Priority P1 Controls
80% of analyzed information security breaches could have been mitigated by the P1 controls. List of threats is here
M1 - STRATEGY AND PLANNING
An information security strategy shall be defined and operating model developed to adhere to the strategy. In addition, information security plans shall be developed for each major service to identify and mitigate the risks corresponding to each service
- M1.1.1 - P1 - UNDERSTANDING THE ENTITY AND ITS CONTEXT
- M.1.1.2 - P1 - LEADERSHIP AND MANAGEMENT COMMITMENT
- M1.1.3 - P1 - ROLES AND RESPONSIBILITIES FOR INFORMATION SECURITY
- M1.2.1 - P1 - INFORMATION SECURITY POLICY
- M1.3.5 - P1 - IDENTIFICATION OF RISKS RELATED TO EXTERNAL PARTIES
- M1.4.1 - P1 - RESOURCES
M2 - INFORMATION SECURITY RISK MANAGEMENT
M2 Information Security Risk Management
An information security risk management process shall be implemented to conduct risk assessments, statements of applicability, security testing and evaluations of information security controls on applicable services
- M2.1.1 - P1 - INFORMATION SECURITY RISK MANAGEMENT POLICY
- M2.2.1 - P1 - INFORMATION SECURITY RISK IDENTIFICATION
- M2.2.2. - P1 - INFORMATION SECURITY RISK ANALYSIS
- M2.2.3 - P1 - INFORMATION SECURITY RISK EVALUATION ANALYSIS
- M2.3.1 - P1 - INFORMATION SECURITY RISK TREATMENT OPTIONS
- M2.3.2 - P1- IDENTIFICATION OF CONTROLS
- M2.3.3 - P1- RISK TREATMENT PLAN
- M2.3.4 - P1- STATEMENT OF APPLICABILITY
- M2.4.1 - P1 - RISK MONITORING AND REVIEW
- M2.4.2 - P1 - RISK COMMUNICATION AND CONSULTATION
M3 - AWARENESS AND TRAINING
An awareness and training program shall be implemented to inform entities of risks associated with their activities and to ensure that entities are adequately trained to carry out their assigned information security responsibilities
M4 - HUMAN RESOURCES SECURITY
Human resources security requirements and security responsibilities shall be addressed prior employment, during employment, and after termination or change of employment
- M4.4.1 - P1- TERMINATION RESPONSIBILITIES
- M4.4.2 - P1- RETURN OF ASSETS
- M4.4.3 - P1 - REMOVAL OF ACCES RIGHTS
T1 - ASSET MANAGEMENT
Assets shall be managed and information shall be classified and labeled to ensure that assets including information receives an appropriate level of information security
T3 - OPERATIONS MANAGEMENT
Operational procedures and responsibilities shall be developed, to ensure an adequate level of information security. In addition, backup, media handling, e-services security and monitoring shall be addressed to ensure protection against malicious code and spyware
Detection, prevention, and recovery controls to protect against malicious code and appropriate user awareness procedures should be implemented
Backup copies of information and software should be taken and tested regularly in accordance with the agreed backup policy.
Procedures for monitoring use of information systems should be established and the results of the monitoring activities reviewed regularly.
T4 -COMMUNICATIONS
Network security and information sharing shall be addressed to ensure protection of information in transit
T5 - ACCESS CONTROL
Access control processes shall be developed to control access to information, to manage user access, control access to both internal and external network services, control access to operating systems, control access to applications and to apply appropriate protection when using mobile computing and teleworking services
- T5.2.1 - P1 - USER REGISTRATION
- T5.2.2 - P1 - PRIVILEGE MANAGEMENT
- T5.2.3 - P1 - USER SECURITY CREDENTIALS MANAGEMENT
- T5.2.3 - P1 - USER SECURITY CREDENTIALS MANAGEMENT
- T5.2.4 - P1- REVIEW OF USER ACCESS RIGHTS
- T5.3.1 - P1 - USE OF SECURITY CREDENTIALS
- T5.4.2 - P1 -USER AUTHENTICATION FOR EXTERNAL CONNECTIONS
- T5.4.3 - P1 - EQUIPMENT INDENTIFICATION NETWORKS
- T5.4.5 - P1- NETWORK CONNECTION CONTROL
- T5.5.1 - P1 - SECURE LOG-ON PROCEDURES
- T5.5.2 - P1 - USER IDENTIFICATION AND AUTHENTICATION
- T5.5.3 - P1 - USER CREDENTIALS MANAGEMENT SYSTEM
- T5.6.1 - P1 - INFORMATION ACCESS RESTRICTION
T7 - INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE
T7 Information System Acquisition, Development & Maintenance
An information systems acquisition, development and maintenance process shall be implemented to prevent unauthorized modification or misuse of information in applications, to ensure that a cryptographic control policy is in place, to maintain security in development and support processes and to manage technical vulnerabilities
