relative Control Weighting = 10

Tichete legate

Legături
Tip de legătură Tichet
is related to Security, Compliance & Resilience Governance Policy
is related to Security, Compliance & Resilience Program (SCRP)
is related to Publishing Security, Compliance & Resilience Documentation
is related to Measures of Performance
is related to Forced Technology Transfer (FTT)
is related to Artificial Intelligence & Autonomous Technologies Policy
is related to Situational Awareness of AI & Autonomous Technologies In Use
is related to Artificial Intelligence and Autonomous Technologies (AAT) & AI Agent Categorization
is related to AI & Autonomous Technologies Risk Profiling
is related to AI & Autonomous Technologies Risk Mapping
is related to AI Threat Modeling & Risk Assessment
is related to Novel Risk Assessment Methods & Technologies
is related to AI & Autonomous Technologies Potential Costs Analysis
is related to Model & AI Agent Documentation
is related to Release Owner Gate (ROG) For AI-Augmented Content
is related to AI & Autonomous Technologies Output Filtering
is related to Data Source Identification
is related to AI & Autonomous Technologies Conformity
is related to Asset Management Policy
is related to Asset Governance
is related to Asset Inventories
is related to Asset Discovery
is related to Prohibited Technology Assets, Applications and/or Services (TAAS)
is related to Asset Scope Classification
is related to Business Continuity & Disaster Recovery Policy
is related to Contingency Plan Root Cause Analysis (RCA) & Lessons Learned
is related to Inability to Return to Primary Site
is related to Change Management Policy
is related to Cloud Security Policy
is related to Standardized Virtualization Formats
is related to Compliance Policy
is related to Statutory, Regulatory & Contractual Compliance
is related to Compliance Scope
is related to Non-Conformity Oversight
is related to Configuration Management Program
is related to Least Functionality
is related to Configure Technology Assets, Applications and/or Services (TAAS) for High-Risk Areas
is related to Continuous Monitoring Policy
is related to Continuous Monitoring
is related to Event Log & Security-Relevant Telemetry Monitoring
is related to Analyze and Prioritize Monitoring Requirements
is related to Alert Threshold Tuning
is related to Correlate Monitoring Information
is related to Event Log & Security-Relevant Telemetry Storage Capacity
is related to Anomalous Behavior
is related to Cryptographic Protections Policy
is related to Cryptographic Management
is related to Cryptographic Cipher Suites and Protocols Inventory
is related to Encrypting Data In Transit
is related to Public Key Infrastructure (PKI)
is related to Data Classification & Handling Policy
is related to Data Protection
is related to Data Catalog
is related to Limitations on Use & Distribution of Sensitive / Regulated Data
is related to Sensitive / Regulated Data Access Mapping
is related to Masking Displayed Sensitive / Regulated Data
is related to Storing Authentication Data
is related to Removable Media Security
is related to Publicly Accessible Content
is related to Ad-Hoc Transfers
is related to Transfer Authorizations
is related to Embedded Technology Policy
is related to Endpoint Security Policy
is related to Malicious Code Protection (Antimalware)
is related to Unified Endpoint Device Management (UEDM)
is related to Human Resources Security Policy
is related to Position Categorization
is related to Defined Roles & Responsibilities
is related to Personnel Screening
is related to Roles With Special Protection Measures
is related to Terms of Employment
is related to Rules of Behavior
is related to Personnel Sanctions
is related to Identification & Authentication Policy
is related to Attribute-Based Access Control (ABAC)
is related to Real-Time Access Decisions
is related to Access Profile Rules
is related to Privileged Account Management (PAM)
is related to Manual Override
is related to Password-Based Authentication
is related to Passkeys
is related to Biometric Authentication
is related to PKI-Based Authentication
is related to Hardware Token-Based Authentication
is related to Authenticator Feedback
is related to Restrictions on Shared Groups / Accounts
is related to Dual Authorization for Privileged Commands
is related to Incident Response Operations
is related to Information Assurance Policy
is related to Information Assurance (IA) Operations
is related to Control Validation Testing (CVT)
is related to Third-Party Assessment Reciprocity
is related to Maintenance Operations
is related to Mobile Device Management Policy
is related to Network Security Policy
is related to Boundary Protection
is related to Data Flow Enforcement – Access Control Lists (ACLs)
is related to Deny Traffic by Default & Allow Traffic by Exception
is related to Network Segmentation (macrosegmentation)
is related to Virtual Local Area Network (VLAN) Separation
is related to Domain Name Service (DNS) Resolution
is related to Zero Trust Architecture (ZTA)
is related to Visibility of Encrypted Communications
is related to Physical Security Plan (PSP)
is related to Zone-Based Physical Security
is related to Data Privacy Policy
is related to Personal Data (PD) Inventory Automation Support
is related to Information Sharing With Third Parties
is related to Security, Compliance & Resilience Protection Portfolio Management
is related to Secure Development Life Cycle (SDLC) Management
is related to Risk Management Policy
is related to Risk Culture
is related to Material Risks
is related to Risk Identification
is related to Secure Engineering & Architecture Policy
is related to Secure Architecture Principles
is related to Technology Development & Acquisition Policy
is related to Product Management
is related to Software Release Integrity Verification
is related to Technical Documentation Artifacts
is related to Security, Compliance & Resilience Testing Throughout Development
is related to Third-Party Management Policy
is related to Supply Chain Risk Management (SCRM)
is related to Security, Compliance & Resilience Outsourcing Limitations
is related to Vulnerability & Patch Management Program (VPMP)
is related to Vulnerability Ranking
is related to Web Application Framework
is related to Assigned Security, Compliance & Resilience Responsibilities
is related to State-Sponsored Espionage
is related to Artificial Intelligence (AI) & Autonomous Technologies Governance
is related to Trustworthy AI & Autonomous Technologies
is related to Adequate Protections For AI & Autonomous Technologies
is related to AI & Autonomous Technologies Risk Management Decisions
is related to AI & Autonomous Technologies Likelihood & Impact Risk Analysis
is related to AI & Autonomous Technologies Risk Response
is related to Responsibility To Supersede, Deactivate and/or Disengage AI & Autonomous Technologies
is related to AI & Autonomous Technologies Intellectual Property Infringement Protections
is related to Data Source Integrity
is related to AI & Autonomous Technologies Harm Prevention
is related to AI & Autonomous Technologies Human Subject Protections
is related to AI & Autonomous Technologies Knowledge Limits
is related to AI & Autonomous Technologies Development Practices
is related to Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)
is related to AI TEVV Trustworthiness Assessment
is related to AI TEVV Safety Demonstration
is related to AI TEVV Results Evaluation
is related to AI & Autonomous Technologies Viability Decisions
is related to AI & Autonomous Technologies Performance Changes
is related to Network Diagrams & Data Flow Diagrams (DFDs)
is related to Secure Disposal, Destruction or Re-Use of Equipment
is related to Use of Personal Devices
is related to Bring Your Own Device (BYOD) Usage
is related to Unsupported Technology Assets, Applications and/or Services (TAAS)
is related to Business Continuity Management System (BCMS)
is related to Data Backups
is related to Capacity & Performance Planning Policy
is related to Change Management Program
is related to Prohibition Of Changes
is related to Cloud Services
is related to Conformity Monitoring
is related to Executive Leadership Oversight of Security, Compliance & Resilience Controls
is related to Government Surveillance
is related to Potential Human Rights Abuses
is related to Configuration Management Policy
is related to Secure Baseline Configurations
is related to Centralized Collection of Event Logs & Security-Relevant Telemetry
is related to Content of Event Logs
is related to Audit Trails
is related to Time Stamps
is related to Protection of Event Logs & Security-Relevant Telemetry
is related to Event Log & Security-Relevant Telemetry Retention
is related to Use of Cryptographic Controls
is related to Integrity of Data In Transit
is related to Encrypting Data At Rest
is related to Cryptographic Key Management
is related to Data & Asset Classification
is related to Data Stewardship
is related to Disclosure of Sensitive / Regulated Data
is related to Digital & Non-Digital Media Disposal
is related to Digital Media Sanitization
is related to Protecting Sensitive / Regulated Data on External Technology Assets, Applications and/or Services (TAAS)
is related to Logical Data Location
is related to Geolocation Requirements for Processing, Storage and Service Locations
is related to Data Localization
is related to External Transfer of Sensitive / Regulated Data
is related to Embedded Technology Security Program
is related to Endpoint Device Management (EDM)
is related to Human Resources Security Management
is related to Users With Elevated Privileges
is related to Technology Use Restrictions
is related to Access Agreements
is related to Confidentiality Agreements
is related to Third-Party Personnel
is related to Identity & Access Management (IAM)
is related to User Provisioning & De-Provisioning
is related to Change of Roles & Duties
is related to Termination of Employment
is related to Identity Proofing (Identity Verification)
is related to Account Management
is related to User & Service Account Inventories
is related to Disable Inactive Accounts
is related to Account Disabling for High Risk Individuals
is related to Management Approval For New or Changed Accounts
is related to Management Approval For Privileged Accounts
is related to Privileged Account Inventories
is related to Periodic Review of Individual & Service Account Privileges
is related to System Account Reviews
is related to Authenticator Management
is related to Protection of Authenticators
is related to No Embedded Unencrypted Static Authenticators
is related to Default Authenticators
is related to User Responsibilities for Account Management
is related to Credential Sharing
is related to Access Enforcement
is related to Access To Sensitive / Regulated Data
is related to Database Access
is related to Least Privilege
is related to Incident Response Policy
is related to Incident Handling
is related to Artificial Intelligence (AI) & Autonomous Technologies (AAT) Incidents
is related to Threat Analysis & Flaw Remediation During Development
is related to Security Authorization
is related to Maintenance Policy
is related to Controlled Maintenance
is related to Centralized Management Of Mobile Devices
is related to Network Security Controls (NSC)
is related to Sensitive / Regulated Data Enclave (Secure Zone)
is related to Remote Access
is related to Work From Anywhere (WFA) - Telecommuting Security
is related to Electronic Messaging
is related to Phishing & Spam Protection
is related to Email Content Protections
is related to Physical & Environmental Security Policy
is related to Physical Access Control
is related to Physical Security of Offices, Rooms & Facilities
is related to Working in Secure Areas
is related to Restrict Unescorted Access
is related to Data Privacy Program
is related to Data Privacy Requirements for Contractors & Service Providers
is related to Project & Resource Management Policy
is related to Security, Compliance & Resilience In Project Management
is related to Risk Management Program
is related to Risk Assessment
is related to Risk Register
is related to Risk Remediation
is related to Supply Chain Risk Management (SCRM) Plan
is related to Secure Engineering Principles
is related to Defense-In-Depth (DiD) Architecture
is related to Security Operations Policy
is related to Security Awareness & Training Policy
is related to Technology Development & Acquisition
is related to Secure Software Development Practices (SSDP)
is related to Software Design Review
is related to Security, Compliance & Resilience Representatives For Product Changes
is related to Separation of Development, Testing and Operational Environments
is related to Third-Party Management
is related to Third-Party Services
is related to Third-Party Processing, Storage and Service Locations
is related to Third-Party Contract Requirements
is related to Third-Party Scope Review
is related to Threat Management Policy
is related to Vulnerability & Patch Management Policy
is related to Vulnerability Remediation Process
is related to Software & Firmware Patching
is related to Web Security Policy
is related to Client-Facing Web Services