CyberStrikeus/CyberStrike - Page 108

gv-sc-06-gvsc-06

Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships

gv-sc-07-gvsc-07

The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and

gv-sc-08-gvsc-08

Relevant suppliers and other third parties are included in incident planning, response, and recovery activities

gv-sc-09-gvsc-09

Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored througho

gv-sc-10-gvsc-10

Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreeme

organizational-context-gv-oc-organizational-context

The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organizatio

oversight-gv-ov-oversight

Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management stra

policy-gv-po-policy

Organizational cybersecurity policy is established, communicated, and enforced

risk-management-strategy-gv-rm-risk-management-strategy

The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support

asset-management-id-am-asset-management

Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identifie

business-environment-id-be-business-environment

Business Environment

governance-id-gv-governance

Governance

id-am-01-idam-01

Inventories of hardware managed by the organization are maintained

id-am-02-idam-02

Inventories of software, services, and systems managed by the organization are maintained

id-am-03-idam-03

Representations of the organization's authorized network communication and internal and external network data flows are maintained

id-am-04-idam-04

Inventories of services provided by suppliers are maintained

id-am-05-idam-05

Assets are prioritized based on classification, criticality, resources, and impact on the mission

id-am-06-idam-06

Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established

id-am-07-idam-07

Inventories of data and corresponding metadata for designated data types are maintained

id-am-08-idam-08

Systems, hardware, software, services, and data are managed throughout their life cycles

id-be-01-idbe-01

The organization’s role in the supply chain is identified and communicated

id-be-02-idbe-02

The organization’s place in critical infrastructure and its industry sector is identified and communicated

id-be-03-idbe-03

Priorities for organizational mission, objectives, and activities are established and communicated

id-be-04-idbe-04

Dependencies and critical functions for delivery of critical services are established

id-be-05-idbe-05

Resilience requirements to support delivery of critical services are established for all operating states (e.g.

id-gv-01-idgv-01

Organizational cybersecurity policy is established and communicated

id-gv-02-idgv-02

Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners

id-gv-03-idgv-03

Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed

id-gv-04-idgv-04

Governance and risk management processes address cybersecurity risks

id-im-01-idim-01

Improvements are identified from evaluations

id-im-02-idim-02

Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

id-im-03-idim-03

Improvements are identified from execution of operational processes, procedures, and activities

id-im-04-idim-04

Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

id-ra-01-idra-01

Vulnerabilities in assets are identified, validated, and recorded

id-ra-02-idra-02

Cyber threat intelligence is received from information sharing forums and sources

id-ra-03-idra-03

Internal and external threats to the organization are identified and recorded

id-ra-04-idra-04

Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

id-ra-05-idra-05

Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

id-ra-06-idra-06

Risk responses are chosen, prioritized, planned, tracked, and communicated

id-ra-07-idra-07

Changes and exceptions are managed, assessed for risk impact, recorded, and tracked