction of such may have a debilitating impact.","N/A","N/A","N/A","N/A","System and assets, whether physical or virtual, so vital to the U.S. that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.\n[Critical Infrastructures Protection Act of 2001, 42 U.S.C. 5195c(e)]","N/A","Systems whose incapacity or destruction would have a debilitating effect on the economic security of an\nenterprise, community or nation.","Critical Infrastructure are the assets, systems, and networks, whether physical or virtual, so vital to the U.S. that their incapacitation or destruction would have a debilitating effect on security, national economic security, public health or safety, or any combination thereof.","Those systems that are so vital to a nation that their incapacity or destruction would have a debilitating effect on national security, the economy, or public health and safety."]
["Risk","The ISACA Definition\n\nRationale: It is the most accurate and concise and would serve as a better root definition to other \"risk\" based terms.","The potential that events, expected or unanticipated, may have an adverse effect on a financial institution's earnings, capital, or reputation.","N/A","N/A","N/A","Effect of uncertainty on objectives","The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals\nresulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring.","Risk can be defined as the combination of the probability of an event and its consequences ","The combination of the probability of an event and its consequence.","potential for an unwanted outcome resulting from an incident, event, or occurrence, as determined by its likelihood and the associated consequences.","1. An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result.\n\n2. The possibility of loss because of one or more threats to information (not to be confused with financial or business risk)."]
["Risk Assessment","The ISACA Definition\n\nRationale: It is not confined to just IT systems like other definitions; it takes a broader view of risk in terms of assessment.","A prioritization of potential business disruptions based on severity and likelihood of occurrence. The risk assessment includes an analysis of threats based on the impact to the institution, its customers, and financial markets, rather than the nature of the threat.","N/A","The risk assessment that each Covered Entity is required to conduct under section 500.09 (Risk Assessment) of this Part.","N/A","Overall process of risk identification, risk analysis and risk evaluation.","The process of identifying risks to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation, arising through the operation of an information system.","Overall process of risk identification, risk analysis and risk evaluation.","A process used to identify and evaluate risk and its potential effects.","Product or process which collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making.","N/A"]
["Risk Analysis","Risk Analysis = Risk Assessment\n\nPosition:  On the call, consensus was that the terms Risk Analysis and Risk Assessment are synonymous and one member read from a NIST document that stated the same.\n\nDefinition Selected: The ISACA definition for Risk Assessment, which is \"A process used to identify and evaluate risk and its potential effects.\"","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","An assessment process that systematically (a) identifies valuable system resources and threats to those resources, (b) quantifies loss exposures (i.e., loss potential) based on estimated frequencies and costs of occurrence, and (c) (optionally) recommends how to allocate available resources to countermeasures so as to minimize total exposure. ","The ISACA definition for Risk Assessment: \n\n\"A process used to identify and evaluate risk and its potential effects.\""]
["Risk Management","DHS Risk Lexicon selected, but modified to substitute out the term \"controlling\" for \"mitigating\" as it relates to managing risk.  It now reads: \n\nProcess of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring or mitigating it to an acceptable level.\n\nRationale - The DHS definition is the most concise in terms of what it means to manage risk.  The one issue is that in definition, it uses the term \"controlling\" when the more accurate term (and more used term) is \"mitigating.\"","The total process required to identify, control, and minimize the impact of uncertain events. The objective of a risk management program is to reduce risk and obtain and maintain appropriate management approval at predefined stages in the life cycle.","N/A","N/A","N/A","Coordinated activities to direct and control an organization with regard to risk.","N/A","N/A","Entails recognizing risk; assessing the impact and likelihood of that risk; and developing strategies, such as avoiding the risk, reducing the negative effect of the risk and/or transferring the risk, to manage it within the context of the enterprise’s risk appetite.","Process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken.","1. The process of identifying, measuring, and controlling (i.e., mitigating) risks in information systems so as to reduce the risks to a level commensurate with the value of the assets protected. \n\n2. The process of controlling uncertain events that may affect information system resources.\n\n3. The total process of identifying, controlling, and mitigating information system-related risks. It includes risk assessment; cost-benefit analysis; and the selection, implementation, test, and security evaluation of safeguards. This overall system security review considers both effectiveness and efficiency, including impact on the mission and constraints due to policy, regulations, and laws."]
["Risk Management Framework","NIST IR Definition\n\nRational:  It is the most concise definition as it applies to the enterprise space.","N/A","N/A","N/A","N/A","Set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organization.","A structured approach used to oversee and manage risk for an enterprise. ","N/A","N/A","N/A","N/A"]
["Risk Management Plan","Risk Management Plan = Risk Management Strategy\n\nPosition:  On the call, consensus was that the terms Risk Management Plan and Risk Management Strategy are synonymous given the language in the available definitions.\n\nDefinition Selected: DHS Lexicon definition of Risk Management Strategy","N/A","N/A","N/A","N/A","Scheme within the risk management framework specifying the approach, the management components and resources to be applied to the management of risk.","N/A","N/A","N/A","Document that identifies risks and specifies the actions that have been chosen to manage those risks.","N/A","DHS Risk Lexicon Definition for Risk Management Strategy:\n\nCourse of action or actions to be taken in order to manage risks."]
["Risk Management Policy","ISO Guide 73 Definition\n\nRationale:  It is the only one provided, and it appropriately concise","N/A","N/A","N/A","N/A","Statement of the overall intentions and direction of an organization related to risk management.","N/A","N/A","N/A","N/A","N/A"]
["Risk Management Process","ISO Guide 73 Definition\n\nRationale:  It is the only one provided, and it appropriately concise","N/A","N/A","N/A","N/A","systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context, and identifying, analyzing, evaluating, treating, monitoring and reviewing risk","N/A","N/A","N/A","N/A","N/A"]
["Risk Management Strategy","Risk Management Plan = Risk Management Strategy\n\nPosition:  On the call, consensus was that the terms Risk Management Plan and Risk Management Strategy are synonymous given the language in the available definitions.\n\nDefinition Selected: DHS Lexicon definition of Risk Management Strategy","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","Course of action or actions to be taken in order to manage risks.","N/A"]
["Risk Appetite","COSO Definition:\n\n\"A broadbased description of the desired level of risk that an entity will take in pursuit of its mission.\"\n\nRationale:  Other definitions were bypassed in favor of COSO's definition because participants felt that any definition selected could not conflate the two, but rather had to make the distinction of \"appetite\" is what you actively pursue and tolerance is what you can accept.  ","N/A","N/A","N/A","The aggregate level and types of risk a financial institution is willing to assume within its risk capacity to achieve its strategic objectives and business plan.","Amount and type of risk that an organization is willing to pursue or retain.","N/A","1. Loss potential and financial impact of risk.\n\n2. Probability and size of potential losses/gains.\n\n3. Objective(s) for control of the risk and desired level of performance.","N/A","N/A","N/A","COSO \"Strengthening Enterprise Risk Management for Strategic Advantage\":\n\nRisk appetite is a broadbased description of the desired level of risk that an entity will take in pursuit of its mission."]
["Risk Measurement","The FFIEC definition, but with modification.  The modifiction is striking the definition's last sentence and stopping the first sentence at \"potential impact.\"\n\nA process to determine the likelihood of an adverse event or threat occurring and the potential impact.\n\nRationale:  The reason for the shortening is because the last sentence in no way contains defining language, and with respect to the shortening of the first sentence, measurement may not always be at an enterprise level.","A process to determine the likelihood of an adverse event or threat occurring and the potential impact of such an event on the institution. The result of risk measurement leads to the prioritization of potential risks based on severity and likelihood of occurrence. ","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"]
["Risk Tolerance","COSO Definition:\n\n\"Reflects the acceptable variation in outcomes related to specific performance measures linked to objectives the entity seeks to achieve.\"\n\nRationale:  Other definitions were bypassed in favor of COSO's definition because participants felt that any definition selected could not conflate the two, but rather had to make the distinction of \"appetite\" is what you actively pursue and tolerance is what you can accept.","N/A","The amount and type of risk that an organisation is willing to take in order\nto meet its strategic objectives (may also be referred to as “risk appetite”).","N/A","N/A","Organization's or stakeholder's readiness to bear the risk after risk treatment in order to achieve its objectives.","1. The level of risk an entity is willing to assume in order to achieve a potential desired result. \n\n2. The defined impacts to an enterprise’s information systems that an entity is willing to accept.","N/A","The acceptable level of variation that management is willing to allow for any particular risk as the enterprise pursues its objectives.","Degree to which an entity, asset, system, network, or geographic area is willing to accept risk.","N/A","COSO \"Strengthening Enterprise Risk Management for Strategic Advantage\":\n\nRisk tolerance reflects the acceptable variation in outcomes related to specific performance measures linked to objectives the entity seeks to achieve."]
["Risk Acceptance","Combined language from the DHS Risk Lexicon and ISO 73-2009 Definitions:\n\nExplicit or implicit decision to take a particular risk.\n\nRationale: The DHS definition was potentially the most accurate, but caused pause due to its use of negative phrasing.  ISO's definition was also accurate, but its use of the term \"informed\" has certain connotations that indicate a certain level of formality and documentation that might be above and beyond a decision based on past non documented experiences.","N/A","N/A","N/A","N/A","N/A","N/A","N/A","If the risk is within the enterprise's risk tolerance or if the cost of otherwise mitigating the risk is higher than the potential loss, the enterprise can assume the risk and absorb any losses.","Explicit or implicit decision not to take an action that would affect all or part of a particular risk.","N/A","ISO/Guide 73:2009 - 3.7.1.6 - Risk acceptance:\n\nInformed decision to take a particular risk."]
["Acceptable Risk","Truncated RFC definition:\n\n\"Risk that is understood and tolerated by a user, operator, owner, or accreditor.\"\n\nRationale: The language following \"accreditor\" assumes a level of quantification that may not be available.","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","Risk that is understood and tolerated by a system's user, operator, owner, or accreditor, usually because the cost or difficulty of implementing an effective countermeasure for the associated vulnerability exceeds the expectation of loss."]
["Threat","Truncated Second NIST IR Definition for Threat:\n\n\"Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals.\"\n\nRationale:  With the removal of \"information systems\" language, the definition is expansive enough to account for all types of impactful circumstances or events.  With its inclusion, however, it reads more as a cyber threat (accordingly, that is why we have chosen that full definition as the definition for cyber threat).  Moreover, with its removal, the term and its definition could be more readily be modified with adjectives such as global, cyber, etc.","N/A","A circumstance or event that has or indicates the potential to exploit vulnerabilities and to adversely impact (create adverse consequences for) organisational operations, organisational assets (including information and information systems), individuals, other organisations or society in general.","N/A","N/A","N/A","1. Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.\n\n2. Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.","N/A","Anything (e.g., object, substance, human) that is capable of acting against an asset in a manner that can result in harm.","Natural or man-made occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property.","1. A potential for violation of security, which exists when there is an entity, circumstance, capability, action, or event that could cause harm.\n\n2. Any circumstance or event with the potential to adversely affect a system through unauthorized access, destruction, disclosure, or modification of data, or denial of service."]
["Cyber Threat","The Second NIST IR Definition for \"Threat\":\n\nAny circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.\n\nRationale:  Aligns with the threat definition selected, which is the truncated version of this definition (it was truncated to make it broader).","An internal or external circumstance, event, action, occurrence, or person with the potential to exploit technology-based vulnerabilities and to adversely impact (create adverse consequences for) organizational operations, organizational assets (including information and information systems), individuals, other organizations, or society.","A circumstance or event with the potential to intentionally or unintentionally exploit one or more vulnerabilities in an FMI’s systems, resulting in a loss of confidentiality, integrity or availability.","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","NIST IR 7298 - Second Definition for Threat:\n\n\n\n2. Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service."]
["Threat Assessment","Threat Assessment = Threat Analysis\n\nNIST 800-30, Rev. 1 (and CNSSI No. 4009) Definition of Threat Assessment:\n\nProcess of formally evaluating the degree of threat to an information system or enterprise and describing the nature of the threat.\n\nRationale:  Given that Risk Assessment and Risk Analysis are regarded as synonyms, following the same logic, so are threat assessment and threat analysis.","N/A","N/A","N/A","N/A","N/A","1. Formal description and evaluation of threat to an information system. \n\n2. Process of formally evaluating the degree of threat to an information system or enterprise and describing the nature of the threat. ","N/A","N/A","Product or process of identifying or evaluating entities, actions, or occurrences, whether natural or man-made, that have or indicate the potential to harm life, information, operations, and/or property.","N/A","NIST 800-30, Rev. 1 (and CNSSI No. 4009) Definition of Threat Assessment:\n\nProcess of formally evaluating the degree of threat to an information system or enterprise and describing the nature of the threat."]
["Threat Intelligence","Truncated CPMI-IOSCO Definition: \n\nInformation that provides relevant and sufficient understanding for mitigating the impact of a potentially harmful event.\n\nRationale:  It is the most concise and aligns with other selected definitions; the reason for removal of the parenthetical is because it in effect confuses two separate terms - \"Threat Intelligence,\" which encompasess a variety of threats (not just cyber) and more specific to contextualized information, and \"Cyber Threat Information,\" which is inclusive of a narrow threat category and non contextualized information.","The acquisition and analysis of information to identify, track, and predict cyber capabilities, intentions, and activities that offer courses of action to enhance decision-making. ","Information that provides relevant and sufficient understanding for mitigating the impact of a potentially harmful event (may also be referred to as “cyber threat information”).","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"]
["Threat Analysis","Threat Assessment = Threat Analysis\n\nNIST 800-30, Rev. 1 (and CNSSI No. 4009) Definition of Threat Assessment:\n\nProcess of formally evaluating the degree of threat to an information system or enterprise and describing the nature of the threat.\n\nRationale:  Given that Risk Assessment and Risk Analysis are regarded as synonyms, following the same logic, so are threat assessment and threat analysis.","N/A","N/A","N/A","N/A","N/A","N/A","N/A","An evaluation of the type, scope and nature of events or actions that can result in adverse consequences;\nidentification of the threats that exist against enterprise assets","N/A","An analysis of the threat actions that might affect a system, primarily emphasizing their probability of occurrence but also considering their resulting threat consequences.","NIST 800-30, Rev. 1 (and CNSSI No. 4009) Definition of Threat Assessment:\n\nProcess of formally evaluating the degree of threat to an information system or enterprise and describing the nature of the threat."]