CyberStrikeus/CyberStrike - Page 110

pr-ds-04-prds-04

Adequate capacity to ensure availability is maintained

pr-ds-05-prds-05

Protections against data leaks are implemented

pr-ds-06-prds-06

Integrity checking mechanisms are used to verify software, firmware, and information integrity

pr-ds-07-prds-07

The development and testing environment(s) are separate from the production environment

pr-ds-08-prds-08

Integrity checking mechanisms are used to verify hardware integrity

pr-ds-10-prds-10

The confidentiality, integrity, and availability of data-in-use are protected

pr-ds-11-prds-11

Backups of data are created, protected, maintained, and tested

pr-ip-01-prip-01

A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g.

pr-ip-02-prip-02

A System Development Life Cycle to manage systems is implemented

pr-ip-03-prip-03

Configuration change control processes are in place

pr-ip-04-prip-04

Backups of information are conducted, maintained, and tested

pr-ip-05-prip-05

Policy and regulations regarding the physical operating environment for organizational assets are met

pr-ip-06-prip-06

Data is destroyed according to policy

pr-ip-07-prip-07

Protection processes are improved

pr-ip-08-prip-08

Effectiveness of protection technologies is shared

pr-ip-09-prip-09

Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed

pr-ip-10-prip-10

Response and recovery plans are tested

pr-ip-11-prip-11

Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)

pr-ip-12-prip-12

A vulnerability management plan is developed and implemented

pr-ir-01-prir-01

Networks and environments are protected from unauthorized logical access and usage

pr-ir-02-prir-02

The organization's technology assets are protected from environmental threats

pr-ir-03-prir-03

Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

pr-ir-04-prir-04

Adequate resource capacity to ensure availability is maintained

pr-ma-01-prma-01

Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools

pr-ma-02-prma-02

Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access

pr-ps-01-prps-01

Configuration management practices are established and applied

pr-ps-02-prps-02

Software is maintained, replaced, and removed commensurate with risk

pr-ps-03-prps-03

Hardware is maintained, replaced, and removed commensurate with risk

pr-ps-04-prps-04

Log records are generated and made available for continuous monitoring

pr-ps-05-prps-05

Installation and execution of unauthorized software are prevented

pr-ps-06-prps-06

Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

pr-pt-01-prpt-01

Audit/log records are determined, documented, implemented, and reviewed in accordance with policy

pr-pt-02-prpt-02

Removable media is protected and its use restricted according to policy

pr-pt-03-prpt-03

The principle of least functionality is incorporated by configuring systems to provide only essential capabilities

pr-pt-04-prpt-04

Communications and control networks are protected

pr-pt-05-prpt-05

Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations

protective-technology-pr-pt-protective-technology

Protective Technology

improvements-rc-im-improvements

Improvements

rc-co-01-rcco-01

Public relations are managed

rc-co-02-rcco-02

Reputation is repaired after an incident