|
is blocked by
|
Security, Compliance & Resilience Program (SCRP) |
|
is blocked by
|
Centralized Management of Security, Compliance & Resilience Controls |
|
is blocked by
|
Standardized Terminology |
|
is blocked by
|
Assessment Objectives (AO) |
|
is blocked by
|
Periodic Review & Update of Security, Compliance & Resilience Program |
|
is blocked by
|
Exception Management |
|
is blocked by
|
Periodic Review of Exceptions |
|
is blocked by
|
Materiality Determination |
|
is blocked by
|
High Value Assets (HVAs) |
|
is blocked by
|
Steering Committee & Program Oversight |
|
is blocked by
|
Status Reporting To Governing Body |
|
is blocked by
|
Assess Controls |
|
is blocked by
|
Monitor Controls |
|
is blocked by
|
Measures of Performance |
|
is blocked by
|
Key Performance Indicators (KPIs) |
|
is blocked by
|
Key Risk Indicators (KRIs) |
|
is blocked by
|
Contacts With Groups & Associations |
|
is blocked by
|
Quality Management System (QMS) |
|
is blocked by
|
Assurance |
|
is blocked by
|
Mergers, Acquisitions & Divestitures (MA&D) |
|
is blocked by
|
Artificial Intelligence (AI) & Autonomous Technologies Governance |
|
is blocked by
|
AI & Autonomous Technologies Value Sustainment |
|
is blocked by
|
Trustworthy AI & Autonomous Technologies |
|
is blocked by
|
AI & Autonomous Technologies Continuous Improvements |
|
is blocked by
|
Situational Awareness of AI & Autonomous Technologies In Use |
|
is blocked by
|
AI Model & Agent Inventory & Lifecycle Management |
|
is blocked by
|
Artificial Intelligence and Autonomous Technologies (AAT) & AI Agent Categorization |
|
is blocked by
|
AI & Autonomous Technologies Impact Assessment |
|
is blocked by
|
AI & Autonomous Technologies Risk Profiling |
|
is blocked by
|
AI & Autonomous Technologies Risk Mapping |
|
is blocked by
|
AI & Autonomous Technologies Likelihood & Impact Risk Analysis |
|
is blocked by
|
AI & Autonomous Technologies High Risk Designations |
|
is blocked by
|
AI Threat Modeling & Risk Assessment |
|
is blocked by
|
Novel Risk Assessment Methods & Technologies |
|
is blocked by
|
AI & Autonomous Technologies Risk Response |
|
is blocked by
|
AI & Autonomous Technologies Risk Tracking Approaches |
|
is blocked by
|
Fine Tuning Risk Mitigation |
|
is blocked by
|
AI & Autonomous Technologies Business Case |
|
is blocked by
|
AI & Autonomous Technologies Potential Benefits Analysis |
|
is blocked by
|
AI & Autonomous Technologies Potential Costs Analysis |
|
is blocked by
|
AI & Autonomous Technologies Cost / Benefit Mapping |
|
is blocked by
|
Model & AI Agent Documentation |
|
is blocked by
|
Release Owner Gate (ROG) For AI-Augmented Content |
|
is blocked by
|
AI & Autonomous Technologies Output Filtering |
|
is blocked by
|
Human Moderation of AI & Autonomous Technologies-Generated Content |
|
is blocked by
|
AI & Autonomous Technologies Intellectual Property Infringement Protections |
|
is blocked by
|
Data Source Identification |
|
is blocked by
|
Data Source Integrity |
|
is blocked by
|
Data Source Lineage & Origin Disclosure |
|
is blocked by
|
Digital Content Modification Logging |
|
is blocked by
|
Training Data Source & Integrity |
|
is blocked by
|
AI & Autonomous Technologies Harm Prevention |
|
is blocked by
|
AI & Autonomous Technologies Environmental Impact & Sustainability |
|
is blocked by
|
Previously Unknown AI & Autonomous Technologies Threats & Risks |
|
is blocked by
|
AI & Autonomous Technologies Conformity |
|
is blocked by
|
Manipulative or Deceptive Techniques |
|
is blocked by
|
Materially Distorting Behaviors |
|
is blocked by
|
Social Scoring |
|
is blocked by
|
Detrimental or Unfavorable Treatment |
|
is blocked by
|
Risk and Criminal Profiling |
|
is blocked by
|
Populating Facial Recognition Databases |
|
is blocked by
|
Emotion Inference |
|
is blocked by
|
Biometric Categorization |
|
is blocked by
|
AI & Autonomous Technologies Requirements Definitions |
|
is blocked by
|
AI & Autonomous Technologies Fairness & Bias |
|
is blocked by
|
AI & Autonomous Technologies Knowledge Limits |
|
is blocked by
|
AI & Autonomous Technologies Development Practices |
|
is blocked by
|
AI & Autonomous Technologies Transparency |
|
is blocked by
|
AI & Autonomous Technologies Implementation Documentation |
|
is blocked by
|
AI & Autonomous Technologies Human Domain Knowledge Reliance |
|
is blocked by
|
AI & Autonomous Technologies Testing Techniques |
|
is blocked by
|
Generative Artificial Intelligence (GAI) Identification |
|
is blocked by
|
AI & Autonomous Technologies Capabilities Testing |
|
is blocked by
|
Real-World Testing |
|
is blocked by
|
Documenting Testing Guidance |
|
is blocked by
|
Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) |
|
is blocked by
|
AI TEVV Trustworthiness Assessment |
|
is blocked by
|
AI TEVV Tools |
|
is blocked by
|
AI TEVV Trustworthiness Demonstration |
|
is blocked by
|
AI TEVV Safety Demonstration |
|
is blocked by
|
AI TEVV Security & Resiliency Assessment |
|
is blocked by
|
AI TEVV Transparency & Accountability Assessment |
|
is blocked by
|
AI TEVV Privacy Assessment |
|
is blocked by
|
AI TEVV Fairness & Bias Assessment |
|
is blocked by
|
AI & Autonomous Technologies Model Validation |
|
is blocked by
|
AI TEVV Comparable Deployment Settings |
|
is blocked by
|
AI TEVV Empirically Validated Methods |
|
is blocked by
|
AI TEVV Benchmarking Content Provenance |
|
is blocked by
|
AI TEVV Model Collapse Mitigations |
|
is blocked by
|
AI TEVV Third-Party Risk Management |
|
is blocked by
|
AI TEVV Results Evaluation |
|
is blocked by
|
AI TEVV Effectiveness |
|
is blocked by
|
AI TEVV Reporting |
|
is blocked by
|
AI & Autonomous Technologies Residual Risks |
|
is blocked by
|
AI & Autonomous Technologies Viability Decisions |
|
is blocked by
|
AI TEVV Post-Deployment Monitoring |
|
is blocked by
|
Updating AI & Autonomous Technologies |
|
is blocked by
|
Robust Stakeholder Engagement for AI & Autonomous Technologies |
|
is blocked by
|
AI & Autonomous Technologies Stakeholder Feedback Integration |
|
is blocked by
|
AI & Autonomous Technologies Ongoing Assessments |
|
is blocked by
|
AI & Autonomous Technologies End User Feedback |
|
is blocked by
|
AI & Autonomous Technologies Incident & Error Reporting |
|
is blocked by
|
AI & Autonomous Technologies Deployment |
|
is blocked by
|
AI & Autonomous Technologies Human Oversight |
|
is blocked by
|
AI & Autonomous Technologies Oversight Measures |
|
is blocked by
|
AI & Autonomous Technologies Separate Verification |
|
is blocked by
|
AI & Autonomous Technologies Data Relevance |
|
is blocked by
|
AI & Autonomous Technologies Production Monitoring |
|
is blocked by
|
AI & Autonomous Technologies Measurement Approaches |
|
is blocked by
|
Measuring AI & Autonomous Technologies Effectiveness |
|
is blocked by
|
Efficacy of AI & Autonomous Technologies Measurement |
|
is blocked by
|
AI & Autonomous Technologies Domain Expert Reviews |
|
is blocked by
|
AI & Autonomous Technologies Performance Changes |
|
is blocked by
|
Pre-Trained AI & Autonomous Technologies Models |
|
is blocked by
|
AI & Autonomous Technologies Event Logging |
|
is blocked by
|
Serious Incident Root Cause Analysis (RCA) For AI & Autonomous Technologies |
|
is blocked by
|
Anomaly Detection & Human Oversight |
|
is blocked by
|
Human-in-the-Loop & Escalation |
|
is blocked by
|
Emergent Behavior & Collusion Protections |
|
is blocked by
|
Multi-Agent Trust & Communication Validation |
|
is blocked by
|
AI & Autonomous Technologies System Value Chain |
|
is blocked by
|
AI & Autonomous Technologies System Value Chain Fallbacks |
|
is blocked by
|
AI Model Resilience |
|
is blocked by
|
AI Model Pollution |
|
is blocked by
|
Cascading Hallucination Defense |
|
is blocked by
|
Resource Exhaustion & Denial of Service (DoS) Resilience |
|
is blocked by
|
Tool & Application Programming Interface (API) Invocation Controls |
|
is blocked by
|
AI Agent Orchestration Protocol Safeguards |
|
is blocked by
|
AI Agent Data Pipeline & Input Integrity |
|
is blocked by
|
AI Agent Data Access Restrictions |
|
is blocked by
|
AI Agent Logic Integrity |
|
is blocked by
|
AI Agent Prompt Injection Defense |
|
is blocked by
|
AI Agent Delegation and Chaining Control |
|
is blocked by
|
AI Agent Behavioral Drift Detection |
|
is blocked by
|
AI Agent Transparency & Audit |
|
is blocked by
|
AI Agent Ethics, Fairness & Bias Detection |
|
is blocked by
|
AI Agent Output Integrity & Verification |
|
is blocked by
|
AI Agent Resource Limiting |
|
is blocked by
|
Agentic Output Traceability & Repudiation |
|
is blocked by
|
AI Agent Logging |
|
is blocked by
|
Human-in-the-Loop Workload & Manipulation |
|
is blocked by
|
Robotic Process Automation (RPA) |
|
is blocked by
|
Business Process Task Enumeration |
|
is blocked by
|
Standardized Naming Convention |
|
is blocked by
|
Asset Inventories |
|
is blocked by
|
Updates During Installations / Removals |
|
is blocked by
|
Component Duplication Avoidance |
|
is blocked by
|
Identify Critical Assets |
|
is blocked by
|
Technology Assets, Applications, Services and/or Data (TAASD) Criticality Ratings |
|
is blocked by
|
Asset-Service Dependencies |
|
is blocked by
|
Stakeholder Identification & Involvement |
|
is blocked by
|
Technology Assets, Applications, Services and/or Data (TAASD) Ownership Assignment |
|
is blocked by
|
Accountability Information |
|
is blocked by
|
Comprehensive Asset Inventory Management |
|
is blocked by
|
Configuration Management Database (CMDB) |
|
is blocked by
|
Component Assignment |
|
is blocked by
|
Asset Discovery |
|
is blocked by
|
Dynamic Host Configuration Protocol (DHCP) Server Logging |
|
is blocked by
|
Automated Network Asset Discovery |
|
is blocked by
|
Automated Location Tracking |
|
is blocked by
|
Approved Technologies |
|
is blocked by
|
Authorized To Connect |
|
is blocked by
|
Automated Unauthorized Component Detection |
|
is blocked by
|
Prohibited Technology Assets, Applications and/or Services (TAAS) |
|
is blocked by
|
Software Licensing Restrictions |
|
is blocked by
|
Provenance |
|
is blocked by
|
Asset Categorization |
|
is blocked by
|
High-Risk Technology Assets, Applications and/or Services (TAAS) Categorization |
|
is blocked by
|
Categorize Artificial Intelligence (AI)-Related Technology Assets, Applications and/or Services (TAAS) |
|
is blocked by
|
Asset Attributes |
|
is blocked by
|
Asset Scope Classification |
|
is blocked by
|
Compliance-Specific Asset Identification |
|
is blocked by
|
Network Diagrams & Data Flow Diagrams (DFDs) |
|
is blocked by
|
Control Applicability Boundary Graphical Representation |
|
is blocked by
|
Data Action Mapping |
|
is blocked by
|
Return of Assets |
|
is blocked by
|
Removal of Assets |
|
is blocked by
|
Usage Parameters |
|
is blocked by
|
Technology Asset Inspections |
|
is blocked by
|
Physical Tampering Detection |
|
is blocked by
|
Logical Tampering Protection |
|
is blocked by
|
Database Management System (DBMS) |
|
is blocked by
|
Technical Debt Reviews |
|
is blocked by
|
Predictable Failure Analysis |
|
is blocked by
|
Defined Operational Resilience Requirements |
|
is blocked by
|
Business Continuity & Disaster Recovery (BC/DR) Plans |
|
is blocked by
|
Recovery Time / Point Objectives (RTO / RPO) |
|
is blocked by
|
Recovery Operations Criteria |
|
is blocked by
|
Recovery Operations Communications |
|
is blocked by
|
Alternate Communications Channels |
|
is blocked by
|
Ongoing Contingency Planning |
|
is blocked by
|
Contingency Planning Components |
|
is blocked by
|
Contingency Plan Update Notifications |
|
is blocked by
|
Coordinate with Related Plans |
|
is blocked by
|
Coordinate With External Service Providers |
|
is blocked by
|
Resume All Missions & Business Functions |
|
is blocked by
|
Contingency Plan Root Cause Analysis (RCA) & Lessons Learned |
|
is blocked by
|
Alternate Storage Site |
|
is blocked by
|
Preparation for Use |
|
is blocked by
|
Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution |
|
is blocked by
|
Restore Within Time Period |
|
is blocked by
|
Recovery Images |
|
is blocked by
|
Isolated Recovery Environment |
|
is blocked by
|
Redundant Secondary System |
|
is blocked by
|
Failover Capability |
|
is blocked by
|
Resilient Data Backup Architecture |
|
is blocked by
|
Data Backups |
|
is blocked by
|
Transfer to Alternate Storage Site |
|
is blocked by
|
Redundant Copies of Business-Critical Data |
|
is blocked by
|
Transaction Recovery |
|
is blocked by
|
Data Replication |
|
is blocked by
|
Data Archiving |
|
is blocked by
|
Continuous Data Protection (CDP) |
|
is blocked by
|
Restoration Integrity Verification |
|
is blocked by
|
Testing for Reliability & Integrity |
|
is blocked by
|
Test Restoration Using Sampling |
|
is blocked by
|
Capacity & Performance Management |
|
is blocked by
|
Capacity Planning |
|
is blocked by
|
Performance Monitoring |
|
is blocked by
|
Elastic Expansion |
|
is blocked by
|
Resiliency Planning For Alternate Sites |
|
is blocked by
|
Dual Authorization for Changes To Critical / Sensitive Technology Assets, Applications and/or Services (TAAS) |
|
is blocked by
|
Dual Approval For High-Impact Environments |
|
is blocked by
|
Security, Compliance & Resilience Representative for Asset Lifecycle Changes |
|
is blocked by
|
Security Impact Analysis for Changes |
|
is blocked by
|
Test, Validate & Document Changes |
|
is blocked by
|
Stakeholder Notification of Changes |
|
is blocked by
|
Control Functionality Verification |
|
is blocked by
|
Report Verification Results |
|
is blocked by
|
Post Configuration Change Reviews |
|
is blocked by
|
Automated Security Response |
|
is blocked by
|
Unauthorized Software Installation Alerts |
|
is blocked by
|
Cloud Infrastructure Offboarding |
|
is blocked by
|
Multi-Tenant Event Logging Capabilities |
|
is blocked by
|
Cloud Access Security Broker (CASB) |
|
is blocked by
|
Ability To Demonstrate Conformity |
|
is blocked by
|
Conformity Assessment |
|
is blocked by
|
Conformity Monitoring |
|
is blocked by
|
Functional Review Of Security, Compliance & Resilience Controls |
|
is blocked by
|
Non-Conformity Oversight |
|
is blocked by
|
Non-Conformity Corrective Action |
|
is blocked by
|
Executive Leadership Oversight of Security, Compliance & Resilience Controls |
|
is blocked by
|
Internal Audit Function |
|
is blocked by
|
Periodic Audits |
|
is blocked by
|
Independent Assessors |
|
is blocked by
|
Control Reciprocity |
|
is blocked by
|
Control Inheritance |
|
is blocked by
|
Evidence Request List (ERL) |
|
is blocked by
|
Evidence Sampling |
|
is blocked by
|
Continuous Control Monitoring (CCM) |
|
is blocked by
|
Investigation Request Notifications |
|
is blocked by
|
Grievances |
|
is blocked by
|
Grievance Response |
|
is blocked by
|
Dual Use Technology |
|
is blocked by
|
USML or CCL Identification |
|
is blocked by
|
Export-Controlled Access Restrictions |
|
is blocked by
|
Export Activities Documentation |
|
is blocked by
|
Statement of Applicability (SOA) |
|
is blocked by
|
Work Products |
|
is blocked by
|
Defensible Evidence of Due Diligence |
|
is blocked by
|
Defensible Evidence of Due Care |
|
is blocked by
|
Security, Compliance & Resilience Status Reporting |
|
is blocked by
|
AI & Autonomous Technologies Registration |
|
is blocked by
|
Control Assurance Automation (CAA) Oversight |
|
is blocked by
|
Control Assurance Automation (CAA) Evidence Integrity & Provenance |
|
is blocked by
|
Approved Configuration Deviations |
|
is blocked by
|
Baseline Configuration Reviews & Updates |
|
is blocked by
|
Automated Baseline Configuration Management & Verification |
|
is blocked by
|
Periodic Configuration Reviews |
|
is blocked by
|
Respond To Unauthorized Changes |
|
is blocked by
|
Integrity Assurance & Enforcement (IAE) |
|
is blocked by
|
Retention Of Previous Configurations |
|
is blocked by
|
Network Device Configuration File Synchronization |
|
is blocked by
|
Explicitly Allow / Deny Applications |
|
is blocked by
|
Zero-Touch Provisioning (ZTP) |
|
is blocked by
|
Production Software Repository |
|
is blocked by
|
Third-Party Libraries |
|
is blocked by
|
Software Repository Protections |
|
is blocked by
|
Software Development Repository |
|
is blocked by
|
Embedded Sensor Configuration Verification |
|
is blocked by
|
Refresh from Trusted Sources |
|
is blocked by
|
Restrict Access To Security Functions |
|
is blocked by
|
Control Assurance Automation (CAA) Change Control |
|
is blocked by
|
Control Assurance Automation (CAA) Unauthorized Change Detection |
|
is blocked by
|
Continuous Monitoring |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Monitoring |
|
is blocked by
|
Centralized Management of Event Log & Security-Relevant Telemetry Content |
|
is blocked by
|
Analyze and Prioritize Monitoring Requirements |
|
is blocked by
|
Audit Level Adjustments |
|
is blocked by
|
System Generated Event Logs & Security-Relevant Telemetry |
|
is blocked by
|
System-Wide / Time-Correlated Audit Trail |
|
is blocked by
|
Centralized Collection of Event Logs & Security-Relevant Telemetry |
|
is blocked by
|
Centralized Event Log & Security-Relevant Telemetry Review & Analysis |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Analysis & Triage |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Review Escalation Matrix |
|
is blocked by
|
Automated Tools for Real-Time Event Log & Security-Relevant Telemetry Analysis |
|
is blocked by
|
Automated Incident Responder Alerting |
|
is blocked by
|
Monitoring Reporting |
|
is blocked by
|
Trend Analysis Reporting |
|
is blocked by
|
Alert Threshold Tuning |
|
is blocked by
|
Correlate Monitoring Information |
|
is blocked by
|
Integration of Scanning & Other Monitoring Information |
|
is blocked by
|
Correlation with Physical Monitoring |
|
is blocked by
|
Content of Event Logs |
|
is blocked by
|
Audit Trails |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Storage Capacity |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Storage Capacity Alerting |
|
is blocked by
|
Time Stamps |
|
is blocked by
|
Synchronization With Authoritative Time Source |
|
is blocked by
|
Protection of Event Logs & Security-Relevant Telemetry |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Backup on Separate Physical Systems / Components |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Access by Subset of Privileged Users |
|
is blocked by
|
Cryptographic Protection of Event Logs & Security-Relevant Telemetry |
|
is blocked by
|
Dual Authorization for Event Log & Security-Relevant Telemetry Movement |
|
is blocked by
|
Write Once Read Many (WORM) Event Log Generation |
|
is blocked by
|
Event Log & Security-Relevant Telemetry Retention |
|
is blocked by
|
Privileged Functions Logging |
|
is blocked by
|
Account Creation and Modification Logging |
|
is blocked by
|
Privileged User Oversight |
|
is blocked by
|
Inventory of Technology Asset Event Logging |
|
is blocked by
|
Anomalous Behavior |
|
is blocked by
|
Unusual Transactions |
|
is blocked by
|
Monitoring for Indicators of Compromise (IOC) |
|
is blocked by
|
Deactivated Account Activity |
|
is blocked by
|
Automated Response to Suspicious Events |
|
is blocked by
|
Insider Threats |
|
is blocked by
|
Third-Party Threats |
|
is blocked by
|
Individuals Posing Greater Risk |
|
is blocked by
|
Session Audit |
|
is blocked by
|
Real-Time Session Monitoring |
|
is blocked by
|
Monitoring For Information Disclosure |
|
is blocked by
|
Monitoring for Third-Party Information Disclosure |
|
is blocked by
|
Covert Channel Analysis |
|
is blocked by
|
Analyze Traffic for Covert Exfiltration |
|
is blocked by
|
Unauthorized Activities |
|
is blocked by
|
Unauthorized Network Services |
|
is blocked by
|
Inbound & Outbound Communications Traffic |
|
is blocked by
|
Proxy Logging |
|
is blocked by
|
Network Intrusion Detection & Prevention Systems (NIDS & NIPS) Monitoring |
|
is blocked by
|
Host Intrusion Detection & Prevention Systems (HIDS & HIPS) Monitoring |
|
is blocked by
|
De-Militarized Zone (DMZ) Monitoring |
|
is blocked by
|
Wireless Network Monitoring |
|
is blocked by
|
File Integrity Monitoring (FIM) |
|
is blocked by
|
File Activity Monitoring (FAM) |
|
is blocked by
|
Query Parameter Audits of Personal Data (PD) |
|
is blocked by
|
Limit Personal Data (PD) In Event Logs & Security-Relevant Telemetry |
|
is blocked by
|
Verbosity Logging for Boundary Devices |
|
is blocked by
|
Database Logging |
|
is blocked by
|
Response To Event Log Processing Failures |
|
is blocked by
|
Real-Time Alerts of Event Logging Failure |
|
is blocked by
|
Non-Repudiation |
|
is blocked by
|
Identity Binding |
|
is blocked by
|
Alternate Event Logging Capability |
|
is blocked by
|
Sharing of Event Logs & Security-Relevant Telemetry |
|
is blocked by
|
Cross-Organizational Monitoring |
|
is blocked by
|
Control Assurance Automation (CAA) Data Feed Identification |
|
is blocked by
|
Cryptographic Management |
|
is blocked by
|
Cryptographic Cipher Suites and Protocols Inventory |
|
is blocked by
|
Integrity of Data In Transit |
|
is blocked by
|
Assigned Cryptographic Key Owners |
|
is blocked by
|
Transmission of Cybersecurity & Data Protection Attributes |
|
is blocked by
|
Certificate Monitoring |
|
is blocked by
|
Cryptographic Hash |
|
is blocked by
|
Data Protection |
|
is blocked by
|
Sensitive / Regulated Data Governance |
|
is blocked by
|
Data Catalog |
|
is blocked by
|
Data & Asset Classification |
|
is blocked by
|
Highest Classification Level |
|
is blocked by
|
Data Reclassification |
|
is blocked by
|
Sensitive Data Inventories |
|
is blocked by
|
Periodic Scans for Sensitive / Regulated Data |
|
is blocked by
|
Sensitive / Regulated Data Protection |
|
is blocked by
|
Limitations on Use & Distribution of Sensitive / Regulated Data |
|
is blocked by
|
Sensitive / Regulated Data Sharing Decisions |
|
is blocked by
|
Disclosure of Sensitive / Regulated Data |
|
is blocked by
|
Controlled Release of Sensitive / Regulated Data |
|
is blocked by
|
Sensitive / Regulated Data Release Sanitization |
|
is blocked by
|
Sensitive / Regulated Data Access Mapping |
|
is blocked by
|
Sensitive / Regulated Media Records |
|
is blocked by
|
Media Marking |
|
is blocked by
|
Automated Marking |
|
is blocked by
|
Masking Displayed Sensitive / Regulated Data |
|
is blocked by
|
Data Storage Location Reviews |
|
is blocked by
|
Digital Media Sanitization Documentation |
|
is blocked by
|
Information Search & Retrieval |
|
is blocked by
|
Electronic Discovery (eDiscovery) |
|
is blocked by
|
Logical Data Location |
|
is blocked by
|
Automated Tools to Support Logical Data Location |
|
is blocked by
|
Geographic Data Location |
|
is blocked by
|
Geolocation Requirements for Processing, Storage and Service Locations |
|
is blocked by
|
External Transfer of Sensitive / Regulated Data |
|
is blocked by
|
Data Quality Operations |
|
is blocked by
|
Data Quality Management |
|
is blocked by
|
Data Quality Automation |
|
is blocked by
|
Data Modeling Guidelines |
|
is blocked by
|
Data Tags |
|
is blocked by
|
Data Analytics Bias |
|
is blocked by
|
De-Identification (Anonymization) |
|
is blocked by
|
Cybersecurity & Data Protection Attributes |
|
is blocked by
|
Dynamic Attribute Association |
|
is blocked by
|
Attribute Value Changes By Authorized Individuals |
|
is blocked by
|
Maintenance of Attribute Associations By System |
|
is blocked by
|
Association of Attributes By Authorized Individuals |
|
is blocked by
|
Attribute Displays for Output Devices |
|
is blocked by
|
Data Subject Attribute Associations |
|
is blocked by
|
Consistent Attribute Interpretation |
|
is blocked by
|
Identity Association Techniques & Technologies |
|
is blocked by
|
Attribute Reassignment |
|
is blocked by
|
Attribute Configuration By Authorized Individuals |
|
is blocked by
|
Audit Changes |
|
is blocked by
|
Data Loss Prevention (DLP) |
|
is blocked by
|
Control Assurance Automation (CAA) Aggregated Telemetry |
|
is blocked by
|
Embedded Technology Inventory Management |
|
is blocked by
|
Embedded Technology Configuration Monitoring |
|
is blocked by
|
Power Level Monitoring |
|
is blocked by
|
Embedded Technology Reviews |
|
is blocked by
|
Safe Operations |
|
is blocked by
|
Proximity Sensor |
|
is blocked by
|
Safety Instrumented System (SIS) |
|
is blocked by
|
Safety Instrumented Function (SIF) |
|
is blocked by
|
Safety Integrity Level (SIL) |
|
is blocked by
|
Endpoint Protection Mechanisms |
|
is blocked by
|
Centralized Management of Endpoint Protection Mechanisms |
|
is blocked by
|
Automatic Endpoint Protection Mechanism Updates |
|
is blocked by
|
Evolving Endpoint Protection Threats |
|
is blocked by
|
Malicious Code Protection (Antimalware) |
|
is blocked by
|
Always On Antimalware Protection |
|
is blocked by
|
Heuristic / Nonsignature-Based Malware Detection |
|
is blocked by
|
Documented Endpoint Security Protection Measures |
|
is blocked by
|
Unified Endpoint Device Management (UEDM) |
|
is blocked by
|
Endpoint Detection & Response (EDR) |
|
is blocked by
|
Extended Detection & Response (XDR) |
|
is blocked by
|
Endpoint File Integrity Monitoring (FIM) |
|
is blocked by
|
Endpoint Integrity Checks |
|
is blocked by
|
Automated Notifications of Integrity Violations |
|
is blocked by
|
Automated Response to Integrity Violations |
|
is blocked by
|
Host Intrusion Detection and Prevention Systems (HIDS / HIPS) |
|
is blocked by
|
Malicious Link & File Protections |
|
is blocked by
|
Human Resources Security Management |
|
is blocked by
|
Position Categorization |
|
is blocked by
|
Users With Elevated Privileges |
|
is blocked by
|
Competency Requirements for Security, Compliance & Resilience-Related Positions |
|
is blocked by
|
Personnel Screening |
|
is blocked by
|
Roles With Special Protection Measures |
|
is blocked by
|
Citizenship Requirements |
|
is blocked by
|
Onboarding, Transferring & Offboarding Personnel |
|
is blocked by
|
Post-Employment Requirements Awareness |
|
is blocked by
|
Post-Employment Requirements Notification |
|
is blocked by
|
Probationary Periods |
|
is blocked by
|
Workplace Investigations |
|
is blocked by
|
Personnel Transfer |
|
is blocked by
|
Automated Employment Status Notifications |
|
is blocked by
|
Asset Collection |
|
is blocked by
|
Identify Critical Skills & Gaps |
|
is blocked by
|
Identity & Access Management (IAM) |
|
is blocked by
|
Authenticate, Authorize and Audit (AAA) |
|
is blocked by
|
Retain Access Records |
|
is blocked by
|
Identity Providers (IdP) & Authorization Servers |
|
is blocked by
|
User Provisioning & De-Provisioning |
|
is blocked by
|
Change of Roles & Duties |
|
is blocked by
|
Termination of Employment |
|
is blocked by
|
Identity Proofing (Identity Verification) |
|
is blocked by
|
In-Person or Trusted Third-Party Registration |
|
is blocked by
|
Identity Evidence |
|
is blocked by
|
Identity Evidence Validation & Verification |
|
is blocked by
|
In-Person Validation & Verification |
|
is blocked by
|
Address Confirmation |
|
is blocked by
|
Role-Based Access Control (RBAC) |
|
is blocked by
|
Attribute-Based Access Control (ABAC) |
|
is blocked by
|
Real-Time Access Decisions |
|
is blocked by
|
Access Profile Rules |
|
is blocked by
|
Automated System Account Management (Directory Services) |
|
is blocked by
|
User & Service Account Inventories |
|
is blocked by
|
Disable Inactive Accounts |
|
is blocked by
|
Automated Audit Actions |
|
is blocked by
|
Privileged Account Inventories |
|
is blocked by
|
Removal of Temporary / Emergency Accounts |
|
is blocked by
|
Periodic Review of Individual & Service Account Privileges |
|
is blocked by
|
System Account Reviews |
|
is blocked by
|
User Identity (ID) Management |
|
is blocked by
|
Standardized Identifier Management (User Names) |
|
is blocked by
|
Employment Status Identification |
|
is blocked by
|
Citizenship Identification |
|
is blocked by
|
Dynamic Management |
|
is blocked by
|
Cross-Organization Management |
|
is blocked by
|
Privileged Account Identifiers |
|
is blocked by
|
Automated Support For Password Strength |
|
is blocked by
|
Biometric Authentication |
|
is blocked by
|
PKI-Based Authentication |
|
is blocked by
|
Group Authentication |
|
is blocked by
|
Access Enforcement |
|
is blocked by
|
Access To Sensitive / Regulated Data |
|
is blocked by
|
Database Access |
|
is blocked by
|
Revocation of Access Authorizations |
|
is blocked by
|
Least Privilege |
|
is blocked by
|
Identification & Authentication for Organizational Users |
|
is blocked by
|
Identification & Authentication for Non-Organizational Users |
|
is blocked by
|
Sharing Identification & Authentication Information |
|
is blocked by
|
Continuous Authentication |
|
is blocked by
|
Onboarding, Transferring & Offboarding Personnel |
|
is blocked by
|
Post-Employment Requirements Awareness |
|
is blocked by
|
Post-Employment Requirements Notification |
|
is blocked by
|
Probationary Periods |
|
is blocked by
|
Workplace Investigations |
|
is blocked by
|
Personnel Transfer |
|
is blocked by
|
Automated Employment Status Notifications |
|
is blocked by
|
Asset Collection |
|
is blocked by
|
Identify Critical Skills & Gaps |
|
is blocked by
|
Identity & Access Management (IAM) |
|
is blocked by
|
Authenticate, Authorize and Audit (AAA) |
|
is blocked by
|
Retain Access Records |
|
is blocked by
|
Identity Providers (IdP) & Authorization Servers |
|
is blocked by
|
User Provisioning & De-Provisioning |
|
is blocked by
|
Change of Roles & Duties |
|
is blocked by
|
Termination of Employment |
|
is blocked by
|
Identity Proofing (Identity Verification) |
|
is blocked by
|
In-Person or Trusted Third-Party Registration |
|
is blocked by
|
Identity Evidence |
|
is blocked by
|
Identity Evidence Validation & Verification |
|
is blocked by
|
In-Person Validation & Verification |
|
is blocked by
|
Address Confirmation |
|
is blocked by
|
Role-Based Access Control (RBAC) |
|
is blocked by
|
Attribute-Based Access Control (ABAC) |
|
is blocked by
|
Real-Time Access Decisions |
|
is blocked by
|
Access Profile Rules |
|
is blocked by
|
Automated System Account Management (Directory Services) |
|
is blocked by
|
User & Service Account Inventories |
|
is blocked by
|
Disable Inactive Accounts |
|
is blocked by
|
Automated Audit Actions |
|
is blocked by
|
Sensitive / Regulated Data Actions |
|
is blocked by
|
Compliance As Code (CAC) Identity Governance |
|
is blocked by
|
Incident Response Operations |
|
is blocked by
|
Continuous Incident Response Improvements |
|
is blocked by
|
Incident Classification & Prioritization |
|
is blocked by
|
Indicators of Compromise (IOC) |
|
is blocked by
|
Incident Handling |
|
is blocked by
|
Correlation with External Organizations |
|
is blocked by
|
Automated Incident Handling Processes |
|
is blocked by
|
Automated Reporting |
|
is blocked by
|
Automated Tracking, Data Collection & Analysis |
|
is blocked by
|
Dynamic Reconfiguration |
|
is blocked by
|
Automatic Disabling of Technology Assets, Applications and/or Services (TAAS) |
|
is blocked by
|
Chain of Custody & Forensics |
|
is blocked by
|
Licensed Forensic Investigators |
|
is blocked by
|
Root Cause Analysis (RCA) & Lessons Learned |
|
is blocked by
|
Incident Stakeholder Reporting |
|
is blocked by
|
Situational Awareness For Incidents |
|
is blocked by
|
Cyber Incident Reporting for Sensitive / Regulated Data |
|
is blocked by
|
Serious Incident Reporting |
|
is blocked by
|
Vulnerabilities Related To Incidents |
|
is blocked by
|
Incident Tracking Repository |
|
is blocked by
|
Incident Pattern Analysis |
|
is blocked by
|
Recurring Incident Analysis |
|
is blocked by
|
Automation Support of Availability of Information / Support |
|
is blocked by
|
Supply Chain Coordination |
|
is blocked by
|
Sensitive / Regulated Data Spill Response |
|
is blocked by
|
Sensitive / Regulated Data Spill Responsible Personnel |
|
is blocked by
|
Sensitive / Regulated Data Spill Training |
|
is blocked by
|
Sensitive / Regulated Data Exposure to Unauthorized Personnel |
|
is blocked by
|
Detonation Chambers (Sandboxes) |
|
is blocked by
|
Data Breach |
|
is blocked by
|
Artificial Intelligence (AI) & Autonomous Technologies (AAT) Incidents |
|
is blocked by
|
Post-Incident Technology Assets, Applications and Services (TAAS) Validation |
|
is blocked by
|
Information Assurance (IA) Operations |
|
is blocked by
|
Assessment Boundaries |
|
is blocked by
|
Control Validation Testing (CVT) |
|
is blocked by
|
Specialized Assessments |
|
is blocked by
|
Third-Party Assessment Reciprocity |
|
is blocked by
|
Adequate Security for Sensitive / Regulated Data In Support of Contracts |
|
is blocked by
|
Applied Security, Compliance and Resilience Controls Documentation |
|
is blocked by
|
Threat Analysis & Flaw Remediation During Development |
|
is blocked by
|
Technical Verification |
|
is blocked by
|
Capabilities Deficiency Tracking |
|
is blocked by
|
Deficiency Tracking Automation |
|
is blocked by
|
Security Assessment Report (SAR) |
|
is blocked by
|
Security Authorization |
|
is blocked by
|
Control Assurance Automation (CAA) Automation |
|
is blocked by
|
Predictive Maintenance |
|
is blocked by
|
Maintenance Monitoring |
|
is blocked by
|
Automated Maintenance Activities |
|
is blocked by
|
Automated Support For Predictive Maintenance |
|
is blocked by
|
Inspect Media |
|
is blocked by
|
Auditing Remote Maintenance |
|
is blocked by
|
Authorized Maintenance Personnel |
|
is blocked by
|
Centralized Management Of Mobile Devices |
|
is blocked by
|
Restricting Access To Authorized Technology Assets, Applications and/or Services (TAAS) |
|
is blocked by
|
Remote Purging |
|
is blocked by
|
Boundary Protection |
|
is blocked by
|
Prevent Unauthorized Exfiltration |
|
is blocked by
|
Domain Name Verification |
|
is blocked by
|
Internet Address Denylisting |
|
is blocked by
|
Certificate Denylisting |
|
is blocked by
|
Network Processing Rules For Personal Data (PD) |
|
is blocked by
|
Human Reviews |
|
is blocked by
|
Interconnection Security Agreements (ISAs) |
|
is blocked by
|
Internal System Connections |
|
is blocked by
|
Sensitive / Regulated Data Actions |
|
is blocked by
|
Compliance As Code (CAC) Identity Governance |
|
is blocked by
|
Incident Response Operations |
|
is blocked by
|
Continuous Incident Response Improvements |
|
is blocked by
|
Incident Classification & Prioritization |
|
is blocked by
|
Indicators of Compromise (IOC) |
|
is blocked by
|
Incident Handling |
|
is blocked by
|
Correlation with External Organizations |
|
is blocked by
|
Automated Incident Handling Processes |
|
is blocked by
|
Automated Reporting |
|
is blocked by
|
Automated Tracking, Data Collection & Analysis |
|
is blocked by
|
Dynamic Reconfiguration |
|
is blocked by
|
Automatic Disabling of Technology Assets, Applications and/or Services (TAAS) |
|
is blocked by
|
Chain of Custody & Forensics |
|
is blocked by
|
Licensed Forensic Investigators |
|
is blocked by
|
Root Cause Analysis (RCA) & Lessons Learned |
|
is blocked by
|
Incident Stakeholder Reporting |
|
is blocked by
|
Situational Awareness For Incidents |
|
is blocked by
|
Cyber Incident Reporting for Sensitive / Regulated Data |
|
is blocked by
|
Serious Incident Reporting |
|
is blocked by
|
Vulnerabilities Related To Incidents |
|
is blocked by
|
Incident Tracking Repository |
|
is blocked by
|
Incident Pattern Analysis |
|
is blocked by
|
Recurring Incident Analysis |
|
is blocked by
|
Automation Support of Availability of Information / Support |
|
is blocked by
|
Supply Chain Coordination |
|
is blocked by
|
Sensitive / Regulated Data Spill Response |
|
is blocked by
|
Sensitive / Regulated Data Spill Responsible Personnel |
|
is blocked by
|
Sensitive / Regulated Data Spill Training |
|
is blocked by
|
Sensitive / Regulated Data Exposure to Unauthorized Personnel |
|
is blocked by
|
Detonation Chambers (Sandboxes) |
|
is blocked by
|
Data Breach |
|
is blocked by
|
Artificial Intelligence (AI) & Autonomous Technologies (AAT) Incidents |
|
is blocked by
|
Post-Incident Technology Assets, Applications and Services (TAAS) Validation |
|
is blocked by
|
Information Assurance (IA) Operations |
|
is blocked by
|
Assessment Boundaries |
|
is blocked by
|
Control Validation Testing (CVT) |
|
is blocked by
|
Microsegmentation |
|
is blocked by
|
Software Defined Networking (SDN) |
|
is blocked by
|
Domain Name Service (DNS) Resolution |
|
is blocked by
|
Secure Name / Address Resolution Service (Recursive or Caching Resolver) |
|
is blocked by
|
Zero Trust Architecture (ZTA) |
|
is blocked by
|
Policy Decision Point (PDP) |
|
is blocked by
|
Network Access Control (NAC) |
|
is blocked by
|
DNS & Content Filtering |
|
is blocked by
|
Authenticated Proxy |
|
is blocked by
|
Visibility of Encrypted Communications |
|
is blocked by
|
Content Check for Encrypted Data |
|
is blocked by
|
Wireless Networking |
|
is blocked by
|
Rogue Wireless Detection |
|
is blocked by
|
Remote Access Endpoint Security Validation |
|
is blocked by
|
Remote Access Monitoring & Control |
|
is blocked by
|
Network Intrusion Detection / Prevention Systems (NIDS / NIPS) |
|
is blocked by
|
Wireless Intrusion Detection / Prevention Systems (WIDS / WIPS) Deployment |
|
is blocked by
|
Web Application Firewall (WAF) |
|
is blocked by
|
Wireless Link Protection |
|
is blocked by
|
Email Domain Reputation Protections |
|
is blocked by
|
Sender Denylisting |
|
is blocked by
|
End-User Messaging Technologies |
|
is blocked by
|
Phishing & Spam Protection |
|
is blocked by
|
Email Content Protections |
|
is blocked by
|
Adaptive Email Protections |
|
is blocked by
|
Email Labeling |
|
is blocked by
|
User Threat Reporting |
|
is blocked by
|
Cross Domain Solution (CDS) |
|
is blocked by
|
Cross Domain Authentication |
|
is blocked by
|
Data Type Identifiers |
|
is blocked by
|
Decomposition Into Policy-Related Subcomponents |
|
is blocked by
|
Detection of Unsanctioned Information |
|
is blocked by
|
Cross Domain Content Transfer |
|
is blocked by
|
Host Containment |
|
is blocked by
|
Resource Containment |
|
is blocked by
|
Object Security Attributes |
|
is blocked by
|
Embedded Data Types |
|
is blocked by
|
Metadata |
|
is blocked by
|
Metadata Validation |
|
is blocked by
|
Physical Security Plan (PSP) |
|
is blocked by
|
Physical Access Authorizations |
|
is blocked by
|
Role-Based Physical Access |
|
is blocked by
|
Physical Access Device Inventories |
|
is blocked by
|
Controlled Ingress & Egress Points |
|
is blocked by
|
Physical Access Logs |
|
is blocked by
|
Physical Security of Offices, Rooms & Facilities |
|
is blocked by
|
Working in Secure Areas |
|
is blocked by
|
On-Site Client Segregation |
|
is blocked by
|
Access To Critical Systems |
|
is blocked by
|
Monitoring Physical Access |
|
is blocked by
|
Intrusion Alarms / Surveillance Equipment |
|
is blocked by
|
Monitoring Physical Access To Critical Systems |
|
is blocked by
|
Visitor Control |
|
is blocked by
|
Automated Records Management & Review |
|
is blocked by
|
Minimize Visitor Personal Data (PD) |
|
is blocked by
|
Component Marking |
|
is blocked by
|
Asset Monitoring and Tracking |
|
is blocked by
|
Automation Support for Water Damage Protection |
|
is blocked by
|
Fire Detection Devices |
|
is blocked by
|
Microsegmentation |
|
is blocked by
|
Software Defined Networking (SDN) |
|
is blocked by
|
Domain Name Service (DNS) Resolution |
|
is blocked by
|
Secure Name / Address Resolution Service (Recursive or Caching Resolver) |
|
is blocked by
|
Zero Trust Architecture (ZTA) |
|
is blocked by
|
Policy Decision Point (PDP) |
|
is blocked by
|
Network Access Control (NAC) |
|
is blocked by
|
DNS & Content Filtering |
|
is blocked by
|
Authenticated Proxy |
|
is blocked by
|
Visibility of Encrypted Communications |
|
is blocked by
|
Content Check for Encrypted Data |
|
is blocked by
|
Wireless Networking |
|
is blocked by
|
Rogue Wireless Detection |
|
is blocked by
|
Remote Access Endpoint Security Validation |
|
is blocked by
|
Remote Access Monitoring & Control |
|
is blocked by
|
Network Intrusion Detection / Prevention Systems (NIDS / NIPS) |
|
is blocked by
|
Wireless Intrusion Detection / Prevention Systems (WIDS / WIPS) Deployment |
|
is blocked by
|
Web Application Firewall (WAF) |
|
is blocked by
|
Wireless Link Protection |
|
is blocked by
|
Email Domain Reputation Protections |
|
is blocked by
|
Sender Denylisting |
|
is blocked by
|
End-User Messaging Technologies |
|
is blocked by
|
Temperature & Humidity Controls Monitoring |
|
is blocked by
|
Temperature & Humidity Controls Alerting |
|
is blocked by
|
Data Privacy Program |
|
is blocked by
|
Privacy-Aware Design |
|
is blocked by
|
Documenting Data Processing Activities |
|
is blocked by
|
Personal Data (PD) Lineage |
|
is blocked by
|
Personal Data (PD) Categories |
|
is blocked by
|
Inventory of Personal Data (PD) |
|
is blocked by
|
Personal Data (PD) Inventory Automation Support |
|
is blocked by
|
Updating Personal Data (PD) Process |
|
is blocked by
|
Updating & Correcting Personal Data (PD) |
|
is blocked by
|
Flaw Remediation with Personal Data (PD) |
|
is blocked by
|
Reasonable Data Privacy Practices |
|
is blocked by
|
Security of Personal Data (PD) |
|
is blocked by
|
Personal Data (PD) Control Testing, Training & Monitoring |
|
is blocked by
|
Authority To Collect, Process, Store & Share Personal Data (PD) |
|
is blocked by
|
Product or Service Delivery Restrictions |
|
is blocked by
|
Data Privacy Requirements for Contractors & Service Providers |
|
is blocked by
|
Binding Corporate Rules (BCR) |
|
is blocked by
|
Information Sharing With Third Parties |
|
is blocked by
|
Limiting Personal Data (PD) Disclosures |
|
is blocked by
|
Accounting of Disclosures |
|
is blocked by
|
Disclosure Request Rejections |
|
is blocked by
|
Justification To Reject Disclosure Requests |
|
is blocked by
|
Financial Incentives For Personal Data (PD) |
|
is blocked by
|
Notice of Financial Incentive |
|
is blocked by
|
Dissemination of Data Privacy Program Information |
|
is blocked by
|
Privacy Act Statements |
|
is blocked by
|
Privacy Act Exemptions |
|
is blocked by
|
System of Records Notice (SORN) |
|
is blocked by
|
System of Records Notice (SORN) Review Process |
|
is blocked by
|
Data Privacy Notice |
|
is blocked by
|
Notice of Right To Limit |
|
is blocked by
|
Real-Time or Layered Notice |
|
is blocked by
|
Purpose Specification |
|
is blocked by
|
Purpose Compatibility |
|
is blocked by
|
Data Subject Consent |
|
is blocked by
|
Active Participation For Consent By Data Subjects |
|
is blocked by
|
Tailored Consent |
|
is blocked by
|
Revoke Consent |
|
is blocked by
|
Just-In-Time Notice & Updated Consent |
|
is blocked by
|
Prohibition of Selling, Processing and/or Sharing Personal Data (PD) |
|
is blocked by
|
Global Privacy Control (GPC) |
|
is blocked by
|
Data Subject Opt-In Consent |
|
is blocked by
|
Parent or Guardian Opt-In Consent For Minors |
|
is blocked by
|
Usage Restrictions of Personal Data (PD) |
|
is blocked by
|
Continued Use of Personal Data (PD) |
|
is blocked by
|
Cease Processing, Storing and/or Sharing Personal Data (PD) |
|
is blocked by
|
Internal Use of Personal Data (PD) For Testing, Training and Research |
|
is blocked by
|
Personal Data (PD) Retention & Disposal |
|
is blocked by
|
Personal Data (PD) Formats |
|
is blocked by
|
Temporary Files Containing Personal Data (PD) |
|
is blocked by
|
Personal Data (PD) Collection Methods |
|
is blocked by
|
Restrict Collection, Processing & Sharing To Identified Purpose |
|
is blocked by
|
Primary Source Collection For Personal Data (PD) |
|
is blocked by
|
Identifiable Image Collection |
|
is blocked by
|
Acquired Personal Data (PD) |
|
is blocked by
|
Data Brokers |
|
is blocked by
|
Personal Data (PD) Accuracy & Integrity |
|
is blocked by
|
Validate Collected Personal Data (PD) |
|
is blocked by
|
Re-Validate Collected Personal Data (PD) |
|
is blocked by
|
Automated Decision-Making Technology (ADMT) |
|
is blocked by
|
Automated Decision-Making Technology (ADMT) For Data Subject Actions |
|
is blocked by
|
Automated Decision-Making Technology (ADMT) Use Notification |
|
is blocked by
|
Automated Decision-Making Technology (ADMT) Opt-Out Consent |
|
is blocked by
|
Automated Decision-Making Technology (ADMT) Transparency |
|
is blocked by
|
Communicating Processing Changes |
|
is blocked by
|
Data Subject Communications Documentation |
|
is blocked by
|
Data Subject Communications Metrics |
|
is blocked by
|
Data Subject Communications Disclosure |
|
is blocked by
|
Data Subject Authentication |
|
is blocked by
|
Data Subject Rights Management |
|
is blocked by
|
Data Subject Empowerment |
|
is blocked by
|
Enabling Data Subjects To Update Personal Data (PD) |
|
is blocked by
|
Correcting Inaccurate Personal Data (PD) |
|
is blocked by
|
Notice of Correction or Processing Change |
|
is blocked by
|
Right to Erasure |
|
is blocked by
|
Data Portability |
|
is blocked by
|
Obligation To Inform Third-Parties |
|
is blocked by
|
Register As A Data Controller and/or Data Processor |
|
is blocked by
|
Purpose Validation |
|
is blocked by
|
Prioritization To Address Evolving Risks & Threats |
|
is blocked by
|
Security, Compliance & Resilience In Project Management |
|
is blocked by
|
Data Shelf-Life Classification for Post-Quantum Cryptography (PQC) Prioritization |
|
is blocked by
|
Long-Lived Data Identification |
|
is blocked by
|
Cryptographic Agility Risk Assessment (CARA) |
|
is blocked by
|
Crypto Agility Maturity Assessment |
|
is blocked by
|
Post-Quantum Cryptography (PQC) Migration Progress Oversight |
|
is blocked by
|
Post-Quantum Cryptography (PQC) Discovery & Visibility |
|
is blocked by
|
Post-Quantum Cryptography (PQC) Asset Inventory |
|
is blocked by
|
Post-Quantum Cryptography Exposure |
|
is blocked by
|
Quantum Threat Intelligence Monitoring |
|
is blocked by
|
Collaboration & Information Sharing |
|
is blocked by
|
Deprecated Cryptographic Algorithms |
|
is blocked by
|
Temperature & Humidity Controls Monitoring |
|
is blocked by
|
Temperature & Humidity Controls Alerting |
|
is blocked by
|
Data Privacy Program |
|
is blocked by
|
Privacy-Aware Design |
|
is blocked by
|
Documenting Data Processing Activities |
|
is blocked by
|
Personal Data (PD) Lineage |
|
is blocked by
|
Personal Data (PD) Categories |
|
is blocked by
|
Inventory of Personal Data (PD) |
|
is blocked by
|
Personal Data (PD) Inventory Automation Support |
|
is blocked by
|
Updating Personal Data (PD) Process |
|
is blocked by
|
Updating & Correcting Personal Data (PD) |
|
is blocked by
|
Flaw Remediation with Personal Data (PD) |
|
is blocked by
|
Reasonable Data Privacy Practices |
|
is blocked by
|
Security of Personal Data (PD) |
|
is blocked by
|
Personal Data (PD) Control Testing, Training & Monitoring |
|
is blocked by
|
Authority To Collect, Process, Store & Share Personal Data (PD) |
|
is blocked by
|
Product or Service Delivery Restrictions |
|
is blocked by
|
Data Privacy Requirements for Contractors & Service Providers |
|
is blocked by
|
Binding Corporate Rules (BCR) |
|
is blocked by
|
Information Sharing With Third Parties |
|
is blocked by
|
Limiting Personal Data (PD) Disclosures |
|
is blocked by
|
Accounting of Disclosures |
|
is blocked by
|
Disclosure Request Rejections |
|
is blocked by
|
Justification To Reject Disclosure Requests |
|
is blocked by
|
Financial Incentives For Personal Data (PD) |
|
is blocked by
|
Notice of Financial Incentive |
|
is blocked by
|
Dissemination of Data Privacy Program Information |
|
is blocked by
|
Privacy Act Statements |
|
is blocked by
|
Privacy Act Exemptions |
|
is blocked by
|
System of Records Notice (SORN) |
|
is blocked by
|
System of Records Notice (SORN) Review Process |
|
is blocked by
|
Data Privacy Notice |
|
is blocked by
|
Notice of Right To Limit |
|
is blocked by
|
Real-Time or Layered Notice |
|
is blocked by
|
Purpose Specification |
|
is blocked by
|
Purpose Compatibility |
|
is blocked by
|
Data Subject Consent |
|
is blocked by
|
Active Participation For Consent By Data Subjects |
|
is blocked by
|
Tailored Consent |
|
is blocked by
|
Revoke Consent |
|
is blocked by
|
Just-In-Time Notice & Updated Consent |
|
is blocked by
|
Risk Management Program |
|
is blocked by
|
Risk Framing |
|
is blocked by
|
Risk-Based Security Categorization |
|
is blocked by
|
Impact-Level Prioritization |
|
is blocked by
|
Business Impact Analysis (BIA) |
|
is blocked by
|
Risk Identification |
|
is blocked by
|
Risk Catalog |
|
is blocked by
|
Risk Owner |
|
is blocked by
|
Risk Assessment Methodology |
|
is blocked by
|
Risk Assessment |
|
is blocked by
|
Instances Requiring A Risk Assessment |
|
is blocked by
|
Risk Assessment Update |
|
is blocked by
|
Risk Assessment Stakeholder Involvement |
|
is blocked by
|
Risk Register |
|
is blocked by
|
Risk Ranking |
|
is blocked by
|
Risk Response |
|
is blocked by
|
Risk Treatment Options |
|
is blocked by
|
Risk Remediation |
|
is blocked by
|
Risk Treatment Plan (RTP) |
|
is blocked by
|
Documented Alternatives |
|
is blocked by
|
Compensating Countermeasures |
|
is blocked by
|
Data Protection Impact Assessment (DPIA) |
|
is blocked by
|
Supply Chain Risk Management (SCRM) Plan |
|
is blocked by
|
AI & Autonomous Technologies Supply Chain Impacts |
|
is blocked by
|
Supply Chain Risk Assessment (SCRA) |
|
is blocked by
|
Risk Monitoring |
|
is blocked by
|
Non-Persistent Information |
|
is blocked by
|
Information Output Filtering |
|
is blocked by
|
Honeyclients |
|
is blocked by
|
Virtual Machine Images |
|
is blocked by
|
Previous Logon Notification |
|
is blocked by
|
Clock Synchronization |
|
is blocked by
|
Database Administrative Processes |
|
is blocked by
|
Secure Practices Guidelines |
|
is blocked by
|
Security Operations Center (SOC) |
|
is blocked by
|
Security Orchestration, Automation, and Response (SOAR) |
|
is blocked by
|
Shadow Information Technology Detection |
|
is blocked by
|
Maintaining Workforce Development Relevancy |
|
is blocked by
|
Simulated Cyber Attack Scenario Training |
|
is blocked by
|
Sensitive / Regulated Data Storage, Handling & Processing |
|
is blocked by
|
Cyber Threat Environment Situational Awareness |
|
is blocked by
|
Social Engineering & Mining |
|
is blocked by
|
Suspicious Communications & Anomalous System Behavior |
|
is blocked by
|
Counterintelligence Training |
|
is blocked by
|
Anti-Counterfeit Training |
|
is blocked by
|
Security, Compliance & Resilience Training Records |
|
is blocked by
|
Training Feedback |
|
is blocked by
|
Software Assurance Maturity Model (SAMM) |
|
is blocked by
|
Criticality Analysis During Development |
|
is blocked by
|
Threat Modeling |
|
is blocked by
|
Supporting Toolchain |
|
is blocked by
|
Software Design Review |
|
is blocked by
|
Software Design Root Cause Analysis (RCA) |
|
is blocked by
|
Integrity Mechanisms for Software / Firmware Updates |
|
is blocked by
|
Software Release Integrity Verification |
|
is blocked by
|
Technical Documentation Artifacts |
|
is blocked by
|
Product-Specific Risk Assessment Artifacts |
|
is blocked by
|
Functional Properties |
|
is blocked by
|
Administrator Documentation |
|
is blocked by
|
Identification & Justification of Ports, Protocols & Services |
|
is blocked by
|
Products With Digital Elements |
|
is blocked by
|
Product Tampering and Counterfeiting (PTC) |
|
is blocked by
|
Minimum Viable Product (MVP) Security Requirements |
|
is blocked by
|
Logging Syntax |
|
is blocked by
|
Diagnostic & Test Interface Monitoring |
|
is blocked by
|
Input Data Validation |
|
is blocked by
|
Error Handling |
|
is blocked by
|
Risk Management Program |
|
is blocked by
|
Risk Framing |
|
is blocked by
|
Risk-Based Security Categorization |
|
is blocked by
|
Impact-Level Prioritization |
|
is blocked by
|
Business Impact Analysis (BIA) |
|
is blocked by
|
Risk Identification |
|
is blocked by
|
Risk Catalog |
|
is blocked by
|
Risk Owner |
|
is blocked by
|
Risk Assessment Methodology |
|
is blocked by
|
Risk Assessment |
|
is blocked by
|
Instances Requiring A Risk Assessment |
|
is blocked by
|
Risk Assessment Update |
|
is blocked by
|
Risk Assessment Stakeholder Involvement |
|
is blocked by
|
Risk Register |
|
is blocked by
|
Risk Ranking |
|
is blocked by
|
Risk Response |
|
is blocked by
|
Risk Treatment Options |
|
is blocked by
|
Risk Remediation |
|
is blocked by
|
Risk Treatment Plan (RTP) |
|
is blocked by
|
Documented Alternatives |
|
is blocked by
|
Compensating Countermeasures |
|
is blocked by
|
Data Protection Impact Assessment (DPIA) |
|
is blocked by
|
Supply Chain Risk Management (SCRM) Plan |
|
is blocked by
|
AI & Autonomous Technologies Supply Chain Impacts |
|
is blocked by
|
Supply Chain Risk Assessment (SCRA) |
|
is blocked by
|
Risk Monitoring |
|
is blocked by
|
Non-Persistent Information |
|
is blocked by
|
Information Output Filtering |
|
is blocked by
|
Malware Testing Prior to Release |
|
is blocked by
|
Product Testing & Reviews |
|
is blocked by
|
Archiving Software Releases |
|
is blocked by
|
Software Escrow |
|
is blocked by
|
Static Code Analysis |
|
is blocked by
|
Dynamic Code Analysis |
|
is blocked by
|
Malformed Input Testing |
|
is blocked by
|
Test Data Integrity |
|
is blocked by
|
Developer Knowledge & Skills Register |
|
is blocked by
|
Developer Configuration Management |
|
is blocked by
|
Developer Threat Analysis & Flaw Remediation |
|
is blocked by
|
Bills of Material (BOMs) |
|
is blocked by
|
Cryptographic Bill of Materials (CBOM) |
|
is blocked by
|
Hardware Bill of Materials (HBOM) |
|
is blocked by
|
Indentured Bill of Materials (IBOM) |
|
is blocked by
|
Software Bill of Materials (SBOM) |
|
is blocked by
|
Third-Party Management Policy |
|
is blocked by
|
Third-Party Management |
|
is blocked by
|
Acquisition Strategies, Tools & Methods |
|
is blocked by
|
Supply Chain Risk Management (SCRM) |
|
is blocked by
|
Processes To Address Weaknesses or Deficiencies |
|
is blocked by
|
Limit Potential Harm |
|
is blocked by
|
Security, Compliance & Resilience Outsourcing Limitations |
|
is blocked by
|
Outsourcing Non-Essential Functions or Services |
|
is blocked by
|
Adequate Supply |
|
is blocked by
|
Third-Party Inventories |
|
is blocked by
|
Third-Party Criticality Assessments |
|
is blocked by
|
Third-Party Risk Assessments & Approvals |
|
is blocked by
|
Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix |
|
is blocked by
|
External Connectivity Requirements - Identification of Ports, Protocols & Services |
|
is blocked by
|
Third-Party Personnel Security |
|
is blocked by
|
Review of Third-Party Services |
|
is blocked by
|
Third-Party Scope Review |
|
is blocked by
|
Managing Changes To Third-Party Services |
|
is blocked by
|
Third-Party Deficiency Remediation |
|
is blocked by
|
Foreign Ownership, Control or Influence (FOCI) |
|
is blocked by
|
Ownership Change Monitoring |
|
is blocked by
|
Ownership Change Provisions |
|
is blocked by
|
First-Party Declaration (1PD) |
|
is blocked by
|
Third-Party Attestation (3PA) |
|
is blocked by
|
Terminating Third-Party Relationships |
|
is blocked by
|
Third-Party Transition Planning |
|
is blocked by
|
Technology Assets, Applications, Services and Data (TAASD) Portability |
|
is blocked by
|
Technology Assets, Applications, Services and Data (TAASD) Disposition |
|
is blocked by
|
Third-Party Access Revocation |
|
is blocked by
|
Third-Party Knowledge & Operational Transfer |
|
is blocked by
|
Third-Party Exit Obligations Management |
|
is blocked by
|
Third-Party Exit Contingencies |
|
is blocked by
|
Threat Intelligence Program |
|
is blocked by
|
Dynamic Threat Awareness |
|
is blocked by
|
Threat Intelligence Feeds |
|
is blocked by
|
Threat Intelligence Reporting |
|
is blocked by
|
Threat Catalog |
|
is blocked by
|
Material Threats |
|
is blocked by
|
Threat Analysis |
|
is blocked by
|
Behavioral Baselining |
|
is blocked by
|
Predictive Cyber Analytics |
|
is blocked by
|
Indicators of Exposure (IOE) |
|
is blocked by
|
Vulnerability Disclosure Program (VDP) |
|
is blocked by
|
Security Disclosure Contact Information |
|
is blocked by
|
Threat Hunting |
|
is blocked by
|
Tainting |
|
is blocked by
|
Insider Threat Program |
|
is blocked by
|
Vulnerability & Patch Management Program (VPMP) |
|
is blocked by
|
Attack Surface Scope |
|
is blocked by
|
Vulnerability Exploitation Analysis |
|
is blocked by
|
Vulnerability Ranking |
|
is blocked by
|
Vulnerability Remediation Process |
|
is blocked by
|
Centralized Management of Flaw Remediation Processes |
|
is blocked by
|
Continuous Vulnerability Remediation Activities |
|
is blocked by
|
Known Exploited Vulnerabilities (KEV) Mitigations |
|
is blocked by
|
Time To Remediate / Benchmarks For Corrective Action |
|
is blocked by
|
Software & Firmware Patching |
|
is blocked by
|
Automated Software & Firmware Updates |
|
is blocked by
|
Software Patch Integrity |
|
is blocked by
|
Automated Remediation Status |
|
is blocked by
|
Deferred Patching Decisions |
|
is blocked by
|
Pre-Deployment Patch Testing |
|
is blocked by
|
Vulnerability Scanning |
|
is blocked by
|
Update Vulnerability Scanning Tools |
|
is blocked by
|
Breadth / Depth of Coverage For Vulnerability Scanning |
|
is blocked by
|
Reviewing Vulnerability Scanner Usage |
|
is blocked by
|
Vulnerability Trend Analysis |
|
is blocked by
|
Review Historical Event logs |
|
is blocked by
|
External Vulnerability Assessment |
|
is blocked by
|
Internal Vulnerability Assessment |
|
is blocked by
|
Acceptable Discoverable Information |
|
is blocked by
|
Correlate Scanning Information |
|
is blocked by
|
Web Application Input Validation & Sanitization |
|
is blocked by
|
Website Change Detection |
|
is blocked by
|
Publicly Accessible Content Reviews |
|
is blocked by
|
Malware Testing Prior to Release |
|
is blocked by
|
Product Testing & Reviews |
|
is blocked by
|
Archiving Software Releases |
|
is blocked by
|
Software Escrow |
|
is blocked by
|
Static Code Analysis |
|
is blocked by
|
Dynamic Code Analysis |
|
is blocked by
|
Malformed Input Testing |
|
is blocked by
|
Test Data Integrity |
|
is blocked by
|
Developer Knowledge & Skills Register |
|
is blocked by
|
Developer Configuration Management |
|
is blocked by
|
Developer Threat Analysis & Flaw Remediation |
|
is blocked by
|
Bills of Material (BOMs) |
|
is blocked by
|
Cryptographic Bill of Materials (CBOM) |
|
is blocked by
|
Hardware Bill of Materials (HBOM) |
|
is blocked by
|
Indentured Bill of Materials (IBOM) |
|
is blocked by
|
Software Bill of Materials (SBOM) |
|
is blocked by
|
Third-Party Management Policy |
|
is blocked by
|
Third-Party Management |
|
is blocked by
|
Acquisition Strategies, Tools & Methods |
|
is blocked by
|
Supply Chain Risk Management (SCRM) |
|
is blocked by
|
Processes To Address Weaknesses or Deficiencies |
|
is blocked by
|
Limit Potential Harm |
|
is blocked by
|
Security, Compliance & Resilience Outsourcing Limitations |
|
is blocked by
|
Outsourcing Non-Essential Functions or Services |
|
is blocked by
|
Adequate Supply |
|
is blocked by
|
Third-Party Inventories |
|
is blocked by
|
Third-Party Criticality Assessments |
|
is blocked by
|
Third-Party Risk Assessments & Approvals |
|
is blocked by
|
Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix |
|
is blocked by
|
External Connectivity Requirements - Identification of Ports, Protocols & Services |
|
is blocked by
|
Third-Party Personnel Security |
|
is blocked by
|
Malware Testing Prior to Release |
|
is blocked by
|
Product Testing & Reviews |
|
is blocked by
|
Archiving Software Releases |
|
is blocked by
|
Software Escrow |
|
is blocked by
|
Static Code Analysis |
|
is blocked by
|
Dynamic Code Analysis |
|
is blocked by
|
Malformed Input Testing |
|
is blocked by
|
Test Data Integrity |
|
is blocked by
|
Developer Knowledge & Skills Register |
|
is blocked by
|
Developer Configuration Management |
|
is blocked by
|
Developer Threat Analysis & Flaw Remediation |
|
is blocked by
|
Bills of Material (BOMs) |
|
is blocked by
|
Cryptographic Bill of Materials (CBOM) |
|
is blocked by
|
Hardware Bill of Materials (HBOM) |
|
is blocked by
|
Indentured Bill of Materials (IBOM) |
|
is blocked by
|
Software Bill of Materials (SBOM) |
|
is blocked by
|
Third-Party Management Policy |
|
is blocked by
|
Third-Party Management |
|
is blocked by
|
Acquisition Strategies, Tools & Methods |
|
is blocked by
|
Supply Chain Risk Management (SCRM) |
|
is blocked by
|
Processes To Address Weaknesses or Deficiencies |
|
is blocked by
|
Limit Potential Harm |
|
is blocked by
|
Security, Compliance & Resilience Outsourcing Limitations |
|
is blocked by
|
Outsourcing Non-Essential Functions or Services |
|
is blocked by
|
Adequate Supply |
|
is blocked by
|
Third-Party Inventories |
|
is blocked by
|
Third-Party Criticality Assessments |
|
is blocked by
|
Third-Party Risk Assessments & Approvals |
|
is blocked by
|
Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix |
|
is blocked by
|
External Connectivity Requirements - Identification of Ports, Protocols & Services |
|
is blocked by
|
Third-Party Personnel Security |