CSA CCM - IEC 62443-3-3
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

 
Comment only
 
 
ABCP
1
CLOUD CONTROLS MATRIX VERSION 3.0.1
2
Control DomainCCM V3.0 Control IDUpdated Control Specification
3
IEC 62443-3-3
4
5
Application & Interface Security
Application Security
AIS-01Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.
6
Application & Interface Security
Customer Access Requirements
AIS-02Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed.SR 1.1 - Human user identification and authentication

7
Application & Interface Security
Data Integrity
AIS-03Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.SR 3.1 - Communication Integrity
SR 3.1 RE 1 - Cryptographic Integrity Protection
SR 3.5 - Input validation
SR 3.6 - Output validation
SR 3.7 - Error handling
SR 4.3 - Use of cryptography
8
Application & Interface Security
Data Security / Integrity
AIS-04Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity, and availability) across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alteration, or destruction.SR 3.2 - Malicous Code Protection
SR 3.2 RE 1- Malicous Code Protection on entry and exit points
SR 3.2 RE 2- Central Management and reporting of Malicous Code Protection
SR 3.5 - Input Validation
SR 3.6 - Deterministic output
SR 4.1 - Information confidentiality
SR 4.2 - Information persistance



9
Audit Assurance & Compliance
Audit Planning
AAC-01Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.
10
Audit Assurance & Compliance
Independent Audits
AAC-02Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.SR 3.3 - Security functionality verification
11
Audit Assurance & Compliance
Information System Regulatory Mapping
AAC-03Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.
12
Business Continuity Management & Operational Resilience
Business Continuity Planning
BCR-01A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements.
Requirements for business continuity plans include the following:
• Defined purpose and scope, aligned with relevant dependencies
• Accessible to and understood by those who will use them
• Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities
• Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation
SR 7.3 - Control System Backup
SR 7.3 RE1 - Backup Verification
SR 7.3 RE 2- Backup Automation
SR 7.4 - Control system recovery and reconstruction
SR 7.5 - Emergency Power
13
Business Continuity Management & Operational Resilience
Business Continuity Testing
BCR-02Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.SR 7.3 RE 1 - Backup verification
14
Business Continuity Management & Operational Resilience
Datacenter Utilities / Environmental Conditions
BCR-03Data center utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.SR 7.5 - Emergency power
15
Business Continuity Management & Operational Resilience
Documentation
BCR-04Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system
• Effectively using the system’s security features
16
Business Continuity Management & Operational Resilience
Environmental Risks
BCR-05Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.
17
Business Continuity Management & Operational Resilience
Equipment Location
BCR-06To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.
18
Business Continuity Management & Operational Resilience
Equipment Maintenance
BCR-07Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.
19
Business Continuity Management & Operational Resilience
Equipment Power Failures
BCR-08Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific business impact assessment.
20
Business Continuity Management & Operational Resilience
Impact Analysis
BCR-09There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption
• Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption
21
Business Continuity Management & Operational Resilience
Policy
BCR-10Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery, and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.
22
Business Continuity Management & Operational Resilience
Retention Policy
BCR-11Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.
23
Change Control & Configuration Management
New Development / Acquisition
CCC-01Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network, and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization's business leadership or other accountable business role or function.
24
Change Control & Configuration Management
Outsourced Development
CCC-02External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g., ITIL service management processes).
25
Change Control & Configuration Management
Quality Testing
CCC-03Organizations shall follow a defined quality change control and testing process (e.g., ITIL Service Management) with established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.SR 3.3 - Security Functionality Verification
SR 3.4 - Software information integrity
26
Change Control & Configuration Management
Unauthorized Software Installations
CCC-04Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.SR 2.4 - Mobile Code
SR 3.2 - Malicious code protection
SR 3.4 - Software and information integrity



27
Change Control & Configuration Management
Production Changes
CCC-05Policies and procedures shall be established for managing the risks associated with applying changes to:
• Business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations.
• Infrastructure network and systems components.
Technical measures shall be implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer (tenant), and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.
SR 7.8 - Control system component inventory
28
Data Security & Information Lifecycle Management
Classification
DSI-01Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.
29
Data Security & Information Lifecycle Management
Data Inventory / Flows
DSI-02Policies and procedures shall be established, and supporting business processes and technical measures implemented, to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's geographically distributed (physical and virtual) applications and infrastructure network and systems components and/or shared with other third parties to ascertain any regulatory, statutory, or supply chain agreement (SLA) compliance impact, and to address any other business risks associated with the data. Upon request, provider shall inform customer (tenant) of compliance impact and risk, especially if customer data is used as part of the services.SR 5.2 - Zone boundary protection
SR 4.1 - Information confidentiality
30
Data Security & Information Lifecycle Management
Ecommerce Transactions
DSI-03Data related to electronic commerce (ecommerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.
31
Data Security & Information Lifecycle Management
Handling / Labeling / Security Policy
DSI-04Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.
32
Data Security & Information Lifecycle Management
Non-Production Data
DSI-05Production data shall not be replicated or used in non-production environments. Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.
33
Data Security & Information Lifecycle Management
Ownership / Stewardship
DSI-06All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.
34
Data Security & Information Lifecycle Management
Secure Disposal
DSI-07Policies and procedures shall be established with supporting business processes and technical measures implemented for the secure disposal and complete removal of data from all storage media, ensuring data is not recoverable by any computer forensic means.SR 4.2 - Information persistence
35
Datacenter Security
Asset Management
DCS-01Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities.SR 7.8 - Control system component inventory
36
Datacenter Security
Controlled Access Points
DCS-02Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.
SR 1.2 - Software process and device identification and authentication
37
Datacenter Security
Equipment Identification
DCS-03Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.
38
Datacenter Security
Off-Site Authorization
DCS-04Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.
39
Datacenter Security
Off-Site Equipment
DCS-05Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory for reuse and deployment, or securely stored until it can be destroyed.
40
Datacenter Security
Policy
DCS-06Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.
41
Datacenter Security
Secure Area Authorization
DCS-07Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.
42
Datacenter Security
Unauthorized Persons Entry
DCS-08Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.
43
Datacenter Security
User Access
DCS-09Physical access to information assets and functions by users and support personnel shall be restricted.
44
Encryption & Key Management
Entitlement
EKM-01Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.SR 1.9 - Strenght of Public Key Authentication
SR 1.9 RE1 - Hardware Security for public key authentication
45
Encryption & Key Management
Key Generation
EKM-02Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control.SR 1.8 - Public key infrastructure certificates
SR 1.9 - Strenght of Public Key Authentication
SR 1.9 - RE1 - Hardware security for public key authentication
SR 4.3 - Use of Cryptography
46
Encryption & Key Management
Sensitive Data Protection
EKM-03Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.SR 1.8 - Public key infrastructure certificates
SR 1.9 - Strenght of Public Key Authentication
SR 1.9 - RE1 - Hardware security for public key authentication
SR 4.3 - Use of Cryptography
47
Encryption & Key Management
Storage and Access
EKM-04Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e., at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.SR 4.1 - Information confidentiality
48
Governance and Risk Management
Baseline Requirements
GRM-01Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory, and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and authorized based on business needs.
49
Governance and Risk Management
Data Focus Risk Assessments
GRM-02Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
• Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure
• Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
50
Governance and Risk Management
Management Oversight
GRM-03Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.
51
Governance and Risk Management
Management Program
GRM-04An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and maintenance
52
Governance and Risk Management
Management Support/Involvement
GRM-05Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.
53
Governance and Risk Management
Policy
GRM-06Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.
54
Governance and Risk Management
Policy Enforcement
GRM-07A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.
55
Governance and Risk Management
Policy Impact on Risk Assessments
GRM-08Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.
56
Governance and Risk Management
Policy Reviews
GRM-09The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.
57
Governance and Risk Management
Risk Assessments
GRM-10Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).
58
Governance and Risk Management
Risk Management Framework
GRM-11Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and stakeholder approval.
59
Human Resources
Asset Returns
HRS-01Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.
60
Human Resources
Background Screening
HRS-02Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.
61
Human Resources
Employment Agreements
HRS-03Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.
62
Human Resources
Employment Termination
HRS-04Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.
63
Human Resources
Mobile Device Management
HRS-05Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).
64
Human Resources
Non-Disclosure Agreements
HRS-06Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.
65
Human Resources
Roles / Responsibilities
HRS-07Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.
66
Human Resources
Technology Acceptable Use
HRS-08Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.
67
Human Resources
Training / Awareness
HRS-09A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.
68
Human Resources
User Responsibility
HRS-10All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
69
Human Resources
Workspace
HRS-11Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.SR 2.5 - Session Lock
SR 2.6 - Remote Session Termination
SR 2.7 - Concurrent Session Control
70
Identity & Access Management
Audit Tools Access
IAM-01Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segregated and access restricted to prevent inappropriate disclosure and tampering of log data.SR 3.9 - Protection of audit information
71
Identity & Access Management
Credential Lifecycle / Provision Management
IAM-02User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following:
• Procedures, supporting roles, and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business relationships, or other third-party business relationships)
• Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems)
• Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multi-factor, expireable, non-shared authentication secrets)
• Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions
• Adherence to applicable legal, statutory, or regulatory compliance requirements
SR 1.3 - Account Management
SR 1.3 RE1 - Unified Account Management
SR 3.8 - Session Integrity
SR 3.8 RE 1 - Invalidation of session Ids after session termination
SR 3.8 RE 2 - Unique Session ID generation
SR 3.8 RE 3 - Randomness of session Ids
72
Identity & Access Management
Diagnostic / Configuration Ports Access
IAM-03User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.
73
Identity & Access Management
Policies and Procedures
IAM-04Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.SR 1.1 - Human user identification and authentication
SR 1.1 RE1 - AAA: unique identification and authentication
SR 1.1 RE2 - AAA: multifactor authentication for untrusted networks
SR 1.1 RE3- AAA: multifactor authentication for all networks
SR 1.4 - Identifier management
74
Identity & Access Management
Segregation of Duties
IAM-05User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.SR 2.1 - Authorization enforecement
SR 2.1 RE 1 - Authorization enforcement for all users
SR 2.1 RE 2 - Permission mapping to roles
SR 2.1 RE 3 - Supervisor override
SR 2.1 RE 4 - Dual approval
75
Identity & Access Management
Source Code Access Restriction
IAM-06Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.SR 1.2 Software process and device identification and authentication
SR 1.2 RE 1 - unique identification and authentication
76
Identity & Access Management
Third Party Access
IAM-07The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.SR 1.2 - Software process and device identification and authentication
SR 1.2 RE 1 - unique identification and authentication
77
Identity & Access Management
Trusted Sources
IAM-08Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.
78
Identity & Access Management
User Access Authorization
IAM-09Provisioning user access (e.g., employees, contractors, customers (tenants), business partners, and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.SR 2.1 - Authorization enforecement
SR 2.1 RE1 - Authorization Enforcement for all users
SR 2.1 RE 2 - Permission mapping to roles
SR 2.1 RE 3 - Supervisor override
79
Identity & Access Management
User Access Reviews
IAM-10User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.SR 2.1 - Authorization enforecement
80
Identity & Access Management
User Access Revocation
IAM-11Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change, or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.
81
Identity & Access Management
User ID Credentials
IAM-12Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets)
SR 1.1 - Human user identification and authentication
SR 1.1 RE1 - AAA: unique identification and authentication
SR 1.1 RE2 - AAA: multifactor authentication for untrusted networks
SR 1.1 RE3- AAA: multifactor authentication for all networks
SR 1.4 - Identifier Management
SR 1.5 - Authenticator Management
SR 1.5 RE1 - AAA Hardware security for software process identity credentials
SR 1.7 - (AAA Constrains regarding password entropy)
SR 1.7 RE 1 - AAA Lifetime restriction of passwords for human users
SR 1.7 RE 2 - AAA Lifetime restriction of passwords for all users
SR 1.10 - Authenticator Feedback
82
Identity & Access Management
Utility Programs Access
IAM-13Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.
83
Infrastructure & Virtualization Security
Audit Logging / Intrusion Detection
IVS-01Higher levels of assurance are required for protection, retention, and lifecycle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.SR 1.11 - Unsuccessful login attempts
SR 1.12 - System Use notification
SR 1.13 - Access via untrusted networks
SR 1.13 RE1 - Explicit access request approval
SR 2.4 - Mobile Code
SR 2.8 - Auditable events
SR 2.9 - Audit storage capacity
SR 3.9 - Protection of audit information
SR 6.1 - Audit Log Accessability
SR 6.1 RE 1 - Programmatic access to audit logs
84
Infrastructure & Virtualization Security
Change Detection
IVS-02The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g., dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g., portals or alerts).
85
Infrastructure & Virtualization Security
Clock Synchronization
IVS-03A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.SR 2.11 - Timestamps
86
Infrastructure & Virtualization Security
Information System Documentation
IVS-04The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.
87
Infrastructure & Virtualization Security
Vulnerability Management
IVS-05Implementers shall ensure that the security vulnerability assessment tools or services accommodate the virtualization technologies used (e.g., virtualization aware).
88
Infrastructure & Virtualization Security
Network Security
IVS-06Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls.SR 5.1 - Network Segmentation
SR 5.1 RE 1 - Physical network segmentation
SR 5.1 RE 2 - Indendence from non-controlsystems network
SR 5.1 RE 3 - Logical and physical isolation of critical networks
SR 5.2 - Zone Boundary protection
SR 5.2 RE1 - deny by default
SR 5.2 RE 2 - Island mode
SR 5.2 RE 3 - Fail close
SR 7.6 Network and security configuration settings
SR 7.6 RE1 - Machine Readable reporting of current security activities


89
Infrastructure & Virtualization Security
OS Hardening and Base Controls
IVS-07Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.SR 7.7 - Least Functionality
90
Infrastructure & Virtualization Security
Production / Non-Production Environments
IVS-08Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.
91
Infrastructure & Virtualization Security
Segmentation
IVS-09Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed, and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory, and regulatory compliance obligations
SR 5.3 - General purpose person-to-person communication restrictions
SR 5.4 - Application partiotioning
92
Infrastructure & Virtualization Security
VM Security - Data Protection
IVS-10Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.SR 5.3 - General purpose person-to-person communication restrictions
93
Infrastructure & Virtualization Security
Hypervisor Hardening
IVS-11Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).
94
Infrastructure & Virtualization Security
Wireless Security
IVS-12Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network
SR 1.6 - Wireless access management
SR 1.6 RE 1 - AAA: Unique identification and authentication
SR 2.2 - Wireless use control
SR 2.2 RE 1 - Identify and Report unauthorized wireless devices

95
Infrastructure & Virtualization Security
Network Architecture
Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.SR 7.1 - Denial of Service protection
SR 7.1 RE1 - Manage communiction loads
SR 7.1 RE2 - Limit Dos Effects to other systems or networks
SR 7.2 - Resource Management
96
Interoperability & Portability
APIs
IPY-01The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.
97
Interoperability & Portability
Data Request
IPY-02All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files).
98
Interoperability & Portability
Policy & Legal
IPY-03Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.
99
Interoperability & Portability
Standardized Network Protocols
IPY-04The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.
100
Interoperability & Portability
Virtualization
IPY-05The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solution-specific virtualization hooks available for customer review.
Loading...
Main menu