CyberStrikeus/CyberStrike - Page 107

de-cm-02-decm-02

The physical environment is monitored to find potentially adverse events

de-cm-03-decm-03

Personnel activity and technology usage are monitored to find potentially adverse events

de-cm-04-decm-04

Malicious code is detected

de-cm-05-decm-05

Unauthorized mobile code is detected

de-cm-06-decm-06

External service provider activities and services are monitored to find potentially adverse events

de-cm-07-decm-07

Monitoring for unauthorized personnel, connections, devices, and software is performed

de-cm-08-decm-08

Vulnerability scans are performed

de-cm-09-decm-09

Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

de-dp-01-dedp-01

Roles and responsibilities for detection are well defined to ensure accountability

de-dp-02-dedp-02

Detection activities comply with all applicable requirements

de-dp-03-dedp-03

Detection processes are tested

de-dp-04-dedp-04

Event detection information is communicated

de-dp-05-dedp-05

Detection processes are continuously improved

detection-processes-de-dp-detection-processes

Detection Processes

gv-oc-01-gvoc-01

The organizational mission is understood and informs cybersecurity risk management

gv-oc-02-gvoc-02

Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and conside

gv-oc-03-gvoc-03

Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and manag

gv-oc-04-gvoc-04

Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated

gv-oc-05-gvoc-05

Outcomes, capabilities, and services that the organization depends on are understood and communicated

gv-ov-01-gvov-01

Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

gv-ov-02-gvov-02

The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

gv-ov-03-gvov-03

Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

gv-po-01-gvpo-01

Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and

gv-po-02-gvpo-02

Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and

gv-rm-01-gvrm-01

Risk management objectives are established and agreed to by organizational stakeholders

gv-rm-02-gvrm-02

Risk appetite and risk tolerance statements are established, communicated, and maintained

gv-rm-03-gvrm-03

Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

gv-rm-04-gvrm-04

Strategic direction that describes appropriate risk response options is established and communicated

gv-rm-05-gvrm-05

Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

gv-rm-06-gvrm-06

A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

gv-rm-07-gvrm-07

Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions

gv-rr-01-gvrr-01

Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually imp

gv-rr-02-gvrr-02

Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

gv-rr-03-gvrr-03

Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

gv-rr-04-gvrr-04

Cybersecurity is included in human resources practices

gv-sc-01-gvsc-01

A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational st

gv-sc-02-gvsc-02

Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and external

gv-sc-03-gvsc-03

Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes

gv-sc-04-gvsc-04

Suppliers are known and prioritized by criticality

gv-sc-05-gvsc-05

Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements