NIST CSF 2.0

Requirements and controls

• GV Govern

  • GV.OC Organizational context

    • GV.OC-01 Mission informs risk management

      The organization's mission is understood and is the starting point for deciding which cybersecurity risks matter most.

      • Risk Framing
      • ISMS Manual

    • GV.OC-02 Stakeholder expectations understood

      Internal and external stakeholders are identified, and what they expect from the organization's cybersecurity risk management is understood and taken into account.

      • ISMS Manual
      • Assigned Security & Privacy Responsibilities
      • Contractual Obligations Register

    • GV.OC-03 Legal, regulatory and contractual requirements managed

      Cybersecurity obligations that come from laws, regulations and contracts, including privacy and civil liberties obligations, are identified, understood and managed.

      • Data Governance
      • Statutory, Regulatory & Contractual Compliance
      • Contractual Obligations Register

    • GV.OC-04 Services others depend on are understood

      The objectives, capabilities and services that customers and other external stakeholders rely on are identified and communicated.

      • Business Continuity Policy & Procedure
      • Impact Analysis
      • Contractual Obligations Register

    • GV.OC-05 Organizational dependencies are understood

      The services, capabilities and suppliers the organization itself depends on, such as cloud providers, are identified and communicated.

      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation
      • Shared Responsibility Model
      • Impact Analysis

  • GV.RM Risk management strategy

    • GV.RM-01 Risk management objectives agreed

      Objectives for cybersecurity risk management are set and agreed with the relevant stakeholders.

      • Risk Framing
      • Risk Assessment Policy & Procedure
      • Security & Privacy Program Review

    • GV.RM-02 Risk appetite and tolerance defined

      Statements of how much cybersecurity risk the organization is prepared to accept are written down, communicated and kept current.

      • Risk Framing
      • Risk Assessment Policy & Procedure
      • Management Review of Risks

    • GV.RM-03 Cybersecurity is part of enterprise risk management

      Cybersecurity risk management activities and their results feed into the organization's overall enterprise risk management.

      • Risk Framing
      • Risk Assessment
      • Management Review of Risks
      • Security & Privacy Program Review

    • GV.RM-04 Risk response direction set

      Leadership sets and communicates which ways of responding to risk, such as accepting, reducing, transferring or avoiding it, are appropriate.

      • Risk Assessment Policy & Procedure
      • Risk Framing
      • Risk Assessment

    • GV.RM-05 Risk communication channels established

      Clear channels exist across the organization for raising and discussing cybersecurity risks, including risks that come from suppliers and other third parties.

      • Assigned Security & Privacy Responsibilities
      • Management Review of Risks
      • Management Review of Third-Party Risks
      • Security & Privacy Program Review

    • GV.RM-06 Standard method for scoring risk

      One agreed method is used to calculate, document, categorize and prioritize cybersecurity risks, and it is communicated to the people who use it.

      • Risk Assessment Policy & Procedure
      • Risk Framing
      • Risk Assessment

    • GV.RM-07 Positive risks considered

      Strategic opportunities, sometimes called positive risks, are identified and included when cybersecurity risk is discussed.

      • Risk Framing
      • Management Review of Risks
      • Security & Privacy Program Review

  • GV.RR Roles, responsibilities and authorities

    • GV.RR-01 Leadership is accountable for cybersecurity risk

      Senior leadership owns cybersecurity risk and promotes a culture that is aware of risk, ethical and focused on continual improvement.

      • Security & Privacy Program Review
      • Assigned Security & Privacy Responsibilities
      • Security Governance Program
      • Code of Business Conduct

    • GV.RR-02 Cybersecurity roles defined and enforced

      Roles, responsibilities and authorities for cybersecurity risk management are assigned, communicated, understood and enforced.

      • Assigned Security & Privacy Responsibilities
      • Cybersecurity Responsibilities
      • Roles & Responsibilities
      • Organizational Structure
      • Compliance Program Manager

    • GV.RR-03 Adequate resources allocated

      Budget, people and tools are allocated in proportion to the cybersecurity risk strategy, roles, responsibilities and policies.

      • Security & Privacy Program Review
      • Management Review of Risks
      • ISMS Manual

    • GV.RR-04 Cybersecurity built into HR practices

      Human resources processes such as screening, onboarding, training, discipline and offboarding include cybersecurity.

      • Human Resources Policy & Procedure
      • Personnel Screening
      • New Hire Policy Acknowledgement
      • New Hire Security & Privacy Training
      • Termination of Employment
      • People Operations Owner

  • GV.PO Policy

    • GV.PO-01 Cybersecurity policy established

      A policy for managing cybersecurity risk is set according to the organization's context, strategy and priorities, and is communicated and enforced.

      • Security Governance Program
      • Information Security & Privacy Policies
      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement

    • GV.PO-02 Cybersecurity policy kept current

      The policy is reviewed and updated when requirements, threats, technology or the mission change, and the updates are communicated and enforced.

      • Management Review of Policies
      • Information Security & Privacy Policies
      • Periodic Policy Acknowledgement

  • GV.OV Oversight

    • GV.OV-01 Strategy outcomes reviewed

      The results of the cybersecurity risk management strategy are reviewed and used to adjust its direction.

      • Security & Privacy Program Review
      • Management Review of Risks
      • Internal Audit

    • GV.OV-02 Strategy coverage reviewed

      The strategy is reviewed and adjusted so that it keeps covering the organization's requirements and risks.

      • Security & Privacy Program Review
      • Management Review of Risks
      • Data Governance

    • GV.OV-03 Risk management performance evaluated

      How well cybersecurity risk management is performing across the organization is measured and reviewed to decide what needs to change.

      • Internal Audit
      • Security & Privacy Program Review
      • Management Review of Third-Party Risks

  • GV.SC Cybersecurity supply chain risk management

    • GV.SC-01 Supply chain risk program established

      A program with a strategy, objectives, policies and processes for managing cybersecurity risk in the supply chain is set up and agreed by stakeholders.

      • Vendor Management Policy & Procedure
      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks

    • GV.SC-02 Security roles of suppliers and partners defined

      The cybersecurity roles and responsibilities of suppliers, customers and partners are defined, communicated and coordinated inside and outside the organization.

      • Shared Responsibility Model
      • Vendor Management Policy & Procedure
      • Assigned Security & Privacy Responsibilities

    • GV.SC-03 Supply chain risk integrated into risk processes

      Supply chain risk management is part of the organization's cybersecurity and enterprise risk management, risk assessment and improvement processes.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Risk Assessment
      • Management Review of Risks

    • GV.SC-04 Suppliers known and ranked by criticality

      The organization knows its suppliers and ranks them by how critical they are to its operations.

      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation

    • GV.SC-05 Security requirements written into supplier agreements

      Requirements for handling supply chain cybersecurity risk are set, prioritized and included in contracts and other agreements with suppliers and relevant third parties.

      • Vendor Management Policy & Procedure
      • Processor Data Protection Agreements
      • Contractual Obligations Register

    • GV.SC-06 Due diligence before engaging suppliers

      Planning and due diligence reduce risk before the organization enters a formal relationship with a supplier or other third party.

      • Third-Party Criticality Assessments
      • Vendor Management Policy & Procedure
      • Subservice Organization Evaluation

    • GV.SC-07 Supplier risk managed throughout the relationship

      Risks from each supplier and its products and services are recorded, prioritized, assessed, responded to and monitored for as long as the relationship lasts.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Subservice Organization Evaluation

    • GV.SC-08 Suppliers included in incident activities

      Relevant suppliers and third parties take part in incident planning, response and recovery.

      • Incident Management Policy & Procedure
      • Vendor Management Policy & Procedure
      • Shared Responsibility Model

    • GV.SC-09 Supply chain security practices monitored

      Supply chain security practices are built into the cybersecurity and enterprise risk programs, and their performance is monitored across the life cycle of products and services.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Subservice Organization Evaluation
      • Vendor Management Policy & Procedure

    • GV.SC-10 Plans cover the end of supplier relationships

      Supply chain risk plans say what happens when a partnership or service agreement ends, such as removing access and returning or deleting data.

      • Vendor Management Policy & Procedure

• ID Identify

  • ID.AM Asset management

    • ID.AM-01 Hardware inventory maintained

      The organization keeps current inventories of the hardware it manages, such as staff devices and servers.

      • Inventory of Endpoint Assets
      • Inventory of Infrastructure Assets
      • Asset Inventory Updates

    • ID.AM-02 Software, service and system inventory maintained

      The organization keeps current inventories of the software, services and systems it manages.

      • Inventory of Infrastructure Assets
      • Asset Inventory Updates
      • Identity Validation

    • ID.AM-03 Network communication and data flows documented

      Up-to-date diagrams show the organization's authorized network connections and its internal and external data flows.

      • Network & Data Flow Diagrams

    • ID.AM-04 Supplier services inventory maintained

      The organization keeps a current inventory of the services its suppliers provide.

      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation

    • ID.AM-05 Assets prioritized

      Assets are prioritized according to their classification, criticality, resources and impact on the mission.

      • Data Classification Labels
      • Data Classification Policy
      • Impact Analysis

    • ID.AM-07 Data inventory maintained

      Inventories of designated types of data, such as personal or customer data, and their metadata are kept current.

      • Personal Data Inventory
      • Data Classification Labels

    • ID.AM-08 Assets managed across their life cycle

      Systems, hardware, software, services and data are managed from acquisition through maintenance to retirement and disposal.

      • Asset Inventory Updates
      • Media Disposal Policy
      • Data Retention Policy
      • Change Management Policy & Procedure
      • System Maintenance

  • ID.RA Risk assessment

    • ID.RA-01 Vulnerabilities identified and recorded

      Vulnerabilities in the organization's assets are found, confirmed and recorded.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation
      • Penetration Testing
      • Endpoint Security Validation

    • ID.RA-02 Threat intelligence received

      The organization receives cyber threat intelligence and security advisories from information-sharing forums and other sources.

      • Threat Intelligence & Security Advisories

    • ID.RA-03 Threats identified and recorded

      Internal and external threats to the organization are identified and recorded.

      • Risk Assessment
      • Fraud Risk Assessment
      • Threat Intelligence & Security Advisories

    • ID.RA-04 Impact and likelihood recorded

      For each threat that could exploit a vulnerability, the potential impact and likelihood are identified and recorded.

      • Risk Assessment
      • Risk Framing

    • ID.RA-05 Inherent risk understood and prioritized

      Threats, vulnerabilities, likelihoods and impacts are combined to understand inherent risk and decide which risk responses come first.

      • Risk Assessment
      • Risk Framing
      • Risk Assessment Policy & Procedure

    • ID.RA-06 Risk responses planned and tracked

      Risk responses are chosen, prioritized, planned, tracked to completion and communicated.

      • Risk Assessment
      • Management Review of Risks

    • ID.RA-07 Changes and exceptions assessed for risk

      Changes and exceptions are managed, assessed for their effect on risk, recorded and tracked.

      • Change Management Policy & Procedure
      • Approval of Changes
      • Risk Assessment

    • ID.RA-08 Vulnerability disclosures handled

      There is a process to receive, analyze and respond to vulnerabilities reported by researchers, customers and other outside parties.

      • Incident Reporting Assistance
      • Vulnerability Management Policy & Procedure
      • Centralized Flaw Remediation

    • ID.RA-09 Hardware and software integrity checked before use

      The authenticity and integrity of hardware and software are checked before they are acquired and put into use.

      • Acquisition Integrity Verification
      • Third-Party Criticality Assessments

    • ID.RA-10 Critical suppliers assessed before acquisition

      Critical suppliers are assessed before the organization buys from them.

      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation

  • ID.IM Improvement

    • ID.IM-01 Improvements from evaluations

      Improvements are identified from evaluations such as internal audits, assessments and management reviews.

      • Internal Audit
      • Security & Privacy Program Review

    • ID.IM-02 Improvements from tests and exercises

      Improvements are identified from security tests and exercises, including those run together with suppliers and other third parties.

      • Penetration Testing
      • Disaster Recovery Testing
      • Incident Response Exercises
      • Backup Restoration Testing

    • ID.IM-03 Improvements from day-to-day operations

      Improvements are identified from running operational processes, procedures and activities, including handling incidents.

      • Incident Management Policy & Procedure
      • Internal Audit
      • Security & Privacy Program Review

    • ID.IM-04 Incident response and operational plans maintained

      Incident response plans and other cybersecurity plans that affect operations are set up, communicated, maintained and improved.

      • Incident Management Policy & Procedure
      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure
      • Incident Response Exercises

• PR Protect

  • PR.AA Identity management, authentication and access control

    • PR.AA-01 Identities and credentials managed

      The organization manages the identities and credentials of authorized users, services and hardware.

      • Access Control Policy & Procedure
      • Identity Validation
      • Termination of Employment
      • User Access Reviews
      • Password Management Guidelines

    • PR.AA-02 Identities verified and bound to credentials

      People's identities are verified and tied to their credentials in a way that suits the context of the interaction.

      • Personnel Screening
      • Identity Validation
      • Access Control Policy & Procedure

    • PR.AA-03 Users, services and hardware authenticated

      Users, services and devices are authenticated before they are given access.

      • Multi-Factor Authentication
      • Password Management Guidelines
      • Production Database Access Restriction
      • Access Control Policy & Procedure

    • PR.AA-04 Identity assertions protected

      Identity assertions, such as single sign-on tokens, are protected while they are passed between systems and are verified before they are trusted.

      • Multi-Factor Authentication
      • Transmission Confidentiality
      • Access Control Policy & Procedure

    • PR.AA-05 Least privilege and separation of duties enforced

      Access permissions are defined in policy, granted, enforced and reviewed according to least privilege and separation of duties.

      • Access Control Policy & Procedure
      • Identity Validation
      • User Privilege Reviews
      • User Access Reviews
      • Segregation of Duties
      • Production System Access Review

    • PR.AA-06 Physical access managed

      Physical access to assets is managed, monitored and enforced in proportion to risk.

      • Physical Access Management
      • Physical Protection Policy & Procedure
      • Shared Responsibility Model

  • PR.AT Awareness and training

    • PR.AT-01 Staff awareness and training

      Everyone in the organization receives awareness and training so they can do their everyday work with cybersecurity risks in mind.

      • Security & Privacy Awareness
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • PR.AT-02 Training for specialized roles

      People in specialized roles, such as engineers, administrators and security staff, receive training for the security side of their work.

      • Periodic Security & Privacy Training
      • Security & Privacy Awareness
      • Cybersecurity Responsibilities

  • PR.DS Data security

    • PR.DS-01 Data at rest protected

      The confidentiality, integrity and availability of stored data are protected.

      • Encryption of Data at Rest
      • Full Device Encryption
      • Endpoint Encryption
      • Production Database Access Restriction
      • Encryption Policy & Procedure

    • PR.DS-02 Data in transit protected

      The confidentiality, integrity and availability of data moving across networks are protected.

      • Transmission Confidentiality
      • Encryption Policy & Procedure
      • Network Security Policy & Procedure

    • PR.DS-10 Data in use protected

      The confidentiality, integrity and availability of data are protected while it is being processed.

      • Identity Validation
      • Production Database Access Restriction
      • Session Lock
      • Test Data Protection

    • PR.DS-11 Backups created, protected and tested

      Data backups are created, protected, kept for the required time and tested.

      • Data Backup Policy
      • Data Backups
      • Backup Restoration Testing

  • PR.PS Platform security

    • PR.PS-01 Configuration management applied

      Configuration management practices, such as hardened baselines and controlled changes, are defined and applied.

      • Secure Configuration Baselines
      • Change Management Policy & Procedure
      • Secure System Modification
      • Endpoint Security Validation

    • PR.PS-02 Software maintained and retired

      Software is patched, replaced and removed in proportion to the risk it poses.

      • Endpoint Security Validation
      • Vulnerability Remediation Process
      • Centralized Flaw Remediation

    • PR.PS-03 Hardware maintained and retired

      Hardware is maintained, replaced and removed in proportion to the risk it poses.

      • System Maintenance
      • Inventory of Endpoint Assets
      • Media Disposal Policy

    • PR.PS-04 Logs generated for monitoring

      Systems generate log records and make them available for continuous monitoring.

      • Centralized Security Logging
      • Clock Synchronization
      • Anomalous Behavior Detection

    • PR.PS-05 Unauthorized software prevented

      The installation and execution of software that has not been authorized is prevented.

      • Least Functionality & Software Restrictions
      • Rules of Behavior
      • Malware Protection

    • PR.PS-06 Secure software development

      Secure development practices are built into the software development life cycle and their performance is monitored.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes
      • Regression Testing
      • Vulnerability Remediation Process

  • PR.IR Technology infrastructure resilience

    • PR.IR-01 Networks protected from unauthorized access

      Networks and environments are protected from unauthorized logical access and use.

      • External System Connections
      • Limit Network Connections
      • Network Security Policy & Procedure
      • Remote & Wireless Access

    • PR.IR-02 Assets protected from environmental threats

      Technology assets are protected from environmental threats such as fire, flooding and loss of power.

      • Physical Protection Policy & Procedure
      • Shared Responsibility Model
      • Disaster Recovery Policy

    • PR.IR-03 Resilience mechanisms in place

      Mechanisms such as redundancy and failover meet the organization's resilience requirements in normal and adverse conditions.

      • Data Backups
      • Business Continuity Policy & Procedure
      • Disaster Recovery Policy
      • Disaster Recovery Testing

    • PR.IR-04 Enough capacity for availability

      Enough resource capacity is maintained to keep systems available.

      • Capacity & Performance Management
      • Impact Analysis

• DE Detect

  • DE.CM Continuous monitoring

    • DE.CM-01 Networks monitored

      Networks and network services are monitored to find potentially adverse events.

      • Anomalous Behavior Detection
      • External System Connections
      • Centralized Security Logging

    • DE.CM-02 Physical environment monitored

      The physical environment is monitored to find potentially adverse events.

      • Physical Access Management
      • Physical Protection Policy & Procedure
      • Shared Responsibility Model

    • DE.CM-03 Personnel activity monitored

      Personnel activity and the use of technology are monitored to find potentially adverse events.

      • Unauthorized Activity Monitoring
      • Centralized Security Logging
      • Anomalous Behavior Detection

    • DE.CM-06 Service provider activity monitored

      The activities and services of external service providers are monitored to find potentially adverse events.

      • Subservice Organization Evaluation
      • Management Review of Third-Party Risks
      • Centralized Security Logging

    • DE.CM-09 Computing environments monitored

      Hardware, software, runtime environments and their data are monitored to find potentially adverse events.

      • Anomalous Behavior Detection
      • Malware Protection
      • Endpoint Security Validation
      • Centralized Security Logging
      • Capacity & Performance Management

  • DE.AE Adverse event analysis

    • DE.AE-02 Adverse events analyzed

      Potentially adverse events are analyzed to understand what activity lies behind them.

      • Incident Tracking
      • Anomalous Behavior Detection
      • Incident Management Policy & Procedure

    • DE.AE-03 Information correlated across sources

      Information from several sources, such as logs and alerts, is correlated during analysis.

      • Centralized Security Logging
      • Anomalous Behavior Detection

    • DE.AE-04 Impact and scope estimated

      The likely impact and scope of adverse events are worked out.

      • Incident Management Policy & Procedure
      • Incident Tracking

    • DE.AE-06 Event information shared with responders

      Information on adverse events reaches authorized staff and tools that need it.

      • Automated Incident Reporting
      • Centralized Security Logging
      • Incident Management Policy & Procedure

    • DE.AE-07 Threat intelligence used in analysis

      Cyber threat intelligence and other context are used when analyzing events.

      • Threat Intelligence & Security Advisories
      • Anomalous Behavior Detection

    • DE.AE-08 Incidents declared against criteria

      An incident is declared when adverse events meet the organization's defined incident criteria.

      • Incident Management Policy & Procedure
      • Incident Tracking

• RS Respond

  • RS.MA Incident management

    • RS.MA-01 Incident response plan executed

      Once an incident is declared, the incident response plan is carried out in coordination with relevant third parties.

      • Incident Management Policy & Procedure
      • Incident Tracking

    • RS.MA-02 Incident reports triaged

      Incident reports are triaged and checked to confirm whether they are genuine.

      • Automated Incident Reporting
      • Incident Tracking
      • Incident Management Policy & Procedure

    • RS.MA-03 Incidents categorized and prioritized

      Incidents are categorized and prioritized.

      • Incident Management Policy & Procedure
      • Incident Tracking

    • RS.MA-04 Incidents escalated as needed

      Incidents are escalated or elevated to the right people when needed.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Automated Incident Reporting

    • RS.MA-05 Recovery start criteria applied

      Defined criteria are used to decide when to start incident recovery.

      • Incident Management Policy & Procedure
      • Disaster Recovery Policy

  • RS.AN Incident analysis

    • RS.AN-03 Root cause analyzed

      Analysis establishes what happened during an incident and what caused it.

      • Incident Management Policy & Procedure
      • Incident Tracking

    • RS.AN-06 Investigation actions recorded

      Actions taken during an investigation are recorded, and the integrity and origin of those records are preserved.

      • Incident Tracking
      • Centralized Security Logging

    • RS.AN-07 Incident data preserved

      Incident data and metadata are collected, and their integrity and origin are preserved.

      • Centralized Security Logging
      • Incident Tracking
      • Incident Management Policy & Procedure

    • RS.AN-08 Incident magnitude estimated

      The size of an incident, such as the systems and records affected, is estimated and confirmed.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Breach Risk Assessment & Notification

  • RS.CO Incident response reporting and communication

    • RS.CO-02 Stakeholders notified of incidents

      Internal and external stakeholders are notified of incidents as laws, regulations, contracts and policies require.

      • Incident Management Policy & Procedure
      • Data Breach Notification Policy
      • Breach Risk Assessment & Notification

    • RS.CO-03 Incident information shared

      Information about incidents is shared with designated internal and external stakeholders.

      • Incident Management Policy & Procedure
      • Breach Risk Assessment & Notification

  • RS.MI Incident mitigation

    • RS.MI-01 Incidents contained

      Incidents are contained to stop them from spreading.

      • Incident Management Policy & Procedure
      • Incident Tracking

    • RS.MI-02 Incidents eradicated

      The cause of an incident is removed from the affected systems.

      • Incident Management Policy & Procedure
      • Incident Tracking

• RC Recover

  • RC.RP Incident recovery plan execution

    • RC.RP-01 Recovery plan executed

      The recovery part of the incident response plan is carried out once the incident response process starts it.

      • Disaster Recovery Policy
      • Incident Management Policy & Procedure

    • RC.RP-02 Recovery actions chosen and performed

      Recovery actions are selected, scoped, prioritized and carried out.

      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure

    • RC.RP-03 Backups verified before restoring

      The integrity of backups and other restoration sources is checked before they are used.

      • Backup Restoration Testing
      • Data Backups

    • RC.RP-04 Post-incident operating norms set

      Critical business functions and cybersecurity risk are considered when deciding how operations should run after an incident.

      • Business Continuity Policy & Procedure
      • Disaster Recovery Policy

    • RC.RP-05 Restored systems verified

      Restored assets are checked for integrity, systems and services are brought back, and normal operation is confirmed.

      • Disaster Recovery Policy
      • Disaster Recovery Testing

    • RC.RP-06 End of recovery declared

      The end of recovery is declared against defined criteria, and the incident documentation is completed.

      • Incident Management Policy & Procedure
      • Incident Tracking

  • RC.CO Incident recovery communication

    • RC.CO-03 Recovery progress communicated

      Recovery activities and progress are communicated to designated internal and external stakeholders.

      • Incident Management Policy & Procedure
      • Disaster Recovery Policy

    • RC.CO-04 Public recovery updates shared

      Public updates about recovery are shared using approved channels and messages.

      • Incident Management Policy & Procedure
      • Data Breach Notification Policy