CyberStrikeus/CyberStrike - Page 133

ra-2-security-categorization

Categorize the system and information it processes, stores, and transmits;

ra-3-1-supply-chain-risk-assessment

Assess supply chain risks associated with [organization-defined] ;

ra-3-2-use-of-all-source-intelligence

Use all-source intelligence to assist in the analysis of risk.

ra-3-3-dynamic-threat-awareness

Determine the current cyber threat environment on an ongoing basis using [organization-defined].

ra-3-4-predictive-cyber-analytics

Employ the following advanced automation and analytics capabilities to predict and identify risks to [organization-defined]: [organization-defined].

ra-3-risk-assessment

Conduct a risk assessment, including: Identifying threats to and vulnerabilities in the system; Determining the likelihood and magnitude of harm from

ra-4-risk-assessment-update

Risk Assessment Update

ra-5-1-update-tool-capability

Update Tool Capability

ra-5-10-correlate-scanning-information

Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.

ra-5-11-public-disclosure-program

Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.

ra-5-2-update-vulnerabilities-to-be-scanned

Update the system vulnerabilities to be scanned [organization-defined].

ra-5-3-breadth-and-depth-of-coverage

Define the breadth and depth of vulnerability scanning coverage.

ra-5-4-discoverable-information

Determine information about the system that is discoverable and take [organization-defined].

ra-5-5-privileged-access

Implement privileged access authorization to [organization-defined] for [organization-defined].

ra-5-6-automated-trend-analyses

Compare the results of multiple vulnerability scans using [organization-defined].

ra-5-8-review-historic-audit-logs

Review historic audit logs to determine if a vulnerability identified in a [organization-defined] has been previously exploited within an [organizatio

ra-5-9-penetration-testing-and-analyses

Penetration Testing and Analyses

ra-5-vulnerability-monitoring-and-scanning

Monitor and scan for vulnerabilities in the system and hosted applications [organization-defined] and when new vulnerabilities potentially affectin...

ra-6-technical-surveillance-countermeasures-survey

Employ a technical surveillance countermeasures survey at [organization-defined] [organization-defined].

ra-7-risk-response

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

ra-8-privacy-impact-assessments

Conduct privacy impact assessments for systems, programs, or other activities before: Developing or procuring information technology that processes pe

ra-9-criticality-analysis

Identify critical system components and functions by performing a criticality analysis for [organization-defined] at [organization-defined].

sa-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] system and services acquisition policy that: Procedures to facili

sa-10-1-software-and-firmware-integrity-verification

Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.

sa-10-2-alternative-configuration-management-processes

Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management

sa-10-3-hardware-integrity-verification

Require the developer of the system, system component, or system service to enable integrity verification of hardware components.

sa-10-4-trusted-generation

Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant h

sa-10-5-mapping-integrity-for-version-control

Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data descri

sa-10-6-trusted-distribution

Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software,

sa-10-7-security-and-privacy-representatives

Require [organization-defined] to be included in the [organization-defined].

sa-10-developer-configuration-management

Require the developer of the system, system component, or system service to: Perform configuration management during system, component, or service [or

sa-11-1-static-code-analysis

Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document th

sa-11-2-threat-modeling-and-vulnerability-analyses

Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and

sa-11-4-manual-code-reviews

Require the developer of the system, system component, or system service to perform a manual code review of [organization-defined] using the following

sa-11-5-penetration-testing

Require the developer of the system, system component, or system service to perform penetration testing: At the following level of rigor: [organizatio

sa-11-6-attack-surface-reviews

Require the developer of the system, system component, or system service to perform attack surface reviews.

sa-11-7-verify-scope-of-testing-and-evaluation

Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage

sa-11-8-dynamic-code-analysis

Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document t

sa-11-9-interactive-application-security-testing

Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws an

sa-11-developer-testing-and-evaluation

Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: Develop