{"text_format":"1","workbook":"xlsx","n_sheets":2,"sheets":["SIMM 5300-B INTRODUCTION","FOUNDATIONAL FRAMEWORK"],"not_rendered":{"charts":0,"images":0,"macros":0,"external_links":3,"defined_names":57,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"SIMM 5300-B INTRODUCTION","index":0,"n_rows":12,"n_cols":1,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
["State of California - Office of Information Security\n\nFOUNDATIONAL FRAMEWORK\n\nSIMM 5300-B\n\nOctober 2017"]
[]
["INTRODUCTION:"]
[]
["The Department of Technology, Office of Information Security has established this foundational framework comprised of 30 priority security objectives to assist state entities with prioritization of their information security efforts. The foundational framework is considered a starting point and will be used to consistently measure and mature state entity security compliance moving forward."]
[]
["As state entities achieve compliance with foundational framework objectives they will continue to address other applicable control areas to sufficiently protect information assets and address organizational risk."]
[]
["Pursuant to Government Code 6254.19, this information security record is confidential and is exempt from  public disclosure. Securely send the entire form and all enclosures to the OIS using the Secure Automated File Exchange (SAFE) system.   "]
[]
["\n\n\n\n\nCalifornia Department of Technology, Office of Information Security\nFoundational Framework                                                                                                                                               Page 1 of 1\nSIMM 5300-B                                                                                                                                                                  October 2017"]

{"sheet":"FOUNDATIONAL FRAMEWORK","index":1,"n_rows":214,"n_cols":7,"rows_kept":214,"cut":false,"hidden":false,"merged":[[139,3,143,3],[169,0,173,0],[84,6,92,6],[101,6,106,6],[107,6,112,6],[113,6,118,6],[69,5,83,5],[84,5,92,5],[101,5,106,5],[107,5,112,5],[113,5,118,5],[93,6,97,6],[98,6,100,6],[93,5,97,5],[98,5,100,5],[144,5,151,5],[152,5,155,5],[156,5,161,5],[162,5,168,5],[169,5,173,5],[169,1,173,1],[107,2,112,2],[139,0,143,0],[139,1,143,1],[1,3,4,3],[5,3,9,3],[10,3,13,3],[14,3,18,3],[19,3,23,3],[24,3,29,3],[30,3,31,3],[32,3,38,3],[134,5,138,5],[119,5,126,5],[127,5,133,5],[101,3,106,3],[107,3,112,3],[113,3,118,3],[119,3,126,3],[127,3,133,3],[134,3,138,3],[39,5,48,5],[73,4,83,4],[60,3,68,3],[69,3,83,3],[84,3,92,3],[39,3,45,3],[55,3,59,3],[1,0,13,0],[14,1,23,1],[14,0,23,0],[1,1,13,1],[101,2,106,2],[19,2,23,2],[24,2,29,2],[30,2,31,2],[32,2,38,2],[55,2,59,2],[1,2,4,2],[14,2,18,2],[5,2,9,2],[10,2,13,2],[32,1,45,1],[32,0,45,0],[24,0,31,0],[24,1,31,1],[39,2,45,2],[60,2,68,2],[69,2,83,2],[84,2,92,2],[196,6,203,6],[204,6,213,6],[152,6,155,6],[156,6,161,6],[162,6,168,6],[169,6,173,6],[119,6,126,6],[127,6,133,6],[134,6,138,6],[139,6,143,6],[144,6,151,6],[174,6,185,6],[186,6,193,6],[144,3,151,3],[152,3,155,3],[156,3,161,3],[162,3,168,3],[169,3,173,3],[169,2,173,2],[144,2,151,2],[152,2,155,2],[156,2,161,2],[162,2,168,2],[139,5,143,5],[1,6,4,6],[14,6,18,6],[19,6,23,6],[24,6,29,6],[30,6,31,6],[69,6,83,6],[10,6,13,6],[5,6,9,6],[32,6,38,6],[55,6,59,6],[60,6,68,6],[39,6,45,6],[1,5,4,5],[5,5,9,5],[10,5,13,5],[14,5,18,5],[19,5,23,5],[32,5,38,5],[55,5,59,5],[60,5,68,5],[24,5,29,5],[30,5,31,5],[113,2,118,2],[119,2,126,2],[127,2,133,2],[134,2,138,2],[107,0,118,0],[107,1,118,1],[119,0,138,0],[119,1,138,1],[144,0,155,0],[144,1,155,1],[139,2,143,2],[156,0,168,0],[156,1,168,1],[196,5,203,5],[186,3,193,3],[186,2,193,2],[174,1,193,1],[174,0,193,0],[194,3,195,3],[186,5,193,5],[194,0,213,0],[194,1,213,1],[204,5,213,5],[174,5,185,5],[196,2,203,2],[204,2,213,2],[174,3,185,3],[196,3,203,3],[204,3,213,3],[174,2,185,2],[46,3,54,3],[46,0,59,0],[60,0,83,0],[60,1,83,1],[93,3,100,3],[93,2,100,2],[84,1,106,1],[84,0,100,0],[101,0,106,0]]}
["Security Program Framework\n\n[REPORT  at this level]","GOALS","2016-2018 PRIORITY                          OBJECTIVES\n\n[MANAGE  at This Level]","NIST \nCYBER SECURITY FUNCTION","TARGET STATE                                                                            \n                                                                                                    [What Good Looks Like]","SAM 5300 \nREFERENCE\n\n[DEPLOY                                      at This Level]","NIST 800-53 REFERENCE\n\n(Control Family, Number, Name)"]
["APPLICATION SECURITY","Establish security controls for the development, acquisition, and use of software applications that are commensurate with the defined security risk for use and operations of those applications.","Application Inventory Management:\n \nDevelop a formal, comprehensive software application inventory management process that includes regular and periodic reviews, management and stakeholder input and approval, integration with enterprise asset management processes","Identify","Formally defined, documented, and centrally managed software inventory management process, mandated by policy with senior management oversight, with regular and periodic review and update of inventory contents.\n\n","5305.5  Information Asset Management\n\n5315.3  Information Asset Documentation\n\n5315.7  Software Usage Restrictions","Configuration Management:\nCM-8  INFORMATION SYSTEM COMPONENT INVENTORY\nPM-5  INFORMATION ASSET INVENTORY"]
[null,null,null,null,"Use of automated tools for software discovery and inventory content maintenance with owner and stakeholder input.\n"]
[null,null,null,null,"Inventory contents include associated software characteristics include owners, assurance and protection requirements, sensitive data stored or processed, infrastructure requirements, aging and skill set requirements.\n"]
[null,null,null,null,"Approach and applicability of the enterprise software inventory and contents is enhanced and enforced through a regular and periodic program of review, audit, and update.\n"]
[null,null,"Application Assurance \nLevel Definition: \n\nDefine application assurance levels based on criticality to business mission and sensitivity of data, as well as operational threat environment","Identify","Application assurance levels have been formally defined, documented and governed through enterprise application development policy with senior management oversight.\n","5315  Information Security Integration\n\n5315.2  SDLC\n\n5315.1  System and Services Acquisition","System and Services Acquisition:\nSA-8  SECURITY ENGINEERING PRINCIPLES\nSA-11  DEVELOPER SECURITY TESTING AND EVALUATION\n "]
[null,null,null,null,"All applications are regularly and periodically assessed.\n"]
[null,null,null,null,"Threats, vulnerabilities, and consequences are used to identify the security requirements of the application in terms of business requirements.\n\n"]
[null,null,null,null,"Assurance ratings are maintained as part of application inventory management process, and used to define appropriate secure coding and testing methodologies.\n"]
[null,null,null,null,"Assurance definitions and assignments are enhanced and enforced through a regular and periodic program of review, audit, and update.\n"]
[null,null,"Secure Code Practices: \n\nEstablish and deploy software development and programming methods, techniques and standards (secure coding practices) used specifically for implementing software in a way that prevents, avoids, or does not create security vulnerability in the resulting application","Protect","Secure coding practices (software development and programming methods, techniques and standards) are formally defined, documented and governed through enterprise application development policy with senior management oversight.\n","5315  SDLC","System and Services Acquisition:\nSA-17  DEVELOPER SECURITY ARCHITECTURE AND DESIGN\nCM-7  LEAST FUNCTIONALITY \nSI-10   INFORMATION INPUT VALIDATION"]
[null,null,null,null,"Practices are defined, documented, integrated, and enforced across all system development environments.\n"]
[null,null,null,null,"App developers are regularly and periodically trained and secure coding practices for applicable system development environments.\n"]
[null,null,null,null,"Practices are enhanced and enforced through a regular and periodic program of review, audit, and update.\n"]
["CONTINGENCY PLANNING","Deploy controls to prevent unauthorized or unacceptable loss of customer, critical, and sensitive information. In keeping with a systematic and comprehensive security program, deploy controls to protect information availability.","Business Impact Assessment: \n\nDevelop and vet an enterprise Business Impact Analysis (BIA) with realistic Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) commensurate with assurance-level of each application and aligned with service recovery objectives established in enterprise Business Continuity Plan (BCP)","Recover","Enterprise Business Impact Analysis (BIA) is conducted regularly and periodically resulting in  realistic Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for all critical systems and supporting IT infrastructure.\n\n","5325 Business Continuity with Technology Recovery\n\n5325.1 Technology Recovery Plan\n\n5325.4 Alternate Storage and Processing Site \n\n5325.5 Telecommunications Services ","Contingency Planning:\nCP-2  CONTINGENCY PLAN\nCP-4  CONTINGENCY PLAN TESTING\nCP-6  ALTERNATE STORAGE SITE\nCP-7  ALTERNATE PROCESSING SITE"]
[null,null,null,null,"Recovery objectives are commensurate with assigned assurance-level of each application and aligned with service recovery objectives established in the enterprise Business Continuity Plan (BCP).\n\n"]
[null,null,null,null,"Service recovery objectives are reviewed and approved by key business process stakeholders.\n"]
[null,null,null,null,"BIA is reviewed and updated at least annually with a complete refresh at least every three years.\n\n"]
[null,null,null,null,"Disaster recovery testing results are used as feedback to periodically enhance BIA-based recovery objectives between BIA refresh cycles.\n"]
[null,null,"Comprehensive DRP Testing: \n\nExisting disaster recovery processes to include periodic live testing of recovery capabilities and incorporating feedback to refine the processes","Recover","Disaster Recovery (DR)/Business Continuity (BC) testing is conducted as part of a formal, documented plan integrated with the regular and periodic review of the DR/BC plans.\n\n","5325.1  Technology Recovery Plan\n\n5325.3  Technology Recovery Testing\n\n5325.6  Information System Backups ","Contingency Planning:\nCP-2  CONTINGENCY PLAN\nCP-3  CONTINGENCY TRAINING\nCP-4  CONTINGENCY PLAN TESTING\nCP-9  INFORMATION SYSTEM BACKUP"]
[null,null,null,null,"Testing is structured as a tiered testing program that includes table-top scenario-based and live partial (function, infrastructure, system or application-specific) recovery testing, as well as live, full failover and recovery testing for all systems supporting critical business processes.       \n"]
[null,null,null,null,"Test results are used as feedback to the plan review process and incorporated as refinements to the plan.\n"]
[null,null,null,null,"Testing occurs at least annually.\n"]
[null,null,null,null,"Full, live testing occurs at least every three years.\n"]
["CHANGE AND CONFIGURATION MANAGEMENT","Establish change and configuration management controls that include a workflow model with documentation, attribution, approval processes, testing, and execution of the change. Additionally, establish controls to protect the integrity and confidentiality of the change management process commensurate with level of criticality of the resources being changed.","Comprehensive Enterprise \nChange Management Process, \nWorkflow, and Database: \n\nEstablish organization-wide change management (CM) process and standards applicable to all IT and information (hardware, software, infrastructure, and data); support change management process with single automated workflow tool and central CM data repository","Identify","Practices are formally defined and governed by enterprise policy with senior management oversight.\n\n","5315.5  Configuration Management\n\n5315  Information Security Integration","Configuration Management:\nCM-3  CONFIGURATION CHANGE CONTROL\nCM-4  SECURITY IMPACT ANALYSIS\nCM-5  ACCESS RESTRICTIONS FOR CHANGE"]
[null,null,null,null,"Enterprise policy is comprehensively applied across the enterprise; mandates the maintenance of an enterprise change management processes; and defines the assets to be managed via the process; outlines specific management and administration responsibilities including change advisory board (CAB) and formal security change impact evaluations.\n"]
[null,null,null,null,"Implementation includes the use of automation for workflow, cataloging, tracking, and reporting.\n"]
[null,null,null,null,"Monitoring and reporting processes are defined and established to ensure policy adherence.\n"]
[null,null,null,null,"Integrated with enterprise configuration and asset management processes.\n"]
[null,null,null,null,"Approach and applicability of the change management policy is enhanced and enforced through a regular and periodic program of review, audit, and approach update.\n"]
[null,null,"Embed Formal Security Evaluations \nin Enterprise CM Process: \n\n Integrate formal security impact evaluation and approval in enterprise risk management processes and panels","Detect","Practices are formally defined and governed by enterprise policy with senior management oversight.\n",null,"Configuration Management:\nCM-4  SECURITY IMPACT ANALYSIS"]
[null,null,null,null,"Enterprise policy is comprehensively applied across the enterprise; mandates the maintenance of an enterprise change management process that includes formal security change impact evaluations to qualify the level of alteration to the enterprise security posture resulting from the proposed change; defines the threshold criteria for identifying types of changes subject to security impact evaluations; outlines specific management and administration responsibilities including actions and authority of change advisory board (CAB) to stop, suspend, or approve changes based on results of security impact evaluation.\n"]
["DATA SECURITY","Deploy governance processes and protection controls  to prevent unauthorized or inappropriate access to or disclosure of private or sensitive information. In keeping with a systematic and comprehensive security program, deploy controls to protect information confidentiality in addition to controls for other major security objectives as they relate to comprehensive data and information protection.","Data Classification Policy \nand Enforcement: \n\nEstablish enterprise policy and practices for data classification that includes identification and definition of data and information types used, processed, and stored throughout the enterprise in alignment with business processes","Identify","\nBusiness data use cases and practices are formally defined and governed by enterprise policy with senior management oversight.\n\n","5305.5  Information Asset Management\n\n5310.1  State Entity Privacy Statement And Notice On Collection\n\n5310.2  Limiting Collection\n\n5310.3  Limiting Use And Disclosure\n\n5310.4  Individual Access to Personnel Information\n\n5310.5  Information Integrity\n\n5310.6  Data Retention and Destruction\n\n5310.7  Security Safeguards\n\n5320 Training and Awareness for Information Security and Privacy\n\n5365.2  Media Protection\n\n5365.3  Media Disposal","Awareness and Training Risk Assessment:\nRA-2  SECURITY CATEGORIZATION\n\nSystem and Communications Protection:\nSC-8  TRANSMISSION CONFIDENTIALITY AND INTEGRITY\nSC-13  CRYPTOGRAPHIC PROTECTION\nSC-28  PROTECTION OF INFORMATION AT REST"]
[null,null,null,null,"Enterprise policy defines practices for data classification that includes identification and definition of data and information types used, processed, and stored throughout the enterprise in alignment with business processes.\n"]
[null,null,null,null,"Authorized use case guidelines are provided for data-at-rest, in-motion, and in-use, as well as required standards for protection per use case.\n"]
[null,null,null,null,"Use case requirements include data exchange, retention, and destruction, as well as hardcopy and mobile media applicability.\n"]
[null,null,null,null,"Training on appropriate use is included in regular and periodic security awareness program.\n"]
[null,null,null,null,"Monitoring and reporting processes are defined and established to ensure policy adherence.\n"]
[null,null,null,null,"Approach and applicability of the enterprise data classification policy is enhanced and enforced through a regular and periodic program of review, audit, and approach update.\n"]
[null,null,"Data Privacy Program \nand Enforcement: \n\nEstablish an enterprise policy and direct the development and maintenance of an organizational Privacy Program that defines the overall Privacy Program as it explicitly describes the applicability of privacy policy to enterprise business processes and ensures the compliance with the California Information Practices Act. ","Protect","Enterprise privacy policy is defined with senior management accountability.   Appoints a Chief Privacy Officer (CPO) or Privacy Coordinator (PC) responsible for the development, implementation, maintenance of a privacy program to protect individual privacy and to ensure the compliance with applicable laws and regulations regarding the collection, use, maintenance, sharing and disposal of personally information by programs and information systems.\n","5305.2  Policy, Procedure and Standards Management\n\n5305.6  Risk Management\n\n5305.7  Risk Assessment\n\n5310.1  State Entity Privacy Statement and Notice on Collection\n\n5310.2  Limiting Collection                                          \n\n                                   5310.3  Limiting Use and Disclosure\n\n5310.4  Individual Access \n   \n5310.5  Information Integrity\n\n5310.6  Data Retention and Destruction \n\n5315.3  Information Asset Documentation\n\n5330.1  Security Assessments","Accountability, Audit, and Risk Management:\nAR-1  GOVERNANCE AND PRIVACY PROGRAM\nAR-2  PRIVACY IMPACT AND ASSESSMENT\nAR-3  PRIVACY REQUIREMENTS FOR CONTRACTORS AND SERVICE PROVIDERS\nAR-4  PRIVACY MONITORING AND AUDITING\nAR-6  PRIVACY REPORTING\nAR-7  PRIVACY ENHANCED SYSTEM DESIGN AND DEVELOPMENT\nAR-8  ACCOUNTING OF DISCLOSURES\n\nRisk Assessment:\nRA-1  RISK ASSESSMENT POLICY AND PROCEDURES\n\nProgram Management:\nPM-9  RISK MANAGEMENT STRATEGY\n\nAuthority and Purpose:\nAP-1  AUTHORITY TO COLLECT\nAP-2  PURPOSE SPECIFICATION\n\n                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Data Minimization and Retention:\nDI-1  MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION\n \nIndividual Participation and Redress:\nIP-1  CONSENT\n\nTransparency:\nTR-1  PRIVACY NOTICE"]
[null,null,null,null,"Policy is defined to support achievement of privacy objectives commensurate with business objectives.\n"]
[null,null,null,null,"Policies are regularly and periodically reviewed and updated for alignment with current prevailing industry practices and applicable threats.\n"]
[null,null,null,null,"Policies and any updates are regularly and periodically communicated to personnel with respect to applicability and enforcement.\n"]
[null,null,null,null,"Policy is supported by comprehensive, set of defined policy implementation standards and guidelines, as well as requirements for minimum baseline policy enforcement across all aspects of the architecture and business processes.\n                                                                 "]
[null,null,null,null,"Privacy policy definition, applicability, and enforcement is enhanced and validated through a program of regular and periodic review, maintenance, update, monitoring and audit.\n"]
[null,null,null,null,"All public websites contain a Privacy Policy Statement.  All online and hard copy forms that collect personal information contain a Notice on Collection.\n"]
["DATA SECURITY, (CONT'D).",null,null,"Protect","Comprehensive privacy risk assessment strategy is formally defined and governed by the enterprise privacy policy with senior management oversight.\n"]
[null,null,null,null,"Policy identifies privacy-specific management and administrative roles and responsibilities including applicability to vendors and contractors. \n                                                                                                        "]
[null,null,null,null,"Regular and periodic assessment of privacy-related risk and formal acceptance of residual risk by accountable organization management for programs, systems and technologies and including existing and new through informal and formal project management processes include Privacy Threshold Assessments (PTA) and Privacy Impact Assessments (PIA).\n                                                                   "]
[null,null,null,null,"The assessment process is based on an industry-accepted leading practice privacy framework and includes criteria for qualifying risk commensurate with the business mission of the organization.\n"]
[null,null,null,null,"Process addresses residual risk in all aspects of the enterprise including telecommunications perimeter, major systems and applications, infrastructure, resources and data, governance, and procurement/acquisition.\n"]
[null,null,null,null,"The process is enforced through a program of regular and periodic monitoring and testing to validate assessment findings, with resulting metrics used to provide input to residual risk acceptance process.\n"]
[null,null,null,null,"Privacy program is periodically supplemented by privacy assessments conducted by independent third-parties.\n"]
[null,null,null,null,"Privacy assessment results are provided as input into overall enterprise risk and compliance management processes.\n"]
[null,null,null,null,"Privacy assessment processes are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
[null,null,"Protecting Confidential \nand Sensitive Data: \n\nEmploy encryption technology to protect sensitive data-at-rest, in accordance with the enterprise data classification policy, in all enterprise and organization-specific structured data repositories that contain sensitive information including databases and enterprise content management systems","Protect","Data-at-rest protection practices are defined and governed in accordance with the enterprise information classification policy requirements for sensitive data.\n","5310.7  Security Safeguards\n\n5350.1  Encryption\n\n5365.2  Media Protection\n\n5350  Operational Security \n","Media Protection:\nMP-5  MEDIA TRANSPORT\n\nSystem and Communications Protection:\nSC-12  CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT\nSC-17  PUBLIC KEY INFRASTRUCTURE CERTIFICATES\nSC-28  PROTECTION OF INFORMATION AT REST\nSC-8  TRANSMISSION CONFIDENTIALITY AND INTEGRITY\nSC-13  CRYPTOGRAPHIC PROTECTION"]
[null,null,null,null,"Appropriate, current-state technological protection, such as encryption, masking and obfuscation, or tokenization, are employed on all enterprise and organization-specific electronic media and devices with the capability to store information.\n"]
[null,null,null,null,"Encryption strength (key and algorithm) is commensurate with assurance-level requirements of the devices and media, as well as use cases in which the devices and media are used.\n"]
[null,null,null,null,"Encryption approach(es) are supplemented with sufficient encryption key management processes to ensure protected and managed data recovery for loss, mis-configuration, or forensic investigation.\n"]
[null,null,null,null,"Data-at-rest protection practices are enhanced and enforced through a regular and periodic program of review, audit, testing, and update.\n"]
["SECURITY GOVERNANCE","Establish a high-level enterprise Security Governance process led by an information security officer (ISO) who is empowered to protect enterprise IT assets while removing the barriers to productivity through well-understood management processes and governance principles.","Awareness Training Program: \n\nEstablish a comprehensive enterprise security awareness and training policy with requirements for regular and periodic (annual) awareness training for all users of IT operated by or on behalf of the enterprise","Respond","Regular and periodic security awareness training is mandated by enterprise security policy with senior management oversight.\n","5305.4  Personnel Management\n\n5320  Training And Awareness For Information Security And Privacy\n\n5320.1  Security And Privacy Awareness\n\n5320.2  Security And Privacy Training\n\n5320.3  Security And Privacy Training Records\n\n5320.4  Personnel Security","Awareness and Training:\nAT-1  SECURITY AWARENESS POLICY AND PROCEDURES\nAT-2  SECURITY AWARENESS TRAINING\nAT-3  ROLE-BASED SECURITY TRAINING\nAT-4  TRAINING RECORDS\n\nSecurity Planning:\nPL-4  RULES OF BEHAVIOR\n"]
[null,null,null,null,"Awareness training is mandatory for all enterprise personnel, as well as all vendors, suppliers, and providers which make use of or operate IT resources and information on behalf of the organization.\n"]
[null,null,null,null,"Training compliance is formally tracked, managed, and reported, and enforced through suspension of access to IT assets required for job function.\n"]
[null,null,null,null,"Training content includes awareness of security policy applicability and enforcement, applicable threats, and reporting.\n"]
[null,null,null,null,"Training content is regularly and periodically updated to maintain currency with prevailing events.\n"]
[null,null,null,null,"Training program is multi-faceted to include formal training, mass communications, and topic-specific messaging.\n"]
[null,null,null,null,"Training program includes role-specific training for audiences from at least the general-user, technical, and management perspectives.\n"]
[null,null,null,null,"Metrics exist to measure success of awareness program as it relates to improved security and decreased risk.\n"]
[null,null,null,null,"Security awareness training program is enhanced through a program of regular and periodic review, maintenance, update, and audit.\n"]
[null,null,"Comprehensive Security \nPolicy Structure: \n\n Formally establish and document a consolidated, comprehensive enterprise-specific security governance policy structure that includes policy, requirements, and supporting standards","Protect","\n\n\nEnterprise security policy is defined with senior management accountability.","5305  Information Security Program\n \n5305.2  Policy, Procedures and Standards Management","Access Control:\nAC-1  ACCESS CONTROL POLICY AND PROCEDURES \nAwareness and Training:\nAT-1  SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES \nAudit and Accountability: \nAU-1  AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES \nSecurity Assessment and Authorization:\nCA-1  SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND PROCEDURES \nConfiguration Management: \nCM-1  CONFIGURATION MANAGEMENT POLICY AND PROCEDURES \nContingency Planning: \nCP-1  CONTINGENCY PLANNING POLICY AND PROCEDURES \nIdentification and Authentication:\nIA-1  IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES \nIncident Response: \nIR-1  INCIDENT RESPONSE POLICY AND PROCEDURES \nMaintenance:\nMA-1  SYSTEM MAINTENANCE POLICY AND PROCEDURES \nMedia Protection: \nMP-1  MEDIA PROTECTION POLICY AND PROCEDURES\nPhysical and Environmental Protection: \nPE-1  PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND PROCEDURES \nPlanning: \nPL-1  SECURITY PLANNING POLICY AND PROCEDURES \nPersonnel Security:\nPS-1  PERSONNEL SECURITY POLICY AND PROCEDURES\nRisk Assessment:\nRA-1  RISK ASSESSMENT POLICY AND PROCEDURES \nSystem and Services Acquisition:\nSA-1  SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES\nSystem and Communications Protection: \nSC-1  SYSTEM AND COMMUNICATIONS PROTECTION POLICY AND PROCEDURES \nSystem and Information Integrity: \nSI-1  SYSTEM AND INFORMATION INTEGRITY POLICY AND PROCEDURES"]
[null,null,null,null,"Policy is defined to support achievement of security objectives commensurate with business objectives.\n"]
[null,null,null,null,"Policy is regularly and periodically reviewed and updated for alignment with current prevailing industry practices and applicable threats.\n"]
[null,null,null,null,"Policy updates are regularly and periodically communicated to personnel with respect to applicability and enforcement.\n"]
[null,null,null,null,"Policy is supported by comprehensive, set of defined policy implementation standards and guidelines, as well as requirements for minimum baseline policy enforcement across all aspects of the security architecture and all business processes.\n"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["SECURITY \nGOVERNANCE, (CONT'D).",null,"Security Management Plan: \n\nEstablish an enterprise policy and direct the development and maintenance of an organizational Security Management Plan (SMP) that defines the overall information protection program as it relates to security and privacy, and explicitly describes applicability of security and privacy policy to enterprise business processes","Protect","Comprehensive security and risk assessment strategy is formally defined and governed by the enterprise security management policy with senior management oversight.\n","5305  Information Security Program\n\n5305.1  Information Security Program Management\n\n5305.2  Risk Management\n\n5305.6  Risk Management\n\n5305.7  Risk Assessment\n\n5330.1  Security Assessments\n","Security Assessment and Authorization:\nCA-7  CONTINUOUS MONITORING\n\nProgram Management:\nPM-1  INFORMATION SECURITY PROGRAM PLAN\n\nRisk Assessment:\nRA-3  RISK ASSESSMENT\nRA-1  RISK ASSESSMENT POLICY AND PROCEDURES\n\n"]
[null,null,null,null,"Policy identifies security-specific management and administrative roles and responsibilities including applicability to vendors and contractors.\n"]
[null,null,null,null,"Policy mandates process for residual security risk management that includes regular and periodic assessment of security-related risk and formal acceptance of residual risk by accountable organization management.\n"]
[null,null,null,null,"The assessment process is based on an industry-accepted leading practice security framework and includes criteria for qualifying risk commensurate with the business mission of the organization.\n\n"]
[null,null,null,null,"Process addresses residual risk in all aspects of the enterprise including telecommunications perimeter, major systems and applications, infrastructure, resources and data, governance, and procurement/acquisition.\n"]
[null,null,null,null,"The process is enforced through a program of regular and periodic monitoring and testing to validate assessment findings, with resulting metrics used to provide input to residual risk acceptance process.\n\n"]
[null,null,null,null,"Assessment program is periodically supplemented by assessments conducted by independent third-parties.\n"]
[null,null,null,null,"Assessment results are provided as input into overall enterprise risk and compliance management processes.\n"]
[null,null,null,null,"Security and risk assessment processes are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
[null,null,"Risk Acceptance: \n\nFormally establish an organization-specific policy and supporting process for residual security risk management that includes regular and periodic assessment of security-related risk and formal acceptance of residual risk by accountable organization management","Identify","Comprehensive security planning and system authorization strategy is formally defined and governed by the enterprise security management policy with senior management oversight.\n\n","5305.6  Risk Management\n\n5305.7  Risk Assessment\n\n5315.9  Security Authorization\n","Security Assessment and Authorization:\nCA-5  PLAN OF ACTION AND MILESTONES\nCA-6  SECURITY AUTHORIZATION\n\nProgram Management:\nPM-4  PLAN OF ACTION AND MILESTONES PROCESS\nPM-9  RISK MANAGEMENT STRATEGY\nPM-10  SECURITY AUTHORIZATION PROCESS\n\nRisk Assessment:\nRA-3  RISK ASSESSMENT"]
[null,null,null,null,"Policy identifies security-specific management and administrative roles and responsibilities including applicability to vendors and contractors.\n"]
[null,null,null,null,"Policy mandates the development and periodic maintenance of system-specific security plans, and requires senior management approval of the plans, as well as approval to operate the system or application in the risk environment documented in the plan.\n"]
[null,null,null,null,"Policy defines and identifies accountable management designated to formally accept residual risk per organization-specific criteria which includes overall responsibility for providing data and services to end-users, and the authority to provide and/or manage funding required to appropriately mitigate risks to an acceptable level.\n"]
[null,null,null,null,"Security plans align established security policy with applicable business-specific processes.\n"]
[null,null,null,null,"Security plans are established for all systems and applications identified as critical to the organization and successful execution of the business, and identify the approaches used to satisfy the confidentiality, availability, and integrity requirements of the systems and data processed, stored, or used by the system.\n"]
[null,null,null,null,"Security plans define the overall information protection approach applied to the system and application as it relates to security and privacy, including policies, processes, and controls.\n"]
[null,null,null,null,"Security planning and system authorization processes are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
["SECURITY \nGOVERNANCE, (CONT'D).",null,"Procurement and Acquisition:\n \nEstablish and deploy contract terms and conditions as appropriate for enforcing enterprise security risk management policies and requirements in software, hardware, or services acquisition and procurement, including outsourced or other contracted efforts.","Protect","Procurement governance is formally established, including the identification of spend thresholds, and governed by enterprise policy.\n","5230.4  Principles for IT Procurement\n\n5305.8  Provisions for Agreements with State and Non-State Entities\n\n5315  Information Security Integration\n\n5330  Information Security Compliance\n\n5315.1  System and Services Acquisition","Access Control:\nAC-20  USE OF EXTERNAL INFORMATION SYSTEMS\n\nPersonnel Security:\nPS-7  THIRD-PARTY PERSONNEL SECURITY\n\nSystem and Services Acquisition:\nSA-9  EXTERNAL INFORMATION SYSTEM SERVICES\nSA-10  DEVELOPER CONFIGURATION MANAGEMENT\nSA-4  ACQUISITION PROCESS\nSA-4 (1)  Functional Properties of Security Controls"]
[null,null,null,null,"Policy is aligned to the strategic business objectives and articulates the business value.\n"]
[null,null,null,null,"Procurement process workflow is documented to illustrate how stakeholders acquire IT systems/services.\n"]
[null,null,null,null,"Process includes incorporation of security-specific requirements commensurate with the type (hardware, software, services) and level of assurance of items being acquired.\n"]
[null,null,null,null,"Procurement decisions are documented for transparency, and the results are commensurate with established policy.\n"]
[null,null,null,null,"Procurement process is periodically assessed, improvement areas identified, and enhancements implemented.\n"]
["ENDPOINT SECURITY","Deploy appropriate management and protection controls on endpoint platforms that will maintain stated security objectives for hosted data and applications under specific use cases, establish minimal controls for protecting systems, and enforce location-based policies with respect to applicable information, network, and application architectures. Choose a protection portfolio that includes preventative, detective, and responsive (react or adapt) technologies.","Platform-Specific Build \nStandards and Procedures: \n\nEstablish enterprise policy that directs the development and maintenance of organization-specific platform development / build standards, processes, and procedures","Protect","Platform development / build standards, processes, and procedures are formally defined and governed by enterprise policy with senior management oversight.","5315.6  Activate Only Essential Functionality\n\n5335.2  Auditable Events\n\n5315.5  Configuration Management","Configuration Management:\nCM-2  BASELINE CONFIGURATION\nCM-2 (1)  Reviews and Updates\nCM-3  CONFIGURATION CHANGE CONTROL"]
[null,null,null,null,"Policy identifies specific management and administrative roles and responsibilities, including dependencies of vendors and contractors.\n"]
[null,null,null,null,"Practices include the application of security configuration hardening requirements that are based on industry-accepted standards for platform security configuration management.\n"]
[null,null,null,null,"Practices are applied comprehensively for all platform (hardware and operating system) types in the organization IT asset inventory.\n"]
[null,null,null,null,"Policy and standards align with and complement business-specific processes related to IT platform use.\n\n"]
[null,null,null,null,"Security hardening requirements are enforced through a program of regular and periodic review, maintenance, update, and audit.\n"]
[null,null,"Platform-Specific Hardening \nStandards and Procedures: \n\nEstablish and document formal enterprise security policy and standards for platform configuration management including requirements for security configuration (hardening)","Protect","\n\n\nPlatform development / build standards, processes, and procedures are formally defined and governed by enterprise policy with senior management oversight.\n","5315.6  Activate Only Essential Functionality\n\n5355  Endpoint Defense\n","Configuration Management:\nCM-6  CONFIGURATION SETTINGS\n\n"]
[null,null,null,null,"Policy identifies specific management and administrative roles and responsibilities, including dependencies of vendors and contractors.\n"]
[null,null,null,null,"Practices include the application of security configuration hardening requirements that are based on industry-accepted standards for platform security configuration management.\n"]
[null,null,null,null,"Practices are applied comprehensively for all platform (hardware and operating system) types in the organization IT asset inventory.\n"]
[null,null,null,null,"Policy and standards align with and complement business-specific processes related to IT platform use.\n\n"]
[null,null,null,null,"Security hardening requirements are enforced through a program of regular and periodic review, maintenance, update, and audit.\n"]
["IDENTITY AND \nACCESS MANAGEMENT","Establish an identity management service layer that provides consistent access control and policy enforcement; identity lifecycle and credential management; and identity data services for all subjects (users and services) and resources (systems, applications, data) in the environment.","Comprehensive Documented Enterprise Access Management \nand Provisioning Strategy: \n\nEstablish organization-specific access management processes that includes identity lifecycle management, consolidated and comprehensive use case provisioning and change management workflow, and centralized access authentication and authorization processes","Protect","Comprehensive identity and access management strategy is formally defined and governed by enterprise policy with senior management oversight.\n","5305.4  Personnel Management\n\n5360 Identity and Access Management\n\n5360.1  Remote Access\n\n5360.2 Wireless Access\n\n5365.1  Access Control for Output Devices","Access Control:\nAC-1  ACCESS CONTROL POLICY AND PROCEDURES\nAC-1 (1)  Automated Account Management\nAC-1 (2)  Remove of Temporary/Emergency Accounts\nAC-1 (3)  Disable Inactive Accounts\nAC-1 (4)  Automated Audit Actions\nAC-2  ACCOUNT MANAGEMENT\nAC-3  ACCESS ENFORCEMENT\nAC-5  SEPARATION OF DUTIES\nAC-6  LEAST PRIVILEGE\n\nIdentification and Authentication:\nIA-1  IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES\nIA-2  IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)\nIA-3  DEVICE IDENTIFICATION AND AUTHENTICATION\nIA-4  IDENTIFIER MANAGEMENT\nIA-5  AUTHENTICATOR MANAGEMENT\nIA-8  IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS)\n\nPersonnel Security:\nPS-3  PERSONNEL SCREENING\nPS-5  PERSONNEL TRANSFER\nPS-6  ACCESS AGREEMENTS"]
[null,null,null,null,"Enterprise policy is applied comprehensively for all business use cases.\n"]
[null,null,null,null,"Policy identifies specific management and administrative roles and responsibilities, including applicability to vendors and contractors.\n"]
[null,null,null,null,"Strategy is enforced through IAM-specific architecture and aligned with organization-specific business objectives and enterprise security objectives.\n"]
[null,null,null,null,"Enterprise policy is enforced through use of provisioning processes to track, report, and validate individual user access rights and privileges.\n"]
[null,null,null,null,"Policy is implemented through use of modern, enterprise-class automated provisioning and access management technology.\n"]
[null,null,null,null,"Compliance and reporting requirements are enforced through the deployment of modern Governance-Risk-Compliance (GRC) technology integrated with provisioning processes.\n"]
[null,null,null,null,"Strategy and policy, processes, and integrity of identity data is enhanced and validated through a program of regular and periodic review, maintenance, update, and audit."]
[null,null,"Multi-Factor Authentication \nfor Elevated Risk Use Cases: \n\nReplace the use of traditional passwords for authentication by acquiring and deploying appropriate multi-factor authentication for all high risk use cases and users with write/modify-rights to sensitive data","Protect","Standards for credentials for gaining access to IT resources are formally defined and governed by enterprise policy with senior management oversight.\n","5305.4  Personnel Management\n\n5360  Identity and Access Management\n\n5360.1  Remote Access","Access Control:\nAC-1  ACCESS CONTROL POLICY AND PROCEDURES\nAC-2  ACCESS CONTROL POLICY AND PROCEDURES\nAC-17  REMOTE ACCESS\n\nIdentification and Authentication:\nIA-1  IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES\nIA-2  IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) \nIA-2 (1)  Network Access to Privileged Accounts\nIA-2 (2)  Network Access to Non-Privileged Accounts\nIA-2 (3)  Local Access to Privileged Accounts\nIA-2 (4)  Local Access to Non-Privileged Accounts\nIA-4 IDENTIVER MANAGEMENT\nIA-5  AUTHENTICATOR MANAGEMENT\nIA-8  IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS)\n\nPersonnel Security:\nPS-5  Personnel Transfer\nPS-6  Access Agreements"]
[null,null,null,null,"Policy identifies specific management and administrative roles and responsibilities, including applicability to vendors and contractors, and is applied and enforced comprehensively for all use cases and platforms in the enterprise IT asset inventory.\n"]
[null,null,null,null,"Policy enforcement addresses requirements applicable to levels of authentication assurance for systems and data commensurate with business processes and impact of risk exposure.\n"]
[null,null,null,null,"Standards address password strength as applicable to assurance requirements, and are based on industry-accepted standards for consumer authentication.\n"]
[null,null,null,null,"Traditional passwords have been replaced by multi-factor credentials for all high risk use cases including remote access users, privileged users and administrators (i.e., users authorized to bypass or modify security controls and device or data configurations), and users with write/modify-rights to sensitive data.\n"]
[null,null,null,null,"Credentials are administered and managed through enterprise provisioning process.\n"]
[null,null,null,null,"Standards are further enforced and enhanced through a program of regular and periodic review, maintenance, update, and audit. "]
[null,null,"Privileged User Management \nand Best Practices Enforcement: \n\nEnhance the administration of privileged accounts (i.e., users authorized to bypass or modify security controls and device or data configurations) by acquiring and deploying appropriate Privileged Account Management solution. Configure and systematically enforce expiration of all privileged accounts. Consider the implementation of a shared-account password management capability","Protect","Approach for user access authorization rights and privilege management is defined and governed as part of the enterprise IAM policy.\n","5305.4  Personnel Management\n\n5360  Identity and Access Management\n\n5360.1  Remote Access","Access Control:\nAC-1  ACCESS CONTROL POLICY AND PROCEDURES\nAC-2  ACCOUNT MANAGEMENT\nAC-6  LEAST PRIVILEGE\nAC-17  REMOTE ACCESS\n\nIdentification and Authentication:\nIA-1  IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES\nIA-5  AUTHENTICATOR MANAGEMENT\nIA-11  RE-AUTHENTICATION"]
[null,null,null,null,"Authorization management practices are managed through enterprise provisioning process, enforced through enterprise authoritative identity data sources, and integrated with centralized access management processes and technology.\n"]
[null,null,null,null,"Execution of authentication rights and privileges are contingent on successful authentication, and are comprehensively used to facilitate reduced sign-on, role and entitlement management, and transaction monitoring as applicable.\n"]
[null,null,null,null,"Authorization management enforcement is strengthened through regular and periodic re-validation of individual user access requirements and assignments.\n"]
[null,null,null,null,"Processes and integrity of authorization data is enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
["MOBILE SECURITY","Deploy appropriate management and protection controls on mobile devices that will maintain stated security objectives for hosted data and applications under specific use cases, establish minimal controls for protecting devices, and enforce location-based policies with respect to applicable information, network, and application architectures.","Enterprise Mobile \nDevice Management: \n\nEstablish and document a formal enterprise security policy and standards for mobile handheld devices and device configuration management","Protect","Devices configurations are formally defined and governed by enterprise policy.\n","5350.1  Encryption\n\n5365.3  Media Disposal\n\n5315.5  Configuration Management","Access Control:\nAC-19  ACCESS CONTROL FOR MOBILE DEVICES\n\nConfiguration Management:\nCM-2  BASELINE CONFIGURATION\n\nIdentification and Authentication:\nIA-3  DEVICE IDENTIFICATION AND AUTHENTICATION"]
[null,null,null,null,"Configurations are enforced through comprehensive device management technologies that include configuration control and remote wipe; data transmission and on-device encryption; data archiving and containerization; on-device application control and enterprise mobile application lifecycle management; user authentication to device and device authentication to environment.\n"]
[null,null,null,null,"Training on appropriate use is included in regular and periodic security awareness program.\n"]
[null,null,null,null,"Monitoring and reporting processes are defined and established to ensure policy adherence.\n"]
[null,null,null,null,"Device configurations and protections are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
["SECURITY ANALYTICS AND CONTINUOUS MONITORING","Deploy controls that monitor and prevent attacks or limit the consequences of their success on the network or within the infrastructure.","Exposure and Intrusion Detection \nand Prevention Capability: \n\nDeploy monitoring and response processes and technologies for all inbound, internal, and outbound network activity to identify suspicious patterns and correct malicious or unauthorized actions or policy violations","Detect","Modern, enterprise-class network intrusion prevention/detection technologies are deployed and operational to provide feedback on protection of critical IT resources and business processes with significant sensitive information responsibilities.\n","5335.1  Continuous Monitoring\n\n5335  Information Security Monitoring\n\n5335.2  Auditable Events\n\n5340  Information Security Incident Management\n\n5340.3  Incident Handling\n\n5340.4  Incident Reporting","Audit and Accountability:\nAU-2  AUDIT EVENTS\nAU-3  CONTENT OF AUDIT RECORDS\nAU-6  AUDIT REVIEW, ANALYSIS, AND\n\nReporting:\nAU-7  LOG AGGREGATION\nAU-12  AUDIT GENERATION\n\nIncident Response:\nIR-4  INCIDENT HANDLING\nIR-1  INCIDENT RESPONSE POLICY AND PROCEDURES\nIR-5  INCIDENT RESPONSE MONITORING\n\nSystem and Information Integrity:\nSI-3  MALICIOUS CODE PROTECTION\nSI-4  INFORMATION SYSTEM MONITORING"]
[null,null,null,null,"Solution(s) are: aligned with organization-specific business processes; tailored commensurate with enterprise data classification policy; aligned and integrated with enterprise telecommunications and network services strategy as well as the network zoning strategy.\n"]
[null,null,null,null,"Monitoring capabilities include: critical alert escalation through enterprise incident response process; supplementation with active network segment blocking, re-routing, or resource suspension; integration with enterprise security information and event management (SIEM) capability and/or security operations center (SOC).\n"]
[null,null,null,null,"Monitoring effectiveness is maintained through a program of regular and periodic review, update, and audit.\n"]
[null,null,null,null,"A baseline of activity within the organization has been created from which anomalous activity can be identified and investigated.\n"]
[null,null,null,null,"Baseline maintenance is part of the development lifecycle and revalidated as part of the testing new services.\n"]
[null,null,null,null,"Signature based tools are used at appropriate choke points within the organization to identify malicious activity embedded in valid traffic flows.\n"]
[null,null,null,null,"There is a well defined incident response process when anomalous activity is detected, which includes a pre-defined action plan and a communication plan for key stakeholders. \n"]
[null,null,"Enterprise Specific Event Correlation \nand Evaluation Capability: \n\nAcquire and deploy organization-specific event analysis capabilities for critical infrastructure environments and those with significant sensitive information contents. Consider engaging a Managed Security Service Provider (MSSP) to assist in monitoring and analyzing system events","Detect","\nOrganization-specific Security Information and Event Management (SIEM) risk monitoring capabilities are deployed for critical infrastructure environments and those with significant sensitive information contents.\n","5335.1  Continuous Monitoring\n\n5335  Information Security Monitoring\n\n5335.2  Auditable Events\n\n5355.2  Security Alerts, Advisories, and Directives","Audit and Accountability:\nAU-2  AUDIT EVENTS\nAU-3  CONTENT OF AUDIT RECORDS\nAU-6  AUDIT REVIEW, ANALYSIS, AND REPORTING\nAU-7  LOG AGGREGATION\nAU-12  AUDIT GENERATION\n\nIncident Response:\nIR-4  INCIDENT HANDLING\n\nSystem and Information Integrity:\nSI-3  MALICIOUS CODE PROTECTION\nSI-4  INFORMATION SYSTEM MONITORING\nSI-5  SECURITY ALERTS, ADVISORIES, AND DIRECTIVES"]
[null,null,null,null,"SIEM integrates and archives alert and transaction log information from all critical perimeter and infrastructure processing, monitoring, and control devices.\n"]
[null,null,null,null,"Alerts are integrated with organization-specific incident response process.\n"]
[null,null,null,null,"Risk monitoring and analytics processes and technologies are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
["NETWORK SECURITY","Deploy controls that establish external perimeters to separate zones of trust (enterprise-wide, business unit/function, location) and to enforce controls on the traffic entering or leaving each zone.","Technical Enforcement of Security Layers and Data Center Separation: \n\nCreate multiple distinct zones separated by firewall functionality. Deploy technical security separation controls (e.g., firewall-enforced network segmentation) between user resources and infrastructure (e.g., servers, mainframes, network components) resources located on the internal, trusted network (data center firewall)","Protect","Comprehensive standards for internal telecommunication network architecture are formally defined and governed by enterprise policy with senior management oversight.\n","5315.8  Information Asset Connections\n\n5350  Operational Security","System and Communications Protection:\nSC-7  BOUNDARY PROTECTION\n\nSecurity Assessment and Authorization:\nCA-3  SYSTEM INTERCONNECTIONS \n"]
[null,null,null,null,"Standards include identification and definition of zones of trust including perimeter zones such as De-Militarized Zones, Trusted Zones such as user and resource zones, and Restricted Zones such as high-value asset, Control, or Audit Zones.\n"]
[null,null,null,null,"Standards address authorized internal network protocols, zone perimeter configurations, and protection and monitoring controls commensurate and aligned with enterprise data classification and telecommunications and network services policies and standards.\n"]
[null,null,null,null,"Authorized use case guidelines for each zone are defined and enforced, and include the protection of data and resources used, processed, stored, or transmitted through the zone.\n"]
[null,null,null,null,"Standards are enforced through integration of modern network segmentation technologies and methodologies into enterprise perimeter control and monitoring infrastructure.\n"]
[null,null,null,null,"Standards and zoning architecture are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
[null,null,"Network Admission Control:\n \nEstablish enterprise policy and practices for establishing connections with the IT infrastructure that includes identification and definition of connection types used throughout the enterprise in alignment with business processes","Detect","Comprehensive endpoint connection and remote access strategy is formally defined and governed by enterprise policy with senior management oversight.\n","5315.8  Information Asset Connections\n\n5355.1  Malicious Code Protection\n\n5360.1  Remote Access\n\n5360.2 Wireless Access\n\n5315.5  Configuration Management\n\n5360  Identity and Access Management","Security Assessment and Authorization:\nCA-2  SECURITY ASSESSMENTS\nCA-5  PLAN OF ACTION AND MILESTONES\nCA-6  SECURITY AUTHORIZATION\nCM-7  LEAST FUNCTIONALITY \n\nProgram Management:\nPM-4  PLAN OF ACTION AND MILESTONES PROCESS\nPM-9  RISK MANAGEMENT STRATEGY\nPM-10  SECURITY AUTHORIZATION PROCES"]
[null,null,null,null,"Strategy includes identification and definition of authorized business-justified remote access use cases, and identifies security-specific management and administrative roles and responsibilities including applicability to vendors and contractors.\n"]
[null,null,null,null,"Strategy is aligned and integrated with enterprise telecommunications and network services policy, as well as device configuration management strategy.\n"]
[null,null,null,null,"Policy and practices for establishing connections with the IT infrastructure includes identification and definition of connection types used throughout the enterprise in alignment with business processes.\n\n"]
[null,null,null,null,"Authorized use case guidelines for connection approaches include remote, wired, wireless, and other over-the-air, as well as required standards for security and data protection per use case.\n"]
[null,null,null,null,"Secure access policy enforces: standards for user and device identification and authentication; device configuration with respect to operating system, patch level, anti-malware software, endpoint protection mechanisms, and telecommunications capabilities; device health with respect to unauthorized or malicious software.\n"]
[null,null,null,null,"Implementation is enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
["PHYSICAL SECURITY","Ensure that a defense-in-depth approach includes physical controls that protect against unauthorized access to or inadvertent exposure of critical IT equipment and sensitive information.","Physical Security Policy Enforcement \nfor Data Center and Remote Sites: \n\nEvaluate and enforce existing physical security policies and practices through monitoring and audit reporting","Protect","Comprehensive physical protection and access strategy is formally defined and governed by enterprise policy with senior management oversight.\n","5365  Physical Security\n\n5365.1  Access Control for Output Devices\n\n5365.2  Media Protection\n\n5365.3  Media Disposal\n\n5320.4  Personnel Security","Identification and Authentication:\nIA-2  IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)\n\nMedia Protection:\nMP-2  MEDIA ACCESS\nMP-4  MEDIA STORAGE\n\nPhysical and Environmental Protection:\nPE-1  PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND PROCEDURES\nPE-2  PHYSICAL ACCESS AUTHORIZATIONS\nPE-3  PHYSICAL ACCESS CONTROL\nPE-5  ACCESS CONTROL FOR OUTPUT DEVICES\nPE-6  MONITORING PHYSICAL ACCESS\nPE-18  LOCATION OF INFORMATION SYSTEM COMPONENTS"]
[null,null,null,null,"Strategy identifies security-specific management and administrative roles and responsibilities including applicability to vendors and contractors.\n"]
[null,null,null,null,"Strategy is commensurate with business use cases and aligned with business and security objectives.\n"]
[null,null,null,null,"Policy is enforced through comprehensive hybrid of modern technological and procedural methods which address: hazard free building location (airports, nuclear power plants); building perimeter and interior access controls; visitor and vendor control and logging; locking office space and printer protection; hardcopy protection including retention, storage, destruction, and \"clean desk\"; video surveillance for internal, perimeter, and external; emergency procedures; personnel badging and key access.\n"]
[null,null,null,null,"Policy and practices enforcements are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
["VULNERABILITY MANAGEMENT","Deploy controls to track and map assets to technical security policy, monitor and scan for known vulnerabilities, and evaluate and mitigate vulnerabilities by patching the software, changing configurations, or deploying other controls in an attempt to reduce the attack surface at the resource layer (system or device operating systems, applications, databases, and other information technology (IT) resources).","Comprehensive Platform-Specific \nAnti-Malware Approach: \n\nDeploy anti-malicious software or endpoint protection solution on all server and workstation platforms used across the enterprise","Protect","Comprehensive anti-malicious software strategy is formally defined and governed by enterprise security management policy.\n","5355  Endpoint Defense\n\n5355.1  Malicious Code Protection\n\n5355.2  Security Alerts, Advisories, and Directives","System and Information Integrity:\nSI-3  MALICIOUS CODE PROTECTION\nSI-3 (1)  Central Management\nSI-3 (2)  Automatic Updates\nSI-4  INFORMATION SYSTEM MONITORING\nSI-4 (2)  Automated Tools for Real-Time Analysis\nSI-4 (5)  Stystem Generated Alerts"]
[null,null,null,null,"Policy identifies process-specific operational, management, and administrative roles and responsibilities including applicability to vendors and contractors.\n"]
[null,null,null,null,"Strategy is commensurate with business use cases and aligned with business and security objectives.\n"]
[null,null,null,null,"Anti-malicious software/endpoint protection solutions are deployed on all server and workstation platforms used across the enterprise, including mobile devices.\n"]
[null,null,null,null,"Enterprise class Secure Web Gateway (SWG) and Secure Email Gateway are deployed to filter critical infrastructure environments from malicious software, external attacks, and other inappropriate or unauthorized activity.\n"]
[null,null,null,null,"Solution(s) are aligned with organization-specific business processes and tailored commensurate with enterprise acceptable use and data classification policies.\n"]
[null,null,null,null,"Prevention controls are enforced with active blocking and alerting.\n"]
[null,null,null,null,"Deployment is comprehensive across all server platform types including application, file share, data base and data repository, communication and collaboration, and domain management.\n"]
[null,null,null,null,"Deployment encompasses all platforms in all environments including external and internal-facing, production, development, test, and stand-alone.\n"]
[null,null,null,null,"Solutions are configured to accept timely updates to attack recognition criteria or signature information, as well as processing and analysis engine software.\n"]
[null,null,null,null,"Solution is configured for centralized alerting and notification, and integrated with security event management or security operations center, and incident response and management processes.\n\n"]
[null,null,null,null,"Control effectiveness is enhanced and validated through a program of regular and periodic review, maintenance, update, testing, and audit.\n"]
[null,null,"Comprehensive Incident Response \nand Management Plan: \n\nEstablish repeatable and consistent enterprise policy, processes, and practices for security incident response and management","Respond","Comprehensive security incident handling strategy is formally defined and governed by enterprise policy with senior management oversight.\n","5340  Information Security Incident Management\n\n5340.2  Incident Response Testing\n\n5340.3  Incident Handling\n\n5340.4  Incident Reporting","Incident Response:\nIR-1  INCIDENT RESPONSE POLICY AND PROCEDURES\nIR-2  INCIDENT RESPONSE TRAINING\nIR-3  INCIDENT RESPONSE TESTING\nIR-4  INCIDENT HANDLING\nIR-5  INCIDENT MONITORING\nIR-6  INCIDENT REPORTING\nIR-8  INCIDENT RESPONSE PLAN"]
[null,null,null,null,"Policy identifies security-specific management and administrative roles and responsibilities including applicability to vendors and contractors.\n"]
[null,null,null,null,"Incident response and management plan is documented and includes identification and definition of potential and actual incident events and associated priorities, responses, authority, roles and responsibilities, points of escalation, and closure.\n"]
[null,null,null,null,"Plan identifies security-specific technical, operational, management and administrative roles and responsibilities, including applicability to vendors and contractors.\n"]
[null,null,null,null,"Plan includes communication plan that addresses emergency notification, management escalation, peer and partner notification, public affairs communication management, and constituent (service/product customer/consumer) notification with respect to applicable statutory regulations.\n\n"]
[null,null,null,null,"Incident handling process, governed by the plan, addresses event reporting intake and coordination, immediate incident response and triage, near-term vulnerability remediation and testing, long-term enterprise architecture enhancement, tracking and reporting events metrics and lessons learned, and formal closure.\n"]
[null,null,null,null,"Incident handling processes is integrated with and escalation to business continuity, disaster recovery, and emergency management plans as appropriate.\n"]
[null,null,null,null,"Incident response and management plan is maintained through a program of regular and periodic formal reviews and testing, as well as personnel training.\n"]
["VULNERABILITY MANAGEMENT, CONT.",null,null,"Respond","Incident reporting process is addressed through enterprise security awareness program.\n"]
[null,null,null,null,"Incident response and management plan and processes are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
[null,null,"Comprehensive Platform-Specific \nVulnerability Patching Process: \n\nEstablish a formal, comprehensive organization-specific platform management process to ensure that vendor platform operating system and software releases and patches are appropriately identified, evaluated, tested, and deployed in a timely manner for all IT assets in use by or managed on behalf of the organization (patch management process)","Protect","Patch management standards are formally defined and governed by enterprise configuration management policy with senior management oversight.\n","5305.8  Provisions for Agreements with State and Non-State Entities\n\n5345  Vulnerability and Threat Management\n\n5355.2  Security Alerts, Advisories, and Directives","Configuration Management:\nCM-2  BASELINE CONFIGURATION\n\nSystem and Services Acquisition:\nSA-10  DEVELOPER CONFIGURATION MANAGEMENT\nSA-22  UNSUPPORTED SYSTEM COMPONENTS\n\nSystem and Information Integrity:\nSI-2  FLAW REMEDIATION"]
[null,null,null,null,"Policy identifies specific management and administrative roles and responsibilities, including dependencies of vendors and contractors.\n"]
[null,null,null,null,"Standards address all platform and 3rd-party software.\n"]
[null,null,null,null,"Processes are used to ensure that applicable vendor platform operating system, software releases, patches are appropriately identified, evaluated, tested, and deployed in a timely manner for all IT assets in use by or managed on behalf of the organization.\n"]
[null,null,null,null,"Processes includes testing in target or like environment, and deployment to individual devices through a controlled process from a managed distribution environment.\n"]
[null,null,null,null,"Patch management is enforced through metrics related to successful testing and deployment, and include closed-loop follow-up verification of successful deployment.\n"]
[null,null,null,null,"Patch management tools include automated patch management solution, and integrate tracking through organization-specific change management process.\n"]
[null,null,null,null,"Patch management processes are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]
[null,null,"Comprehensive Vulnerability Identification Program Including Periodic and Pre-Production Vulnerability Scans \nfor Platforms and Applications:\n \nEstablish a formal, comprehensive enterprise vulnerability scanning and testing program that includes regular and periodic vulnerability scanning of all operational applications, platforms, and devices operating in production as well prior to placing any applications, platforms, or devices into production","Detect","Vulnerability management practices are formally defined, documented, and governed by enterprise configuration management policy with senior management oversight.\n","5345  Vulnerability and Threat Management\n\n5355.2  Security Alerts, Advisories, and Directives","Risk Assessment Policy and Procedures:\nRA-5 VULNERABILITY SCANNING\n\nSystem and Services Acquisition:\nSA-11  DEVELOPER SECURITY TESTING AND EVALUATION\n\nSystem and Information Integrity:\nSI-2  FLAW REMEDIATION\nSI-7  SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY"]
[null,null,null,null,"Policy identifies security-specific management and administrative roles and responsibilities including applicability to vendors and contractors.\n"]
[null,null,null,null,"Comprehensive enterprise vulnerability scanning and testing program includes regular and periodic vulnerability scanning of all operational applications, platforms, and devices operating in production as well as prior to placing any applications, platforms, or devices into production.\n\n"]
[null,null,null,null,"Pre-production vulnerability scanning is used to supplement all software and hardware build, promotion, and production-release processes.\n"]
[null,null,null,null,"The scanning  program is enforced at both the enterprise and organization-specific levels, as well as from both external and internal perspectives.\n"]
[null,null,null,null,"Vulnerability scanning program is supplemented with additional program of regular and periodic active penetration testing.\n"]
[null,null,null,null,"Critical or repeat findings are escalated to enterprise level for tracking and reporting.\n"]
[null,null,null,null,"Enforce policy for remediation of critical, externally-determined findings within specific period of time with defined consequences for lack of compliance.\n"]
[null,null,null,null,"Integrate remediation of scan and test findings with organization-specific change management process.\n"]
[null,null,null,null,"Vulnerability scanning processes are enhanced and validated through a program of regular and periodic review, maintenance, update, and audit.\n"]