CyberStrikeus/CyberStrike - Page 109

id-ra-08-idra-08

Processes for receiving, analyzing, and responding to vulnerability disclosures are established

id-ra-09-idra-09

The authenticity and integrity of hardware and software are assessed prior to acquisition and use

id-ra-10-idra-10

Critical suppliers are assessed prior to acquisition

id-rm-01-idrm-01

Risk management processes are established, managed, and agreed to by organizational stakeholders

id-rm-02-idrm-02

Organizational risk tolerance is determined and clearly expressed

id-rm-03-idrm-03

The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis

id-sc-01-idsc-01

Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders

id-sc-02-idsc-02

Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply cha

id-sc-03-idsc-03

Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybe

id-sc-04-idsc-04

Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their

id-sc-05-idsc-05

Response and recovery planning and testing are conducted with suppliers and third-party providers

improvement-id-im-improvement

Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions

risk-assessment-id-ra-risk-assessment

The cybersecurity risk to the organization, assets, and individuals is understood by the organization

risk-management-strategy-id-rm-risk-management-strategy

Risk Management Strategy

supply-chain-risk-management-id-sc-supply-chain-risk-management

Supply Chain Risk Management

awareness-and-training-pr-at-awareness-and-training

The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks

data-security-pr-ds-data-security

Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information

maintenance-pr-ma-maintenance

Maintenance

platform-security-pr-ps-platform-security

The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with t

pr-aa-01-praa-01

Identities and credentials for authorized users, services, and hardware are managed by the organization

pr-aa-02-praa-02

Identities are proofed and bound to credentials based on the context of interactions

pr-aa-03-praa-03

Users, services, and hardware are authenticated

pr-aa-04-praa-04

Identity assertions are protected, conveyed, and verified

pr-aa-05-praa-05

Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least

pr-aa-06-praa-06

Physical access to assets is managed, monitored, and enforced commensurate with risk

pr-ac-01-prac-01

Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes

pr-ac-02-prac-02

Physical access to assets is managed and protected

pr-ac-03-prac-03

Remote access is managed

pr-ac-04-prac-04

Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties

pr-ac-05-prac-05

Network integrity is protected (e.g., network segregation, network segmentation)

pr-ac-06-prac-06

Identities are proofed and bound to credentials and asserted in interactions

pr-ac-07-prac-07

Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individual

pr-at-01-prat-01

Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in

pr-at-02-prat-02

Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with

pr-at-03-prat-03

Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities

pr-at-04-prat-04

Senior executives understand their roles and responsibilities

pr-at-05-prat-05

Physical and cybersecurity personnel understand their roles and responsibilities

pr-ds-01-prds-01

The confidentiality, integrity, and availability of data-at-rest are protected

pr-ds-02-prds-02

The confidentiality, integrity, and availability of data-in-transit are protected

pr-ds-03-prds-03

Assets are formally managed throughout removal, transfers, and disposition