+Boundary Protection
---+Limit Network Connections
---+External Telecommunications Services
---+Prevent Discovery of Internal Information
---+Direct Internet Access Restrictions
---+Prevent Unauthorized Exfiltration
---+Protocol Compliance Enforcement
---+Domain Name Verification
---+Bandwidth Control
---+Internet Address Denylisting
---+Certificate Denylisting
---+Content Disarm and Reconstruction (CDR)
---+Network Processing Rules For Personal Data (PD)
---+Split Tunneling

Boundary Protection

Description

Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Firewall as boundary protection device

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Business-grade firewall (e.g., Cisco Meraki, pfSense)
∙ DMZ for public-facing services

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ NGFW boundary protection
∙ DMZ architecture
∙ IDS/IPS at perimeter

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Enterprise NGFW with IPS
∙ DMZ design
∙ Network segmentation
∙ Perimeter monitoring

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise perimeter security
∙ NGFW, IPS, DMZ
∙ Zero-trust perimeter
∙ Continuous boundary monitoring

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.
▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.
▪ SBC enforce network activity monitoring and control communications at the external network boundary and at key internal boundaries within the network.

Level 3 Well Defined

Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.
▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.
▪ An implemented and operational capability exists to monitor and control communications at the external network boundary and at key internal boundaries within the network.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

1. Prezentare generală

Titlu	Standard
Limit Network Connections	Description Mechanisms exist to limit the number of concurrent external network connections to its Technology Assets, Applications and/or Services (TAAS). Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Firewall rules to limit inbound/outbound connections Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Firewall rules limiting connections to business need ∙ Deny-by-default policy Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal network connection policy ∙ Firewall rule review process ∙ Least-privilege network access Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise firewall management ∙ Automated firewall rule review ∙ Network access control (NAC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise firewall management platform (e.g., Tufin, FireMon) ∙ Zero-trust network access (ZTNA) ∙ Automated rule optimization SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to limit the number of concurrent external network connections to its Technology Assets, Applications and/or Services (TAAS). Level 4 Quantitatively Controlled Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
External Telecommunications Services	Description Mechanisms exist to maintain a managed interface for each external telecommunication service that protects the confidentiality and integrity of the information being transmitted across each interface. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Document external telecom services and provider contacts Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ External telecom service inventory ∙ SLA requirements in provider agreements Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Formal external telecom management policy ∙ Provider security requirements ∙ Redundant connections Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Telecommunications governance program ∙ Redundant ISP connections ∙ Provider SLA monitoring Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise telecom governance framework ∙ Redundant multi-provider architecture ∙ Automated failover ∙ Provider security assessments SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to maintain a managed interface for each external telecommunication service that protects the confidentiality and integrity of the information being transmitted across each interface. Level 4 Quantitatively Controlled Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Prevent Discovery of Internal Information	Description Mechanisms exist to prevent the public disclosure of internal network information. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Configure firewall to block external probing of internal network info Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Firewall rules preventing internal network enumeration ∙ Disable unnecessary banners Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Network hardening to prevent internal network discovery ∙ OSINT monitoring for leaked network info Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Network obfuscation controls ∙ Active response to network scanning ∙ Firewall rules blocking enumeration Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise network obfuscation and deception (e.g., deception technology) ∙ Automated blocking of reconnaissance ∙ Network information leakage monitoring SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to prevent the public disclosure of internal network information. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Direct Internet Access Restrictions	Description Mechanisms exist to prohibit, or strictly-control, Internet access from sensitive and/or regulated data enclaves (secure zones). Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) ∙ Access Control Lists (ACLs) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) ∙ Access Control Lists (ACLs) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) ∙ Access Control Lists (ACLs) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) ∙ Access Control Lists (ACLs) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) ∙ Access Control Lists (ACLs) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts). Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to prohibit, or strictly-control, Internet access from sensitive/regulated data enclaves (secure zones). Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Prevent Unauthorized Exfiltration	Description Automated mechanisms exist to prevent the unauthorized exfiltration of sensitive and/or regulated data across managed interfaces. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Basic firewall ∙ Network security policy Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Small business firewall (e.g., Cisco Meraki) ∙ Network security policy Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Data Loss Prevention (DLP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Data Loss Prevention (DLP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Data Loss Prevention (DLP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to automatically prevent the unauthorized exfiltration of sensitive/regulated data across managed interfaces. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Protocol Compliance Enforcement	Description Automated mechanisms exist to ensure network traffic complies with Internet Engineering Task Force (IETF) protocol specifications. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Configure firewall to enforce protocol compliance Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Firewall rules enforcing protocol compliance ∙ Block non-standard protocol usage Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Protocol compliance enforcement at network gateway ∙ Application-layer filtering Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise NGFW with deep packet inspection (DPI) for protocol compliance Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise NGFW with DPI and protocol anomaly detection (e.g., Palo Alto, Fortinet) ∙ Automated protocol enforcement SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts). Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to automatically ensure network traffic complies with Internet Engineering Task Force (IETF) protocol specifications. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Domain Name Verification	Description Mechanisms exist to ensure that domain name lookups, whether for internal or external domains, are validated according to Domain Name System Security Extensions (DNSSEC). Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Verify domain names before clicking links or navigating to sites Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ DNS filtering to block malicious/spoofed domains ∙ User awareness training Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ DNS security service with domain verification (e.g., Cisco Umbrella) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise DNS security service ∙ Domain reputation filtering ∙ Browser isolation for high-risk sites Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise DNS security platform with domain verification ∙ Real-time domain reputation ∙ Browser isolation (e.g., Menlo Security) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts). Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to ensure that domain name lookups, whether for internal or external domains, are validated according to Domain Name System Security Extensions (DNSSEC). Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Bandwidth Control	Description Mechanisms exist to implement bandwidth control technologies to limit the amount of bandwidth used by categories of domains that are bandwidth-intensive. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Note: Typically not required at this size; router Quality of Service (QoS) settings for critical applications Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Firewall/router QoS or bandwidth limits for non-critical traffic categories Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Bandwidth management policy for critical services Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise bandwidth management/QoS solution ∙ Critical service prioritization Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise bandwidth management platform (e.g., Palo Alto QoS, Cisco NBAR) ∙ Traffic shaping for critical services SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to implement bandwidth control technologies to limit the amount of bandwidth used by categories of domains that are bandwidth-intensive. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Internet Address Denylisting	Description Mechanisms exist to implement Internet address denylisting protections that blocks traffic received from or destined to a denylisted Internet address. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Block known malicious IP addresses on firewall Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Threat intelligence-based IP denylisting on firewall Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Automated threat intelligence feed integration for IP denylisting Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise threat intelligence platform with automated IP denylisting ∙ SIEM integration Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise TIP with automated denylisting (e.g., Anomali, Recorded Future) ∙ SOAR integration for automated blocking SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to implement Internet address denylisting protections that blocks traffic received from or destined to a denylisted Internet address. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Certificate Denylisting	Description Mechanisms exist to prevent communication with Technology Assets, Applications and/or Services (TAAS) that use a set of known bad certificates. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Check SSL certificate validity before trusting websites Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Certificate revocation checking policy ∙ Browser settings for certificate validation Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Certificate denylisting enforcement at proxy/gateway ∙ CRL/OCSP validation Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise certificate revocation management ∙ CRL/OCSP enforcement at gateway Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise certificate management platform (e.g., Venafi, DigiCert CertCentral) ∙ Automated revocation checking ∙ OCSP stapling enforcement SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to prevent communication with Technology Assets, Applications and/or Services (TAAS) that use a set of known bad certificates. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Content Disarm and Reconstruction (CDR)	Description Automated mechanisms exist to implement Content Disarm and Reconstruction (CDR) to remove active content from files traversing trust boundaries, resulting in reconstructed content containing only known safe elements. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Use email gateway with attachment sandboxing Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Email and web gateway with CDR capability (e.g., Proofpoint, Mimecast) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Content disarm and reconstruction (CDR) solution for email and web Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise CDR solution (e.g., OPSWAT MetaDefender, Deep Secure) ∙ Integration with email and web gateways Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise CDR platform (e.g., OPSWAT MetaDefender, Deep Secure) ∙ Multi-engine scanning ∙ Sanitization for all inbound content SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts). Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational Content Disarm and Reconstruction (CDR) capability detects the presence of unapproved active content and facilitates its removal, resulting in content with only known safe elements. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Network Processing Rules For Personal Data (PD)	Description Mechanisms exist to apply network-based processing rules to data elements of Personal Data (PD). Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Basic firewall ∙ Network security policy Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Small business firewall (e.g., Cisco Meraki) ∙ Network security policy Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Data Loss Prevention (DLP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Data Loss Prevention (DLP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Data Loss Prevention (DLP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to apply network-based processing rules to data elements of Personal Data (PD). Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Split Tunneling	Description Mechanisms exist to prevent split tunneling for remote devices unless the split tunnel is securely provisioned using organization-defined safeguards. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides). Level 2 Planned Tracked Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides). Level 3 Well Defined Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners. ▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution and log aggregator). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. ▪ An implemented and operational capability exists to prevent split tunneling for remote devices unless the split tunnel is securely provisioned using organization-defined safeguards. Level 4 Quantitatively Controlled Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe
Sursă	Cerință

3. Reglementări asociate

Reglementări
Sursă	Reglementare
EULAW	Articolul 13 Gestionarea securității rețelelor Articolul 13 Gestionarea securității rețelelor Ca parte a garanțiilor care asigură securitatea rețelelor împotriva intruziunilor și a utilizării abuzive a datelor, entitățile financiare elaborează, documentează și pun în aplicare politici, proceduri, protocoale și instrumente privind gestionarea securității rețelelor, inclusiv toate elementele următoare: (a) segregarea și segmentarea sistemelor și rețelelor TIC, ținând seama de: (i) caracterul critic sau importanța funcției pe care o sprijină sistemele și rețelele TIC respective; (ii) clasificarea stabilită în conformitate cu articolul 8 alineatul (1) din Regulamentul (UE) 2022/2554; (iii) profilul general de risc al activelor TIC care utilizează sistemele și rețelele TIC respective; (b) documentarea tuturor conexiunilor la rețea și fluxurilor de date ale entității financiare; (c) utilizarea unei rețele separate și specializate pentru gestionarea activelor TIC; (d) identificarea și punerea în aplicare a controalelor accesului la rețea pentru a preveni și a detecta conexiunile la rețeaua entității financiare prin orice dispozitiv sau sistem neautorizat sau orice punct final care nu îndeplinește cerințele de securitate ale entității financiare; (e) criptarea conexiunilor la rețea care trec prin rețele corporative, rețele publice, rețele naționale, rețele terțe și rețele fără fir, pentru protocoalele de comunicare utilizate, ținând seama de rezultatele clasificării aprobate a datelor, de rezultatele evaluării riscurilor TIC și de criptarea conexiunilor de rețea menționate la articolul 6 alineatul (2); (f) proiectarea rețelelor în conformitate cu cerințele de securitate TIC stabilite de entitatea financiară, ținând seama de cele mai avansate practici pentru a asigura confidențialitatea, integritatea și disponibilitatea rețelei; (g) securizarea traficului de rețea între rețelele interne și internet și alte conexiuni externe; (h) identificarea rolurilor și responsabilităților și a etapelor pentru specificarea, punerea în aplicare, aprobarea, modificarea și revizuirea regulilor firewall și a filtrelor de conexiuni; (i) efectuarea de revizuiri ale arhitecturii rețelei și ale modului în care este concepută securitatea rețelei o dată pe an și periodic pentru microîntreprinderi, pentru a se identifica potențialele vulnerabilități; (j) măsurile de izolare temporară, dacă este necesar, a subrețelelor și a componentelor și dispozitivelor de rețea; (k) implementarea unei configurații de referință securizate pentru toate componentele rețelei și întărirea rețelei și a dispozitivelor de rețea, în conformitate cu eventualele instrucțiuni ale furnizorului, după caz, precum și cu standardele definite la articolul 2 punctul 1 din Regulamentul (UE) nr. 1025/2012 și cu cele mai avansate practici; (l) procedurile de limitare, blocare și închidere a sistemului și a sesiunilor la distanță după o anumită perioadă de inactivitate; (m) pentru acordurile de servicii de rețea: (i) identificarea și specificarea măsurilor TIC și de securitate a informațiilor, a nivelurilor serviciilor și a cerințelor de gestionare a tuturor serviciilor de rețea; (ii) dacă aceste servicii sunt furnizate de un furnizor de servicii TIC intragrup sau de furnizori terți de servicii TIC. În sensul literei (h), entitățile financiare efectuează revizuirea regulilor firewall și a filtrelor de conexiuni în mod regulat, în conformitate cu clasificarea stabilită conform articolului 8 alineatul (1) din Regulamentul (UE) 2022/2554 și cu profilul general de risc al sistemelor TIC implicate. Pentru sistemele TIC care sprijină funcții critice sau importante, entitățile financiare verifică adecvarea regulilor firewall existente și a filtrelor de conectare cel puțin o dată la 6 luni.
EULAW	Articolul 35 Securitatea datelor, a sistemului și a rețelelor Articolul 35 Securitatea datelor, a sistemului și a rețelelor Entitățile financiare menționate la articolul 16 alineatul (1) din Regulamentul (UE) 2022/2554 elaborează și pun în aplicare, ca parte a sistemelor, protocoalelor și instrumentelor lor, garanții care asigură securitatea rețelelor împotriva intruziunilor și a utilizării abuzive a datelor și care mențin disponibilitatea, autenticitatea, integritatea și confidențialitatea datelor. În special, ținând seama de clasificarea menționată la articolul 30 alineatul (1) din prezentul regulament, entitățile financiare stabilesc toate elementele următoare: (a) identificarea și punerea în aplicare a măsurilor de protecție a datelor în uz, în tranzit și în repaus; (b) identificarea și punerea în aplicare a măsurilor de securitate privind utilizarea software-ului, a mediilor de stocare a datelor, a sistemelor și a dispozitivelor de punct final care asigură transferul și stocarea datelor entității financiare; (c) identificarea și punerea în aplicare a măsurilor de prevenire și detectare a conexiunilor neautorizate la rețeaua entității financiare, precum și de securizare a traficului de rețea între rețelele interne ale entității financiare și internet și alte conexiuni externe; (d) identificarea și punerea în aplicare a unor măsuri care asigură disponibilitatea, autenticitatea, integritatea și confidențialitatea datelor în timpul transmisiilor în rețea; (e) un proces care asigură ștergerea în condiții de siguranță a datelor, aflate în sediile entității financiare sau stocate extern, pe care entitatea financiară nu mai are nevoie să le colecteze sau să le stocheze; (f) un proces de eliminare sau scoatere din uz în condiții de siguranță a dispozitivelor de stocare a datelor aflate în sediile entității financiare sau a dispozitivelor de stocare a datelor stocate în exterior, care conțin informații confidențiale; (g) identificarea și punerea în aplicare a unor măsuri care asigură că telemunca și utilizarea dispozitivelor de punct final private nu au un impact negativ asupra capacității entității financiare de a-și desfășura activitățile critice în mod adecvat, în timp util și în condiții de siguranță.

Tichete legate

Legături
Tip de legătură	Tichet
is related to	Annual
is related to	relative Control Weighting = 10
is related to	Technology
is related to	Protect
is related to	SCRM Focus Tier 2 OPERATIONAL
blocks	Loss of Accountability / Attribution
blocks	Excessive or Unauthorized Privilege
blocks	Unauthorized Privilege Elevation
blocks	Unauthorized Access
blocks	Loss, Theft or Damage of Assets
blocks	Unauthorized Modification / Loss of System Integrity
blocks	Unauthorized Retention / Inability to Dispose of Data
blocks	Business / Service Interruption
blocks	Data Loss / Integrity Compromise
blocks	Reduced Operational Productivity
blocks	System / Data Compromise (Technical Vector)
blocks	System / Data Compromise (Non-Technical Vector)
blocks	Revenue Loss
blocks	Contractual Default / Termination
blocks	Loss of Competitive Advantage
blocks	Reputational Harm / Loss of Stakeholder Trust
blocks	Regulatory / Legal / Contractual Financial Liability
blocks	Exposure from Unaddressed Vulnerabilities
blocks	System / Service Compromise
blocks	Failure to Support Business / Mission Objectives
blocks	Unaddressed Security / Compliance Exposure
blocks	Unperformed / Unowned Control Responsibilities
blocks	Uncontrolled Internal Security / Privacy Exposure
blocks	Uncontrolled Third-Party Security / Privacy Exposure
blocks	Lack of oversight of internal controls
blocks	Lack of oversight of third-party controls
blocks	Harm from Illegal, Abusive or Unsafe Content / Conduct
blocks	Loss of Investigative / Evidentiary Capability
blocks	Delayed Containment / Increased Incident Impact
blocks	Incident Persistence / Recurrence
blocks	Incident Response / Recovery Cost
blocks	Undetected / Delayed Detection of Adverse Activity
blocks	Third-Party Cybersecurity Compromise / Exposure
blocks	Third-Party Physical Security Disruption / Exposure
blocks	Sub-Tier / Fourth-Party Supply Chain Exposure
blocks	Third-Party Legal / Compliance Exposure
blocks	Harm from Unauthorized / Unintended Product or Service Use
blocks	Third-Party Dependency Failure
blocks	Data Obfuscation
blocks	Junk Data
blocks	Steganography
blocks	Protocol or Service Impersonation
blocks	Fallback Channels
blocks	Traffic Duplication
blocks	Remote Desktop Protocol
blocks	SMB/Windows Admin Shares
blocks	Distributed Component Object Model
blocks	VNC
blocks	Windows Remote Management
blocks	Scheduled Transfer
blocks	Data Transfer Size Limits
blocks	Masquerade File Type
blocks	Exfiltration Over C2 Channel
blocks	Network Service Discovery
blocks	Exfiltration Over Alternative Protocol
blocks	Exfiltration Over Symmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Unencrypted Non-C2 Protocol
blocks	Process Injection
blocks	Dynamic-link Library Injection
blocks	Portable Executable Injection
blocks	Thread Execution Hijacking
blocks	Asynchronous Procedure Call
blocks	Thread Local Storage
blocks	Ptrace System Calls
blocks	Proc Memory
blocks	Extra Window Memory Injection
blocks	Process Hollowing
blocks	Process Doppelgänging
blocks	VDSO Hijacking
blocks	Exploitation for Privilege Escalation
blocks	Application Layer Protocol
blocks	Web Protocols
blocks	File Transfer Protocols
blocks	Mail Protocols
blocks	DNS
blocks	Publish/Subscribe Protocols
blocks	Software Deployment Tools
blocks	Valid Accounts
blocks	Taint Shared Content
blocks	Proxy
blocks	Internal Proxy
blocks	External Proxy
blocks	Multi-hop Proxy
blocks	Non-Application Layer Protocol
blocks	Account Manipulation
blocks	Additional Cloud Credentials
blocks	Web Service
blocks	Dead Drop Resolver
blocks	Bidirectional Communication
blocks	One-Way Communication
blocks	Multi-Stage Channels
blocks	Ingress Tool Transfer
blocks	Email Collection
blocks	Email Forwarding Rule
blocks	Data Encoding
blocks	Standard Encoding
blocks	Non-Standard Encoding
blocks	External Remote Services
blocks	Create Account
blocks	Domain Account
blocks	Cloud Account
blocks	Software Extensions
blocks	Forced Authentication
blocks	Drive-by Compromise
blocks	Exploit Public-Facing Application
blocks	BITS Jobs
blocks	Trusted Relationship
blocks	Exploitation for Client Execution
blocks	User Execution
blocks	Malicious Link
blocks	Malicious File
blocks	Malicious Image
blocks	Traffic Signaling
blocks	Port Knocking
blocks	Exploitation of Remote Services
blocks	Exploitation for Stealth
blocks	Exploitation for Credential Access
blocks	System Binary Proxy Execution
blocks	Verclsid
blocks	Electron Applications
blocks	Remote Access Tools
blocks	Template Injection
blocks	Domain Trust Discovery
blocks	Service Stop
blocks	Network Denial of Service
blocks	Direct Network Flood
blocks	Reflection Amplification
blocks	Endpoint Denial of Service
blocks	OS Exhaustion Flood
blocks	Service Exhaustion Flood
blocks	Application Exhaustion Flood
blocks	Application or System Exploitation
blocks	IIS Components
blocks	Data from Cloud Storage
blocks	Transfer Data to Cloud Account
blocks	Pre-OS Boot
blocks	ROMMONkit
blocks	TFTP Boot
blocks	Unsecured Credentials
blocks	Credentials In Files
blocks	Private Keys
blocks	Cloud Instance Metadata API
blocks	Container API
blocks	Adversary-in-the-Middle
blocks	Name Resolution Poisoning and SMB Relay
blocks	ARP Cache Poisoning
blocks	DHCP Spoofing
blocks	Evil Twin
blocks	Inter-Process Communication
blocks	Component Object Model
blocks	Dynamic Data Exchange
blocks	Archive Collected Data
blocks	Archive via Utility
blocks	Remote Service Session Hijacking
blocks	RDP Hijacking
blocks	Data Manipulation
blocks	Stored Data Manipulation
blocks	Runtime Data Manipulation
blocks	Phishing
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	Spearphishing via Service
blocks	Exfiltration Over Web Service
blocks	Exfiltration to Code Repository
blocks	Exfiltration to Cloud Storage
blocks	Exfiltration to Text Storage Sites
blocks	Exfiltration Over Webhook
blocks	Dynamic Resolution
blocks	Domain Generation Algorithms
blocks	Lateral Tool Transfer
blocks	Non-Standard Port
blocks	Protocol Tunneling
blocks	Encrypted Channel
blocks	Symmetric Cryptography
blocks	Asymmetric Cryptography
blocks	DNS
blocks	Phishing for Information
blocks	Spearphishing Service
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	Network Boundary Bridging
blocks	Network Address Translation Traversal
blocks	Data from Configuration Repository
blocks	SNMP (MIB Dump)
blocks	Network Device Configuration Dump
blocks	Container Administration Command
blocks	Deploy Container
blocks	Escape to Host
blocks	Build Image on Host
blocks	Container and Resource Discovery
blocks	Debugger Evasion
blocks	Serverless Execution
blocks	Content Injection
blocks	Identity Compromise / Impersonation
blocks	Intellectual Property / Trade Secret Loss
blocks	OT Safety / Process Availability Failure
blocks	Loss of Confidentiality
blocks	Loss of Data Integrity
blocks	Loss of Data / Service Availability
blocks	Drought & Water Shortage
blocks	Earthquakes
blocks	Fire & Wildfires
blocks	Floods
blocks	Hurricanes & Tropical Storms
blocks	Landslides & Debris Flow
blocks	Pandemic (Disease) Outbreaks
blocks	Severe Weather
blocks	Space Weather
blocks	Thunderstorms & Lightning
blocks	Tornadoes
blocks	Tsunamis
blocks	Volcanoes
blocks	Winter Storms & Extreme Cold
blocks	Malicious Cyber Activity
blocks	Physical Crime
blocks	Terrorism & Armed Attacks
blocks	Utility Service Disruption
blocks	Dysfunctional Management Practices
blocks	Human Error
blocks	Technical / Mechanical Failure
blocks	Data Quality Degradation / Data Poisoning
blocks	Hazardous / Degraded Operational Environment
blocks	Infrastructure Failure / Degradation
blocks	Adversarial Artificial Intelligence (AI) Attack
blocks	Operational Technology (OT) / Industrial Control System (ICS) Attack
blocks	COS-02.01B
blocks	COS-03.02B
blocks	COS-04.01B
blocks	COS-04.01AS
is blocked by	NET-03 Boundary Protection – Assessment Procedure
blocks	SC-07 Boundary Protection
blocks	SC-07(09) Restrict Threatening Outgoing Communications Traffic
blocks	SC-07(11) Restrict Incoming Communications Traffic
blocks	SC-07 [L] Boundary Protection
blocks	SC-07 [M] Boundary Protection
blocks	SC-07 [H] Boundary Protection
blocks	03.01.12 Remote Access
blocks	03.01.18 Access Control for Mobile Devices
blocks	03.13.01 Boundary Protection

Secure Controls Framework -
The Secure Controls Framework® (SCF)

"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.

The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.

Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.

The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/

Terms & Conditions

The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.