| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | AA | AB | AC | AD | AE | AF | AG | AH | AI | AJ | AK | AL | AM | AN | AO | AP | AQ | AR | AS | AT | AU | AV | AW | AX | AY | AZ | BA | BB | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | CLOUD CONTROLS MATRIX VERSION 3.0.1 | |||||||||||||||||||||||||||||||||||||||||||||||||||||
2 | Control Domain | CCM V3.0 Control ID | Updated Control Specification | Architectural Relevance | Corp Gov Relevance | Cloud Service Delivery Model Applicability | Supplier Relationship | Scope Applicability | ||||||||||||||||||||||||||||||||||||||||||||||
3 | Phys | Network | Compute | Storage | App | Data | SaaS | PaaS | IaaS | Service Provider | Tenant / Consumer | AICPA 2009 TSC Map | AICPA Trust Service Criteria (SOC 2SM Report) | AICPA 2014 TSC | BITS Shared Assessments AUP v5.0 | BITS Shared Assessments SIG v6.0 | BSI Germany | Canada PIPEDA | CCM V1.X | COBIT 4.1 | COBIT 5.0 | COPPA | CSA Enterprise Architecture (formerly Trusted Cloud Initiative) | CSA Guidance V3.0 | ENISA IAF | 95/46/EC - European Union Data Protection Directive | FedRAMP Security Controls (Final Release, Jan 2012) --LOW IMPACT LEVEL-- | FedRAMP Security Controls (Final Release, Jan 2012) --MODERATE IMPACT LEVEL-- | FERPA | GAPP (Aug 2009) | HIPAA / HITECH Act | ISO/IEC 27001:2005 | ISO/IEC 27001:2013 | ISO/IEC 27002:2013 | ISO/IEC 27017:2015 | ISO/IEC 270018:2015 | ITAR | Jericho Forum | Mexico - Federal Law on Protection of Personal Data Held by Private Parties | NERC CIP | NIST SP800-53 R3 | NIST SP800-53 R4 App J | NZISM | ODCA UM: PA R2.0 | PCI DSS v2.0 | PCI DSS v3.0 | ||||||||
4 | Domain > Container > Capability | Public | Private | PA ID | PA level | |||||||||||||||||||||||||||||||||||||||||||||||||
5 | Application & Interface Security Application Security | AIS-01 | Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations. | X | X | X | X | X | X | X | X | S3.10.0 S3.10.0 | (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access. (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies. | CC7.1 | I.4 | G.16.3, I.3 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-04 | AI2.4 | APO09.03 APO13.01 BAI03.01 BAI03.02 BAI03.03 BAI03.05 MEA03.01 MEA03.02 | 312.8 and 312.10 | Application Services > Development Process > Software Quality Assurance | shared | x | Domain 10 | 6.03.01. (c) | Article: 27 (3) | NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-14 | NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SC-2 NIST SP 800-53 R3 SC-4 NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18) NIST SP 800-53 R3 SC-8 NIST SP 800-53 R3 SC-8 (1) NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1) NIST SP 800-53 R3 SC-10 NIST SP 800-53 R3 SC-11 NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-12 (2) NIST SP 800-53 R3 SC-12 (5) NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-13 (1) NIST SP 800-53 R3 SC-14 NIST SP 800-53 R3 SC-17 NIST SP 800-53 R3 SC-18 | 1.2.6 | 45 CFR 164.312(e)(2)(i) | A.11.5.6 A.11.6.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.5.2 A.12.5.4 A.12.5.5 A.12.6.1 A.15.2.1 | A9.4.2 A9.4.1, 8.1*Partial, A14.2.3, 8.1*partial, A.14.2.7 A12.6.1, A18.2.2 | 9.4.2 9.4.1 12.6.1 14.2.1 14.2.3 14.2.7 18.2.2 | 9.4.1 12.6.1 14.2.1 | Commandment #1 Commandment #2 Commandment #4 Commandment #5 Commandment #11 | CIP-007-3 - R5.1 | SC-2 SC-3 SC-4 SC-5 SC-6 SC-7 SC-8 SC-9 SC-10 SC-11 SC-12 SC-13 SC-14 SC-17 SC-18 SC-20 SC-21 SC-22 SC-23 | AR-7 The organization designs information systems to support privacy by automating privacy controls. | 14.5 14.6 | PA17 PA31 | SGP BSGP | 6.5 | 6, 6.5 | ||||||||||
6 | Application & Interface Security Customer Access Requirements | AIS-02 | Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed. | X | X | X | X | X | X | X | X | X | X | X | X | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | C.2.1, C.2.3, C.2.4, C.2.6.1, H.1 | 10 (B) 11 (A+) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 | SA-01 | APO09.01 APO09.02 APO09.03 APO13.01 BAI02 DSS05 | 312.3, 312.8 and 312.10 | BOSS > Legal Services > Contracts | shared | x | Domain 10 | Article 17 (1), (2) | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-5 NIST SP 800-53 R3 CA-6 | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-5 NIST SP 800-53 R3 CA-6 | 1.2.2 1.2.6 6.2.1 6.2.2 | A.6.2.1 A.6.2.2 A.11.1.1 | A9.1.1. | 9.1.1 | Commandment #6 Commandment #7 Commandment #8 | CA-1 CA-2 CA-5 CA-6 | AP-1 The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need. | 9.2 | 4.1.1, 4.2, 4.3 | ||||||||||||||
7 | Application & Interface Security Data Integrity | AIS-03 | Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse. | X | X | X | X | X | X | X | X | X | X | I3.2.0 I3.3.0 I3.4.0 I3.5.0 | (I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies. (I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies. (I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies. (I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa. | PI1.2 PI1.3 PI1.5 | I.4 | G.16.3, I.3 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-05 | DSS06.02 DSS06.04 | 312.8 and 312.10 | Application Services > Programming Interfaces > Input Validation | shared | x | Domain 10 | NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-3 | NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-2 (2) NIST SP 800-53 R3 SI-3 NIST SP 800-53 R3 SI-3 (1) NIST SP 800-53 R3 SI-3 (2) NIST SP 800-53 R3 SI-3 (3) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 SI-6 NIST SP 800-53 R3 SI-7 NIST SP 800-53 R3 SI-7 (1) NIST SP 800-53 R3 SI-9 NIST SP 800-53 R3 SI-10 NIST SP 800-53 R3 SI-11 | 1.2.6 | 45 CFR 164.312 (c)(1) 45 CFR 164.312 (c)(2) 45 CFR 164.312(e)(2)(i) | A.10.9.2 A.10.9.3 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.6.1 A.15.2.1 | A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4 | 9.1.1 9.4.1 10.1.1 13.2.1 13.2.2 18.1.4 | 9.4.1 10.1.1 | Commandment #1 Commandment #9 Commandment #11 | CIP-003-3 - R4.2 | SI-10 SI-11 SI-2 SI-3 SI-4 SI-6 SI-7 SI-9 | AR-7 The organization designs information systems to support privacy by automating privacy controls. | 14.5 14.6 | PA25 | GP | 6.3.1 6.3.2 | 6.3.1 6.3.2 | |||||||||||
8 | Application & Interface Security Data Security / Integrity | AIS-04 | Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity, and availability) across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alteration, or destruction. | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | B.1 | G.8.2.0.2, G.8.2.0.3, G.12.1, G.12.4, G.12.9, G.12.10, G.16.2, G.19.2.1, G.19.3.2, G.9.4, G.17.2, G.17.3, G.17.4, G.20.1 | 6 (B) 26 (A+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-03 | DS5.11 | APO09.01 APO09.02 APO09.03 APO13.01 DSS05.02 DSS06.06 MEA03.01 MEA03.02 | 312.8 and 312.10 | BOSS > Data Governance > Rules for Information Leakage Prevention | shared | x | Domain 10 | 6.02. (b) 6.04.03. (a) | Article 17 (1), (2),(3), (4) | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-13 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-8 | 1.1.0 1.2.2 1.2.6 4.2.3 5.2.1 7.1.2 7.2.1 7.2.2 7.2.3 7.2.4 8.2.1 8.2.2 8.2.3 8.2.5 9.2.1 | A.10.8.1 A.10.8.2 A.11.1.1 A.11.6.1 A.11.4.6 A.12.3.1 A.12.5.4 A.15.1.4 | A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4 | 9.1.1 9.4.1 10.1.1 13.2.1 13.2.2 18.1.4 | 9.4.1 10.1.1 | All | AC-1 AC-4 SC-1 SC-16 | AR-7 The organization designs information systems to support privacy by automating privacy controls. | 16.5 16.8 17.4 | PA20 PA25 PA29 | GP P SGP | 2.3 3.4.1 4.1 4.1.1 6.1 6.3.2a 6.5c 8.3 10.5.5 11.5 | 2.3 3.4.1 4.1 4.1.1 6.1 6.3.2a 6.5c, 7.1, 7.2, 7.3, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8 10.5.5, 10.8 11.5, 11.6 | |||||||||
9 | Audit Assurance & Compliance Audit Planning | AAC-01 | Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits. | X | X | X | X | X | X | X | X | X | X | X | S4.1.0 S4.2.0 | (S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies. (S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. | CC4.1 | L.1, L.2, L.7, L.9, L.11 | 58 (B) | CO-01 | ME 2.1 ME 2.2 PO 9.5 PO 9.6 | APO12.04 APO12.05 APO12.06 MEA02.01 MEA02.02 | Title 16 Part 312 | BOSS > Compliance > Audit Planning | shared | x | Domain 2, 4 | 6.01. (d) | NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-7 | NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CA-7 (2) NIST SP 800-53 R3 PL-6 | 10.2.5 | 45 CFR 164.312(b) | Clause 4.2.3 e) Clause 4.2.3b Clause 5.1 g Clause 6 A.15.3.1 | Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 6.2(e), 9.1, 9.1(e), 9.2, 9.3(f), A12.7.1 | 12.7.1 | Commandment #1 Commandment #2 Commandment #3 | CA-2 CA-7 PL-6 | AR-4 Privacy Auditing and Monitoring. To promote accountability, organizations identify and address gaps in privacy compliance, management, operational, and technical controls by conducting regular assessments (e.g., internal risk assessments). Audit for effective implementation of all privacy controls identified in this appendix, organizations assess whether they: (i) implement a process to embed privacy considerations into the life cycle of personally identifiable information (PII), programs, information systems, mission/business processes, and technology; (ii) monitor for changes to applicable privacy laws, regulations, and policies; (iii) track programs, information systems, and applications that collect and maintain PII to ensure compliance; (iv) ensure that access to PII is only on a need-to-know basis; and (v) ensure that PII is being maintained and used only for the legally authorized purposes identified in the public notice(s). | 5.1, 5.3, 5.4 | PA15 | SGP | 2.1.2.b | ||||||||||||
10 | Audit Assurance & Compliance Independent Audits | AAC-02 | Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations. | X | X | X | X | X | X | X | X | X | X | X | X | S4.1.0 S4.2.0 | (S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies. (S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. | CC4.1 | L.2, L.4, L.7, L.9, L.11 | 58 (B) 59 (B) 61 (C+, A+) 76 (B) 77 (B) | CO-02 | DS5.5 ME2.5 ME 3.1 PO 9.6 | APO12.04 APO12.05 DSS05.07 MEA02.06 MEA02.07 MEA02.08 MEA03.01 | Title 16 Part 312 | BOSS > Compliance > Independent Audits | shared | x | Domain 2, 4 | 6.03. (e) 6.07.01. (m) 6.07.01. (n) | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 RA-5 | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 RA-5 NIST SP 800-53 R3 RA-5 (1) NIST SP 800-53 R3 RA-5 (2) NIST SP 800-53 R3 RA-5 (3) NIST SP 800-53 R3 RA-5 (6) NIST SP 800-53 R3 RA-5 (9) | 1.2.5 1.2.7 4.2.1 8.2.7 10.2.3 10.2.5 | 45 CFR 164.308 (a)(8) 45 CFR 164.308(a)(1)(ii)(D) | Clause 4.2.3e Clause 5.1 g Clause 5.2.1 d) Clause 6 A.6.1.8 | Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 9.1, 9.2, 9.3(f), A18.2.1 | 18.2.1 | Commandment #1 Commandment #2 Commandment #3 | Chapter VI, Section 1 Article 39, I. and VIII. Chapter 8 Article 59 | CIP-003-3 - R1.3 - R4.3 CIP-004-3 R4 - R4.2 CIP-005-3a - R1 - R1.1 - R1.2 | CA-1 CA-2 CA-6 RA-5 | AR-4. Privacy Auditing and Monitoring. These assessments can be self-assessments or third-party audits that result in reports on compliance gaps identified in programs, projects, and information systems. | 6.1 | PA18 | GP | 11.2 11.3 6.6 12.1.2.b | 11.2 11.3 6.3.2, 6.6 11.2.1, 11.2.2, 11.2.3, 11.3.1, 11.3.2, 12.1.2.b, 12.8.4 | ||||||||
11 | Audit Assurance & Compliance Information System Regulatory Mapping | AAC-03 | Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected. | X | X | X | X | X | X | X | X | X | X | X | X | S3.1.0 x3.1.0 | (S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operations that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats. | CC3.1 | L.1, L.2, L.4, L.7, L.9 | 76 (B) 77 (B) 78 (B) 83 (B) 84 (B) 85 (B) | Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3 | CO-05 | ME 3.1 | APO12.01 APO12.02 APO12.03 MEA03.01 | 312.4 | BOSS > Compliance > Information System Regulatory Mapping | shared | x | Domain 2, 4 | 6.10. (a) 6.10. (b) 6.10. (c) 6.10. (d) 6.10. (e) 6.10. (f) 6.10. (g) 6.10. (h) 6.10. (i) | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-7 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-7 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-13 (1) NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SI-1 | 1.2.2 1.2.4 1.2.6 1.2.11 3.2.4 5.2.1 | ISO/IEC 27001:2005 Clause 4.2.1 b) 2) Clause 4.2.1 c) 1) Clause 4.2.1 g) Clause 4.2.3 d) 6) Clause 4.3.3 Clause 5.2.1 a - f Clause 7.3 c) 4) A.7.2.1 A.15.1.1 A.15.1.3 A.15.1.4 A.15.1.6 | Clauses 4.2(b), 4.4, 5.2(c), 5.3(ab), 6.1.2, 6.1.3, 6.1.3(b), 7.5.3(b), 7.5.3(d), 8.1, 8.3 9.2(g), 9.3, 9.3(b), 9.3(f), 10.2, A.8.2.1, A.18.1.1, A.18.1.3, A.18.1.4, A.18.1.5 | 8.2.1 18.1.1 18.1.3 18.1.4 18.1.5 | 18.1.1 18.1.3 18.1.5 | Commandment #1 Commandment #2 Commandment #3 | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IA-7 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 RA-1 RA-2 SA-1 SA-6 SC-1 SC-13 SI-1 | 1.2 2.2 3.3 5.2 | 3.1.1 3.1 | 3.1 | ||||||||||||
12 | Business Continuity Management & Operational Resilience Business Continuity Planning | BCR-01 | A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: • Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval • Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information • Method for plan invocation | X | X | X | X | X | X | X | X | X | X | X | X | A3.1.0 A3.3.0 A3.4.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats. (A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. (A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. | CC3.1 A1.2 A1.3 | K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6, K.1.2.7, K.1.2.11, K.1.2.13, K.1.2.15 | RS-03 | DSS04.01 DSS04.02 DSS04.03 DSS04.05 | BOSS > Operational Risk Management > Business Continuity | provider | x | Domain 7, 8 | 6.07. (a) 6.07. (b) 6.07. (c) | Article 17 (1), (2) | NIST SP800-53 R3 CP-1 NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4 NIST SP800-53 R3 CP-9 NIST SP800-53 R3 CP-10 | NIST SP800-53 R3 CP-1 NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-2 (1) NIST SP800-53 R3 CP-2 (2) NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4 NIST SP800-53 R3 CP-4 (1) NIST SP800-53 R3 CP-6 NIST SP800-53 R3 CP-6 (1) NIST SP800-53 R3 CP-6 (3) NIST SP800-53 R3 CP-7 NIST SP800-53 R3 CP-7 (1) NIST SP800-53 R3 CP-7 (2) NIST SP800-53 R3 CP-7 (3) NIST SP800-53 R3 CP-7 (5) NIST SP800-53 R3 CP-8 NIST SP800-53 R3 CP-8 (1) NIST SP800-53 R3 CP-8 (2) NIST SP800-53 R3 CP-9 NIST SP800-53 R3 CP-9 (1) NIST SP800-53 R3 CP-9 (3) NIST SP800-53 R3 CP-10 NIST SP800-53 R3 CP-10 (2) NIST SP800-53 R3 CP-10 (3) NIST SP800-53 R3 PE-17 | 45 CFR 164.308 (a)(7)(i) 45 CFR 164.308 (a)(7)(ii)(B) 45 CFR 164.308 (a)(7)(ii)(C) 45 CFR 164.308 (a)(7)(ii)(E) 45 CFR 164.310 (a)(2)(i) 45 CFR 164.312 (a)(2)(ii) | Clause 5.1 A.6.1.2 A.14.1.3 A.14.1.4 | Clause 5.1(h) A.17.1.2 A.17.1.2 | 17.1.2 | CLD12.1.5 | Commandment #1 Commandment #2 Commandment #3 | CP-1 CP-2 CP-3 CP-4 CP-6 CP-7 CP-8 CP-9 CP-10 PE-17 | UL-2 INFORMATION SHARING WITH THIRD PARTIES - a. Shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes; b. Where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used; c. Monitors, audits, and trains its staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII; and d. Evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required. | 6.4 | 12.9.1 12.9.3 12.9.4 12.9.6 | 12.9.1 12.9.3 12.9.4 12.9.6 | ||||||||||||||
13 | Business Continuity Management & Operational Resilience Business Continuity Testing | BCR-02 | Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies. | X | X | X | X | X | X | X | X | X | X | X | X | A3.3 | (A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. | A1.2 | K.1.3, K.1.4.3, K.1.4.6, K.1.4.7, K.1.4.8, K.1.4.9, K.1.4.10, K.1.4.11, K.1.4.12 | 52 (B) 55 (A+) | RS-04 | DSS04.04 | BOSS > Operational Risk Management > Business Continuity | provider | x | Domain 7, 8 | 6.07.01. (b) 6.07.01. (j) 6.07.01. (l) | NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4 | NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-2 (1) NIST SP800-53 R3 CP-2 (2) NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4 NIST SP800-53 R3 CP-4 (1) | 45 CFR 164.308 (a)(7)(ii)(D) | A.14.1.5 | A17.3.1 | 17.3.1 | Commandment #1 Commandment #2 Commandment #3 | CP-2 CP-3 CP-4 | 4.4 5.2(time limit) 6.3(whenever change occurs) | PA15 | SGP | 12.9.2 | 12.9.2, 12.10.2 | ||||||||||||||
14 | Business Continuity Management & Operational Resilience Datacenter Utilities / Environmental Conditions | BCR-03 | Data center utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions. | X | X | X | X | X | X | A3.2.0 A3.4.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. (A3.4.0) Procedures exist to protect against unauthorized access to system resource. | A1.1 A1.2 A1.3 | F.1 | F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.12 | 9 (B) 10 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-08 | DSS01.03 DSS01.04 DSS01.05 DSS04.03 | 312.8 and 312.10 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.08. (a) 6.09. (c) 6.09. (f) 6.09. (g) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3) | NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-4 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3) | A.9.2.2 A.9.2.3 | A11.2.2, A11.2.3 | 11.2.2 11.2.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #4 Commandment #9 Commandment #11 | PE-1 PE-4 PE-13 | 10.1 10.2 10.3 10.4 10.5 10.6 | PA15 | SGP | 4.1, 4.1.1, 9.1, 9.2 | ||||||||||||||||||
15 | Business Continuity Management & Operational Resilience Documentation | BCR-04 | Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following: • Configuring, installing, and operating the information system • Effectively using the system’s security features | X | X | X | X | X | X | X | X | X | X | S3.11.0 A.2.1.0 | (S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities. (A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users. | CC1.3 CC1.4 CC2.1 | G.1.1 | 56 (B) 57 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | OP-02 | DS 9 DS 13.1 | BAI08 BAI10 DSS01.01 | 312.8 and 312.10 | SRM > Policies and Standards > Job Aid Guidelines | shared | x | Domain 7, 8 | Article 17 | NIST SP 800-53 R3 CP-9 NIST SP 800-53 R3 CP-10 NIST SP 800-53 R3 SA-5 | NIST SP 800-53 R3 CP-9 NIST SP 800-53 R3 CP-9 (1) NIST SP 800-53 R3 CP-9 (3) NIST SP 800-53 R3 CP-10 NIST SP 800-53 R3 CP-10 (2) NIST SP 800-53 R3 CP-10 (3) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1) | 1.2.6 | Clause 4.3.3 A.10.7.4 | Clause 9.2(g) A12.1.1 | 12.1.1 | Commandment #1 Commandment #2 Commandment #4 Commandment #5 Commandment #11 | CIP-005-3a - R1.3 CIP-007-3 - R9 | CP-9 CP-10 SA-5 SA-10 SA-11 | 10.5 13.5 17.1 | 12.1 12.2 12.3 12.4 | 1.1.2, 1.1.3, 2.2, 12.3 12.6 | ||||||||||||||
16 | Business Continuity Management & Operational Resilience Environmental Risks | BCR-05 | Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied. | X | X | X | X | X | X | A3.1.0 A3.2.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats. (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. | CC3.1 A1.1 A1.2 | F.1 | F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.8 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-05 | DSS01.03 DSS01.04 DSS01.05 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.07. (d) 6.08. (a) 6.09. (a) 6.09. (b) 6.09. (d) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15 | NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3) NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15 NIST SP800-53 R3 PE-18 | 8.2.4 | 45 CFR 164.308 (a)(7)(i) 45 CFR 164.310(a)(2)(ii) | A.9.1.4 A.9.2.1 | A11.1.4, A11.2.1 A11.2.2 | 11.1.4 11.2.1 11.2.2 | Commandment #1 Commandment #2 Commandment #3 | CIP-004-3 R3.2 | PE-1 PE-13 PE-14 PE-15 PE-18 | 8.1 8.4 | PA15 | SGP | 3.5.2, 3.6.3, 3.7, 5.1, 5.2, 5.3, 6.1, 6.2, 7.1, 7.2, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 12.2 | |||||||||||||||||
17 | Business Continuity Management & Operational Resilience Equipment Location | BCR-06 | To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance. | X | X | X | X | X | X | A3.1.0 A3.2.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats. (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. | CC3.1 A1.1 A1.2 | F.1 | F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.8 | 53 (A+) 75 (C+, A+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-06 | DSS01.04 DSS01.05 | 312.8 and 312.10 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.07. (d) 6.08. (a) 6.09. (a) 6.09. (b) 6.09. (d) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15 | NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-5 NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15 NIST SP800-53 R3 PE-18 | 45 CFR 164.310 (c) | A.9.2.1 | A11.2.1 | 11.2.1 | Commandment #1 Commandment #2 Commandment #3 | PE-1 PE-5 PE-14 PE-15 PE-18 | 8.1 | PA15 | SGP | 9.1.3 9.5 9.6 9.9 9.9.1 | 9.1.3 9.5 9.6 9.9 9.9.1, 12.2 | ||||||||||||||||
18 | Business Continuity Management & Operational Resilience Equipment Maintenance | BCR-07 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel. | X | X | X | X | X | X | X | X | X | X | X | A3.2.0 A4.1.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. (A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies. | A1.1 A1.2 CC4.1 | F.2.19 | 1 (B) | OP-04 | A13.3 | BAI03.10 BAI04.03 BAI04.04 DSS03.05 | Infra Services > Equipment Maintenance > | provider | x | Domain 7, 8 | 6.09. (h) | Article 17 (1) | NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-5 | NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-2 (1) NIST SP 800-53 R3 MA-3 NIST SP 800-53 R3 MA-3 (1) NIST SP 800-53 R3 MA-3 (2) NIST SP 800-53 R3 MA-3 (3) NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-4 (1) NIST SP 800-53 R3 MA-4 (2) NIST SP 800-53 R3 MA-5 NIST SP 800-53 R3 MA-6 | 5.2.3 8.2.2 8.2.3 8.2.4 8.2.5 8.2.6 8.2.7 | 45 CFR 164.310 (a)(2)(iv) | A.9.2.4 | A11.2.4 | 11.2.4 | Commandment #2 Commandment #5 Commandment #11 | CIP-007-3 - R6.1 - R6.2 - R6.3 - R6.4 | MA-2 MA-3 MA-4 MA-5 MA-6 | 3.3 12.1 12.5 14.5 (software) | PA8 PA15 | BSGP SGP | 10.8, 11.6 | ||||||||||||
19 | Business Continuity Management & Operational Resilience Equipment Power Failures | BCR-08 | Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific business impact assessment. | X | X | X | X | X | X | X | X | A3.2.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. | A1.1 A1.2 | F.1 | F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.12 | 54 (A+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-07 | DSS01.04 DSS01.05 DSS04.01 DSS04.02 DSS04.03 | 312.8 and 312.10 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.08. (a) 6.09. (e) 6.09. (f) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-12 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-14 | NIST SP800-53 R3 CP-8 NIST SP800-53 R3 CP-8 (1) NIST SP800-53 R3 CP-8 (2) NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-9 NIST SP800-53 R3 PE-10 NIST SP800-53 R3 PE-11 NIST SP800-53 R3 PE-12 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3) NIST SP800-53 R3 PE-14 | A.9.2.2 A.9.2.3 A 9.2.4 | A.11.2.2, A.11.2.3, A.11.2.4 | 11.2.2 11.2.3 11.2.4 | Commandment #1 Commandment #2 Commandment #3 | CP-8 PE-1 PE-9 PE-10 PE-11 PE-12 PE-13 PE-14 | 8.1 8.2 8.3 8.4 | PA15 | SGP | |||||||||||||||||
20 | Business Continuity Management & Operational Resilience Impact Analysis | BCR-09 | There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following: • Identify critical products and services • Identify all dependencies, including processes, applications, business partners, and third party service providers • Understand threats to critical products and services • Determine impacts resulting from planned or unplanned disruptions and how these vary over time • Establish the maximum tolerable period for disruption • Establish priorities for recovery • Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption • Estimate the resources required for resumption | X | X | X | X | X | X | X | X | X | X | X | X | A3.1.0 A3.3.0 A3.4.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats. (A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. (A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. | CC3.1 A1.2 A1.3 | K.2 | RS-02 | BAI06.01 BAI10.01 BAI10.02 BAI10.03 DSS04.01 DSS04.02 | ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis | provider | x | Domain 7, 8 | 6.02. (a) 6.03.03. (c) 6.07. (a) 6.07. (b) 6.07. (c) | Article 17 (1), (2) | NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 CP-2 NIST SP 800-53 R3 RA-3 | NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 CP-2 NIST SP 800-53 R3 RA-3 | 45 CFR 164.308 (a)(7)(ii)(E) | ISO/IEC 27001:2005 A.14.1.2 A 14.1.4 | A.17.1.1 A.17.1.2 | 17.1.1 17.1.2 | CLD12.1.5 | Commandment #1 Commandment #2 Commandment #3 | CIP-007-3 - R8 - R8.1 - R8.2 - R8.3 | RA-3 | 6.4 | PA8 PA15 | BSGP SGP | ||||||||||||||
21 | Business Continuity Management & Operational Resilience Policy | BCR-10 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery, and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training. | X | X | X | X | X | X | S2.3.0 | (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2 | G.1.1 | 45 (B) | OP-01 | DS13.1 | APO01 APO07.01 APO07.03 APO09.03 DSS01.01 | SRM > Policies and Standards > Operational Security Baselines | shared | x | Domain 7, 8 | 6.03. (c) | NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-4 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5 | NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 CM-3 NIST SP 800-53 R3 CM-3 (2) NIST SP 800-53 R3 CM-4 NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 CM-6 (1) NIST SP 800-53 R3 CM-6 (3) NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-4 (1) NIST SP 800-53 R3 MA-4 (2) NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1) NIST SP 800-53 R3 SA-12 | 8.2.1 | Clause 5.1 A 8.1.1 A.8.2.1 A 8.2.2 A.10.1.1 | Clause 5.1(h) A.6.1.1 A.7.2.1 A.7.2.2 A.12.1.1 | 6.1.1 7.2.1 7.2.2 12.1.1 15.1.1 15.1.3 | 6.1.1 7.2.2 15.1.1 15.1.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #6 Commandment #7 | CM-2 CM-3 CM-4 CM-5 CM-6 CM-9 MA-4 SA-3 SA-4 SA-5 SA-8 SA-10 SA-11 SA-12 | 12.1 12.2 12.3 12.4 | 4.3, 10.8, 11.1.2, 12.1 12.2 12.3 12.4 12.5, 12.5.3, 12.6, 12.6.2, 12.10 | |||||||||||||||||||||
22 | Business Continuity Management & Operational Resilience Retention Policy | BCR-11 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness. | X | X | X | X | X | X | X | X | X | X | A3.3.0 A3.4.0 I3.20.0 I3.21.0 | (A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. (A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. (I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies. (I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems. | A1.2 A1.3 I3.21 | D.2.2.9 | 36 (B) | Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.5.2 | DG-04 | DS 4.1 DS 4.2 DS 4.5 DS 4.9 DS 11.6 | BAI09.01 BAI09.02 BAI09.03 DSS04.01 DSS04.02 DSS04.03 DSS04.04 DSS04.07 MEA03.01 | 312.3 | BOSS > Data Governance > Data Retention Rules | shared | x | Domain 5 | 6.03. (h) 6.07.01. (c) | Article 6(1) e | NIST SP 800-53 R3 CP-2 NIST SP 800-53 R3 CP-9 | NIST SP 800-53 R3 CP-2 NIST SP 800-53 R3 CP-2 (1) NIST SP 800-53 R3 CP-2 (2) NIST SP 800-53 R3 CP-6 NIST SP 800-53 R3 CP-6 (1) NIST SP 800-53 R3 CP-6 (3) NIST SP 800-53 R3 CP-7 NIST SP 800-53 R3 CP-7 (1) NIST SP 800-53 R3 CP-7 (2) NIST SP 800-53 R3 CP-7 (3) NIST SP 800-53 R3 CP-7 (5) NIST SP 800-53 R3 CP-8 NIST SP 800-53 R3 CP-8 (1) NIST SP 800-53 R3 CP-8 (2) NIST SP 800-53 R3 CP-9 NIST SP 800-53 R3 CP-9 (1) NIST SP 800-53 R3 CP-9 (3) | 5.1.0 5.1.1 5.2.2 8.2.6 | 45 CFR 164.308 (a)(7)(ii)(A) 45 CFR 164.310 (d)(2)(iv) 45 CFR 164.308(a)(7)(ii)(D) 45 CFR 164.316(b)(2)(i) (New) | Clause 4.3.3 A.10.5.1 A.10.7.3 | Clauses 9.2(g) 7.5.3(b) 5.2 (c) 7.5.3(d) 5.3(a) 5.3(b) 8.1 8.3 A.12.3.1 A.8.2.3 | 8.2.3 12.3.1 15.1.1 15.1.3 | 12.3.1 15.1.1 15.1.3 | EAR 15 § 762.6 Period of Retention EAR 15 CFR § 786.2 Recordkeeping | Commandment #11 | Chapter II Article 11, 13 | CIP-003-3 - R4.1 | CP-2 CP-6 CP-7 CP-8 CP-9 SI-12 AU-11 | FTC Fair Information Principles Integrity/Security Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm | 6.4 13.1 | PA10 PA29 | BSGP SGP | 3.1 3.1.1 3.2 9.9.1 9.5 9.6 10.7 | 3.1 3.1.a 3.2 9.9.1 9.5. 9.5.1 9.6. 9.7, 9.8 10.7, 12.10.1 | ||||||
23 | Change Control & Configuration Management New Development / Acquisition | CCC-01 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network, and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization's business leadership or other accountable business role or function. | X | X | X | X | X | X | X | X | X | X | S3.12.0 S3.10.0 S3.13.0 | (S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies. (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies. (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.2 CC7.1 CC7.4 | I.2 | I.1.1, I.1.2, I.2. 7.2, I.2.8, I.2.9, I.2.10, I.2.13, I.2.14, I.2.15, I.2.18, I.2.22.6, L.5 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-01 | A12 A16.1 | APO01.02 APO01.06 BAI02.04 BAI06.01 | ITOS > IT Operation > Architecture Governance | shared | x | None | 6.03. (a) | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) | 1.2.6 | A.6.1.4 A.6.2.1 A.12.1.1 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.5 A.15.1.3 A.15.1.4 | A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* (partial) A.14.2.7 A.18.1.3 A.18.1.4 | 9.4.5 12.5.1 14.1.1 14.2.1 14.2.7 14.3.1 15.1.1 15.1.3 18.1.3 18.1.4 | 14.1.1 14.2.1 15.1.1 15.1.3 18.1.3 | Commandment #1 Commandment #2 Commandment #3 | CA-1 CM-1 CM-9 PL-1 PL-2 SA-1 SA-3 SA-4 | 12.1 | 6.3.2 | 6.3.2, 12.3.4 | |||||||||||||||
24 | Change Control & Configuration Management Outsourced Development | CCC-02 | External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g., ITIL service management processes). | X | X | X | X | X | X | X | X | X | X | S3.10.0 S3.13 | (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies. (S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.1 CC7.4 | C.2 I.1 I.2 I.4 | C.2.4, G.4, G6, I.1, I.4.4, I.4.5, I.2.7.2, I.2.8, I.2.9, I.2.15, I.2.18, I.2.22.6, I.2.7.1, I.2.13, I.2.14, I.2.17, I.2.20, I.2.22.2, I.2.22.4, I.2.22.7, I.2.22.8, I.2.22.9, I.2.22.10, I.2.22.11, I.2.22.12, I.2.22.13, I.2.22.14, I.3, J.1.2.10, L.7, L.9, L.10 | 27 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-04 | APO07.06 APO09.03 APO09.04 APO10.01 APO10.04 APO10.05 APO11.01 APO11.02 APO11.04 APO11.05 | ITOS > IT Operation > Architecture Governance | shared | x | None | NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-9 | NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SA-9 (1) NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1) NIST SP 800-53 R3 SA-12 | A.6.1.8 A.6.2.1 A.6.2.3 A.10.1.4 A.10.2.1 A.10.2.2 A.10.2.3 A.10.3.2 A.12.1.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.1 A.12.5.2 A.12.5.3 A.12.5.5 A.12.6.1 A.13.1.2 A.15.2.1 A.15.2.2 | A18.2.1 A.15.1.2 A.12.1.4 8.1* (partial) 8.1* (partial) A.15.2.1 8.1* (partial) A.15.2.2 A.14.2.9 A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* (partial) A.14.2.2 8.1* (partial) A.14.2.3 8.1* (partial) A.14.2.4 8.1* (partial) A.14.2.7 A.12.6.1 A.16.13 A.18.2.2 A.18.2.3 | 9.4.5 12.1.4 12.5.1 12.6.1 14.1.1 14.2.1 14.2.2 14.2.3 14.2.4 14.2.7 14.2.9 14.3.1 15.1.1 15.1.2 15.1.3 15.2.1 15.2.2 16.1.3 18.2.1 18.2.2 18.2.3 | 12.6.1 14.1.1 14.2.1 15.1.1 15.1.2 15.1.3 18.2.1 | Commandment #1 Commandment #2 Commandment #3 | SA-4 SA-5 SA-8 SA-9 SA-10 SA-11 SA-12 SA-13 | 2.2 4.1 | PA17 | SGP | 3.6.7 6.4.5.2 7.1.3 8.5.1 9.1 9.1.2 9.2b 9.3.1 10.5.2 11.5 12.3.1 12.3.3 | 2.1, 2.2.4, 2.3, 2.5 3.3, 3.4, 3.6 4.1, 4.2 6.3.1, 6.3.2, 6.4.2, 6.4.3, 6.4.4, 6.4.5.2 6.7 7.1, 7.1.3, 7.1.4 8.3, 8.5.1, 8.7 9.1 9.1.2 9.2 10.5 11.5 12.3 12.8 | |||||||||||||||
25 | Change Control & Configuration Management Quality Testing | CCC-03 | Organizations shall follow a defined quality change control and testing process (e.g., ITIL Service Management) with established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services. | X | X | X | X | X | X | X | X | X | A3.13.0 C3.16.0 I3.14.0 S3.10.0 S3.13 | (A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies. (S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.1 CC7.1 CC7.1 CC7.1 CC7.4 | C.1.7, G.1, G.6, I.1, I.4.5, I.2.18, I.22.1, I.22.3, I.22.6, I.2.23, I.2.22.2, I.2.22.4, I.2.22.7. I.2.22.8, I.2.22.9, I.2.22.10, I.2.22.11, I.2.22.12, I.2.22.13, I.2.22.14,I.2.20, I.2.17, I.2.7.1, I.3, J.2.10, L.9 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-03 | PO 8.1 | APO11.01 APO11.02 APO11.04 APO11.05 BAI02.04 BAI03.06 BAI03.08 BAI07.03 BAI07.05 | ITOS > Service Support > Release Management | shared | x | None | 6.03.01. (b) 6.03.01. (d) | NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5 | NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1) | 9.1.0 9.1.1 9.2.1 9.2.2 | A.6.1.3 A.10.1.1 A.10.1.4 A.10.3.2 A.12.1.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.1 A.12.5.2 A.12.5.3 A.12.6.1 A.13.1.2 A.15.2.1 A.15.2.2 | A.6.1.1 A.12.1.1 A.12.1.4 A.14.2.9 A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* partial A.14.2.2 8.1* partial A.14.2.3 8.1* partial A.14.2.4 A.12.6.1 A.16.1.3 A.18.2.2 A.18.2.3 | 6.1.1 9.4.5 12.1.1 12.1.4 12.5.1 12.6.1 14.1.1 14.2.2 14.2.3 14.2.4 14.2.9 14.3.1 15.1.1 15.1.3 16.1.3 18.2.2 18.2.3 | 6.1.1 12.6.1 14.1.1 15.1.1 15.1.3 | Commandment #1 Commandment #2 Commandment #3 | CM-1 CM-2 SA-3 SA-4 SA-5 SA-8 SA-10 SA-11 SA-13 | 12.1 14.1 14.2 | 1.1.1 6.1 6.4 | 6.1 6.2 6.3 6.4 6.5 6.6 6.7 | |||||||||||||||||
26 | Change Control & Configuration Management Unauthorized Software Installations | CCC-04 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. | X | X | X | X | X | X | X | X | A3.6.0 S3.5.0 S3.13.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software. (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC5.5 CC5.8 CC7.4 | G.1 I.2 | G.2.13, G.20.2,G.20.4, G.20.5, G.7, G.7.1, G.12.11, H.2.16, I.2.22.1, I.2.22.3, I.2.22.6, I.2.23 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-05 | APO13.01 BAI06.01 BAI10 DSS05.03 DSS05.04 DSS05.05 DSS05.07 DSS06.03 | 312.8 and 312.10 | ITOS > Service Support > Configuration Management -> Software Management | shared | x | None | NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-3 | NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 CM-3 NIST SP 800-53 R3 CM-3 (2) NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1) NIST SP 800-53 R3 CM-5 (5) NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1) NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1) NIST SP 800-53 R3 CM-8 (3) NIST SP 800-53 R3 CM-8 (5) NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-3 NIST SP 800-53 R3 SI-3 (1) NIST SP 800-53 R3 SI-3 (2) NIST SP 800-53 R3 SI-3 (3) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 SI-7 NIST SP 800-53 R3 SI-7 (1) | 3.2.4 8.2.2 | A.10.1.3 A.10.4.1 A.11.5.4 A.11.6.1 A.12.4.1 A.12.5.3 | A.6.1.2 A.12.2.1 A.9.4.4 A.9.4.1 A.12.5.1 8.1* (partial) A.14.2.4 | 6.1.2 9.4.1 9.4.4 12.2.1 12.5.1 14.2.1 14.2.4 15.1.1 15.1.3 | 9.4.1 9.4.4 CLD12.1.5 14.2.1 15.1.1 15.1.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #5 Commandment #11 | CM-1 CM-2 CM-3 CM-5 CM-7 CM-8 CM-9 SA-6 SA-7 SI-1 SI-3 SI-4 SI-7 | FTC Fair Information Principles Involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm | 14.1 | 1.3.3 2.1, 2.2.2 3.6 4.1 5.1, 5.2, 5.3, 5.4 6.2 7.1 9.1 9.1.1 9.1.2 9.1.3 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7 11.1, 11.4, 11.5 12.3 | ||||||||||||||||||
27 | Change Control & Configuration Management Production Changes | CCC-05 | Policies and procedures shall be established for managing the risks associated with applying changes to: • Business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations. • Infrastructure network and systems components. Technical measures shall be implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer (tenant), and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment. | X | X | X | X | X | X | X | X | X | X | X | A3.16.0 S3.13.0 | (A3.16.0, S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.4 CC7.4 | I.2.17, I.2.20, I.2.22 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-02 | A16.1 A17.6 | BAI06.01 BAI06.02 BAI06.03 BAI06.04 BAI07.01 BAI07.03 BAI07.04 BAI07.05 BAI07.06 | ITOS > Service Support > Release Management | shared | x | None | 6.03. (a) | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 PL-5 NIST SP 800-53 R3 SI-2 | NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CA-7 (2) NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 CM-3 NIST SP 800-53 R3 CM-3 (2) NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1) NIST SP 800-53 R3 CM-5 (5) NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 CM-6 (1) NIST SP 800-53 R3 CM-6 (3) NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 PL-5 NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-2 (2) NIST SP 800-53 R3 SI-6 NIST SP 800-53 R3 SI-7 NIST SP 800-53 R3 SI-7 (1) | 1.2.6 | 45 CFR 164.308 (a)(5)(ii)(C) 45 CFR 164.312 (b) | A.10.1.4 A.12.5.1 A.12.5.2 | A.12.1.4 8.1* (partial) A.14.2.2 8.1* (partial) A.14.2.3 | 12.1.4 14.1.1 14.2.1 14.2.2 14.2.3 15.1.1 15.1.3 | CLD12.1.5 14.1.1 14.2.1 15.1.1 15.1.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #11 | CIP-003-3 - R6 | CA-1 CA-6 CA-7 CM-2 CM-3 CM-5 CM-6 CM-9 PL-2 PL-5 SI-2 SI-6 SI-7 | AR- 4. Privacy Monitoring and Auditing. Organizations also: (i) implement technology to audit for the security, appropriate use, and loss of PII; (ii) perform reviews to ensure physical security of documents containing PII; (iii) assess contractor compliance with privacy requirements; and (iv) ensure that corrective actions identified as part of the assessment process are tracked and monitored until audit findings are corrected. The organization Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) coordinates monitoring and auditing efforts with information security officials and ensures that the results are provided to senior managers and oversight officials. | 12.1 12.4 | PA14 | SGP | 1.1.1 6.3.2 6.4 6.1 | 1.1.1 6.3.2 6.4.5 | ||||||||||
28 | Data Security & Information Lifecycle Management Classification | DSI-01 | Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization. | X | X | X | X | X | X | X | X | X | X | S3.8.0 C3.14.0 | (S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies. | CC3.1 CC3.1 | D.1.3, D.2.2 | DG-02 | PO 2.3 DS 11.6 | APO01.06 APO03.02 APO08.01 APO09.03 APO13.01 BAI09.01 BAI09.02 BAI09.03 DSS04.07 DSS05.04 DSS05.05 DSS06.06 | 312.3 | BOSS > Data Governance > Data Classification | shared | x | Domain 5 | 6.04.03. (a) | Article 4 (1), Article 12, Article 17 | NIST SP 800-53 R3 RA-2 | NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 AC-4 | 1.2.3 1.2.6 4.1.2 8.2.1 8.2.5 8.2.6 | A.7.2.1 | A.8.2.1 | 8.2.1 | Commandment #9 | General Provisions, Article 3, V. and VI. | CIP-003-3 - R4 - R5 | RA-2 AC-4 | DM-1 Minimization of Personally Identifiable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research. | PA10 | SGP | 9.7.1 9.10 12.3 | 3.1 9.6.1, 9.7.1 9.10 12.3 | ||||||||||||
29 | Data Security & Information Lifecycle Management Data Inventory / Flows | DSI-02 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's geographically distributed (physical and virtual) applications and infrastructure network and systems components and/or shared with other third parties to ascertain any regulatory, statutory, or supply chain agreement (SLA) compliance impact, and to address any other business risks associated with the data. Upon request, provider shall inform customer (tenant) of compliance impact and risk, especially if customer data is used as part of the services. | X | X | X | X | X | X | X | X | X | X | -- | APO01.06 APO03.01 APO03.02 APO09.01 APO09.01 BAI06.03 BAI09.01 BAI10.01 BAI10.02 BAI10.03 BAI10.04 BAI10.05 | BOSS > Data Governance > Handling / Labeling / Security Policy | Domain 5 | 6.10. (a) 6.10. (b) 6.10. (c) 6.10. (d) 6.10. (e) | NIST SP 800-53 R3 SC-30 | Clause 4.2 5.2, 7.5, 8.1 | TR-2 SYSTEM OF RECORDS NOTICES AND PRIVACY ACT STATEMENTS | 1.1.3 12.3.3 | ||||||||||||||||||||||||||||||||
30 | Data Security & Information Lifecycle Management Ecommerce Transactions | DSI-03 | Data related to electronic commerce (ecommerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data. | X | X | X | X | X | X | X | S3.6 I13.3.a-e I3.4.0 | (S3.6) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (I13.3.a-e) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies. (I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies. | CC5.7 PI1.5 | G.4 G.11 G.16 G.18 I.3 I.4 | G.19.1.1, G.19.1.2, G.19.1.3, G.10.8, G.9.11, G.14, G.15.1 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-28 | DS 5.10 5.11 | APO01.06 APO03.02 APO08.01 APO13.01 APO13.02 DSS05 DSS06 | 312.8 and 312.10 | SRM > Cryptographic Services > Data in Transit Encryption | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-22 NIST SP 800-53 R3 AU-1 | NIST SP 800-53 R3 AC-22 NIST SP 800-53 R3 AU-10 NIST SP 800-53 R3 AU-10 (5) NIST SP 800-53 R3 SC-8 NIST SP 800-53 R3 SC-8 (1) NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1) | 3.2.4 4.2.3 7.1.2 7.2.1 7.2.2 8.2.1 8.2.5 | 45 CFR 164.312(e)(1) 45 CFR 164.312(e)(2)(i) | A.7.2.1 A.10.6.1 A.10.6.2 A.10.9.1 A.10.9.2 A.15.1.4 | A.8.2.1 A.13.1.1 A.13.1.2 A.14.1.2 A.14.1.3 A.18.1.4 | 8.2.1 13.1.1 13.1.2 14.1.2 14.1.3 18.1.4 | Commandment #4 Commandment #5 Commandment #9 Commandment #10 Commandment #11 | AC-14 AC-21 AC-22 IA-8 AU-10 SC-4 SC-8 SC-9 | TR-2 SYSTEM OF RECORDS NOTICES AND PRIVACY ACT STATEMENTS | PA25 PA21 PA5 | GP GP BSGP | 2.1.1 4.1 4.1.1 4.2 | 2.1.1 3.1 4.1 4.1.1 4.2 | |||||||||||||||
31 | Data Security & Information Lifecycle Management Handling / Labeling / Security Policy | DSI-04 | Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data. | X | X | X | X | X | X | X | X | X | X | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | G.13 | D.2.2 | DG-03 | PO 2.3 DS 11.6 | APO01.06 APO03.02 APO08.01 APO09.03 APO13.01 BAI09.01 BAI09.02 BAI09.03 DSS04.07 DSS05.04 DSS05.05 DSS06.06 | 312.2 | BOSS > Data Governance > Handling / Labeling / Security Policy | shared | x | Domain 5 | 6.03.05. (b) | Article 22 Article 23 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PE-16 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-12 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-16 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-3 NIST SP 800-53 R3 PE-16 NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1) NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-12 | 99.31.(a)(1)(ii) | 1.1.2 5.1.0 7.1.2 8.1.0 8.2.5 8.2.6 | A.7.2.2 A.10.7.1 A.10.7.3 A.10.8.1 | A.8.2.2 A.8.3.1 A.8.2.3 A.13.2.1 | 8.2.2 8.2.3 8.3.1 13.2.1 | 8.2.2 | Commandment #8 Commandment #9 Commandment #10 | Chapter II Article 8, 9, 11, 12, 14, 18, 19, 20, 21 | CIP-003-3 - R4 - R4.1 | AC-16 MP-1 MP-3 PE-16 SI-12 SC-9 | DM-1 Minimization of Personally Identifiable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research. SE-1 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION | 13.1 | 9.5 9.6 9.7.1 9.7.2 9.10 | 9.5, 9.5.1 9.6 9.7 9.8 9.9 | ||||||||||
32 | Data Security & Information Lifecycle Management Non-Production Data | DSI-05 | Production data shall not be replicated or used in non-production environments. Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements. | X | X | X | X | X | X | X | C3.5.0 S3.4.0 C3.21.0 | (C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies. (S3.4.0) Procedures exist to protect against unauthorized access to system resources. (C3.21.0) Procedures exist to provide that confidential information is protected during the system development, testing, and change processes in accordance with defined system confidentiality and related security policies. | C1.3 CC5.6 C1.1 | I.2.18 | DG-06 | APO01.06 BAI01.01 BAI03.07 BAI07.04 | SRM > Policies and Standards > Technical Standard (Data Management Security Standard) | shared | x | Domain 5 | 6.03. (d) | NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1) | 1.2.6 | 45 CFR 164.308(a)(4)(ii)(B) | A.7.1.3 A.10.1.4 A.12.4.2 A.12.5.1 | A.8.1.3 A.12.1.4 A.14.3.1 8.1* (partial) A.14.2.2. | 8.1.3 12.1.4 14.2.2 14.3.1 | Commandment #9 Commandment #10 Commandment #11 | CIP-003-3 - R6 | SA-11 CM-04 | DM-1 Minimization of Personally Identifiable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research. | 17.8 | 6.4.3 | 6.4.3 | ||||||||||||||||||||
33 | Data Security & Information Lifecycle Management Ownership / Stewardship | DSI-06 | All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated. | X | X | X | X | X | X | X | X | X | S2.2.0 S2.3.0 S3.8.0 | (S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. (S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary | CC2.3 CC3.1 | C.2.5.1, C.2.5.2, D.1.3, L.7 | Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3 | DG-01 | DS5.1 PO 2.3 | APO01.06 APO03.02 APO13.01 APO13.03 | 312.4 | BOSS > Data Governance > Data Ownership / Stewardship | shared | x | Domain 5 | Article 4 | NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 SA-2 | NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 SA-2 | 6.2.1 | 45 CFR 164.308 (a)(2) | A.6.1.3 A.7.1.2 A.15.1.4 | A.6.1.1 A.8.1.2 A.18.1.4 | 6.1.1 8.1.2 18.1.4 | 6.1.1 CLD.6.3.1 | Commandment #6 Commandment #10 | Chapter IV Article 30 | CIP-007-3 - R1.1 - R1.2 | CA-2 PM-5 PS-2 RA-2 SA-2 | AP-1 AUTHORITY TO COLLECT. AP-2 PURPOSE SPECIFICATION. | 3.4 | 3.7 12.5.5 12.10.4 | |||||||||||||
34 | Data Security & Information Lifecycle Management Secure Disposal | DSI-07 | Policies and procedures shall be established with supporting business processes and technical measures implemented for the secure disposal and complete removal of data from all storage media, ensuring data is not recoverable by any computer forensic means. | X | X | X | X | X | X | X | X | X | C3.5.0 S3.4.0 | (C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies. (S3.4.0) Procedures exist to protect against unauthorized access to system resources. | C1.3 CC5.6 | D.2.2.10, D.2.2.11, D.2.2.14, | 37 (B) | Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.7.5 and 4.5.3 | DG-05 | DS 11.4 | APO01.06 APO13.01 BAI09.03 DSS01.01 | 312.3 | BOSS > Data Governance > Secure Disposal of Data | shared | x | Domain 5 | 6.03. (h) | Article 16 Article 17 | NIST SP 800-53 R3 MP-6 NIST SP 800-53 R3 PE-1 | NIST SP 800-53 R3 MP-6 NIST SP 800-53 R3 MP-6 (4) NIST SP 800-53 R3 PE-1 | 5.1.0 5.2.3 | 45 CFR 164.310 (d)(2)(i) 45 CFR 164.310 (d)(2)(ii) | A.9.2.6 A.10.7.2 | A.11.2.7 A.8.3.2 | 8.3.2 11.2.7 | 11.2.7 CLD.8.1.5 | Commandment #11 | CIP-007-3 - R7 - R7.1 - R7.2 R7.3 | MP-6 PE-1 | DM-2 DATA RETENTION AND DISPOSAL | 13.4 13.5 | PA10 PA39 PA34 PA40 | BSGP SGP SGP SGP | 3.1.1 9.10 9.10.1 9.10.2 3.1 | 3.1.1 9.8, 9.8.1, 9.8.2, 3.1 | |||||||||
35 | Datacenter Security Asset Management | DCS-01 | Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities. | X | X | X | X | X | S3.1.0 C3.14.0 S1.2.b-c | (S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies. (S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies. c. Assessing risks on a periodic basis. | CC3.1 CC3.1 | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-08 | APO01.06 APO03.02 APO08.01 APO09.03 BAI09.01 BAI09.02 BAI09.03 DSS04.07 DSS05.04 DSS05.05 DSS06.06 | ITOS > Service Support > Configuration Management - Physical Inventory | provider | x | Domain 8 | Article 17 | Annex A.8 | 8.1.1 8.1.2 8.1.3 8.1.4 15.1.1 15.1.3 | 8.1.1 15.1.1 15.1.3 | Clause 8 | 12.3 | PA4 PA8 PA37 PA38 | BSGP BSGP SGP SGP | 9.7.1 9.9 9.9.1 | |||||||||||||||||||||||||||
36 | Datacenter Security Controlled Access Points | DCS-02 | Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems. | X | X | X | X | X | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | F.2 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-03 | DS 12.2 DS 12.3 | APO13.01 DSS01.01 DSS01.05 DSS05.05 DSS06.03 DSS06.06 | 312.8 and 312.10 | Infra Services > Facility Security > Controlled Physical Access | provider | x | Domain 8 | 6.08. (a) 6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-8 | NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-6 (1) NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-7 (1) NIST SP 800-53 R3 PE-8 NIST SP 800-53 R3 PE-18 | 99.31.a.1.ii | 8.2.3 | A.9.1.1 A.9.1.2 | A.11.1.1 A.11.1.2 | 11.1.1 11.1.2 | Commandment #1 Commandment #2 Commandment #3 Commandment #5 | CIP-006-3c R1.2 - R1.3 - R1.4 - R1.6 - R1.6.1 - R2 - R2.2 | PE-2 PE-3 PE-6 PE-7 PE-8 PE-18 | 8.1 8.2 | PA4 | BSGP | 9.1 9.1.1 9.1.2 9.1.3 9.2 | 9.1 9.1.1 9.1.2, 9.1.3 9.2, 9.3, 9.4, 9.4.1, 9.4.2, 9.4.3, 9.4.4 | ||||||||||||||
37 | Datacenter Security Equipment Identification | DCS-03 | Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location. | X | X | X | X | X | X | X | X | X | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | D.1 | D.1.1, D.1.3 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-13 | DS5.7 | APO13.01 DSS05.02 DSS05.03 | 312.3, 312.8 and 312.10 | > > | Domain 10 | 6.05. (a) | Article 17 | NIST SP 800-53 R3 IA-4 | NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-4 (4) | A.11.4.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #5 Commandment #8 | IA-3 IA-4 | PA22 PA33 | GP SGP | |||||||||||||||||||||
38 | Datacenter Security Off-Site Authorization | DCS-04 | Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises. | X | X | X | X | X | X | X | X | S3.2.f C3.9.0 | (S3.2.f) f. Restriction of access to offline storage, backup data, systems, and media. (C3.9.0) Procedures exist to restrict physical access to the defined system including, but not limited to: facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.1 CC5.5 | F.2.18, F.2.19, | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 | FS-06 | EDM05.02 APO01.02 APO03.02 BAI02.03 BAI02.04 BAI03.09 BAI06.01 | 312.8 and 312.10 | SRM > Facility Security > Asset Handling | provider | x | Domain 8 | 6.08. (a) 6.09. (j) | Article 17 | NIST SP 800-53 R3 AC-17 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PE-16 | NIST SP 800-53 R3 AC-17 NIST SP 800-53 R3 AC-17 (1) NIST SP 800-53 R3 AC-17 (2) NIST SP 800-53 R3 AC-17 (3) NIST SP 800-53 R3 AC-17 (4) NIST SP 800-53 R3 AC-17 (5) NIST SP 800-53 R3 AC-17 (7) NIST SP 800-53 R3 AC-17 (8) NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PE-16 NIST SP 800-53 R3 PE-17 | 45 CFR 164.310 (c ) 45 CFR 164.310 (d)(1) 45 CFR 164.310 (d)(2)(i) | A.9.2.5 A.9.2.6 | A.11.2.6 A.11.2.7 | 11.2.6 11.2.7 | 11.2.7 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #4 Commandment #5 Commandment #11 | AC-17 MA-1 PE-1 PE-16 PE-17 | 12.5 19.1 | PA4 | BSGP | 9.8 9.9 9.10 | 9.6.3 | ||||||||||||||
39 | Datacenter Security Off-Site Equipment | DCS-05 | Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory for reuse and deployment, or securely stored until it can be destroyed. | X | X | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | remove CC5.6 add CC5.7 | D.1 | D.1.1, D.2.1. D.2.2, | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 | FS-07 | APO09.03 APO10.04 APO10.05 APO13.01 DSS01.02 | 312.8 and 312.10 | BOSS > Data Governance > Secure Disposal of Data | provider | x | Domain 8 | 6.05. (a) 6.05. (b) 6.05. (c) | Article 17 | NIST SP 800-53 R3 CM-8 | NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1) NIST SP 800-53 R3 CM-8 (3) NIST SP 800-53 R3 CM-8 (5) NIST SP 800-53 R3 SC-30 | 45 CFR 164.310 (d)(2)(iii) | A.7.1.1 A.7.1.2 | A.8.1.1 A.8.1.2 | 8.1.1 8.1.2 15.1.1 | 8.1.1 15.1.1 | Commandment #6 Commandment #7 Commandment #8 | CM-8 | 12.6 | PA4 | BSGP | 9.9.1 12.3.3 12.3.4 | 9.8, 9.8.1, 9.8.2 12.3 | ||||||||||
40 | Datacenter Security Policy | DCS-06 | Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information. | X | X | X | X | X | X | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | H.6 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.4.2, F1.4.6, F.1.4.7, F.1.7, F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-01 | APO13.01 DSS01.04 DSS01.05 DSS04.01 DSS04.03 | SRM > Policies and Standards > Information Security Policies (Facility Security Policy) | provider | x | Domain 8 | 6.08. (a) 6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 | NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-4 NIST SP 800-53 R3 PE-5 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-6 (1) | 99.31.a.1.ii | 8.2.1 8.2.2 8.2.3 | 45 CFR 164.310(a)(1) 45 CFR 164.310(a)(2)(ii) 45 CFR 164.310(b) 45 CFR 164.310 ( c) (New) | A.9.1.1 A.9.1.2 | A.11.1.1 A.11.1.2 | 11.1.1 11.1.2 15.1.1 15.1.3 | 15.1.1 15.1.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #5 | CIP-006-3c R1.2 - R1.3 - R1.4 -R2 - R2.2 | PE-2 PE-3 PE-4 PE-5 PE-6 | 4.2 8.1 | PA4 | BSGP | 9.1 | 9.1 9.1.1 9.1.2 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 9.4.4 | |||||||||||||
41 | Datacenter Security Secure Area Authorization | DCS-07 | Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access. | X | X | X | X | X | X | X | X | X | X | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | F.2 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-04 | DS 12.3 | APO13.01 APO13.02 DSS05.05 | 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policy (Facility Security Policy) | provider | x | Domain 8 | 6.08. (a) 6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-16 | NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-7 (1) NIST SP 800-53 R3 PE-16 NIST SP 800-53 R3 PE-18 | 99.31.a.1.ii | 8.2.3 | A.9.1.6 | A.11.1.6 | 11.1.6 | Commandment #1 Commandment #2 Commandment #3 Commandment #5 | CIP-006-3c R1.2 - R1.3 - R1.4 | PE-7 PE-16 PE-18 | 8.2 8.1 | PA4 | BSGP | 9.1 9.1.1 9.1.3 | ||||||||||
42 | Datacenter Security Unauthorized Persons Entry | DCS-08 | Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss. | X | X | X | X | X | X | X | X | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | G.21 | F.2.18 | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-05 | APO13.01 APO13.02 DSS05.05 DSS06.03 | 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policy (Facility Security Policy) | provider | x | Domain 8 | 6.08. (a) 6.09. (j) | Article 17 | NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 PE-16 | NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-2 (1) NIST SP 800-53 R3 PE-16 | 99.31.a.1.ii | 8.2.5 8.2.6 | 45 CFR 164.310 (d)(1) | A.9.2.7 A.10.1.2 | A.11.2.5 8.1* (partial) A.12.1.2 | 11.2.5 12.1.2 | 12.1.2 | Commandment #6 Commandment #7 | MA-1 MA-2 PE-16 | 8.1 8.2 8.3 8.4 | PA4 | BSGP | 9.8 9.9 | 9.1 9.1.1 9.1.2 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 9.4.4 9.5 9.5.1 | ||||||||||||
43 | Datacenter Security User Access | DCS-09 | Physical access to information assets and functions by users and support personnel shall be restricted. | X | X | X | X | X | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | F.2 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B) 10 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-02 | DS 12.3 | APO13.01 APO13.02 DSS05.04 DSS05.05 DSS06.03 | 312.8 and 312.10 | Infra Services > Facility Security > | Domain 8 | 6.08. (a) 6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 | NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-6 (1) NIST SP 800-53 R3 PE-18 | 99.31.a.1.ii | 8.2.3 | A.9.1.1 | A.11.1.1 | 11.1.1 15.1.1 15.1.3 | 15.1.1 15.1.3 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #1 Commandment #2 Commandment #3 Commandment #5 | Chapter II, Article 19 | CIP-006-3c R1.2 - R1.3 - R1.4 - R1.6 - R1.6.1 - R2 - R2.2 | PE-2 PE-3 PE-6 PE-18 | 8.1 8.2 | PA4 PA13 PA24 | BSGP SGP P | 9.1 | 9.1 9.1.1 9.1.2 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 9.4.4 9.5 9.5.1 | |||||||||||||
44 | Encryption & Key Management Entitlement | EKM-01 | Keys must have identifiable owners (binding keys to identities) and there shall be key management policies. | X | X | X | X | X | X | X | X | X | X | APO01.06 APO13.01 DSS05.04 DSS05.06 DSS06.03 DSS06.06 | SRM > Cryptographic Services > Key Management | Annex A.10.1 A.10.1.1 A.10.1.2 | 10.1.1 10.1.2 | 10.1 10.1.1 10.1.2 | Clause 10.1 10.1.1 10.1.2 | PA36 | 3.5, 7.1.3 8.1 8.1.1 8.2.2 8.5 8.5.1 | |||||||||||||||||||||||||||||||||
45 | Encryption & Key Management Key Generation | EKM-02 | Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control. | X | X | X | X | X | X | X | X | X | S3.6.0 S3.4 | (S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.7 CC5.6 | L.6 | 38 (B) 39 (C+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-19 | DS5.8 | APO13.01 APO13.02 APO09.03 BAI06.01 BAI09.01 BAI09.02 BAI09.03 | 312.8 and 312.10 | SRM > Cryptographic Services > Key Management | shared | x | Domain 2 | 6.04.04. (a) 6.04.04. (b) 6.04.04. (c) 6.04.04. (d) 6.04.04. (e) 6.04.05. (d) 6.04.05. (e) 6.04.08.02. (b) | Article 17 | NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-13 | NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-12 (2) NIST SP 800-53 R3 SC-12 (5) NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-13 (1) NIST SP 800-53 R3 SC-17 | 8.1.1 8.2.1 8.2.5 | 45 CFR 164.312 (a)(2)(iv) 45 CFR 164.312(e)(1) | Clause 4.3.3 A.10.7.3 A.12.3.2 A.15.1.6 | Clauses 5.2(c) 5.3(a) 5.3(b) 7.5.3(b) 7.5.3(d) 8.1 8.3 9.2(g) A.8.2.3 A.10.1.2 A.18.1.5 | 8.2.3 10.1.2 18.1.5 | 10.1.2 18.1.5 | Clause 10.1 10.1.1 10.1.2 | Commandment #9 Commandment #10 Commandment #11 | SC-12 SC-13 SC-17 SC-28 | 16.2 | PA36 | 3.4.1 3.5 3.5.1 3.5.2 3.6 3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 3.6.6 3.6.7 3.6.8 | 3.4.1 3.5 3.5.1 3.5.2 3.6 3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 3.6.6 3.6.7 3.6.8, 4.1 6.5.3 8.2.1 8.2.2 | |||||||||||
46 | Encryption & Key Management Sensitive Data Protection | EKM-03 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations. | X | X | X | X | X | X | X | X | X | X | C3.12.0 S3.6.0 S3.4 | (C3.12.0, S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.7 CC5.6 | G.4 G.15 I.3 | G.10.4, G.11.1, G.11.2, G.12.1, G.12.2, G.12.4, G.12.10, G.14.18, G.14.19, G.16.2, G.16.18, G.16.19, G.17.16, G.17.17, G.18.13, G.18.14, G.19.1.1, G.20.14 | 23 (B) 24 (B) 25 (B) | Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3 | IS-18 | DS5.8 DS5.10 DS5.11 | APO13.01 DSS05.02 DSS05.03 DSS06.06 | 312.8 and 312.10 | SRM > Data Protection > Cryptographic Services - Data-At-Rest Encryption, Cryptographic Services - Data-in-Transit Encryption | shared | x | Domain 2 | 6.04.05. (a) 6.04.05. (c) | Article 17 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 IA-7 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-13 | NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-18 (1) NIST SP 800-53 R3 AC-18 (2) NIST SP 800-53 R3 IA-7 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-8 NIST SP 800-53 R3 SC-8 (1) NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1) NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-13 (1) NIST SP 800-53 R3 SC-23 NIST SP 800-53 R3 SC-28 NIST SP 800-53 R3 SI-8 | 8.1.1 8.2.1 8.2.5 | 45 CFR 164.312 (a)(2)(iv) 45 CFR 164.312 (e)(1) 45 CFR 164.312 (e)(2)(ii) | A.10.6.1 A.10.8.3 A.10.8.4 A.10.9.2 A.10.9.3 A.12.3.1 A.15.1.3 A.15.1.4 | A.13.1.1 A.8.3.3 A.13.2.3 A.14.1.3 A.14.1.2 A.10.1.1 A.18.1.3 A.18.1.4 | 8.3.3 10.1.1 13.1.1 13.2.3 14.1.3 14.1.2 18.1.3 18.1.4 | 10.1.1 18.1.3 | Commandment #4 Commandment #5 Commandment #9 Commandment #10 Commandment #11 | CIP-003-3 - R4.2 | AC-18 IA-3 IA-7 SC-7 SC-8 SC-9 SC-13 SC-16 SC-23 SI-8 | 16.1 | PA25 | GP | 2.1.1 3.4 3.4.1 4.1 4.1.1 4.2 | 2.1.1 2.3 3.3 3.4 3.4.1 4.1 4.1.1 4.2 4.3 6.5.3 6.5.4 8.2.1 | ||||||||
47 | Encryption & Key Management Storage and Access | EKM-04 | Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e., at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties. | X | X | X | X | X | X | X | -- | APO01.06 BAI09.02 BAI09.03 | SRM > Cryptographic Services > Key Management | shared | x | Domain 11 | Annex A.10.1 A.10.1.1 A.10.1.2 | 10.1.1 10.1.2 | 10.1 10.1.1 10.1.2 | 3.5.2, 3.5.3 3.6.1, 3.6.3 | ||||||||||||||||||||||||||||||||||
48 | Governance and Risk Management Baseline Requirements | GRM-01 | Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory, and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and authorized based on business needs. | X | X | X | X | X | X | X | X | X | X | X | S1.1.0 S1.2.0(a-i) | (S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group. (S1.2.0(a-i)) The entity's security policies include, but may not be limited to, the following matters: | CC3.2 | L.2 | L.2, L.5, L.7 L.8, L.9, L.10 | 12 (B) 14 (B) 13 (B) 15 (B) 16 (C+, A+) 21 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | IS-04 | AI2.1 AI2.2 AI3.3 DS2.3 DS11.6 | APO01.06 APO03.02 APO13.01 APO13.02 BAI02.01 BAI02.03 BAI02.04 BAI06.01 BAI10.01 BAI10.02 MEA02.01 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Technical Standards | shared | x | Domain 2 | 6.03.01. (a) 6.03.04. (a) 6.03.04. (b) 6.03.04. (c) 6.03.04. (e) 6.07.01. (o) | Article 17 | NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 SA-2 NIST SP 800-53 R3 SA-4 | NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 SA-2 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SC-30 | 1.2.6 8.2.1 8.2.7 | A.12.1.1 A.15.2.2 | A.14.1.1 A.18.2.3 | 14.1.1 15.1.1 15.1.3 18.1.2 18.2.3 | 14.1.1 15.1.1 15.1.3 18.1.2 | Commandment #2 Commandment #4 Commandment #5 Commandment #11 | Chapter II, Article 19 and Chapter VI, Section I, Article 39 | CM-2 SA-2 SA-4 | AR-1 Governance and Privacy Program. TR-1 PRIVACY NOTICE. TR-3 DISSEMINATION OF PRIVACY PROGRAM INFORMATION | 4.4 5.1 | 1.1 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 2.2 2.2.1 2.2.2 2.2.3 2.2.4 | 1.1 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 2.2 2.2.1 2.2.2 2.2.3 2.2.4 | |||||||||
49 | Governance and Risk Management Data Focus Risk Assessments | GRM-02 | Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following: • Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements • Data classification and protection from unauthorized use, access, loss, destruction, and falsification | X | X | X | X | X | X | X | X | X | X | S3.1.0 C3.14.0 S1.2.b-c | (S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies. (S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies. c. Assessing risks on a periodic basis. | CC3.1 CC3.1 | L.4, L.5, L.6, L.7 | 34 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | DG-08 | PO 9.1 PO 9.2 PO 9.4 DS 5.7 | EDM03.02 APO01.03 APO12.01 APO12.02 APO12.03 APO12.04 BAI09.01 | 312.1 | BOSS > Operational Risk Management > Independent Risk Management | shared | x | Domain 5 | 6.01. (d) 6.04.03. (a) | Article 6, Article 8, Article 17 (1) | NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SI-12 | NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SI-12 | 1.2.4 8.2.1 | 45 CFR 164.308(a)(1)(ii)(A) 45 CFR 164.308(a)(8) | Clause 4.2.1 c) & g) Clause 4.2.3 d) Clause 4.3.1 & 4.3.3 Clause 7.2 & 7.3 A.7.2 A.15.1.1 A.15.1.3 A.15.1.4 | Clauses 5.2(c) 5.3(a) 5.3(b) 6.1.2 6.1.2(a)(2) 6.1.3(b) 7.5.3(b) 7.5.3(d) 8.1 8.2 8.3 9.2(g) A.18.1.1 A.18.1.3 A.18.1.4 A.8.2.2 | 8.2.2 18.1.1 18.1.3 | 8.2.2 18.1.1 18.1.3 | EAR 15 CFR §736.2 (b) | Commandment #1 Commandment #2 Commandment #3 Commandment #6 Commandment #7 Commandment #9 Commandment #10 Commandment #11 | CA-3 RA-2 RA-3 MP-8 PM-9 SI-12 | AR-2 Privacy Impact and Risk Assessment | 3.3 4.3 8.4 | PA10 PA18 | BSGP GP | 12.1 12.1.2 | 12.2 | ||||||||
50 | Governance and Risk Management Management Oversight | GRM-03 | Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility. | X | X | X | X | X | X | S1.2.f S2.3.0 | (S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2 | E.1 | E.4 | 5 (B) 65 (B) | Schedule 1 (Section 5) 4.1 Accountability; 4.7 Safeguards, Sub 4.7.4 | IS-14 | DS5.3 DS5.4 DS5.5 | APO01.03 APO01.04 APO01.08 DSS01.01 | 312.8 and 312.10 | BOSS > Human Resources Security > Roles and Responsibilities | shared | x | Domain 3, 9 | NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-5 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 | NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-5 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CA-7 (2) | 1.1.2 8.2.1 | Clause 5.2.2 A.8.2.1 A.8.2.2 A 11.2.4 A.15.2.1 | Clause 7.2(a,b) A.7.2.1 A.7.2.2 A.9.2.5 A.18.2.2 | 7.2.1 7.2.2 9.2.5 18.1.2 18.2.2 | 7.2.2 18.1.2 | Commandment #6 Commandment #7 Commandment #8 | AT-2 AT-3 CA-1 CA-5 CA-6 CA-7 PM-10 | AR-1 Governance and Privacy Program | 3.2 | 12.6.1 12.6.2 | 12.6, 7.3, 8.8, 9.10 | |||||||||||||||||
51 | Governance and Risk Management Management Program | GRM-04 | An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business: • Risk management • Security policy • Organization of information security • Asset management • Human resources security • Physical and environmental security • Communications and operations management • Access control • Information systems acquisition, development, and maintenance | X | X | X | X | X | X | X | X | X | X | X | X | x1.2. | (x1.2.) The entity’s system [availability, processing integrity, confidentiality and related] security policies include, but may not be limited to, the following matters: | A.1, B.1 | 2 (B) 3 (B) 5 (B) | Schedule 1 (Section 5), 4.1 - Accountability; 4.7 Safeguards | IS-01 | R2 DS5.2 R2 DS5.5 | APO13.01 APO13.02 APO13.03 | 312.8 and 312.10 | SRM > InfoSec Management > Capability Mapping | shared | x | Domain 2 | Article 17 | 99.31.(a)(1)(ii) | 8.2.1 | 45 CFR 164.308(a)(1)(i) 45 CFR 164.308(a)(1)(ii)(B) 45 CFR 164.316(b)(1)(i) 45 CFR 164.308(a)(3)(i) (New) 45 CFR 164.306(a) (New) | Clause 4.2 Clause 5 A.6.1.1 A.6.1.2 A.6.1.3 A.6.1.4 A.6.1.5 A.6.1.6 A.6.1.7 A.6.1.8 | All in sections 4, 5, 6, 7, 8, 9, 10. A.6.1.1 A.13.2.4 A.6.1.3 A.6.1.4 A.18.2.1 | 6.1.1 6.1.3 6.1.4 13.2.4 15.1.1 15.1.3 18.1.2 18.2.1 | 6.1.1 6.1.3 15.1.1 15.1.3 18.1.2 18.2.1 CLD.6.3.1 | Commandment #1 Commandment #2 | Chapter II, Article 19 | CIP-001-1a - R1 - R2 CIP-003-3 - R1 - R1.1 - R4 CIP-006-3c R1 | PM-1 PM-2 PM-3 PM-4 PM-5 PM-6 PM-7 PM-8 PM-9 PM-10 PM-11 | AR-1 Governance and Privacy Program | 4.1 | PA8 | BSGP | 12.1 12.2 | 12.1 12.2 | ||||||||
52 | Governance and Risk Management Management Support/Involvement | GRM-05 | Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned. | X | X | X | X | X | S1.3.0 | (S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned. The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users The security obligations of users and the entity’s security commitments to users are communicated to authorized users. | CC1.2 | C.1 | 5 (B) | Schedule 1 (Section 5), 4.1 Safeguards, Subsec. 4.1.1 | IS-02 | DS5.1 | APO01.02 APO01.03 APO01.04 APO01.08 APO13.01 APO13.02 APO13.03 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Compliance Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 CM-1 | NIST SP 800-53 R3 CM-1 | 8.2.1 | 45 CFR 164.316 (b)(2)(ii) 45 CFR 164.316 (b)(2)(iii) | Clause 5 A.6.1.1 | All in section 5 plus clauses 4.4 4.2(b) 6.1.2(a)(1) 6.2 6.2(a) 6.2(d) 7.1 7.4 9.3 10.2 7.2(a) 7.2(b) 7.2(c) 7.2(d) 7.3(b) 7.3(c) | Commandment #3 Commandment #6 | Chapter VI, Section I, Article 39 | CIP-003-3 - R1 - R1.1 | CM-1 PM-1 PM-11 | 4.1 | 12.5 | 12.4 | ||||||||||||||||||
53 | Governance and Risk Management Policy | GRM-06 | Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership. | X | X | X | X | X | X | S1.1.0 S1.3.0 S2.3.0 | (S1.1.0) The entity's security policies are established and periodically reviewed and approved by a designated individual or group. (S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned. (S2.3.0) Responsibility and accountability for the entity's system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2 CC1.2 CC2.3 | B.1 | Schedule 1 (Section 5) 4.1 Accountability, Subsec 4.1.4 | IS-03 | DS5.2 | APO01.03 APO01.04 APO13.01 APO13.02 | 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policies | shared | x | Domain 2 | 6.02. (e) | Article 17 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | 8.1.0 8.1.1 | 45 CFR 164.316 (a) 45 CFR 164.316 (b)(1)(i) 45 CFR 164.316 (b)(2)(ii) 45 CFR 164.308(a)(2) | Clause 4.2.1 Clause 5 A.5.1.1 A.8.2.2 | Clause 4.3 Clause 5 4.4 4.2(b) 6.1.2(a)(1) 6.2 6.2(a) 6.2(d) 7.1 7.4 9.3 10.2 7.2(a) 7.2(b) 7.2(c) 7.2(d) 7.3(b) 7.3(c) A5.1.1 A.7.2.2 | 5.1.1 7.2.2 15.1.1 15.1.3 18.1.2 | 5.1.1 7.2.2 15.1.1 15.1.3 18.1.2 | Commandment #1 Commandment #2 Commandment #3 | Chapter VI, Section I, Article 39 | CIP-003-3 - R1 -R1.1 - R1.2 - R2 - R2.1 - R2.2 - R2.3 | AC-1 AT-1 AU-1 CA-1 CM-1 IA-1 IR-1 MA-1 MP-1 MP-1 PE-1 PL-1 PS-1 SA-1 SC-1 SI-1 | 4.2 4.3 4.4 4.5 | PA30 | BSGP | 12.1 12.2 | 7.3, 8.8, 9.10, 12.1 12.2 | |||||||||||||
54 | Governance and Risk Management Policy Enforcement | GRM-07 | A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures. | X | X | X | X | X | X | S3.9 S2.4.0 | (S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis. (S2.4.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. | CC6.2 CC2.5 | B.1.5 | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 | IS-06 | PO 7.7 | APO01.03 APO01.08 APO07.04 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-8 | NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-8 | 99.31(a)(i)(ii) | 10.2.4 | 45 CFR 164.308 (a)(1)(ii)(C) | A.8.2.3 | A7.2.3 | 7.2.3 15.1.1 15.1.3 18.1.2 | 15.1.1 15.1.3 18.1.2 | Commandment #6 Commandment #7 | Chapter X, Article 64 | PL-4 PS-1 PS-8 | |||||||||||||||||||
55 | Governance and Risk Management Policy Impact on Risk Assessments | GRM-08 | Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective. | X | X | X | X | X | X | X | X | X | X | X | X | B.2 G.21 L.2 | B.1.1, B.1.2, B.1.6, B.1.7.2, G.2, L.9, L.10 | Schedule 1 (Section 5), 4.7 - Safeguards | RI-04 | PO 9.6 | APO12 APO13.01 APO13.03 | 312.8 and 312.10 | BOSS > Operational Risk Management > Risk Management Framework | shared | x | Domain 2, 4 | 6.03. (a) | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | Clause 4.2.3 Clause 4.2.4 Clause 4.3.1 Clause 5 Clause 7 A.5.1.2 A.10.1.2 A.10.2.3 A.14.1.2 A.15.2.1 A.15.2.2 | Clause 4.2.1 a, 4.2(b) 4.3 c, 4.3(a&b) 4.4 5.1(c) 5.1(d) 5.1(e) 5.1(f) 5.1(g) 5.1(h) 5.2 5.2 e, 5.2(f) 5.3 6.1.1(e)(2), 6.1.2(a)(1) 6.2 6.2(a) 6.2(d) 6.2 e, 6.12 (a) (2), 7.1 7.2(a), 7.2(b) 7.2(c) 7.2(d) 7.3(b), 7.3(c) 7.4 7.5.1 (a) 8.1*, partial 8.2 9.1 9.1 e, 9.2, 9.3 9.3(a) 9.3(b&f) 9.3(c), 9.3(c)(1) 9.3(c)(2), 9.3(c)(3) 9.3(d) 9.3(e) 10.1(c) 10.2, A.5.1.2 A.12.1.2 A.15.2.2 A.17.1.1 A.18.2.2 A.18.2.3 | 15.1.1 15.1.3 | 12.1.2 15.1.1 15.1.3 | CIP-009-3 - R2 | CP-2 RA-2 RA-3 | AR-2 Privacy Impact and Risk Assessment | 4.3 | 12.1.3 | 12.2 | ||||||||||||||
56 | Governance and Risk Management Policy Reviews | GRM-09 | The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations. | X | X | X | X | X | X | S1.1.0 | (S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group. | CC3.2 | B.2 | B.1.33. B.1.34, | IS-05 | DS 5.2 DS 5.4 | APO12 APO13.01 APO13.03 MEA03.01 MEA03.02 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Policy Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | 1.2.1 8.2.7 10.2.3 | 45 CFR 164.316 (b)(2)(iii) 45 CFE 164.306€ | Clause 4.2.3 f) A.5.1.2 | Clause 8.1 A.5.1.2 | 5.1.2 15.1.1 15.1.3 18.1.2 | 15.1.1 15.1.3 18.1.2 | Commandment #1 Commandment #2 Commandment #3 | CIP-003-3 - R3.2 - R3.3 - R1.3 R3 - R3.1 - R3.2 - R3.3 | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IA-5 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 RA-1 SA-1 SC-1 SI-1 | 4.1 6.1 | 12.1.3 | 12.1.1 | |||||||||||||||||
57 | Governance and Risk Management Risk Assessments | GRM-10 | Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance). | X | X | X | X | X | X | X | X | X | X | X | X | S3.1 x3.1.0 S4.3.0 | (S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats. (S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality of data, processing integrity, and system security is assessed on a timely basis; policies are updated for that assessment. | CC3.1 CC3.3 | I.1 I.4 | C.2.1, I.4.1, I.5, G.15.1.3, I.3 | 46 (B) 74 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | RI-02 | PO 9.4 | APO12 | 312.8 and 312.10 | BOSS > Operational Risk Management > Risk Management Framework | shared | x | Domain 2, 4 | 6.03. (a) 6.08. (a) | Article 17 (1), (2) | NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 | NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SC-30 | 1.2.4 1.2.5 | 45 CFR 164.308 (a)(1)(ii)(A) | Clause 4.2.1 c) through g) Clause 4.2.3 d) Clause 5.1 f) Clause 7.2 & 7.3 A.6.2.1 A.12.5.2 A.12.6.1 A.14.1.2 A.15.1.1 A.15.2.1 A.15.2.2 | Clause 4.2(b), 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.17.1.1 A.18.1.1 A.18.2.2 A.18.2.3 | 12.6.1 14.2.3 15.1.1 15.1.3 | 12.6.1 15.1.1 15.1.3 18.1.1 | CIP-002-3 - R1.1 - R1.2 CIP-005-3a - R1 - R1.2 CIP-009-3 - R.1.1 | PL-5 RA-2 RA-3 | 1.1 3.3 5.1 5.2 5.3 5.4 7.1 12.2 17.7 18.1 18.3 | PA2 PA15 | BSGP SGP | 12.1.2 | 12.2 | |||||||
58 | Governance and Risk Management Risk Management Framework | GRM-11 | Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and stakeholder approval. | X | X | X | X | X | X | X | X | X | X | X | X | S3.1 x3.1.0 | (S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats. | CC3.1 | L.2 | A.1, L.1 | Schedule 1 (Section 5), 4.7 - Safeguards | RI-01 | PO 9.1 | EDM03.02 APO01.03 APO12 | 312.8 and 312.10 | BOSS > Operational Risk Management > Risk Management Framework | shared | x | Domain 2, 4 | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SA-9 (1) NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 CM-1 | 1.2.4 | 45 CFR 164.308 (a)(8) 45 CFR 164.308(a)(1)(ii)(B) | Clause 4.2.1 c) through g) Clause 4.2.2 b) Clause 5.1 f) Clause 7.2 & 7.3 A.6.2.1 A.12.6.1 A.14.1.2 A.15.2.1 A.15.2.2 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.12.6.1 A.17.1.1 A.18.2.2 A.18.2.3 | 12.6.1 15.1.1 15.1.3 17.1.1 18.2.2 | 12.6.1 15.1.1 15.1.3 | Chapter II Article 19 | CIP-009-3 - R4 | AC-4 CA-2 CA-6 PM-9 RA-1 | AR-2 Privacy Impact and Risk Assessment | 3.2 (responsibility) 3.3 3.4 4.1 4.3 5.2 (residual Risk) | 12.1.2 | 12.2 | |||||||||
59 | Human Resources Asset Returns | HRS-01 | Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period. | X | X | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | D.1 | E.6.4 | Schedule 1 (Section 5) 4.5 Limiting Use, Disclosure and Retention; 4.7 Safeguards, Subs. 4.7.5 | IS-27 | APO01.08 APO07.06 APO13.01 BAI09.03 | 312.3, 312.8 and 312.10 | BOSS > Human Resources Security > Employee Termination | provider | x | Domain 2 | Article 17 | NIST SP 800-53 R3 PS-4 | NIST SP 800-53 R3 PS-4 | 5.2.3 7.2.2 8.2.1 8.2.6 | 45 CFR 164.308 (a)(3)(ii)(C) | A.7.1.1 A.7.1.2 A.8.3.2 | A.8.1.1 A.8.1.2 A.8.1.4 | 8.1.1 8.1.2 8.1.4 | 8.1.1 | PS-4 | 2.2 | 9.3 | ||||||||||||||
60 | Human Resources Background Screening | HRS-02 | Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk. | X | X | X | X | X | X | X | S3.11.0 | (S3.11.0) Procedures exist to help ensure that personnel responsible for the design, development, implementation, and operation of systems affecting confidentiality and security have the qualifications and resources to fulfill their responsibilities. | CC1.3 CC1.4 | E.2 | E.2 | 63 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | HR-01 | PO 7.6 | APO07.01 APO07.05 APO07.06 | 312.8 and 312.10 | BOSS > Human Resources Security > Background Screening | shared | x | None | 6.01. (a) | Article 17 | NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3 | NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3 | 1.2.9 | A.8.1.2 | A.7.1.1 | 7.1.1 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #2 Commandment #3 Commandment #6 Commandment #9 | CIP-004-3 - R2.2 | PS-2 PS-3 | 9.29 | PA27 | BSGP | 12.7 12.8.3 | 12.7 12.8.3 | ||||||||||||
61 | Human Resources Employment Agreements | HRS-03 | Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets. | X | X | X | X | X | X | X | X | X | X | X | X | S2.2.0 | (S2.2.0) The security obligations of users and the entity's security commitments to users are communicated to authorized users | CC2.2 CC2.3 | C.1 | E.3.5 | 66 (B) | Schedule 1 (Section 5) 4.7 Safeguards, Subsec. 4.7.4 | HR-02 | DS 2.1 | APO01.03 APO13.01 APO07.06 APO09.03 APO10.01 | 312.3, 312.8 and 312.10 | BOSS > Human Resources Security > Employee Code of Conduct | shared | x | None | Article 17 | NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7 | NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7 | 1.2.9 8.2.6 | 45 CFR 164.310(a)(1) 45 CFR 164.308(a)(4)(i) | A.6.1.5 A.8.1.3 | A.13.2.4 A.7.1.2 | 7.1.2 13.2.4 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #6 Commandment #7 | PL-4 PS-6 PS-7 | 9.2 | PA27 | BSGP | 12.4 12.8.2 | |||||||||
62 | Human Resources Employment Termination | HRS-04 | Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated. | X | X | X | X | X | X | S3.2.d S3.8.e | (S3.2.d) Procedures exist to restrict logical access to the system and information resources maintained in the system including, but not limited to, the following matters: d. The process to make changes and updates to user profiles (S3.8.e) e. Procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own | CC5.4 | E.6 | HR-03 | PO 7.8 | APO01.02 APO07.05 APO07.06 | 312.8 and 312.10 | BOSS > Human Resources Security > Roles and Responsibilities | shared | x | None | Article 17 | NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-5 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-8 | NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-5 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-8 | 8.2.2 10.2.5 | 45 CFR 164.308 (a)(3)(ii)(C) | A.8.3.1 | A.7.3.1 | 7.3.1 | Commandment #6 Commandment #7 | PS-4 PS-5 | PA27 | BSGP | |||||||||||||||||||||
63 | Human Resources Mobile Device Management | HRS-05 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring). | X | X | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | G.11, G12, G.20.13, G.20.14 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-32 | DS5.11 DS5.5 | APO01.08 APO13.01 APO13.02 DSS05.01 DSS05.02 DSS05.03 DSS05.07 DSS06.03 DSS06.06 | 312.8 and 312.10 | Presentation Services > Presentation Platform > Endpoints - Mobile Devices - Mobile Device Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-17 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-19 NIST SP 800-53 R3 MP-2 NIST SP 800-53 R3 MP-6 | NIST SP 800-53 R3 AC-17 NIST SP 800-53 R3 AC-17 (1) NIST SP 800-53 R3 AC-17 (2) NIST SP 800-53 R3 AC-17 (3) NIST SP 800-53 R3 AC-17 (4) NIST SP 800-53 R3 AC-17 (5) NIST SP 800-53 R3 AC-17 (7) NIST SP 800-53 R3 AC-17 (8) NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-18 (1) NIST SP 800-53 R3 AC-18 (2) NIST SP 800-53 R3 AC-19 NIST SP 800-53 R3 AC-19 (1) NIST SP 800-53 R3 AC-19 (2) NIST SP 800-53 R3 AC-19 (3) NIST SP 800-53 R3 MP-2 NIST SP 800-53 R3 MP-2 (1) NIST SP 800-53 R3 MP-4 NIST SP 800-53 R3 MP-4 (1) NIST SP 800-53 R3 MP-6 NIST SP 800-53 R3 MP-6 (4) | 1.2.6 3.2.4 8.2.6 | 45 CFR 164.310 (d)(1) | A.7.2.1 A.10.7.1 A.10.7.2 A.10.8.3 A.11.7.1 A.11.7.2 A.15.1.4 | A.8.2.1 A.8.3.1 A.8.3.2 A.8.3.3 A.6.2.1 A.6.2.2 A.18.1.4 | 6.2.1 6.2.2 8.2.1 8.3.1 8.3.2 8.3.3 18.1.4 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | All | CIP-007-3 - R7.1 | AC-17 AC-18 AC-19 MP-2 MP-4 MP-6 | 19.1 19.2 19.3 | PA33 PA34 | SGP SGP | 9.7 9.7.2 9.8 9.9 11.1 12.3 | 11.1 12.3 | |||||||||
64 | Human Resources Non-Disclosure Agreements | HRS-06 | Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals. | X | X | X | X | X | X | X | S4.1.0 | (S4.1.0) The entity’s system availability, confidentiality, processing integrity and security performance is periodically reviewed and compared with the defined system availability and related security policies. | CC4.1 | C.2.5 | Schedule 1 (Section 5), 4.7 - Safeguards | LG-01 | APO01.02 APO01.03 APO01.08 APO07.06 APO09.03 APO10.04 APO13.01 APO13.03 | 312.8 and 312.10 | BOSS > Compliance > Intellectual Property Protection | shared | x | Domain 3 | Article 16 | NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-9 | NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SA-9 (1) | 1.2.5 | ISO/IEC 27001:2005 Annex A.6.1.5 | A.13.2.4 | 13.2.4 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #6 Commandment #7 Commandment #8 Commandment #9 | PL-4 PS-6 SA-9 | DI-2 DATA INTEGRITY AND DATA INTEGRITY BOARD a. Documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls; and b. Establishes a Data Integrity Board when appropriate to oversee organizational Computer Matching Agreements123 and to ensure that those agreements comply with the computer matching provisions of the Privacy Act. IP-1 CONSENT a. Provides means, where feasible and appropriate, for individuals to authorize the collection, use, maintaining, and sharing of personally identifiable information (PII) prior to its collection; b. Provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection, use, dissemination, and retention of PII; c. Obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII; and d. Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII. | PA7 | BSGP | 12.8.2 12.8.3 12.8.4 | ||||||||||||||||||
65 | Human Resources Roles / Responsibilities | HRS-07 | Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security. | X | X | X | X | X | X | X | X | X | X | X | X | S1.2.f | (S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security. | B.1 | B.1.5, D.1.1,D.1.3.3, E.1, F.1.1, H.1.1, K.1.2 | 5 (B) | Schedule 1 (Section 5) 4.1 Accountability | IS-13 | DS5.1 | APO01.02 APO01.03 APO01.08 APO07.06 APO09.03 APO10.04 APO13.01 APO13.03 | 312.3, 312.8 and 312.10 | BOSS > Human Resources Security > Roles and Responsibilities | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7 | NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7 | 99.31(a)(1)(ii) | 1.2.9 8.2.1 | Clause 5.1 c) A.6.1.2 A.6.1.3 A.8.1.1 | Clause 5.3 A.6.1.1 A.6.1.1 | 6.1.1 | 6.1.1 | Commandment #6 Commandment #7 Commandment #8 | AT-3 PL-4 PM-10 PS-1 PS-6 PS-7 | AR-1 GOVERNANCE AND PRIVACY PROGRAM Control: The organization: Supplemental Guidance: The development and implementation of a comprehensive governance and privacy program demonstrates organizational accountability for and commitment to the protection of individual privacy. Accountability begins with the appointment of an SAOP/CPO with the authority, mission, resources, and responsibility to develop and implement a multifaceted privacy program. The SAOP/CPO, in consultation with legal counsel, information security officials, and others as appropriate: (i) ensures the development, implementation, and enforcement of privacy policies and procedures; (ii) defines roles and responsibilities for protecting PII; (iii) determines the level of information sensitivity with regard to PII holdings; (iv) identifies the laws, regulations, and internal policies that apply to the PII; (v) monitors privacy best practices; and (vi) monitors/audits compliance with identified privacy controls. AR-3 PRIVACY REQUIREMENTS FOR CONTRACTORS AND SERVICE PROVIDERS Control: The organization: a. Establishes privacy roles, responsibilities, and access requirements for contractors and service providers; and b. Includes privacy requirements in contracts and other acquisition-related documents. | 2.2 | PA9 PA24 | BSGP | 12.8.5 | |||||||||
66 | Human Resources Technology Acceptable Use | HRS-08 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate. | X | X | X | X | X | X | X | X | S1.2 S3.9 | (S1.2) The entity’s security policies include, but may not be limited to, the following matters: (S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis. | CC3.2 CC6.2 | B.3 | B.1.7, D.1.3.3, E.3.2, E.3.5.1, E.3.5.2 | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 | IS-26 | DS 5.3 | APO01.03 APO01.08 APO13.01 APO13.02 DSS05.04 DSS06.06 | 312.4, 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policies | shared | x | Domain 2 | Article 5, Article 6 Article 7 | NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-8 NIST SP 800-53 R3 AC-20 NIST SP 800-53 R3 PL-4 | NIST SP 800-53 R3 AC-8 NIST SP 800-53 R3 AC-20 NIST SP 800-53 R3 AC-20 (1) NIST SP 800-53 R3 AC-20 (2) NIST SP 800-53 R3 PL-4 | 8.1.0 | 45 CFR 164.310 (b) | A.7.1.3 | A.8.1.3 | 8.1.3 | Commandment #1 Commandment #2 Commandment #3 | AC-8 AC-20 PL-4 | 2.2 5.2 4.2 | 12.3.5 | 12.3 | ||||||||||||||||
67 | Human Resources Training / Awareness | HRS-09 | A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization. | X | X | X | X | X | X | X | X | X | X | X | X | S1.2.k S2.2.0 | (S1.2.k) The entity's security policies include, but may not be limited to, the following matters: k. Providing for training and other resources to support its system security policies (S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. | CC2.2 CC2.3 | E.1 | E.4 | 65 (B) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4 | IS-11 | PO 7.4 | APO01.03 APO01.08 APO07.03 APO07.06 APO13.01 APO13.03 | 312.8 and 312.10 | SRM > GRC > | shared | x | Domain 2 | 6.01. (c) 6.02. (e) | NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 | NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 | 99.31(a)(1)(ii) | 1.2.10 8.2.1 | 45 CFR 164.308 (a)(5)(i) 45 CFR 164.308 (a)(5)(ii)(A) | Clause 5.2.2 A.8.2.2 | Clause 7.2(a), 7.2(b) A.7.2.2 | 7.2.2 | 7.2.2 | Commandment #3 Commandment #6 | Chapter VI, Section I, Article 39 and Chapter VI, Section II, Article 41 | CIP-004-3 - R1 - R2 - R2.1 | AT-1 AT-2 AT-3 AT-4 | AR-5 PRIVACY AWARENESS AND TRAINING Control: The organization: a. Develops, implements, and updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures; b. Administers basic privacy training [Assignment: organization-defined frequency, at least annually] and targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII [Assignment: organization-defined frequency, at least annually]; and c. Ensures that personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements [Assignment: organization-defined frequency, at least annually]. | 9.1 | PA28 | BSGP | 12.6 12.6.1 12.6.2 | 12.6 | ||||
68 | Human Resources User Responsibility | HRS-10 | All personnel shall be made aware of their roles and responsibilities for: • Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. • Maintaining a safe and secure working environment | X | X | X | X | X | X | X | X | X | X | X | X | S2.3.0 | (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality, processing integrity and security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2 | E.1 | E.4 | 65 (B) 66 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.4 | IS-16 | PO 4.6 | APO01.02 APO01.03 APO01.08 APO07.03 APO07.06 APO13.01 APO13.03 | 312.8 and 312.10 | BOSS > Human Resources Security > Employee Awareness | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 NIST SP 800-53 R3 PL-4 | NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 NIST SP 800-53 R3 PL-4 | 1.2.10 8.2.1 | 45 CFR 164.308 (a)(5)(ii)(D) | Clause 5.2.2 A.8.2.2 A.11.3.1 A.11.3.2 | Clause 7.2(a), 7.2(b) A.7.2.2 A.9.3.1 A.11.2.8 | 7.2.2 9.3.1 11.2.8 | 7.2.2 | Commandment #5 Commandment #6 Commandment #7 | Chapter VI, Section I, Article 39 and Chapter VI, Section II, Article 41 | AT-2 AT-3 AT-4 PL-4 | UL-1 INTERNAL USE Control: The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices. | 9.1 | 8.5.7 12.6.1 | 12.4 | ||||||||
69 | Human Resources Workspace | HRS-11 | Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity. | X | X | X | X | X | X | X | X | S3.3.0 S3.4.0 | (S3.3.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.4.0) Procedures exist to protect against unauthorized access to system resources. | CC5.5 CC5.6 | E.1 | E.4 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-17 | APO01.02 APO01.03 APO01.08 APO07.03 APO07.06 APO13.01 APO13.03 DSS05.03 DSS06.06 | 312.8 and 312.10 | BOSS > Data Governance > Clear Desk Policy | shared | x | Domain 2 | NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-2 | NIST SP 800-53 R3 AC-11 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-2 NIST SP 800-53 R3 MP-2 (1) NIST SP 800-53 R3 MP-3 NIST SP 800-53 R3 MP-4 NIST SP 800-53 R3 MP-4 (1) | 8.2.3 | Clause 5.2.2 A.8.2.2 A.9.1.5 A.11.3.1 A.11.3.2 A.11.3.3 | Clause 7.2(a), 7.2(b) A.7.2.2 A.11.1.5 A.9.3.1 A.11.2.8 A.11.2.9 | 7.2.2 9.3.1 11.1.5 11.2.8 11.2.9 | 7.2.2 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #5 Commandment #6 Commandment #7 Commandment #11 | AC-11 MP-2 MP-3 MP-4 | 8.1 | 8.1.8 | ||||||||||||||||||
70 | Identity & Access Management Audit Tools Access | IAM-01 | Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segregated and access restricted to prevent inappropriate disclosure and tampering of log data. | X | X | X | X | X | X | X | X | X | X | S3.2.g | (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | CC5.1 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-29 | DS 5.7 | APO01.03 APO01.08 APO13.01 APO13.02 DSS05.03 DSS05.05 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Privilege Usage Management | shared | x | Domain 2 | 6.03. (i) 6.03. (j) | NIST SP 800-53 R3 AU-9 | NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-9 (2) | 8.2.1 | A.15.3.2 | Commandment #2 Commandment #5 Commandment #11 | CIP-003-3 - R5.2 | AU-9 AU-11 AU-14 | 15.4 | 10.5.5 | 10.5 7.1.2 7.1.4 7.2 8.1 8.1.5 8.5 | ||||||||||||||||||
71 | Identity & Access Management Credential Lifecycle / Provision Management | IAM-02 | User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: • Procedures, supporting roles, and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business relationships, or other third-party business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant)) • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multi-factor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions • Adherence to applicable legal, statutory, or regulatory compliance requirements | X | X | X | X | X | X | X | X | X | X | X | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters: c. Registration and authorization of new users. d. The process to make changes to user profiles. g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | B.1 | B.1.8, B.1.21, B.1.28, E.6.2, H.1.1, K.1.4.5, | 8 (B) 40 (B) 41 (B) 42 (B) 43 (B) 44 (C+) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4 | IS-07 | DS 5.4 | APO01.02 APO01.03 APO01.08 APO13.01 APO13.02 DSS05.04 DSS05.05 DSS05.06 DSS06.03 DSS06.06 | 312.8 and 312.10 | SRM > Policies and Standards > | shared | x | Domain 2 | 6.01. (b) 6.01. (d) 6.02. (e) 6.03. (b) 6.03.04. (b) 6.03.04. (c) 6.03.05. (b) 6.03.05. (d) 6.03.06. (b) 6.04.01. (c) 6.04.01. (f) 6.04.02. (a) 6.04.02. (b) 6.04.02. (c) 6.04.03. (b) 6.04.06. (a) 6.04.08. (a) 6.04.08. (b) 6.04.08. (c) 6.04.08.03. (a) 6.04.08.03. (b) | Article 17 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-7 NIST SP 800-53 R3 AC-14 NIST SP 800-53 R3 IA-1 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-7 NIST SP 800-53 R3 AC-10 NIST SP 800-53 R3 AC-14 NIST SP 800-53 R3 IA-1 | 8.1.0 | 45 CFR 164.308 (a)(3)(i) 45 CFR 164.312 (a)(1) 45 CFR 164.312 (a)(2)(ii) 45 CFR 164.308(a)(4)(ii)(B) 45 CFR 164.308(a)(4)(ii)(c ) | A.11.1.1 A.11.2.1 A.11.2.4 A.11.4.1 A.11.5.2 A.11.6.1 | A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.5 A.9.1.2 A.9.4.1 | 9.1.1 9.1.2 9.2.1 9.2.2 9.2.5 9.4.1 | 9.2.1 9.2.2 9.1.2 9.4.1 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #6 Commandment #7 Commandment #8 | CIP-007-3 - R5.1 - R5.1.2 | AC-1 IA-1 | 15.1 15.2 | 3.5.1 8.5.1 12.5.4 | 3.5.1, 7.0 8.0 12.5.4 | |||||||||
72 | Identity & Access Management Diagnostic / Configuration Ports Access | IAM-03 | User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications. | X | X | X | X | X | X | X | S3.2.g | (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | CC5.1 | H1.1, H1.2, G.9.15 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-30 | DS5.7 | APO13.01 DSS05.02 DSS05.03 DSS05.05 DSS06.06 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Privilege Usage Management - Resource Protection | provider | x | Domain 2 | NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-5 | NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1) NIST SP 800-53 R3 MA-3 NIST SP 800-53 R3 MA-3 (1) NIST SP 800-53 R3 MA-3 (2) NIST SP 800-53 R3 MA-3 (3) NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-4 (1) NIST SP 800-53 R3 MA-4 (2) NIST SP 800-53 R3 MA-5 | A.10.6.1 A.11.1.1 A.11.4.4 A.11.5.4 | A.13.1.1 A.9.1.1 A.9.4.4 | 9.1.1 9.4.4 13.1.1 | 9.4.4 | Commandment #3 Commandment #4 Commandment #5 Commandment #6 Commandment #7 Commandment #8 | CIP-007-3 - R2 | CM-7 MA-3 MA-4 MA-5 | 15.4 | 9.1.2 | 1.2.2 7.1 7.1.2 7.1.3 7.2 7.2.3 9.1.2 9.1.3 | |||||||||||||||||||
73 | Identity & Access Management Policies and Procedures | IAM-04 | Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity. | X | X | X | X | X | X | X | X | X | X | X | -- | APO01.03 APO01.08 APO13.01 APO13.02 DSS05.02 DSS05.04 DSS06.06 | SRM > Policies and Standards > Information Security Policies | Domain 12 | Annex A.9.2 A.9.2.1 A.9.2.2 A.9.2.3, A.9.2.4, A.9.2.5, A.9.2.6 | 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 | 9.2 9.2.1 9.2.2 9.2.3 9.2.4 | Clause 9.2 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 | 7.3 8.8 9.10 | |||||||||||||||||||||||||||||||
74 | Identity & Access Management Segregation of Duties | IAM-05 | User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest. | X | X | X | X | X | X | X | X | X | X | X | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | G.2.13. G.3, G.20.1, G.20.2, G.20.5 | Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3(b) | IS-15 | DS 5.4 | APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 | 312.8 and 312.10 | ITOS > Resource Management > Segregation of Duties | shared | x | Domain 2 | 6.04.01. (d) 6.04.08.02. (a) | Article 17 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-6 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-2 (1) NIST SP 800-53 R3 AC-2 (2) NIST SP 800-53 R3 AC-2 (3) NIST SP 800-53 R3 AC-2 (4) NIST SP 800-53 R3 AC-2 (7) NIST SP 800-53 R3 AC-5 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1) NIST SP 800-53 R3 AC-6 (2) NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-6 (1) NIST SP 800-53 R3 AU-6 (3) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) | 99.31(a)(1)(ii) | 8.2.2 | 45 CFR 164.308 (a)(1)(ii)(D) 45 CFR 164.308 (a)(3)(ii)(A) 45 CFR 164.308(a)(4)(ii)(A) 45 CFR 164.308 (a)(5)(ii)(C) 45 CFR 164.312 (b) | A.10.1.3 | A.6.1.2 | 6.1.2 | Commandment #6 Commandment #7 Commandment #8 Commandment #10 | CIP-007-3 R5.1.1 | AC-1 AC-2 AC-5 AC-6 AU-1 AU-6 SI-1 SI-4 | 3.0 3.1 3.2 3.3 3.4 3.5 | PA24 | P | 6.4.2 | 6.4.2, 7.3 8.8 9.10 | |||||||||
75 | Identity & Access Management Source Code Access Restriction | IAM-06 | Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures. | X | X | X | X | X | X | X | X | S3.13.0 | (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.4 | I.2.7.2, I.2.9, I.2.10, I.2.15 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-33 | APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 | ITOS > Service Support > Release Management - Source Code Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1) NIST SP 800-53 R3 CM-5 (5) | 1.2.6 6.2.1 | Clause 4.3.3 A.12.4.3 A.15.1.3 | Clause 5.2(c) 5.3(a), 5.3(b), 7.5.3(b) 7.5.3(d) 8.1, 8.3 9.2(g) A.9.4.5 A.18.1.3 | 9.4.5 18.1.3 | 18.1.3 | 9.4.5 18.1.3 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #6 Commandment #7 Commandment #9 Commandment #10 | CM-5 CM-6 | 9.4 14.1 14.2 19.1 | 6.4.1 6.4.2 | 6.4.1 6.4.2, 7.1 7.1.1 7.1.2 7.1.3 7.1.4 7.2 7.2.2 7.3 | ||||||||||||||||||
76 | Identity & Access Management Third Party Access | IAM-07 | The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access. | X | X | X | X | X | X | X | X | X | X | X | X | S3.1 x3.1.0 | (S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats. | CC3.1 | B.1 H.2 | B.1.1, B.1.2, D.1.1, E.1, F.1.1, H.1.1, K.1.1, E.6.2, E.6.3 | Schedule 1 (Section 5), 4.7 - Safeguards | RI-05 | DS 2.3 | APO01.03 APO01.08 APO07.06 APO10.04 APO13.02 DSS05.04 DSS05.07 DSS06.03 DSS06.06 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Vendor Management | shared | x | Domain 2, 4 | 6.02. (a) 6.02. (b) 6.03. (a) | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1 | 7.1.1 7.1.2 7.2.1 7.2.2 7.2.3 7.2.4 | A.6.2.1 A.8.3.3 A.11.1.1 A.11.2.1 A.11.2.4 | A.9.2.6 A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.5 | 9.1.1 9.2.1 9.2.2 9.2.5 9.2.6 | 9.2.1 9.2.2 CLD12.4.5 | 9.1.1 9.2.1 9.2.2 9.2.5 9.2.6 | CA-3 MA-4 RA-3 | "FTC Fair Information Principles Integrity/Security Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm". UL-2 INFORMATION SHARING WITH THIRD PARTIES | 2.2 4.3 | 12.8.1 12.8.2 12.8.3 12.8.4 | 12.8 12.2 | ||||||||||
77 | Identity & Access Management Trusted Sources | IAM-08 | Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary. | X | X | X | X | X | S3.2.0 S4.3.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters: c. Registration and authorization of new users. d. The process to make changes to user profiles. g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). (S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality, processing integrity and security is assessed on a timely basis; policies are updated for that assessment. | CC3.3 | IS-08 IS-12 | APO01.03 APO01.08 APO10.04 APO13.02 DSS05.04 DSS06.03 DSS06.06 | 312.8 and 312.10 | Information Services > User Directory Services > Active Directory Services, LDAP Repositories, X.500 Repositories, DBMS Repositories, Meta Directory Services, Virtual Directory Services | shared | x | Domain 12 | Annex A.9.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.5, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.5 | 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 9.3.1 9.4.1 9.4.2 9.4.3 9.4.5 | 9.2 9.2.1 9.2.2 9.2.3 9.2.4 9.4.1 | 9.2 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 9.3.1 9.4.1 9.4.2 9.4.3 9.4.5 | "FTC Fair Information Principles Integrity/Security Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm" | 3.2 9.2 15.2 | 7.1 7.1.1 7.1.2 7.1.3 7.1.4 7.2 | |||||||||||||||||||||||||||||
78 | Identity & Access Management User Access Authorization | IAM-09 | Provisioning user access (e.g., employees, contractors, customers (tenants), business partners, and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control. | X | X | X | X | X | X | X | X | X | X | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters: c. Registration and authorization of new users. d. The process to make changes to user profiles. g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | H.2.4, H.2.5, | 35 (B) 40 (B) 41 (B) 42 (B) 44 (C+) | Schedule 1 (Section 5) Safeguards, Subs. 4.7.2 and 4.7.3 | IS-08 | DS5.4 | APO01.03 APO01.08 APO07.06 APO10.04 APO13.02 DSS05.04 DSS06.03 DSS06.06 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Identity Management - Identity Provisioning | shared | x | Domain 2 | 6.03.04. (b) 6.03.04. (c) 6.03.05. (d) 6.03.06. (a) 6.03.06. (b) 6.04.01. (a) 6.04.01. (b) 6.04.01. (d) 6.04.01. (e) 6.04.01. (g) 6.04.03. (c) 6.04.08.02. (a) | Article 17 | NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 MA-5 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-7 | NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 AC-3 (3) NIST SP 800-53 R3 AC-5 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1) NIST SP 800-53 R3 AC-6 (2) NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-2 (2) NIST SP 800-53 R3 IA-2 (3) NIST SP 800-53 R3 IA-2 (8) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-4 (4) NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 MA-5 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SI-9 | 8.2.2 | 45 CFR 164.308 (a)(3)(i) 45 CFR 164.308 (a)(3)(ii)(A) 45 CFR 164.308 (a)(4)(i) 45 CFR 164.308 (a)(4)(ii)(B) 45 CFR 164.308 (a)(4)(ii)(C) 45 CFR 164.312 (a)(1) | A.11.2.1 A.11.2.2 A.11.4.1 A 11.4.2 A.11.6.1 | A.9.2.1, A.9.2.2 A.9.2.3 A.9.1.2 A.9.4.1 | 9.1.2 9.2.1 9.2.2 9.2.3 9.4.1 | 9.2.1 9.2.2 9.2.3 9.1.2 9.4.1 | Commandment #6 Commandment #7 Commandment #8 Commandment #9 Commandment #10 | CIP-003-3 - R5.1.1 - R5.3 CIP-004-3 R2.3 CIP-007-3 R5.1 - R5.1.2 | AC-3 AC-5 AC-6 IA-2 IA-4 IA-5 IA-8 MA-5 PS-6 SA-7 SI-9 | AP-1 The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need. | 9.2 15.2 | PA24 | GP | 7.1 7.1.1 7.1.2 7.1.3 7.2.1 7.2.2 8.5.1 12.5.4 | 7.1 7.1.1 7.1.2 7.1.3 7.1.4 12.5.4 | |||||||||
79 | Identity & Access Management User Access Reviews | IAM-10 | User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures. | X | X | X | X | X | X | X | X | X | X | X | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters: d. The process to make changes to user profiles. g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | H.2.6, H.2.7, H.2.9, | 41 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | IS-10 | DS5.3 DS5.4 | APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 DSS06.06 MEA01.03 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Authorization Services - Entitlement Review | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7 | NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-2 (1) NIST SP 800-53 R3 AC-2 (2) NIST SP 800-53 R3 AC-2 (3) NIST SP 800-53 R3 AC-2 (4) NIST SP 800-53 R3 AC-2 (7) NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-6 (1) NIST SP 800-53 R3 AU-6 (3) NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7 | 99.31(a)(1)(ii) | 8.2.1 8.2.7 | 45 CFR 164.308 (a)(3)(ii)(B) 45 CFR 164.308 (a)(4)(ii)(C) | A.11.2.4 | A.9.2.5 | 9.2.5 | 9.2.5 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #6 Commandment #7 Commandment #8 Commandment #10 | CIP-004-3 R2.2.2 CIP-007-3 - R5 - R.1.3 | AC-2 AU-6 PM-10 PS-6 PS-7 | 9.2 | 8.1.4 | |||||||||||
80 | Identity & Access Management User Access Revocation | IAM-11 | Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change, or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control. | X | X | X | X | X | X | X | X | X | X | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters: d. The process to make changes to user profiles. g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | H.2 | E.6.2, E.6.3 | Schedule 1 (Section 5), 4.7 - Safeguards | IS-09 | DS 5.4 | APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 DSS06.06 MEA01.03 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Identity Management - Identity Provisioning | shared | x | Domain 2 | 6.03.04. (b) 6.03.04. (c) 6.03.05. (d) 6.03.06. (a) 6.04.02. (b) | Article 17 | NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-5 | NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-2 (1) NIST SP 800-53 R3 AC-2 (2) NIST SP 800-53 R3 AC-2 (3) NIST SP 800-53 R3 AC-2 (4) NIST SP 800-53 R3 AC-2 (7) NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-5 NIST SP 800-53 R3 SC-30 | 99.31(a)(1)(ii) | 8.2.1 | 45 CFR 164.308(a)(3)(ii)(C) | ISO/IEC 27001:2005 A.8.3.3 A.11.1.1 A.11.2.1 A.11.2.2 | Annex A A.9.2.6 A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.3 | 9.1.1 9.2.1 9.2.2 9.2.3 9.2.6 | 9.2.1 9.2.2 9.2.3 | 9.1.1 9.2.1 9.2.2. 9.2.3. 9.2.6 | ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b) | Commandment #6 Commandment #7 Commandment #8 | CIP-004-3 R2.2.3 CIP-007-3 - R5.1.3 -R5.2.1 - R5.2.3 | AC-2 PS-4 PS-5 | "FTC Fair Information Principles Integrity/Security Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm" | 9.2 | 8.5.4 8.5.5 | 8.1.3 8.1.4 8.1.5, 12.5.4 | ||||||||
81 | Identity & Access Management User ID Credentials | IAM-12 | Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures: • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets) | X | X | X | X | X | X | X | X | X | S3.2.b | (S3.2.b) b. Identification and authentication of users. | CC5.3 | B.1 H.5 | E.6.2, E.6.3, H.1.1, H.1.2, H.2, H.3.2, H.4, H.4.1, H.4.5, H.4.8 | 6 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-02 | DS5.3 DS5.4 | APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 DSS06.06 MEA01.03 | 312.8 and 312.10 | SRM > Policies and Standards > Technical Security Standards | shared | x | Domain 10 | 6.03.04. (b) 6.03.04. (c) 6.03.05. (d) 6.04.05. (b) | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-6 NIST SP 800-53 R3 IA-8 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 AC-11 NIST SP 800-53 R3 AC-11 (1) NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-2 (3) NIST SP 800-53 R3 AU-2 (4) NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-2 (2) NIST SP 800-53 R3 IA-2 (3) NIST SP 800-53 R3 IA-2 (8) NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IA-6 NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 SC-10 | 99.3 99.31(a)(1)(ii) | 45 CFR 164.308(a)(5)(ii)(c) 45 CFR 164.308 (a)(5)(ii)(D) 45 CFR 164.312 (a)(2)(i) 45 CFR 164.312 (a)(2)(iii) 45 CFR 164.312 (d) | A.8.3.3 A.11.1.1 A.11.2.1 A.11.2.3 A.11.2.4 A.11.5.5 | A.9.2.6 A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.4 A.9.2.5 A.9.4.2 | 9.1.1 9.2.1 9.2.2 9.2.4 9.2.5 9.2.6 9.4.2 | 9.2.1 9.2.2 9.2.4 | 9.1.1 9.2.1 9.2.2 9.2.4 9.2.5 9.2.6 | Commandment #6 Commandment #7 Commandment #8 Commandment #9 | CIP-004-3 R2.2.3 CIP-007-3 - R5.2 - R5.3.1 - R5.3.2 - R5.3.3 | AC-1 AC-2 AC-3 AC-11 AU-2 AU-11 IA-1 IA-2 IA-5 IA-6 IA-8 SC-10 | "FTC Fair Information Principles Integrity/Security Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm" | 15.1 15.2 | PA9 PA6 PA24 PA22 | BSGP BSGP P GP | 8.1 8.2, 8.3 8.4 8.5 10.1, 12.2, 12.3.8 | 8.0 10.1, 12.3 | |||||||
82 | Identity & Access Management Utility Programs Access | IAM-13 | Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted. | X | X | X | X | X | X | X | X | X | X | S3.2.g | (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | CC5.1 | H.2.16 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-34 | DS5.7 | APO13.01 APO13.02 DSS05.05 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Privilege Usage Management - Resource Protection | shared | x | Domain 2 | NIST SP 800-53 R3 CM-7 | NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1) NIST SP 800-53 R3 AC-6 (2) NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1) | A.11.4.1 A 11.4.4 A.11.5.4 | A.9.1.2 Deleted A.9.4.4 | 9.1.2 9.4.4 | 9.1.2 9.4.4 | 9.1.2 9.4.4 | Commandment #1 Commandment #5 Commandment #6 Commandment #7 | CIP-007-3 - R2.1 - R2.2 - R2.3 | AC-5 AC-6 CM-7 SC-3 SC-19 | 12.2 14.2 | 7.1.2 | 5.0 7.1 7.1.2 7.2 | |||||||||||||||
83 | Infrastructure & Virtualization Security Audit Logging / Intrusion Detection | IVS-01 | Higher levels of assurance are required for protection, retention, and lifecycle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach. | X | X | X | X | X | X | X | X | X | X | X | S3.7 | (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents. | CC6.2 | G.7 G.8 G.9 J.1 L.2 | G.14.7, G.14.8, G.14.9, G.14.10,G.14.11, G.14.12, G.15.5, G.15.7, G.15.8, G.16.8, G.16.9, G.16.10, G.15.9, G.17.5, G.17.7, G.17.8, G.17.6, G.17.9, G.18.2, G.18.3, G.18.5, G.18.6, G.19.2.6, G.19.3.1, G.9.6.2, G.9.6.3, G.9.6.4, G.9.19, H.2.16, H.3.3, J.1, J.2, L.5, L.9, L.10 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-14 | DS5.5 DS5.6 DS9.2 | APO13.01 APO13.02 BAI10.01 BAI10.02 BAI10.03 DSS01.03 DSS02.01 DSS05.07 DSS06.05 | 312.3, 312.8 and 312.10 | BOSS > Security Monitoring Services > SIEM | shared | x | Domain 10 | 6.03. (i) 6.03. (j) 6.03.03. (a) 6.03.03. (d) 6.03.04. (e) 6.04.07. (a) 6.07.01. (a) 6.07.01. (c) | Article 17 | NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-3 NIST SP 800-53 R3 AU-4 NIST SP 800-53 R3 AU-5 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 AU-12 NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 | NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-2 (3) NIST SP 800-53 R3 AU-2 (4) NIST SP 800-53 R3 AU-3 NIST SP 800-53 R3 AU-3 (1) NIST SP 800-53 R3 AU-4 NIST SP 800-53 R3 AU-5 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-6 (1) NIST SP 800-53 R3 AU-6 (3) NIST SP 800-53 R3 AU-7 NIST SP 800-53 R3 AU-7 (1) NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 AU-12 NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 SC-18 | 8.2.1 8.2.2 | 45 CFR 164.308 (a)(1)(ii)(D) 45 CFR 164.312 (b) 45 CFR 164.308(a)(5)(ii)© | A.10.10.1 A.10.10.2 A.10.10.3 A.10.10.4 A.10.10.5 A.11.2.2 A.11.5.4 A.11.6.1 A.13.1.1 A.13.2.3 A.15.2.2 A.15.1.3 | A.12.4.1 A.12.4.1 A.12.4.2, A.12.4.3 A.12.4.3 A.12.4.1 A.9.2.3 A.9.4.4 A.9.4.1 A.16.1.2 A.16.1.7 A.18.2.3 A.18.1.3 | A.9.2.3 A.9.4.4 A.9.4.1 12.4.1 12.4.2 12.4.3 15.1.1 15.1.3 16.1.2 16.1.7 18.2.3 18.1.3 | 12.4.1 12.4.1 12.4.3 12.4.3 12.4.1 9.2.3 9.4.4 9.4.1 15.1.1 15.1.3 16.1.2 16.1.7 18.1.3 CLD.9.5.1 CLD12.4.5 | 9.2.3 9.4.1 9.4.4 12.4.1 12.4.2 12.4.3 16.1.2 16.1.7 18.2.3 18.1.3 | Commandment #6 Commandment #7 Commandment #11 | CIP-007-3 - R6.5 | AU-1 AU-2 AU-3 AU-4 AU-5 AU-6 AU-7 AU-9 AU-11 AU-12 AU-14 SI-4 | 17.6 | PA11 PA12 PA13 PA24 | BSGP SGP SGP P | 10.1 10.2 10.3 10.5 10.6 10.7 11.4 12.5.2 12.9.5 | 10.1 10.2 10.3 10.4 10.5 10.6 10.7, 10.8 11.4, 11.5, 11.6 12.5.2 | |||||||
84 | Infrastructure & Virtualization Security Change Detection | IVS-02 | The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g., dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g., portals or alerts). | X | X | X | X | X | X | X | X | X | APO08.04 APO13.01 BAI06.01 BAI06.02 BAI10.03 BAI10.04 | SRM > Privilege Management Infrastructure > Privileged Usage Management -> Hypervisor Governance and Compliance | Annex A.12.1.2 A.12.4, A.12.4.1, A.12.4.2, A.12.4.3, A.12.6.1, A.12.6.2, A.16.1.1, A.16.1.2, A.16.1.3, A.16.1.4, A.16.1.5, A.16.1.6, A.16.1.7 | 12.1.2 12.4.1 12.4.2 12.4.3 12.6.1 12.6.2 15.1.1 15.1.3 16.1.1 16.1.2 16.1.3 16.1.4 16.1.5 16.1.6 16.1.7 | 12.1.2 12.4, 12.4.1 12.4.3 12.6.1 15.1.1 15.1.3 16.1.1 16.1.2 16.1.7 | PA35 | GP | 10.5.5, 12.10.5 | ||||||||||||||||||||||||||||||||||
85 | Infrastructure & Virtualization Security Clock Synchronization | IVS-03 | A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines. | X | X | X | X | X | X | X | S3.7 | (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents. | CC6.2 | G.7 G.8 | G.13, G.14.8, G.15.5, G.16.8, G.17.6, G.18.3, G.19.2.6, G.19.3.1 | 20 (B) 28 (B) 30 (B) 35 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-12 | DS5.7 | APO01.08 APO13.01 APO13.02 BAI03.05 DSS01.01 | 312.8 and 312.10 | Infra Services > Network Services > Authoritative Time Source | provider | x | Domain 10 | 6.03. (k) | NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-8 | NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-8 NIST SP 800-53 R3 AU-8 (1) | A.10.10.1 A.10.10.6 | A.12.4.1 A.12.4.4 | 12.4.1 12.4.4 15.1.1 15.1.3 | 12.4.1 12.4.4 15.1.1 15.1.3 | 12.4.1 12.4.4 | AU-1 AU-8 | 10.4 | 10.4 | ||||||||||||||||||
86 | Infrastructure & Virtualization Security Information System Documentation | IVS-04 | The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload. | X | X | X | X | X | X | X | X | X | A3.2.0 A4.1.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. (A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies. | A1.1 A1.2 CC4.1 | G.5 | OP-03 | DS 3 | APO01.03 APO01.08 BAI04.01 BAI04.04 BAI04.05 BAI10.01 BAI10.02 | 312.8 and 312.10 | ITOS > Service Delivery > Information Technology Resiliency - Capacity Planning | provider | x | Domain 7, 8 | 6.03.07. (a) 6.03.07. (b) 6.03.07. (c) 6.03.07. (d) | Article 17 (1) | NIST SP 800-53 R3 SA-4 | NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) | 1.2.4 | A.10.3.1 | A.12.1.3 | 12.1.3 15.1.1 15.1.3 | 12.1.3 15.1.1 15.1.3 | 12.1.3 | Commandment #1 Commandment #2 Commandment #3 | SA-4 | 3.3 | PA16 | SGP | |||||||||||||||
87 | Infrastructure & Virtualization Security Vulnerability Management | IVS-05 | Implementers shall ensure that the security vulnerability assessment tools or services accommodate the virtualization technologies used (e.g., virtualization aware). | X | X | X | X | X | -- | APO01.08 APO04.02 APO04.03 APO04.04 DSS05.03 DSS06.06 | SRM > Threat and Vulnerability Management > Vulnerability Management | provider | x | Domain 1, 13 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) | 15.1.1 15.1.3 | 15.1.1 15.1.3 | PA36 | 6.1 | |||||||||||||||||||||||||||||||||||
88 | Infrastructure & Virtualization Security Network Security | IVS-06 | Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls. | X | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | G.2 G.4 G.15 G.16 G.17 G.18 I.3 | G.9.17, G.9.7, G.10, G.9.11, G.14.1, G.15.1, G.9.2, G.9.3, G.9.13 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-08 | APO03.01 APO03.02 APO13.01 APO13.02 BAI02.01 BAI03.02 BAI03.03 BAI03.04 BAI03.05 DSS05.02 DSS06.06 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > Network | provider | x | Domain 10 | 6.03.03. (a) 6.03.03. (d) 6.03.04. (d) 6.04.07. (a) 6.07.01. (c) | Article 17 | NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-20 (1) | NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1) NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18) NIST SP 800-53 R3 SC-20 (1) NIST SP 800-53 R3 SC-21 NIST SP 800-53 R3 SC-22 NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SC-32 | 8.2.5 | A.10.6.1 A.10.6.2 A.10.9.1 A.10.10.2 A.11.4.1 A.11.4.5 A.11.4.6 A.11.4.7 A.15.1.4 | A.13.1.1 A.13.1.2 A.14.1.2 A.12.4.1 A.9.1.2 A.13.1.3 A.18.1.4 | 9.1.2 12.4.1 13.1.1 13.1.2 13.1.3 14.1.2 15.1.1 15.1.3 18.1.4 | 12.4.1 9.1.2 13.1.3 15.1.1 15.1.3 CLD.9.5.2 CLD13.1.4 | 9.1.2 12.4.1 13.1.1 13.1.2 14.1.2 18.1.4 | Commandment #1 Commandment #2 Commandment #3 Commandment #9 Commandment #10 Commandment #11 | CIP-004-3 R2.2.4 | SC-7 | 17.1 17.2 | PA3 PA5 PA16 PA19 PA18 | BSGP BSGP SGP GP SGP | 1.1 1.1.2 1.1.3 1.1.5 1.1.6 1.2 1.2.1 2.2.2 2.2.3 | 1.1 1.1.2 1.1.3 1.1.5 1.1.6 1.2 1.2.1 1.2.2 1.2.3 1.3 2.2.2 2.2.3 2.2.4 2.5 4.1 | |||||||||
89 | Infrastructure & Virtualization Security OS Hardening and Base Controls | IVS-07 | Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template. | X | X | X | X | X | X | X | -- | APO13.01 APO13.02 BAI02.01 BAI03.02 BAI03.03 BAI03.04 BAI03.05 DSS05.01 DSS05.03 DSS06.06 | SRM > Policies and Standards > Operational Security Baselines | shared | x | Domain 1, 13 | Annex A.12.1.4 A.12.2.1 A.12.4.1 A.12.6.1 | 12.1.4 12.2.1 12.4.1 12.6.1 15.1.1 15.1.3 | 12.4.1 12.6.1 CLD.9.5.2 15.1.1 15.1.3 | 12.1.4 12.2.1 12.4.1 12.6.1 | 2.1 2.2 2.5 5.1 | |||||||||||||||||||||||||||||||||
90 | Infrastructure & Virtualization Security Production / Non-Production Environments | IVS-08 | Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties. | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | B.1 | I.2.7.1, I.2.20, I.2.17, I.2.22.2, I.2.22.4, I.2.22.10-14, H.1.1 | 22 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-06 | DS5.7 | APO03.01 APO03.02 APO13.01 APO13.02 DSS05.02 DSS05.05 DSS06.06 | 312.8 and 312.10 | Information Services > Data Governance > Data Segregation | shared | x | Domain 10 | 6.03. (d) | NIST SP 800-53 R3 SC-2 | 1.2.6 | A.10.1.4 A.10.3.2 A.11.1.1 A.12.5.1 A.12.5.2 A.12.5.3 | A.12.1.4 A.14.2.9 A.9.1.1 8.1,partial, A.14.2.2 8.1,partial, A.14.2.3 8.1,partial, A.14.2.4 | 9.1.1 12.1.4 14.2.2 14.2.3 14.2.4 14.2.9 15.1.1 15.1.3 | 15.1.1 15.1.3 | Commandment #1 Commandment #10 Commandment #11 | SC-2 | 14.5 | PA3 | BSGP | 6.4.1 6.4.2 | 6.4.1 6.4.2 | ||||||||||||
91 | Infrastructure & Virtualization Security Segmentation | IVS-09 | Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed, and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations: • Established policies and procedures • Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance • Compliance with legal, statutory, and regulatory compliance obligations | X | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | G.17 | G.9.2, G.9.3, G.9.13 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-09 | DS5.10 | APO03.01 APO03.02 APO13.01 APO13.02 DSS05.02 DSS05.05 DSS06.06 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > Network - Firewall | provider | x | Domain 10 | 6.03.03. (b) 6.03.05. (a) 6.03.05. (b) 6.04.01. (a) 6.04.01. (g) 6.04.03. (c) 6.04.08.02. (a) 6.04.08.02. (b) 6.05. (c) | Article 17 | NIST SP 800-53 R3 SC-7 | NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18) | 45 CFR 164.308 (a)(4)(ii)(A) | A.11.4.5 A.11.6.1 A.11.6.2 A.15.1.4 | A.13.1.3 A.9.4.1 A.18.1.4 | 9.4.1 13.1.3 15.1.1 15.1.3 18.1.4 | 13.1.3 9.4.1 CLD.9.5.1 15.1.1 15.1.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #9 Commandment #10 Commandment #11 | CIP-004-3 R3 | AC-4 SC-2 SC-3 SC-7 | 17.6 18.1 18.4 | PA3 PA5 PA16 PA20 | BSGP BSGP SGP GP | 1.1 1.2 1.2.1 1.3 1.4 | 1.1 1.2 1.2.1 1.2.3 1.3 1.4 2.1.1 2.2.3 2.2.4 2.3 | |||||||||
92 | Infrastructure & Virtualization Security VM Security - Data Protection | IVS-10 | Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations. | X | X | X | X | X | -- | APO03.01 APO03.02 APO03.04 APO13.01 APO13.02 DSS05.02 DSS05.05 DSS06.06 | SRM > Cryptographic Services > Data-in-transit Encryption | provider | X | Domain 1, 13 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3 | 12.6.1 14.2.3 15.1.1 15.1.3 | 12.6.1 15.1.1 15.1.3 18.1.1 | 4.1 | ||||||||||||||||||||||||||||||||||||
93 | Infrastructure & Virtualization Security Hypervisor Hardening | IVS-11 | Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles). | X | X | X | X | X | X | X | X | X | X | -- | APO13.01 APO13.02 DSS05.02 DSS05.04 DSS06.03 DSS06.06 | SRM > Privilege Management Infrastructure > Privilege Use Management - Hypervisor Governance and Compliance | provider | X | Domain 1, 13 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3 | 12.6.1 14.2.3 15.1.1 15.1.3 | 12.6.1 15.1.1 15.1.3 18.1.1 CLD.9.5.2 | 3.5.1, 3.6.6 | |||||||||||||||||||||||||||||||
94 | Infrastructure & Virtualization Security Wireless Security | IVS-12 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following: • Perimeter firewalls implemented and configured to restrict unauthorized traffic • Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings) • User access to wireless network devices restricted to authorized personnel • The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network | X | X | X | X | X | X | X | X | X | X | X | X | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | D.1 B.3 F.1 G.4 G.15 G.17 G.18 | E.3.1, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 G.9.17, G.9.7, G.10, G.9.11, G.14.1, G.15.1, G.9.2, G.9.3, G.9.13 | 40 (B) 44 (C+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-10 | DS5.5 DS5.7 DS5.8 DS5.10 | APO01.08 APO13.01 APO13.02 DSS02.02 DSS05.02 DSS05.03 DSS05.04 DSS05.05 DSS05.07 DSS06.03 DSS06.06 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > Network - Wireless Protection | provider | X | Domain 10 | Article 17 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 SC-7 | NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-18 (1) NIST SP 800-53 R3 AC-18 (2) NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 CM-6 (1) NIST SP 800-53 R3 CM-6 (3) NIST SP 800-53 R3 PE-4 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18) | 8.2.5 | 45 CFR 164.312 (e)(1)(2)(ii) 45 CFR 164.308(a)(5)(ii)(D) 45 CFR 164.312(e)(1) 45 CFR 164.312(e)(2)(ii) | A.7.1.1 A.7.1.2 A.7.1.3 A.9.2.1 A.9.2.4 A.10.6.1 A.10.6.2 A.10.8.1 A.10.8.3 A.10.8.5 A.10.10.2 A.11.2.1 A.11.4.3 A.11.4.5 A.11.4.6 A.11.4.7 A.12.3.1 A.12.3.2 | A.8.1.1 A.8.1.2 A.8.1.3 A.11.2.1 A.11.2.4 A.13.1.1 A.13.1.2 A.13.2.1 A.8.3.3 A.12.4.1 A.9.2.1, A.9.2.2 A.13.1.3 A.10.1.1 A.10.1.2 | 8.1.1 8.1.2 8.1.3 8.3.3 9.2.1 9.2.2 10.1.1 10.1.2 11.2.1 11.2.4 12.4.1 13.1.1 13.1.2 13.1.3 13.2.1 15.1.1 15.1.3 | 8.1.1 12.4.1 9.2.1 9.2.2 13.1.3 10.1.1 10.1.2 15.1.1 15.1.3 | Commandment #1 Commandment #2 Commandment #3 Commandment #4 Commandment #5 Commandment #9 Commandment #10 Commandment #11 | CIP-004-3 R3 CIP-007-3 - R6.1 | AC-1 AC-18 CM-6 PE-4 SC-3 SC-7 | 11.1 17.3 | PA3 PA6 PA16 PA20 PA25 PA32 PA33 | BSGP BSGP SGP GP P BSGP SGP | 1.2.3 2.1.1 4.1 4.1.1 11.1 9.1.3 | 1.2.3 2.1.1 4.1 4.1.1 11.1, 11.1.a, 11.1.b, 11.1.c, 11.1.d, 11.1.1, 11.1.2 9.1.3 | |||||||
95 | Infrastructure & Virtualization Security Network Architecture | IVS-13 | Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks. | X | X | X | X | X | X | X | X | X | X | X | X | 15.1.1 15.1.3 | 15.1.1 15.1.3 | |||||||||||||||||||||||||||||||||||||
96 | Interoperability & Portability APIs | IPY-01 | The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications. | X | X | X | X | X | X | X | X | X | -- | BAI02.04 BAI03.01 BAI03.02 BAI03.03 BAI03.04 BAI03.05 | Application Services > Programming Interfaces > | provider | X | Domain 6 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3 | 12.6.1 14.2.3 18.1.1 18.2.2 18.2.3 | 12.6.1 18.1.1 | |||||||||||||||||||||||||||||||||
97 | Interoperability & Portability Data Request | IPY-02 | All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files). | X | X | X | X | X | X | X | X | X | -- | APO01.03 APO01.06 APO03.01 APO08.01 APO09.03 DSS04.07 | Information Services > Reporting Services > | provider | Domain 6 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3 | 12.6.1 14.2.3 18.1.1 18.2.2 18.2.3 | 12.6.1 18.1.1 | ||||||||||||||||||||||||||||||||||
98 | Interoperability & Portability Policy & Legal | IPY-03 | Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence. | X | X | X | X | X | X | X | X | X | X | X | X | -- | APO01.08 APO02.05 APO03.01 APO03.02 APO04.02 BAI02.01 BAI02.04 APO09.03 | Information Technology Operation Services > Service Delivery > Service Level Management - External SLA's | provider | Domain 3 | 6.04.03. (b) 6.04.08. (a) 6.04.08. (b) 6.06. (a) 6.06. (b) 6.06. (c) 6.06. (d) 6.06. (e) 6.06. (f) | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3 | 6.1.1 6.1.3 12.6.1 14.2.3 18.1.1 18.2.2 18.2.3 | 6.1.1 6.1.3 12.6.1 18.1.1 | ||||||||||||||||||||||||||||||
99 | Interoperability & Portability Standardized Network Protocols | IPY-04 | The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved. | X | X | X | X | X | X | -- | APO01.08 APO02.05 APO03.01 APO03.02 APO04.02 BAI02.01 BAI02.04 APO09.03 | SRM > Data Protection > Cryptographic Services - Data-In-Transit Encryption | provider | x | Domain 6 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3 | 12.6.1 14.2.3 18.1.1 18.2.2 18.2.3 | 12.6.1 18.1.1 | 4.1 | |||||||||||||||||||||||||||||||||||
100 | Interoperability & Portability Virtualization | IPY-05 | The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solution-specific virtualization hooks available for customer review. | X | X | X | X | X | X | X | X | X | -- | APO01.08 APO02.05 APO03.01 APO03.02 APO04.02 BAI02.01 BAI02.04 APO09.03 | Infrastructure Services > Virtual Infrastructure > Server Virtualization | provider | X | Domain 6 | Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3 | 12.6.1 14.2.3 18.1.1 18.2.2 18.2.3 | 12.6.1 18.1.1 | |||||||||||||||||||||||||||||||||