Details
M1 - STRATEGY AND PLANNING
An information security strategy shall be defined and operating model developed to adhere to the strategy. In addition, information security plans shall be developed for each major service to identify and mitigate the risks corresponding to each service
M5 - COMPLIANCE
- M5.2.2 - P4 - INTELLECTUAL PROPERTY RIGHTS (IPR)
- M5.2.7 - P4 -LIABILITY TO THE INFORMATION SHARING COMMUNITY
- M5.3.1 - P4 - COMPLIANCE WITH SECURITY POLICIES AND STANDARDS
- M5.5.1 - P4 - INFORMATION SYSTEMS AUDIT CONTROLS
- M5.5.2 - P4 - PTOTECTION OF INFORMATION SYSTEMS AUDIT TOOL
- M5.5.3 - P4 - AUDIT OF COMMUNITY FUNCTIONS
T2 - PHYSICAL AND ENVIRONMENTAL SECURITY
- T2.1.1 - P4 - PHYSICAL AND ENVIRONMENTAL SECURITY POLICY
- T2.2.4 - P4 - PROCTECTING AGAINST EXTERNAL AND ENVIRONMENTAL THREATS
- T2.3.2 - P4 - SUPPORTING UTILITIES
- T2.3.3 - P4 - CABLING SECURITY
T3 - OPERATIONS MANAGEMENT
Operational procedures and responsibilities shall be developed, to ensure an adequate level of information security. In addition, backup, media handling, e-services security and monitoring shall be addressed to ensure protection against malicious code and spyware
- T3.1.1 - P4 - OPERATIONS MANAGEMENT POLICY
- T3.2.3 - P4 - CHANGE MANAGEMENT
- T3.3.1- P4 - CAPACITY MANAGEMENT
- T3.6.7 - P4 - CLOCK SYNCHRONIZATION
T4 - COMMUNICATIONS
Network security and information sharing shall be addressed to ensure protection of information in transit
- T4.2.5 - P4 - BUSINESS INFORMATION SYSTEMS
- T4.3.3 - P4 - PUBLICLY AVAILABLE INFORMATION
- T4.4.1 - P4 - CONNECTIVITY TO INFORMATION SHARPING PLATFORMS
- T4.4.2 - P4 - INFORMATION RELEASED INTO INFORMATION SHARING COMMUNITIES
T5 - ACCESS CONTROL
Access control processes shall be developed to control access to information, to manage user access, control access to both internal and external network services, control access to operating systems, control access to applications and to apply appropriate protection when using mobile computing and teleworking services
- T5.4.4 - P4 - REMOTE DIAGNOSTIC AND CONFIGURATION PROTECTION
- T5.5.4 - P4 - USE OF SYSTEM UTILITIES
- T5.7.1 - P4 - ACCESS CONTROL FOR MOBILE DEVICES
- T5.7.2 - P4 - TELEWORKING
T6 - THIRD PARTY SECURITY
T7 - INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE
T7 Information System Acquisition, Development & Maintenance
An information systems acquisition, development and maintenance process shall be implemented to prevent unauthorized modification or misuse of information in applications, to ensure that a cryptographic control policy is in place, to maintain security in development and support processes and to manage technical vulnerabilities
- T7.1.1 - P4 - INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENENCE POLICY
- T7.2.2 - DEVELOPER-PROVIDED STRATEGY
- T7.5.1 - P4 - CONTROL OF OPERATIONAL SOFTWARE
- T7.8.1 - P4 - SUPPLY CHAIN PROTECTION STRATEGY
- T7.8.2 - P4 - SUPPLIER REVIEWS
- T7.8.3 - P4 - LIMITATION OF HARM
- T7.8.4 - P4 - SUPPLY CHAIN OPERATIONS SECURITY
- T7.8.5 - P4 - RELIABLE DELIVERY
- T7.8.7 - P4 - SUPPLY OF CRITICAL INFORMATION SYSTEMS COMPONENTS
T8 - INFORMATION SECURITY INCIDENT MANAGEMENT
T8 Information Security Incident Management
- T8.2.3 - P4 - INCIDENT CLASSIFICATION
- T8.2.4 - P4 - INCIDENT RESPONSE TRAINING
- T8.2.5 - P4 - INCIDENT RESPONSE TESTING
- T8.2.6 - P4 - INCIDENT RESPONSE ASSISTANCE
- T2.8.7 - P4 - INFORMATION SECURITY INCIDENT DOCUMENTATION
- T8.2.8 - P4 - LEARNING FROM INFORMATION SECURITY INCIDENTS
- T8.2.9 - P4 - COLLECTION OF EVIDENCE
- T8.3.1 - P4 - SITUATIONAL AWARENESS
- T8.3.2 - P4 - REPORTING INFORMATION SECURITY EVENTS
- T8.3.3 - P4 - REPORTING SECURITY WEAKNESSES
