Standards Overlap

CAN/CIOSC 104

Control Number	Group	Title	Description
4.1.2.1	Organizational Controls	Leadership	Leadership - Commitment to the Cyber Security Program - Top management shall demonstrate their commitment to the cyber security program by: a) ensuring the cyber security policy and objectives are established and are aligned with the strategic direction of the organization; b) ensuring that the resources needed for the cyber security program are available and are aligned with the cyber security policy and objectives; c) communicating the importance of effective cyber security and of conforming to the cyber security program requirements; d) establishing cybersecurity program metrics and tracking progress; and supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility. e) supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility
4.2.2.1	Organizational Controls	Accountability	Accountability - Top Management's Appointment of Senior-level IT Security Leadership - Top management shall appoint a member of the senior-level leadership team to oversee and be accountable for the organization’s IT security
4.3.2.1	Organizational Controls	Cyber Security Training	The organization shall train employees on basic security practices, including but not limited to the following practices: a. Compliance with password policies (see Subsection 5.5); b. Identification of malicious communications and phishing; c. Keeping employee devices and software updated. d. Principle of least privilege and basic access controls.
4.3.3.1	Organizational Controls	Ongoing awareness training	Cyber Security Training - Investment in Regular and Ongoing Awareness Training - The organization shall invest in regular and ongoing cyber security awareness and training for their employees.
4.4.2.1	Organizational Controls	Cyber Security Risk Assessment	Cyber Security Risk Assessment - Risk Assessment Questionnaire "Annex B" or Outsourced - Complete the “Cyber Security Risk Assessment Questionnaire” found in Annex B
4.4.3.1	Organizational Controls	Cyber Security Risk Assessment Policy	Cyber Security Risk Assessment - Senior Leadership Risk Assessments and Control Implementation - The member of the senior-level leadership team appointed to oversee the organization’s IT security shall conduct cyber security risk assessments and coordinate the implementation of cyber security controls to address potential cyber security risks.
4.4.3.2	Organizational Controls	List of information systems and assets	Cyber Security Risk Assessment - Information Systems and Assets List (Registry) - The organization shall develop and maintain a list of their information systems and assets. For any information systems and assets not included in their implementation of the baseline cyber security controls, the organization shall document all instances where they make the business decision not to do so.
4.4.3.3	Organizational Controls	Accepted cyber security risks	Cyber Security Risk Assessment - Documentation and Authorization of Accepted Risks - Cyber security risks accepted by the organization shall be documented and authorized by a senior official of the organization.
4.4.3.4	Organizational Controls	IT Security-Spending Levels-Raw	Cyber Security Risk Assessment - Financial Spending for IT and IT Security - The organization shall identify their financial spending levels for IT and IT security investment (as raw numbers and as a percent of total expenditures).
4.4.3.5	Organizational Controls	IT security staffing	Cyber Security Risk Assessment - Identification of Internal Staffing for IT and IT Security - The organization shall identify their internal staffing levels for IT and IT security (as raw numbers and as a percent of total staff).
4.4.3.6	Organizational Controls	Commitment to Cyber Security	Cyber Security Risk Assessment - Commitment to Progressive Improvements to Cyber Security - The organization shall commit to progressive improvements to cyber security.
4.4.3.7	Organizational Controls	When to update an existing risk assessment	Cyber Security Risk Assessment - Triggers and Thresholds for New or Updated Risk Assessment - The organization shall determine triggers and thresholds to conduct a new or update an existing cyber security risk assessment.
4.4.3.8	Organizational Controls	Implementing baseline controls	Cyber Security Risk Assessment - Baseline Controls Per Section 5 and 6 - Regardless of the outcomes from the cyber security risk assessment, the organization shall implement the foundational or baseline cyber security controls specified in Section 5, and as appropriate, Section 6 based on its business environment.
4.4.3.9	Organizational Controls	Reviewing controls to ensure effectiveness	Cyber Security Risk Assessment - Periodically Test and/or Review Controls - The organization shall periodically review and/or test cyber security controls to ensure effectiveness. Testing and/or review shall take place at a minimum annually, or if a major change occurs in their system.
4.4.3.10	Organizational Controls	Number of Employees	The organization shall provide documentation attesting to the total number of employees employed by the organization as well as part-time employees and contractors that may have access to the organization’s data.
5.1.2.1	Baseline Controls	Incident Response Plan	Incident Response Plan - Incident Response Plan for Varying Severity - The organization shall have an incident response plan for how to respond to incidents of varying severity. If an organization is unable to manage some types of incidents on its own, the organization should have a plan for what it will do.
5.1.2.2	Baseline Controls	Incident Response Plan	Incident Response Plan - Detail's of Responsible Party and External Parties - The incident response plan shall detail who is responsible for handling incidents including any relevant contact information for communicating to external parties, stakeholders and regulators. The organization shall have an up-to-date hard copy version of this plan available for situations where soft copies are not available.
5.1.2.3	Baseline Controls	Cybersecurity insurance	Incident Response Plan - Cyber Security Insurance Policy or Rationale - The organization should consider purchasing a cyber security insurance policy that includes coverage for incident response and recovery activities or provide rationale for not purchasing one.
5.1.2.4	Baseline Controls	Cyber Security Insurance	The organization should consider purchasing a cyber security insurance policy that includes coverage for incident response and recovery activities or provide rationale for not purchasing one.
5.1.2.5	Baseline Controls	Incident Response Plan Template	Incident Response Plan - Plan Template to Satisfy Requirements in Section 5.1.2- See "Annex A" - The organization may use the incident response plan template (see Annex A) as a measure of satisfying Requirements contained in Subsection 5.1.2.
5.2.2.1	Baseline Controls	Security patches	Automatically Patch OS and Applications - Up to Date Security Patches for Software and Hardware - The organization shall have up-to-date security patches for all software and hardware installed to protect assets from known vulnerabilities.
5.2.2.2	Baseline Controls	Automatic Patching	Automatically Patch OS and Applications - Automatic Patching for Software and Hardware - The organization shall enable automatic patching for all software and hardware or document all instances where they make the business decision not to do so.
5.2.2.3	Baseline Controls	Replacing systems incapable of automatic patching	Automatically Patch OS and Applications - Risk Assessment for Systems Incapable of Auto-Patching - The organization shall perform a risk assessment whether to replace systems incapable of automatic patching.
5.3.2.1	Baseline Controls	Enable security software	Enable Security Software - Anti-Malware Solutions- Automatic Updating - The organization shall enable anti-malware solutions that update automatically and prevent malware from executing without user intervention.
5.4.2.1	Baseline Controls	Changing default passwords	Securely Configure Devices - Changing Default Passwords - The organization shall implement secure configurations for all their devices by: a) changing all default passwords.
5.5.2.1	Baseline Controls	Multi-factor authentication	Use Strong User Authentication - Implement Multi-Factor Authentication (MFA) - Organizations shall implement multi-factor authentication or document all instances where they cannot or make the business decision not to do so.
5.5.2.2	Baseline Controls	Changing password on suspicion of compromise	Use Strong User Authentication - Password Change on Suspicion or Evidence of a Compromise - Organizations shall enforce password changes on suspicion or evidence of compromise.
5.5.2.3	Baseline Controls	Password length-reuse-writing down	Use Strong User Authentication - Password Length, Managers, and Physical Usage - Organizations shall have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password. NOTE: Organizations may use password selection guidance from the Communications Security Establishment’s User Authentication Guidance for Information Technology Systems
5.5.3.1	Baseline Controls	Password managers	Use Strong User Authentication - Password Manager Use - Organizations shall implement a password manager or document the business decision not to do so. NOTE: Guidance document - Guidance documents as references to the Bibliography. https://www.cyber.gc.ca/en/guidance/best-practices-passphrases-and-passwords-itsap30032
5.6.2.1	Baseline Controls	Essential business information	Backup and Encrypt Data - Determine the Essential Information for Functioning of the Organization - Organizations shall determine on a case-by-case basis what business information and software (including but not limited to sensitive information) is essential to the functioning of the organization, and how frequently this information changes.NOTE: As an example, critical workstations and servers may require daily incremental backups, whereas desktops may be recovered from one common image.
5.6.2.2	Baseline Controls	Frequency of backups	Backup and Encrypt Data - Systems Back Up Frequency - Organizations shall determine on a case-by-case basis what systems to back up and at what frequency since every system will have different back-up and recovery requirements.
5.6.2.3	Baseline Controls	System backups	Backup and Encrypt Data - Backup and Recovery of Essential Systems - Organizations shall backup systems that contain essential business information and ensure that recovery mechanisms effectively and efficiently restore these systems from backups.
5.6.2.4	Baseline Controls	Storing backups	Backup and Encrypt Data - Offsite Storage - Organizations shall store backups at a secure offsite location (either physically or via network separated cloud services) at regular intervals to provide diversity in the event of a disaster (fire, flood, earthquake or localized cyber security incident).
5.6.2.5	Baseline Controls	Encrypting backups	Backup and Encrypt Data - Encrypted Backups - Organizations should consider the use of encrypted backups with securely stored and recoverable key material. Decryption keys and/or unencrypted backups should be stored securely and should be accessible only to authorized employees or officers.
5.6.2.6	Baseline Controls	Backups	Backup files shall not be modifiable to maintain data integrity.
5.6.2.7	Baseline Controls	Testing Critical Backups	The organization shall regularly test critical backups for security and integrity.
5.6.2.8	Baseline Controls	Backup and Encrypt Data	Organizations shall use a sampling of backup data to test and verify recovery procedures at regular intervals to ensure the integrity of the end-to-end backup and restoration process.
5.7.3.1	Baseline Controls	Firewalls	Establish Basic Perimeter Defenses - Perimeter Firewall - The organization shall have a firewall placed between two perimeters that controls the amount and kinds of traffic that may pass between the two.
5.7.3.2	Baseline Controls	DNS Firewall	Establish Basic Perimeter Defenses - DNS Firewall - The organization should consider implementing a DNS firewall for outbound DNS requests to the Internet.
5.7.3.3	Baseline Controls	Software firewalls	Establish Basic Perimeter Defenses - Activation of Software Firewalls-Host - The organization shall activate any software firewalls included on devices within their networks or document the alternative measures in place instead of these firewalls.
5.7.3.4	Baseline Controls	Encrypted Connectivity and VPN Access with MFA	Establish Basic Perimeter Defenses - Encrypted and VPN Connectivity with MFA - The organization shall require encrypted connectivity to all corporate IT resources and require VPN connectivity with multi-factor authentication for all remote access into corporate networks.
5.7.3.5	Baseline Controls	Corporate Wi-Fi	Establish Basic Perimeter Defenses - Secure Wi-Fi - Section 5.5 Password Requirements - The organization shall use secure Wi-Fi, at a minimum WPA2-AES, preferably WPA2-Enterprise or WPA3-Enterprise, following password requirements in section 5.5.
5.7.3.6	Baseline Controls	Segmenting corporate and public networks	Establish Basic Perimeter Defenses - Segmented Networks -Guest WIFI - The organization should segment their networks to ensure networks provided to the public/customers are separated (and/or isolated) from the corporate networks.
5.7.3.7	Baseline Controls	DMARC	Establish Basic Perimeter Defenses - DMARC- SPF, DKIM and DMARC Records - The organization shall ensure the implementation of DMARC on all organization email services.
5.7.3.8	Baseline Controls	Email filtering	Establish Basic Perimeter Defenses - E-mail Filtering - The organization shall ensure email filtering is implemented.
5.7.3.9	Baseline Controls	Home Network	The organization should ensure that their users join a separate network that is independent of the home network (e.g. guest network) in conducting their employment activities.
5.8.2.1	Baseline Controls	Minimum Functionality	The organization shall provision accounts with the minimum functionality necessary for tasks and shall restrict administrator privileges to an as-required basis.
5.8.2.2	Baseline Controls	Removal of Functions When No longer Required	Implement Access Control and Authorization - Removal of Functions When No longer Required - The organization shall remove accounts and/or functionality when users no longer require these for their tasks.
5.8.2.3	Baseline Controls	Limit Administrator Privilege	Implement Access Control and Authorization - Limit Administrator Privilege - The organization shall only permit administrator accounts to perform administrative activities (and not user-level activities such as accessing email or browsing the web).
5.8.3.1	Baseline Controls	Provision accounts with minimum functionality necessary	Implement Access Control and Authorization -Account Provisioning - The organization shall provision accounts with the minimum functionality necessary for tasks and shall restrict administrator privileges to an as-required basis.
6.1.2.1	Baseline Controls by Operating Environment	Secure Mobility	The organization using mobile devices (i.e., cellphones) shall educate users to: a. disable automatic connections to open networks; b. avoid connecting to untrusted Wi-Fi networks; c. limit the use of Bluetooth and NFC for the exchange of sensitive information; d. use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi; and e. use secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks.
6.1.3.1	Baseline Controls by Operating Environment	Ownership model for mobile devices	Secure Mobility - Ownership Model with Associated Risk - Organization using mobility (i.e., cellphones) shall decide on an ownership model for mobile devices and document the rationale and associated risks.
6.1.3.2	Baseline Controls by Operating Environment	Securing mobile devices	Secure Mobility - Mobile Device Management - Organization using mobility (i.e., cellphones) shall:a. Require separation between work and personal data on mobile devices with access to corporate IT resources and document the details of this separation; b. Ensure that employees only download mobile device applications (i.e., apps) from the organization’s list of trusted sources. c. Require that all mobile devices store all sensitive information in a secure, encrypted state. d. Consider the implementation of an enterprise mobility management solution for all mobile devices or document the risks assumed to the audit, management, and security functionality of mobile devices by not implementing such a solution. e. Enforce or educate users to: - disable automatic connections to open networks; - avoid connecting to unknown Wi-Fi networks; - limit the use of Bluetooth and NFC for the exchange of sensitive information ; and - use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi. f. Consider using secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks, or provide the rationale for not doing so
6.2.2.1	Baseline Controls by Operating Environment	Evaluating risk tolerance for outsourced IT or cloud apps	Secure Cloud and Outsourced IT Services - Evaluate Outsourced IT - Organization using cloud applications and/or outsourcing IT services shall evaluate their risk tolerance level with how their outsourced IT providers handle and access their sensitive information.
6.2.3.1	Baseline Controls by Operating Environment	AICPA SSAE 18 or equivalent reports	Secure Cloud and Outsourced IT Services - Cloud and IT Outsourcing Compliance - The organization using cloud applications and/or outsourcing IT services shall: a. Require that all their cloud service providers share an AICPA SSAE 18 or equivalent report that states that they achieved Trust Service Principles compliance or provide a documented business case as why they chose not to; NOTE: The organization determines equivalence to AICPA SSAE 18. b. Evaluate their risk tolerance level with the legal jurisdictions where their outsourced providers store or use their sensitive information; c. Ensure that their IT infrastructure and users communicate securely with all cloud services and applications; and d. Ensure that administrative accounts for cloud services use multi-factor authentication and differ from internal administrator accounts.
6.3.2.1	Baseline Controls by Operating Environment	OWASP Top 10 Awareness	The organization shall demonstrate awareness of the OWASP Top 10 risks.
6.3.3.1	Baseline Controls by Operating Environment	OWASP Top 10	Secure Websites - OWASP Top 10 - 1 Organizations deploying websites shall ensure that their websites address the OWASP top 10 vulnerabilities. NOTE: For a comprehensive list of vulnerability scanning tools, please visit the “Vulnerability Scanning Tools” page on the OWASP website.
6.3.3.2	Baseline Controls by Operating Environment	ASVS Levels	Secure Websites - Understanding of OWASP ASVS - Organizations shall ensure that they understand the OWASP ASVS level they need to meet for each of their websites.
6.4.2.1	Baseline Controls by Operating Environment	Company owned portable media	Secure Portable Media- Mandating of Organization-Owned Portable Media - Organizations using portable media shall mandate the sole use of organization-owned secure portable media.
6.4.3.1	Baseline Controls by Operating Environment	Using portable media	Secure Portable Media - Portable Media Guidelines - Organizations using portable media shall: a. Have strong asset controls for these devices; b. Require the use of encryption on all of these devices; and c. Have processes for the sanitization or destruction of portable media prior to disposal.
6.5.2.1	Baseline Controls by Operating Environment	Terminals and Financial Systems	Point of Sale (POS) and Financial Systems - PCI DSS - Organizations using point of sale terminals and financial systems shall follow the Payment Card Industry Data Security Standard (PCI DSS) and isolate these systems from the Internet.
6.6.3.1	Baseline Controls by Operating Environment	Log management	Computer Security Log Management - Understanding of Security Logging Capabilities - Log Management - Organizations shall ensure an appropriate understanding of their security logging capabilities and needs and ensure a corresponding log management policy is in place. NOTE: NIST SP 800-92, “Guide to Computer Security Log Management” describes considerations for Security Log Management and includes examples. Understanding what data is available and what is missing is a key step in defining a good log management and incident.

ISO 27001

Control Number	Control Description
5.1	Information Security Policies - The Information Security and other related policies should be developed and after management approval, communicated to relevant personnel and reviewed at regular intervals.
5.2	Information Security Roles and Responsibilities - The roles and responsibilities related to Information security should be defined and allocated as per organizational needs.
5.3	Segregation of Duties - The duties and responsibilities containing conflicts should be segregated.
5.4	Management Responsibilities - Management must ensure that all staff adhere to the organization's information security policy, as well as relevant topic-specific policies and procedures.
5.5	Contact With Government Authorities - The organization must stay in contact with relevant authorities.
5.6	Contact With Special Interest Groups - The organization must connect with specialized security groups and professional associations.
5.7	Threat Intelligence - Collect and analyze information security threats for threat intelligence.
5.8	Information Security in Project Management - Incorporate information security into project management.
5.9	Inventory of Information and Other Associated Assets - Create and maintain an inventory of information and associated assets, including owners.
5.10	Acceptable Use of Information and Other Associated Assets - Define, document, and enforce rules for acceptable use and handling of information assets.
5.11	Return of Assets - All personnel must return organization assets (which were in their possession) upon termination or change in employment.
5.12	Classification of Information - Classify information based on organization's security needs: confidentiality, integrity, availability, and relevant stakeholder requirements.
5.13	Labelling of Information - Develop and implement information labelling procedures based on organization's classification scheme.
5.14	Information Transfer - Establish information transfer rules, procedures, or agreements for all internal and external transfer facilities.
5.15	Access Control - Establish and implement access control rules for physical and logical access to the information based on business and security needs.
5.16	Identity Management - Manage the entire identity life cycle.
5.17	Authentication Information - Control authentication information allocation and management through a managed process, including recommendation on the appropriate handling.
5.18	Access Rights - Provision, review, modify, and remove access rights to the information and other related assets according to organization's access control policy and rules.
5.19	Information Security in Supplier Relationships - Define and implement processes and procedures to manage security risks associated with the use of the supplier products or services.
5.20	Addressing Information Security Within Supplier Agreements - Establish and agree on relevant security requirements with each supplier based on their relationship type.
5.21	Managing Information Security in the ICT Supply Chain - Define and implement procedures to manage security risks in the ICT supply chain.
5.22	Monitoring and Review and Change Management of Supplier Services - Regularly monitor, review, evaluate, and manage changes in supplier security practices and service delivery.
5.23	Information Security for Use of Cloud Services - Establish processes for acquiring, using, managing, and exiting cloud services aligned with information security requirements.
5.24	Information Security Incident Management Planning and Preperation - Plan for managing security incidents by defining and communicating processes, roles, and responsibilities.
5.25	Assessment and Decision on Information Security Events - The organization should evaluate information security events to determine if they qualify as security incidents.
5.26	Response to Information Security Incidnets - Respond to information security incidents as per the documented procedures.
5.27	Learning From Information Security Incidents - Insights from security incidents should be used to enhance and refine information security measures.
5.28	Collection of Evidence - The organization should develop and enforce procedures to identify, gather, acquire, and preserve evidence pertaining to information security events.
5.29	Information Security During Disruption - The organization should strategize to uphold information security at a suitable level during disruptions.
5.30	ICT Readiness for Business Continuity - Plan, implement, maintain, and test ICT readiness according to business continuity objectives and ICT continuity requirements.
5.31	Legal, Statutory, Regulatory and Contractual Requirements - Identify, document, and update legal, statutory, regulatory, and contractual requirements relevant to information security and the organization's compliance approach.
5.32	Intellectual Property Rights - Implement suitable procedures to safeguard intellectual property rights.
5.33	Protection of Records - Safeguard records against loss, destruction, falsification, unauthorized access, and release.
5.34	Privacy and Protection of PII - The organization should recognize and fulfill obligations for preserving privacy and safeguarding Personally Identifiable Information (PII) in accordance with relevant laws, regulations, and contracts.
5.35	Independent Review of Information Security - The organization's management of information security, covering people, processes, and technologies, should undergo regular independent reviews and assessments, as well as when significant changes take place.
5.36	Compliance With Policies, Rules and Standards for Information Security - Regularly review compliance with the organization's information security policy, topic-specific policies, rules, and standards.
5.37	Documented Operating Procedures - Document and provide operating procedures for information processing facilities to relevant personnel.
6.1	Screening - Conduct background checks on potential personnel before and during employment, adhering to relevant laws, regulations, and ethical standards. Adjust checks based on business needs, information classification, and perceived risks.
6.2	Terms and Conditions of Employment - Employment contracts should outline the responsibilities of both personnel and the organization regarding information security.
6.3	Information Security Awareness, Education, and Training - The organization's personnel and relevant parties should undergo suitable information security awareness, education, and training. They should also receive regular updates on the organization's policies and procedures relevant to their roles.
6.4	Disciplinary Process - Establish and communicate a formal disciplinary process to address information security policy violations by personnel and relevant parties.
6.5	Responsibilities After Termination or Change of Employment - Define, enforce, and communicate information security responsibilities and duties that persist after termination or change of employment to relevant personnel and interested parties.
6.6	Confidentiality or Non-Disclosure Agreements - Identify, document, regularly review, and have personnel and relevant parties sign confidentiality or non-disclosure agreements tailored to the organization's information protection needs.
6.7	Remote Working - Implement security measures to protect information accessed, processed, or stored outside the organization's premises when personnel work remotely.
6.8	Information Security Event Reporting - The organization should provide personnel a way to report observed or suspected information security events promptly through suitable channels.
7.1	Physical Security Perimeters - Define and utilize security perimeters to safeguard areas containing information and associated assets.
7.2	Physical Entry - Protect secure areas with suitable entry controls and access points.
7.3	Securing Offices, Rooms and Facilities - Design and implement physical security measures for offices, rooms, and facilities.
7.4	Physical Security Monitoring - Continuous monitoring should be conducted to prevent unauthorized physical access to the premises.
7.5	Protecting Against Physical and Environmental Threats - Design and implement safeguards against physical and environmental threats, including natural disasters and intentional or unintentional physical risks to infrastructure.
7.6	Working In Secure Areas - Design and implement security measures for working in secure areas.
7.7	Clear Desk and Clear Screen - Define and enforce clear desk rules for papers and removable storage media, as well as clear screen rules for information processing facilities.
7.8	Equipment Siting and Protection - Securely position and protect equipment.
7.9	Security of Assets Off-Premises - Assets located off-site should be safeguarded.
7.10	Storage Media - Manage storage media throughout their lifecycle, including acquisition, use, transportation, and disposal, following the organization’s classification scheme and handling requirements.
7.11	Supporting Utilities - Safeguard information processing facilities against power failures and disruptions from utility failures.
7.12	Cabling Security - Protect cables transmitting power, data, or supporting information services from interception, interference, or damage.
7.13	Equipment Maintenance - Maintain equipment properly to ensure the availability, integrity, and confidentiality of information.
7.14	Secure Disposal or Re-Use of Equipment - Before disposal or reuse, verify equipment with storage media to ensure sensitive data and licensed software have been securely removed or overwritten.
8.1	User Endpoint Devices - Protect information stored, processed, or accessible through user endpoint devices.
8.2	Privileged Access Rights - Privileged access rights allocation and usage should be restricted and controlled.
8.3	Information Access Restriction - Limit access to information and associated assets according to the established topic-specific access control policy.
8.4	Access to Source Code - Manage read and write access to source code, development tools, and software libraries appropriately.
8.5	Secure Authentication - Implement secure authentication technologies and procedures in line with information access restrictions and the topic-specific access control policy.
8.6	Capacity Management - Monitor and adjust resource usage according to current and anticipated capacity needs.
8.7	Protection Against Malware - Implement malware protection and support it with adequate user awareness.
8.8	Management of Technical Vulnerabilities - Obtain information on technical vulnerabilities of in-use information systems, evaluate the organization's exposure, and take appropriate measures.
8.9	Configuration Management - Establish, document, implement, monitor, and review configurations, including security configurations, of hardware, software, services, and networks.
8.10	Information Deletion - Delete information stored in information systems, devices, or any storage media when no longer required.
8.11	Data Masking - Utilize data masking in alignment with the organization’s access control policy and other relevant policies, along with business requirements, while considering applicable legislation.
8.12	Data Leakage Prevention - Apply data leakage prevention measures to systems, networks, and other devices handling sensitive information.
8.13	Information Backup - Maintain and regularly test backup copies of information, software, and systems as per the agreed topic-specific backup policy.
8.14	Redundancy of Information Processing Facilities - Implement information process facilities with redundancy to meet availability requirements.
8.15	Logging - Generate, store, protect, and analyze logs that record activities, exceptions, faults, and other relevant events.
8.16	Monitoring Activities - Monitor networks, systems, and applications for unusual behavior and take appropriate actions to assess potential information security incidents.
8.17	Clock Synchronisation - Information processing systems used by the organization should synchronize their clocks with approved time sources.
8.18	Use of Privileged Utility Programs - Restrict and tightly control the use of utility programs capable of overriding system and application controls.
8.19	Installation of Software on Operational Systems - Implement procedures and measures to securely manage software installation on operational systems.
8.20	Network Security - Secure, manage, and control networks and network devices to safeguard information in systems and applications.
8.21	Security of Network Services - Identify, implement, and monitor security mechanisms, service levels, and service requirements for network services.
8.22	Segregation of Networks - Segregate groups of information services, users, and information systems in the organization's networks.
8.23	Web Filtering - Manage access to external websites to minimize exposure to malicious content.
8.24	Use of Cryptography - Define and implement rules for the efficient use of cryptography, including cryptographic key management.
8.25	Secure Development Life Cycle - Establish and enforce rules for secure software and system development.
8.26	Application Security Requirements - Identify, specify, and approve information security requirements during application development or acquisition.
8.27	Secure System Architecture and Engineering Principles - Establish, document, maintain, and apply principles for engineering secure systems to all information system development activities.
8.28	Secure Coding - Apply secure coding principles in software development.
8.29	Security Testing in Development and Acceptance - Define and implement security testing processes in the development life cycle.
8.30	Outsourced Development - The organization should direct, monitor, and evaluate activities related to outsourced system development.
8.31	Seperation of Development, Test and Production Environments - Separate and secure development, testing, and production environments.
8.32	Change Management - Changes to information processing facilities and systems should adhere to change management procedures.
8.33	Test Information - Select, protect, and manage test information appropriately.
8.34	Protection of Information Systems During Audit Testing - Plan and agree on audit tests and other assurance activities for assessing operational systems between the tester and relevant management.

NIST 800 171

Control Number	Control Description
3.1.1	Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2	Limit system access to the types of transactions and functions that authorized users are permitted to execute.
3.1.3	Control the flow of CUI in accordance with approved authorizations.
3.1.4	Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
3.1.5	Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6	Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7	Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.8	Limit unsuccessful logon attempts.
3.1.9	Provide privacy and security notices consistent with applicable CUI rules.
3.1.10	Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
3.1.11	Terminate (automatically) a user session after a defined condition.
3.1.12	Monitor and control remote access sessions.
3.1.13	Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
3.1.14	Route remote access via managed access control points.
3.1.15	Authorize remote execution of privileged commands and remote access to security-relevant information.
3.1.16	Authorize wireless access prior to allowing such connections.
3.1.17	Protect wireless access using authentication and encryption.
3.1.18	Control connection of mobile devices.
3.1.19	Encrypt CUI on mobile devices and mobile computing platforms.
3.1.20	Verify and control/limit connections to and use of external systems.
3.1.21	Limit use of portable storage devices on external systems.
3.1.22	Control CUI posted or processed on publicly accessible systems.
3.2.1	Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
3.2.2	Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
3.2.3	Provide security awareness training on recognizing and reporting potential indicators of insider threat.
3.3.1	Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
3.3.2	Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
3.3.3	Review and update logged events.
3.3.4	Alert in the event of an audit logging process failure.
3.3.5	Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
3.3.6	Provide audit record reduction and report generation to support on-demand analysis and reporting.
3.3.7	Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
3.3.8	Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
3.3.9	Limit management of audit logging functionality to a subset of privileged users.
3.4.1	Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
3.4.2	Establish and enforce security configuration settings for information technology products employed in organizational systems.
3.4.3	Track, review, approve or disapprove, and log changes to organizational systems.
3.4.4	Analyze the security impact of changes prior to implementation.
3.4.5	Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.4.6	Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
3.4.7	Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
3.4.8	Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
3.4.9	Control and monitor user-installed software.
3.5.1	Identify system users, processes acting on behalf of users, and devices.
3.5.2	Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
3.5.3	Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
3.5.4	Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.
3.5.5	Prevent reuse of identifiers for a defined period.
3.5.6	Disable identifiers after a defined period of inactivity.
3.5.7	Enforce a minimum password complexity and change of characters when new passwords are created.
3.5.8	Prohibit password reuse for a specified number of generations.
3.5.9	Allow temporary password use for system logons with an immediate change to a permanent password.
3.5.10	Store and transmit only cryptographically-protected passwords.
3.5.11	Obscure feedback of authentication information.
3.6.1	Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
3.6.2	Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
3.6.3	Test the organizational incident response capability.
3.7.1	Perform maintenance on organizational systems.
3.7.2	Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
3.7.3	Ensure equipment removed for off-site maintenance is sanitized of any CUI.
3.7.4	Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
3.7.5	Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
3.7.6	Supervise the maintenance activities of maintenance personnel without required access authorization.
3.8.1	Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
3.8.2	Limit access to CUI on system media to authorized users.
3.8.3	Sanitize or destroy system media containing CUI before disposal or release for reuse.
3.8.4	Mark media with necessary CUI markings and distribution limitations.
3.8.5	Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
3.8.6	Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
3.8.7	Control the use of removable media on system components.
3.8.8	Prohibit the use of portable storage devices when such devices have no identifiable owner.
3.8.9	Protect the confidentiality of backup CUI at storage locations.
3.9.1	Screen individuals prior to authorizing access to organizational systems containing CUI.
3.9.2	Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
3.10.1	Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
3.10.2	Protect and monitor the physical facility and support infrastructure for organizational systems.
3.10.3	Escort visitors and monitor visitor activity.
3.10.4	Maintain audit logs of physical access.
3.10.5	Control and manage physical access devices.
3.10.6	Enforce safeguarding measures for CUI at alternate work sites.
3.11.1	Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
3.11.2	Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
3.11.3	Remediate vulnerabilities in accordance with risk assessments.
3.12.1	Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
3.12.2	Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
3.12.3	Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
3.12.4	Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
3.13.1	Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2	Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
3.13.3	Separate user functionality from system management functionality.
3.13.4	Prevent unauthorized and unintended information transfer via shared system resources.
3.13.5	Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
3.13.6	Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
3.13.7	Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
3.13.8	Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
3.13.9	Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
3.13.10	Establish and manage cryptographic keys for cryptography employed in organizational systems.
3.13.11	Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
3.13.12	Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
3.13.13	Control and monitor the use of mobile code.
3.13.14	Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
3.13.15	Protect the authenticity of communications sessions.
3.13.16	Protect the confidentiality of CUI at rest.
3.14.1	Identify, report, and correct system flaws in a timely manner.
3.14.2	Provide protection from malicious code at designated locations within organizational systems.
3.14.3	Monitor system security alerts and advisories and take action in response.
3.14.4	Update malicious code protection mechanisms when new releases are available.
3.14.5	Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
3.14.6	Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
3.14.7	Identify unauthorized use of organizational systems.