|
is blocked by
|
Security, Compliance & Resilience Program (SCRP) |
|
is blocked by
|
Centralized Management of Security, Compliance & Resilience Controls |
|
is blocked by
|
Periodic Review & Update of Security, Compliance & Resilience Program |
|
is blocked by
|
Assigned Security, Compliance & Resilience Responsibilities |
|
is blocked by
|
Stakeholder Accountability Structure |
|
is blocked by
|
Authoritative Chain of Command |
|
is blocked by
|
Defining Business Context & Mission |
|
is blocked by
|
Materiality Determination |
|
is blocked by
|
High Value Assets (HVAs) |
|
is blocked by
|
Steering Committee & Program Oversight |
|
is blocked by
|
Status Reporting To Governing Body |
|
is blocked by
|
Business As Usual (BAU) Security, Compliance & Resilience Practices |
|
is blocked by
|
Operationalizing Security, Compliance & Resilience Capabilities |
|
is blocked by
|
Select Controls |
|
is blocked by
|
Implement Controls |
|
is blocked by
|
Assess Controls |
|
is blocked by
|
Contacts With Groups & Associations |
|
is blocked by
|
Mergers, Acquisitions & Divestitures (MA&D) |
|
is blocked by
|
Artificial Intelligence (AI) & Autonomous Technologies Governance |
|
is blocked by
|
AI & Autonomous Technologies Mission and Goals Definition |
|
is blocked by
|
AI & Autonomous Technologies Value Sustainment |
|
is blocked by
|
Assigned Responsibilities for AI & Autonomous Technologies |
|
is blocked by
|
AI & Autonomous Technologies Continuous Improvements |
|
is blocked by
|
AI & Autonomous Technologies Risk Response |
|
is blocked by
|
AI & Autonomous Technologies Risk Tracking Approaches |
|
is blocked by
|
AI & Autonomous Technologies Business Case |
|
is blocked by
|
AI & Autonomous Technologies Potential Benefits Analysis |
|
is blocked by
|
AI & Autonomous Technologies Potential Costs Analysis |
|
is blocked by
|
AI & Autonomous Technologies Cost / Benefit Mapping |
|
is blocked by
|
Human Moderation of AI & Autonomous Technologies-Generated Content |
|
is blocked by
|
AI & Autonomous Technologies Harm Prevention |
|
is blocked by
|
AI & Autonomous Technologies Environmental Impact & Sustainability |
|
is blocked by
|
Previously Unknown AI & Autonomous Technologies Threats & Risks |
|
is blocked by
|
AI & Autonomous Technologies Stakeholder Diversity |
|
is blocked by
|
AI & Autonomous Technologies Stakeholder Competencies |
|
is blocked by
|
AI & Autonomous Technologies Human Oversight |
|
is blocked by
|
AI & Autonomous Technologies Oversight Functions Competency |
|
is blocked by
|
AI Agent Adversarial & Red Team Testing |
|
is blocked by
|
AI Agent Resource Limiting |
|
is blocked by
|
Human-in-the-Loop Workload & Manipulation |
|
is blocked by
|
Asset Governance |
|
is blocked by
|
Return of Assets |
|
is blocked by
|
Travel-Only Devices |
|
is blocked by
|
Technology Lifecycle Management |
|
is blocked by
|
Technical Debt Reviews |
|
is blocked by
|
Unsupported Technology Assets, Applications and/or Services (TAAS) |
|
is blocked by
|
Alternate Sources for Continued Support |
|
is blocked by
|
Business Continuity Management System (BCMS) |
|
is blocked by
|
Operational Resilience Capabilities |
|
is blocked by
|
Business Continuity & Disaster Recovery (BC/DR) Plans |
|
is blocked by
|
Recovery Time / Point Objectives (RTO / RPO) |
|
is blocked by
|
Recovery Operations Criteria |
|
is blocked by
|
Recovery Operations Communications |
|
is blocked by
|
Alternate Communications Channels |
|
is blocked by
|
Ongoing Contingency Planning |
|
is blocked by
|
Contingency Planning Components |
|
is blocked by
|
Contingency Plan Update Notifications |
|
is blocked by
|
Coordinate with Related Plans |
|
is blocked by
|
Coordinate With External Service Providers |
|
is blocked by
|
Resume All Missions & Business Functions |
|
is blocked by
|
Continue Essential Mission & Business Functions |
|
is blocked by
|
Resume Essential Missions & Business Functions |
|
is blocked by
|
Contingency Training |
|
is blocked by
|
Simulated Events |
|
is blocked by
|
Automated Training Environments |
|
is blocked by
|
Contingency Plan Testing & Exercises |
|
is blocked by
|
Coordinated Testing with Related Plans |
|
is blocked by
|
Contingency Plan Testing For Alternate Storage & Processing Sites |
|
is blocked by
|
Contingency Plan Root Cause Analysis (RCA) & Lessons Learned |
|
is blocked by
|
Alternate Storage Site |
|
is blocked by
|
Separation from Primary Storage Site |
|
is blocked by
|
Primary Storage Site Accessibility |
|
is blocked by
|
Alternate Processing Site |
|
is blocked by
|
Separation from Primary Processing Site |
|
is blocked by
|
Alternate Processing Site Accessibility |
|
is blocked by
|
Alternate Site Priority of Service |
|
is blocked by
|
Preparation for Use |
|
is blocked by
|
Inability to Return to Primary Site |
|
is blocked by
|
Personnel Transfer to Alternate Processing / Storage Site |
|
is blocked by
|
Telecommunications Services Availability |
|
is blocked by
|
Telecommunications Priority of Service Provisions |
|
is blocked by
|
Separation of Primary / Alternate Providers |
|
is blocked by
|
Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution |
|
is blocked by
|
Restore Within Time Period |
|
is blocked by
|
Recovery Images |
|
is blocked by
|
Isolated Recovery Environment |
|
is blocked by
|
Reserve Hardware |
|
is blocked by
|
Redundant Secondary System |
|
is blocked by
|
Failover Capability |
|
is blocked by
|
Resilient Data Backup Architecture |
|
is blocked by
|
Data Backups |
|
is blocked by
|
Transfer to Alternate Storage Site |
|
is blocked by
|
Separate Storage for Critical Information |
|
is blocked by
|
Redundant Copies of Business-Critical Data |
|
is blocked by
|
Transaction Recovery |
|
is blocked by
|
Data Replication |
|
is blocked by
|
Data Archiving |
|
is blocked by
|
Continuous Data Protection (CDP) |
|
is blocked by
|
Testing for Reliability & Integrity |
|
is blocked by
|
Test Restoration Using Sampling |
|
is blocked by
|
Dual Authorization For Sensitive / Regulated Backup Media Destruction |
|
is blocked by
|
Capacity & Performance Planning Policy |
|
is blocked by
|
Capacity & Performance Management |
|
is blocked by
|
Capacity Planning |
|
is blocked by
|
Elastic Expansion |
|
is blocked by
|
Resiliency Planning For Alternate Sites |
|
is blocked by
|
Change Management Policy |
|
is blocked by
|
Change Management Program |
|
is blocked by
|
Compliance Policy |
|
is blocked by
|
Statutory, Regulatory & Contractual Compliance |
|
is blocked by
|
Compliance Scope |
|
is blocked by
|
Ability To Demonstrate Conformity |
|
is blocked by
|
Conformity Assessment |
|
is blocked by
|
Designated Certifying Official |
|
is blocked by
|
Conformity Attestations |
|
is blocked by
|
Declaration of Conformity |
|
is blocked by
|
Conformity Monitoring |
|
is blocked by
|
Functional Review Of Security, Compliance & Resilience Controls |
|
is blocked by
|
Non-Conformity Oversight |
|
is blocked by
|
Non-Conformity Corrective Action |
|
is blocked by
|
Executive Leadership Oversight of Security, Compliance & Resilience Controls |
|
is blocked by
|
Internal Audit Function |
|
is blocked by
|
Periodic Audits |
|
is blocked by
|
Independent Assessors |
|
is blocked by
|
Assessment Team Subject Matter Expertise |
|
is blocked by
|
Control Reciprocity |
|
is blocked by
|
Control Inheritance |
|
is blocked by
|
Evidence Request List (ERL) |
|
is blocked by
|
Evidence Sampling |
|
is blocked by
|
Continuous Control Monitoring (CCM) |
|
is blocked by
|
Localized Representation |
|
is blocked by
|
Representative Powers |
|
is blocked by
|
Dual Use Technology |
|
is blocked by
|
Approved Configuration Deviations |
|
is blocked by
|
Baseline Configuration Reviews & Updates |
|
is blocked by
|
Periodic Configuration Reviews |
|
is blocked by
|
Respond To Unauthorized Changes |
|
is blocked by
|
Control Assurance Automation (CAA) Separation of Duties |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Storage Capacity |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Storage Capacity Alerting |
|
is blocked by
|
Cryptographic Protections Policy |
|
is blocked by
|
Data Stewardship |
|
is blocked by
|
Data Localization |
|
is blocked by
|
Data Management Board |
|
is blocked by
|
Embedded Technology Security Program |
|
is blocked by
|
Internet of Things (IOT) |
|
is blocked by
|
Operational Technology (OT) |
|
is blocked by
|
Embedded Technology Maintenance |
|
is blocked by
|
Embedded Technology Reviews |
|
is blocked by
|
Endpoint Security Policy |
|
is blocked by
|
Human Resources Security Policy |
|
is blocked by
|
Human Resources Security Management |
|
is blocked by
|
Competency Requirements for Security, Compliance & Resilience-Related Positions |
|
is blocked by
|
Technology Use Restrictions |
|
is blocked by
|
Use of Critical Technologies |
|
is blocked by
|
Use of Mobile Devices |
|
is blocked by
|
Security-Minded Dress Code |
|
is blocked by
|
Access Agreements |
|
is blocked by
|
Confidentiality Agreements |
|
is blocked by
|
Onboarding, Transferring & Offboarding Personnel |
|
is blocked by
|
Formal Indoctrination |
|
is blocked by
|
Policy Familiarization & Acknowledgement |
|
is blocked by
|
Post-Employment Requirements Awareness |
|
is blocked by
|
Post-Employment Requirements Notification |
|
is blocked by
|
Probationary Periods |
|
is blocked by
|
Third-Party Personnel |
|
is blocked by
|
Separation of Duties (SoD) |
|
is blocked by
|
Identify Critical Skills & Gaps |
|
is blocked by
|
Remediate Identified Skills Deficiencies |
|
is blocked by
|
Identify Vital Security, Compliance & Resilience Staff |
|
is blocked by
|
Establish Redundancy for Vital Security, Compliance & Resilience Staff |
|
is blocked by
|
Perform Succession Planning |
|
is blocked by
|
Technology Use Restrictions |
|
is blocked by
|
Use of Critical Technologies |
|
is blocked by
|
Use of Mobile Devices |
|
is blocked by
|
Security-Minded Dress Code |
|
is blocked by
|
Access Agreements |
|
is blocked by
|
Confidentiality Agreements |
|
is blocked by
|
Onboarding, Transferring & Offboarding Personnel |
|
is blocked by
|
Formal Indoctrination |
|
is blocked by
|
Policy Familiarization & Acknowledgement |
|
is blocked by
|
Post-Employment Requirements Awareness |
|
is blocked by
|
Post-Employment Requirements Notification |
|
is blocked by
|
Probationary Periods |
|
is blocked by
|
Third-Party Personnel |
|
is blocked by
|
Separation of Duties (SoD) |
|
is blocked by
|
Identify Critical Skills & Gaps |
|
is blocked by
|
Remediate Identified Skills Deficiencies |
|
is blocked by
|
Identify Vital Security, Compliance & Resilience Staff |
|
is blocked by
|
Establish Redundancy for Vital Security, Compliance & Resilience Staff |
|
is blocked by
|
Perform Succession Planning |
|
is blocked by
|
Incident Response Policy |
|
is blocked by
|
Incident Response Operations |
|
is blocked by
|
Continuous Incident Response Improvements |
|
is blocked by
|
Incident Handling |
|
is blocked by
|
Correlation with External Organizations |
|
is blocked by
|
Information Assurance (IA) Operations |
|
is blocked by
|
Assessor Independence |
|
is blocked by
|
Mobile Device Management Policy |
|
is blocked by
|
Human Reviews |
|
is blocked by
|
Incident Response Policy |
|
is blocked by
|
Incident Response Operations |
|
is blocked by
|
Continuous Incident Response Improvements |
|
is blocked by
|
Incident Handling |
|
is blocked by
|
Correlation with External Organizations |
|
is blocked by
|
Information Assurance (IA) Operations |
|
is blocked by
|
Controlled Ingress & Egress Points |
|
is blocked by
|
Physical Access Logs |
|
is blocked by
|
Personnel Searches |
|
is blocked by
|
Physical Security of Offices, Rooms & Facilities |
|
is blocked by
|
Working in Secure Areas |
|
is blocked by
|
On-Site Client Segregation |
|
is blocked by
|
Access To Critical Systems |
|
is blocked by
|
Monitoring Physical Access |
|
is blocked by
|
Intrusion Alarms / Surveillance Equipment |
|
is blocked by
|
Monitoring Physical Access To Critical Systems |
|
is blocked by
|
Visitor Control |
|
is blocked by
|
Distinguish Visitors from On-Site Personnel |
|
is blocked by
|
Identification Requirement |
|
is blocked by
|
Restrict Unescorted Access |
|
is blocked by
|
Automated Records Management & Review |
|
is blocked by
|
Visitor Access Revocation |
|
is blocked by
|
Delivery & Removal |
|
is blocked by
|
Temporary Storage |
|
is blocked by
|
Equipment Siting & Protection |
|
is blocked by
|
Transmission Medium Security |
|
is blocked by
|
Access Control for Output Devices |
|
is blocked by
|
Component Marking |
|
is blocked by
|
Asset Monitoring and Tracking |
|
is blocked by
|
Supporting Utilities |
|
is blocked by
|
Automatic Voltage Controls |
|
is blocked by
|
Emergency Shutoff |
|
is blocked by
|
Emergency Power |
|
is blocked by
|
Emergency Lighting |
|
is blocked by
|
Water Damage Protection |
|
is blocked by
|
Automation Support for Water Damage Protection |
|
is blocked by
|
Redundant Cabling |
|
is blocked by
|
Fire Protection |
|
is blocked by
|
Fire Detection Devices |
|
is blocked by
|
Fire Suppression Devices |
|
is blocked by
|
Data Privacy Program |
|
is blocked by
|
Data Privacy Accountability Structure |
|
is blocked by
|
Chief Privacy Officer (CPO) |
|
is blocked by
|
Data Protection Officer (DPO) |
|
is blocked by
|
Personal Data Process Manager (PDPM) |
|
is blocked by
|
Data Fiduciary |
|
is blocked by
|
Project & Resource Management Policy |
|
is blocked by
|
Strategic Plan & Objectives |
|
is blocked by
|
Targeted Capability Maturity Levels |
|
is blocked by
|
Security, Compliance & Resilience Protection Portfolio Management |
|
is blocked by
|
Purpose Validation |
|
is blocked by
|
Security, Compliance & Resilience Resource Management |
|
is blocked by
|
Commitment To Continual Improvements |
|
is blocked by
|
Prioritization To Address Evolving Risks & Threats |
|
is blocked by
|
Allocation of Resources |
|
is blocked by
|
Secure Development Life Cycle (SDLC) Management |
|
is blocked by
|
Security, Compliance & Resilience In Project Management |
|
is blocked by
|
Project Management Stage Gates |
|
is blocked by
|
Security, Compliance & Resilience Requirements Definition |
|
is blocked by
|
Business Process Definition |
|
is blocked by
|
Manage Organizational Knowledge |
|
is blocked by
|
Post-Quantum Cryptography Agility Plan (PQCAP) |
|
is blocked by
|
Post-Quantum Cryptography (PQC) Transition Planning & Hybrid Mode Support |
|
is blocked by
|
Post-Quantum Cryptography (PQC) Supply Chain Flow-Down Requirements |
|
is blocked by
|
Fire Suppression Devices |
|
is blocked by
|
Data Privacy Program |
|
is blocked by
|
Data Privacy Accountability Structure |
|
is blocked by
|
Chief Privacy Officer (CPO) |
|
is blocked by
|
Data Protection Officer (DPO) |
|
is blocked by
|
Personal Data Process Manager (PDPM) |
|
is blocked by
|
Data Fiduciary |
|
is blocked by
|
Risk Management Policy |
|
is blocked by
|
Risk Management Program |
|
is blocked by
|
Risk Management Resourcing |
|
is blocked by
|
Risk Culture |
|
is blocked by
|
Risk Framing |
|
is blocked by
|
Risk Tolerance |
|
is blocked by
|
Risk Threshold |
|
is blocked by
|
Risk Appetite |
|
is blocked by
|
Material Risks |
|
is blocked by
|
Business Impact Analysis (BIA) |
|
is blocked by
|
Risk Identification |
|
is blocked by
|
Risk Catalog |
|
is blocked by
|
Risk Owner |
|
is blocked by
|
Risk Assessment Methodology |
|
is blocked by
|
Risk Assessment |
|
is blocked by
|
Instances Requiring A Risk Assessment |
|
is blocked by
|
Risk Assessment Update |
|
is blocked by
|
Risk Assessment Stakeholder Involvement |
|
is blocked by
|
Risk Register |
|
is blocked by
|
Risk Ranking |
|
is blocked by
|
Risk Response |
|
is blocked by
|
Risk Treatment Options |
|
is blocked by
|
Risk Remediation |
|
is blocked by
|
Risk Treatment Plan (RTP) |
|
is blocked by
|
Documented Alternatives |
|
is blocked by
|
Compensating Countermeasures |
|
is blocked by
|
Data Protection Impact Assessment (DPIA) |
|
is blocked by
|
Supply Chain Risk Management (SCRM) Plan |
|
is blocked by
|
AI & Autonomous Technologies Supply Chain Impacts |
|
is blocked by
|
Supply Chain Risk Assessment (SCRA) |
|
is blocked by
|
Risk Monitoring |
|
is blocked by
|
Security, Compliance & Resilience Aware Design |
|
is blocked by
|
Flexible Technology Stack |
|
is blocked by
|
Secure Architecture Principles |
|
is blocked by
|
Alignment With Enterprise Architecture |
|
is blocked by
|
Secure Engineering Principles |
|
is blocked by
|
Heterogeneity |
|
is blocked by
|
Security Operations Policy |
|
is blocked by
|
Operations Security |
|
is blocked by
|
Security Concept Of Operations (CONOPS) |
|
is blocked by
|
Standardized Operating Procedures (SOP) |
|
is blocked by
|
System Administrative Processes |
|
is blocked by
|
Database Administrative Processes |
|
is blocked by
|
Service Delivery (Business Process Support) |
|
is blocked by
|
Security Operations Center (SOC) |
|
is blocked by
|
Security Awareness & Training Policy |
|
is blocked by
|
Security, Compliance & Resilience-Minded Workforce |
|
is blocked by
|
Maintaining Workforce Development Relevancy |
|
is blocked by
|
Security, Compliance & Resilience Awareness Training |
|
is blocked by
|
Simulated Cyber Attack Scenario Training |
|
is blocked by
|
Role-Based Security, Compliance & Resilience Training |
|
is blocked by
|
Sensitive / Regulated Data Storage, Handling & Processing |
|
is blocked by
|
Privileged User Training |
|
is blocked by
|
AI & Autonomous Technologies Risk Management Training |
|
is blocked by
|
Vendor-Specific Security, Compliance & Resilience Training |
|
is blocked by
|
Cyber Threat Environment Situational Awareness |
|
is blocked by
|
Social Engineering & Mining |
|
is blocked by
|
Suspicious Communications & Anomalous System Behavior |
|
is blocked by
|
Counterintelligence Training |
|
is blocked by
|
Anti-Counterfeit Training |
|
is blocked by
|
Quantum Security Awareness |
|
is blocked by
|
Continuing Professional Education (CPE) - Security, Compliance & Resilience Personnel |
|
is blocked by
|
Continuing Professional Education (CPE) - DevOps Personnel |
|
is blocked by
|
Practical Security Training Exercises |
|
is blocked by
|
Security, Compliance & Resilience Training Records |
|
is blocked by
|
Training Feedback |
|
is blocked by
|
Security, Compliance & Resilience Knowledge Sharing |
|
is blocked by
|
Technology Development & Acquisition Policy |
|
is blocked by
|
Technology Development & Acquisition |
|
is blocked by
|
Development Methods, Techniques & Processes |
|
is blocked by
|
Software Assurance Maturity Model (SAMM) |
|
is blocked by
|
Developer Architecture & Design |
|
is blocked by
|
Programming Language Selection |
|
is blocked by
|
Secure Software Development Practices (SSDP) |
|
is blocked by
|
Criticality Analysis During Development |
|
is blocked by
|
Threat Modeling |
|
is blocked by
|
Software Design Review |
|
is blocked by
|
Software Design Root Cause Analysis (RCA) |
|
is blocked by
|
Product Management |
|
is blocked by
|
Product Tampering and Counterfeiting (PTC) |
|
is blocked by
|
Customized Development of Critical Components |
|
is blocked by
|
DevSecOps |
|
is blocked by
|
Minimum Viable Product (MVP) Security Requirements |
|
is blocked by
|
Commercial Off-The-Shelf (COTS) Security Solutions |
|
is blocked by
|
Risk Management Policy |
|
is blocked by
|
Risk Management Program |
|
is blocked by
|
Risk Management Resourcing |
|
is blocked by
|
Risk Culture |
|
is blocked by
|
Risk Framing |
|
is blocked by
|
Risk Tolerance |
|
is blocked by
|
Risk Threshold |
|
is blocked by
|
Risk Appetite |
|
is blocked by
|
Material Risks |
|
is blocked by
|
Business Impact Analysis (BIA) |
|
is blocked by
|
Risk Identification |
|
is blocked by
|
Risk Catalog |
|
is blocked by
|
Risk Owner |
|
is blocked by
|
Risk Assessment Methodology |
|
is blocked by
|
Risk Assessment |
|
is blocked by
|
Instances Requiring A Risk Assessment |
|
is blocked by
|
Risk Assessment Update |
|
is blocked by
|
Risk Assessment Stakeholder Involvement |
|
is blocked by
|
Risk Register |
|
is blocked by
|
Risk Ranking |
|
is blocked by
|
Risk Response |
|
is blocked by
|
Risk Treatment Options |
|
is blocked by
|
Risk Remediation |
|
is blocked by
|
Risk Treatment Plan (RTP) |
|
is blocked by
|
Documented Alternatives |
|
is blocked by
|
Compensating Countermeasures |
|
is blocked by
|
Data Protection Impact Assessment (DPIA) |
|
is blocked by
|
Supply Chain Risk Management (SCRM) Plan |
|
is blocked by
|
AI & Autonomous Technologies Supply Chain Impacts |
|
is blocked by
|
Supply Chain Risk Assessment (SCRA) |
|
is blocked by
|
Risk Monitoring |
|
is blocked by
|
Security, Compliance & Resilience Aware Design |
|
is blocked by
|
Flexible Technology Stack |
|
is blocked by
|
Secure Architecture Principles |
|
is blocked by
|
Alignment With Enterprise Architecture |
|
is blocked by
|
Secure Engineering Principles |
|
is blocked by
|
Product Testing & Reviews |
|
is blocked by
|
Security, Compliance & Resilience Representatives For Product Changes |
|
is blocked by
|
Software Escrow |
|
is blocked by
|
Security, Compliance & Resilience Testing Throughout Development |
|
is blocked by
|
Static Code Analysis |
|
is blocked by
|
Dynamic Code Analysis |
|
is blocked by
|
Malformed Input Testing |
|
is blocked by
|
Application Penetration Testing |
|
is blocked by
|
Manual Code Review |
|
is blocked by
|
Developer Screening |
|
is blocked by
|
Requisite Developer Training |
|
is blocked by
|
Developer Threat Analysis & Flaw Remediation |
|
is blocked by
|
Developer-Provided Training |
|
is blocked by
|
Third-Party Management |
|
is blocked by
|
Acquisition Strategies, Tools & Methods |
|
is blocked by
|
Supply Chain Risk Management (SCRM) |
|
is blocked by
|
Processes To Address Weaknesses or Deficiencies |
|
is blocked by
|
Security, Compliance & Resilience Outsourcing Limitations |
|
is blocked by
|
Outsourcing Non-Essential Functions or Services |
|
is blocked by
|
Supplier Diversity |
|
is blocked by
|
Adequate Supply |
|
is blocked by
|
Third-Party Criticality Assessments |
|
is blocked by
|
Third-Party Risk Assessments & Approvals |
|
is blocked by
|
Conflict of Interests |
|
is blocked by
|
Third-Party Contract Requirements |
|
is blocked by
|
Contract Flow-Down Requirements |
|
is blocked by
|
Provider Contingency Plan |
|
is blocked by
|
Review of Third-Party Services |
|
is blocked by
|
Third-Party Scope Review |
|
is blocked by
|
Third-Party Deficiency Remediation |
|
is blocked by
|
Break Clauses |
|
is blocked by
|
Foreign Ownership, Control or Influence (FOCI) |
|
is blocked by
|
Ownership Change Monitoring |
|
is blocked by
|
Ownership Change Provisions |
|
is blocked by
|
Third-Party Incident Response & Recovery Capabilities |
|
is blocked by
|
Security Compromise Notification Agreements |
|
is blocked by
|
Terminating Third-Party Relationships |
|
is blocked by
|
Third-Party Transition Planning |
|
is blocked by
|
Technology Assets, Applications, Services and Data (TAASD) Portability |
|
is blocked by
|
Third-Party Knowledge & Operational Transfer |
|
is blocked by
|
Third-Party Exit Obligations Management |
|
is blocked by
|
Third-Party Exit Contingencies |
|
is blocked by
|
Independent Penetration Agent or Team |
|
is blocked by
|
Product Testing & Reviews |
|
is blocked by
|
Security, Compliance & Resilience Representatives For Product Changes |
|
is blocked by
|
Software Escrow |
|
is blocked by
|
Security, Compliance & Resilience Testing Throughout Development |
|
is blocked by
|
Static Code Analysis |
|
is blocked by
|
Dynamic Code Analysis |
|
is blocked by
|
Malformed Input Testing |
|
is blocked by
|
Application Penetration Testing |
|
is blocked by
|
Manual Code Review |
|
is blocked by
|
Developer Screening |
|
is blocked by
|
Requisite Developer Training |
|
is blocked by
|
Developer Threat Analysis & Flaw Remediation |
|
is blocked by
|
Developer-Provided Training |
|
is blocked by
|
Third-Party Management |
|
is blocked by
|
Acquisition Strategies, Tools & Methods |
|
is blocked by
|
Supply Chain Risk Management (SCRM) |
|
is blocked by
|
Processes To Address Weaknesses or Deficiencies |
|
is blocked by
|
Security, Compliance & Resilience Outsourcing Limitations |
|
is blocked by
|
Outsourcing Non-Essential Functions or Services |
|
is blocked by
|
Supplier Diversity |
|
is blocked by
|
Adequate Supply |
|
is blocked by
|
Third-Party Criticality Assessments |
|
is blocked by
|
Third-Party Risk Assessments & Approvals |
|
is blocked by
|
Conflict of Interests |
|
is blocked by
|
Third-Party Contract Requirements |
|
is blocked by
|
Product Testing & Reviews |
|
is blocked by
|
Security, Compliance & Resilience Representatives For Product Changes |
|
is blocked by
|
Software Escrow |
|
is blocked by
|
Security, Compliance & Resilience Testing Throughout Development |
|
is blocked by
|
Static Code Analysis |
|
is blocked by
|
Dynamic Code Analysis |
|
is blocked by
|
Malformed Input Testing |
|
is blocked by
|
Application Penetration Testing |
|
is blocked by
|
Manual Code Review |
|
is blocked by
|
Developer Screening |
|
is blocked by
|
Requisite Developer Training |
|
is blocked by
|
Developer Threat Analysis & Flaw Remediation |
|
is blocked by
|
Developer-Provided Training |
|
is blocked by
|
Third-Party Management |
|
is blocked by
|
Acquisition Strategies, Tools & Methods |
|
is blocked by
|
Supply Chain Risk Management (SCRM) |
|
is blocked by
|
Processes To Address Weaknesses or Deficiencies |
|
is blocked by
|
Security, Compliance & Resilience Outsourcing Limitations |
|
is blocked by
|
Outsourcing Non-Essential Functions or Services |
|
is blocked by
|
Supplier Diversity |
|
is blocked by
|
Adequate Supply |
|
is blocked by
|
Third-Party Criticality Assessments |
|
is blocked by
|
Third-Party Risk Assessments & Approvals |
|
is blocked by
|
Conflict of Interests |
|
is blocked by
|
Third-Party Contract Requirements |