CyberFundamentals

Equipment maintenance and safety

Documentation of other protected assets

Critical

High

Normal

Low

ID.AM-2: Software platforms and applications used within the organization are inventoried.

An inventory that reflects what software platforms and applications are being used in the organization shall be documented, reviewed, and updated when changes occur.
Guidance
- This inventory includes software programs, software platforms and databases, even if outsourced (SaaS).
- Outsourcing arrangements should be part of the contractual agreements with the provider.
- Information in the inventory should include for example: name, description, version, number of users,
data processed, etc.
- A distinction should be made between unsupported software and unauthorized software.
- The use of an IT asset management tool could be considered.

The inventory of software platforms and applications associated with information and information processing shall reflect changes in the organization’s context and include all information necessary for effective accountability.
Guidance
The inventory of software platforms and applications should include the title, publisher, initial install/use date, and business purpose for each entry; where appropriate, include the Uniform Resource Locator (URL), app store(s), version(s), deployment mechanism, and decommission date.

Individuals who are responsible and who are accountable for administering software platforms and applications within the organization shall be identified.

When unauthorized software is detected, it shall be quarantined for possible exception handling, removed, or replaced, and the inventory shall be updated accordingly.
Guidance
- Any unsupported software without an exception documentation, is designated as unauthorized.
- Unauthorized software can be detected during inventory, requests for support by the user or other means.

Mechanisms for detecting the presence of unauthorized software within the organization’s ICT/OT environment shall be identified.
Guidance
- Where safe and feasible, these mechanisms should be automated.
- There should be a process to regularly address unauthorised assets; The organization may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset.

Related tasks

Automatic blocking and detecting of unauthorized software

Critical

High

Normal

Low

Malware protection

Data system listing and owner assignment

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Management of information systems and devices in systems management

Critical

High

Normal

Low

Processing principles and accountability

ID.AM-3: Organizational communication and data flows are mapped.

Information that the organization stores and uses shall be identified.
Guidance
- Start by listing all the types of information your business stores or uses. Define “information type” in any useful way that makes sense to your business. You may want to have your employees make a list of all the information they use in their regular activities. List everything you can think of, but you do not need to be too specific. For example, you may keep customer names and email addresses, receipts for raw material, your banking information, or other proprietary information.
- Consider mapping this information with the associated assets identified in the inventories of physical devices, systems, software platforms and applications used within the organization (see ID.AM-1 &ID.AM-2).

All connections within the organization's ICT/OT environment, and to other organization internal platforms shall be mapped, documented, approved, and updated as appropriate.
Guidance
- Connection information includes, for example, the interface characteristics, data characteristics, ports,
protocols, addresses, description of the data, security requirements, and the nature of the connection.
- Configuration management can be used as supporting asset.
- This documentation should not be stored only on the network it represents.
- Consider keeping a copy of this documentation in a safe offline environment (e.g. offline hard disk,paper hardcopy, …).

The information flows/data flows within the organization’s ICT/OT environment, as well as to other organization-internal systems shall be mapped, documented, authorized, and updated when changes occur.
Guidance
- With knowledge of the information/data flows within a system and between systems, it is possible to determine where information can and cannot go.
- Consider:
- Enforcing controls restricting connections to only authorized interfaces.
- Heightening system monitoring activity whenever there is an indication of increased risk to organization's critical operations and assets.
- Protecting the system from information leakage due to electromagnetic signals emanations.

Related tasks

Data store listing and owner assignment

Critical

High

Normal

Low

Data system listing and owner assignment

Critical

High

Normal

Low

Documentation of interfaces for data systems

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Description of administrative data flows

Critical

High

Normal

Low

Cloud service management

Measures for the storage of incoming information, information being processed and outgoing information

Critical

High

Normal

Low

ID.AM-4: External information systems are catalogued.

The organization shall map, document, authorize and when changes occur, update, all external services and the connections made with them.
Guidance
- Outsourcing of systems, software platforms and applications used within the organization is covered in ID.AM-1 & ID.AM-2
- External information systems are systems or components of systems for which organizations typically have no direct supervision and authority over the application of security requirements and controls, or the determination of the effectiveness of implemented controls on those systems i.e., services that
are run in cloud, SaaS, hosting or other external environments, API (Application Programming interface)…
- Mapping external services and the connections made to them and authorizing them in advance avoids wasting unnecessary resources investigating a supposedly non-authenticated connection to external systems.

The flow of information to/from external systems shall be mapped, documented, authorized, and update when changes occur.
Guidance
Consider requiring external service providers to identify and document the functions, ports, protocols, and services necessary for the connection services.

Related tasks

Data system listing and owner assignment

Critical

High

Normal

Low

Documentation of interfaces for data systems

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

ID.AM-5: Resources are prioritized based on their classification, criticality, and business value.

The organization’s resources (hardware, devices, data, time, personnel, information, and software) shall be prioritized based on their classification, criticality, and business value.
Guidance
- Determine organization’s resources (e.g., hardware, devices, data, time, personnel, information, and software):
- What would happen to my business if these resources were made public, damaged, lost…?
- What would happen to my business when the integrity of resources is no longer guaranteed?
- What would happen to my business if I/my customers couldn’t access these resources? And rank these resources based on their classification, criticality, and business value.
- Resources should include enterprise assets.
- Create a classification for sensitive information by first determining categories, e.g.
- Public - freely accessible to all, even externally
- Internal - accessible only to members of your organization
- Confidential - accessible only to those whose duties require access.
- Communicate these categories and identify what types of data fall into these categories (HR data, financial data, legal data, personal data, etc.).
- Consider the use of the Traffic Light Protocol (TLP).
- Data classification should apply to the three aspects: C-I-A
- Consider implementing an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service provider.

Related tasks

Use of a DLP-system

Critical

High

Normal

Low

Email and web browser

Documentation of data classes for data sets

Critical

High

Normal

Low

Data classification

Definition of data classifications and class-specific security procedures

Critical

High

Normal

Low

Data classification

Using data loss prevention policies

Critical

High

Normal

Low

Priority classification of an organization's information assets

Critical

High

Normal

Low

ID.AM-6: Cybersecurity roles, responsibilities, and authorities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established.

Information security and cybersecurity roles, responsibilities and authorities within the organization shall be documented, reviewed, authorized, and updated and alignment with organization-internal roles and external partners.
Guidance
It should be considered to:
- Describe security roles, responsibilities, and authorities: who in your organization should be
consulted, informed, and held accountable for all or part of your assets.
- Provide security roles, responsibilities, and authority for all key functions in information/cyber
security (legal, detection activities…).
- Include information/cybersecurity roles and responsibilities for third-party providers with physical or logical access to the organization’s ICT/OT environment.

The organization shall appoint an information security officer.
Guidance
The information security officer should be responsible for monitoring the implementation of the organization's information/cyber security strategy and safeguards.

Related tasks

Defining security roles and responsibilities

Critical

High

Normal

Low

Confirming information security roles and responsibilities related to utilized cloud services

Critical

High

Normal

Low

ID.BE-1: The organization’s role in the supply chain is identified and communicated.

The organization’s role in the supply chain shall be identified, documented, and communicated.
Guidance
- The organisation should be able to clearly identify who is upstream and downstream of the organisation and which suppliers provide services, capabilities, products and items to the organisation.
- The organisation should communicate its position to its upstream and downstream so that it is understood where they sit in terms of critical importance to the organisation's operations.

The organization shall protect its ICT/OT environment from supply chain threats by applying security safeguards as part of a documented comprehensive security strategy.

Related tasks

Minimum requirements for partner companies to gain access to different levels of information

Critical

High

Normal

Low

Criteria for high priority partners

Critical

High

Normal

Low

The role of the organization in the supply chain

Critical

High

Normal

Low

Cloud service management

Supply chain cyber security risk management

Critical

High

Normal

Low

Agreements and monitoring

Communicating responsibilities to suppliers

Critical

High

Normal

Low

ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated.

The organization’s place in critical infrastructure and its industry sector shall be identifiedand communicated.
Guidance
The organisation covered by NIS legislation has a responsibility to know the other organisations in the same sector in order to work with them to achieve the objectives set by NIS for that particular sector.

Related tasks

The role of the organization in critical infrastructure

Critical

High

Normal

Low

Cloud service management

ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated.

Priorities for organization's business, objectives, and activities shall be established and communicated.
Guidance
- Organizational mission, objectives and activities should be determined and prioritized.
- Information protection needs should be determined, and the related processes revised as necessary, until an achievable set is obtained.

Related tasks

Defining and documenting security objectives

Critical

High

Normal

Low

Security roles, responsibilities, and objectives derived from the organization's goals

Critical

High

Normal

Low

ID.BE-4: Dependencies and critical functions for delivery of critical services are established.

Dependencies and mission-critical functions for the delivery of critical services shall be identified, documented, and prioritized according to their criticality as part of the risk assessment process. Guidance Dependencies and business critical functions should include support services.

Related tasks

Multiple providers for critical network equipment

Critical

High

Normal

Low

Consideration of critical functions in risk management

Critical

High

Normal

Low

Identifying critical functions and related assets

Critical

High

Normal

Low

ID.BE-5: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations).

To support cyber resilience and secure the delivery of critical services, the necessary requirements are identified, documented and their implementation tested and approved.
Guidance
- Consider implementing resiliency mechanisms to support normal and adverse operational situations
(e.g., failsafe, load balancing, hot swap).
- Consider aspects of business continuity management in e.g. Business Impact Analyse (BIA), Disaster Recovery Plan (DRP) and Business Continuity Plan (BCP).

Information processing & supporting facilities shall implement redundancy to meet availability requirements, as defined by the organization and/or regulatory frameworks.
Guidance
- Consider provisioning adequate data and network redundancy (e.g. redundant network devices, servers with load balancing, raid arrays, backup services, 2 separate datacentres, fail-over network connections, 2 ISP's…).
- Consider protecting critical equipment/services from power outages and other failures due to utility interruptions (e.g. UPS & NO-break, frequent test, service contracts that include regular maintenance, redundant power cabling, 2 different power service providers...).

Recovery time and recovery point objectives for the recovery of essential ICT/OT system processes shall be defined.
Guidance
- Consider applying the 3-2-1 back-up rule to improve RPO and RTO (maintain at least 3 copies of your data, keep 2 of them at separate locations and one copy should be stored at an off-site location).
- Consider implementing mechanisms such as hot swap, load balancing and failsafe to increase resilience.

Related tasks

Creating and documenting continuity plans

Critical

High

Normal

Low

Defined security arrangements for providing critical network equipment

Critical

High

Normal

Low

Regular testing and review of continuity plans

Critical

High

Normal

Low

Testing and reviewing continuity plans related to cyber security breaches

Critical

High

Normal

Low

Ensuring and testing the resilience of data processing environment

Critical

High

Normal

Low

Identifying critical functions and related assets

Critical

High

Normal

Low

ID.GV-1: Organizational cybersecurity policy is established and communicated.

Policies and procedures for information security and cyber security shall be created, documented, reviewed, approved, and updated when changes occur.
Guidance
- Policies and procedures used to identify acceptable practices and expectations for business operations, can be used to train new employees on your information security expectations, and can aid an investigation in case of an incident. These policies and procedures should be readily accessible
to employees.
- Policies and procedures for information- and cybersecurity should clearly describe your expectations for protecting the organization’s information and systems, and how management expects the company’s resources to be used and protected by all employees.
- Policies and procedures should be reviewed and updated at least annually and every time there are changes in the organization or technology. Whenever the policies are changed, employees should be made aware of the changes.

An organization-wide information security and cybersecurity policy shall be established,documented, updated when changes occur, disseminated, and approved by senior management.
Guidance
The policy should include, for example:
- The identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance. Guidance on role profiles along with their identified titles, missions, tasks, skills, knowledge, competences is available in the "European Cybersecurity Skills Framework Role Profiles" by ENISA. (https://www.enisa.europa.eu/publications/europeancybersecurity-skills-framework-role-profiles)
- The coordination among organizational entities responsible for the different aspects of security (i.e., technical, physical, personnel, cyber-physical, information, access control, media protection, vulnerability management, maintenance, monitoring)
- The coverage of the full life cycle of the ICT/OT systems.

Related tasks

Information security policy -report publishing, informing and maintenance

Critical

High

Normal

Low

Defining security roles and responsibilities

Critical

High

Normal

Low

Defining and documenting security objectives

Critical

High

Normal

Low

Management commitment to cyber security management and management system

Critical

High

Normal

Low

Communication plan for information security management system

Critical

High

Normal

Low

Continuous improvement and documentation

Critical

High

Normal

Low

Informing and data subject requests

ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood, and managed.

Legal and regulatory requirements regarding information/cybersecurity, including privacy obligations, shall be understood, implemented, and managed.
Guidance
- There should be regular reviews to ensure the continuous compliance with legal and regulatory
requirements regarding information/cybersecurity, including privacy obligations.
- This requirement also applies to contractors and service providers.

Related tasks

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Executing and documenting internal audits

Critical

High

Normal

Low

Implementation and documentation of management reviews

Critical

High

Normal

Low

Informing and data subject requests

Privacy notices -report publishing and maintenance

Critical

High

Normal

Low

Identification, documentation and management of other information security requirements

Critical

High

Normal

Low

ID.GV-4: Governance and risk management processes address cybersecurity risks.

As part of the company's overall risk management, a comprehensive strategy to manage information security and cybersecurity risks shall be developed and updated when changes occur.
Guidance
This strategy should include determining and allocating the required resources to protect the organization’s business-critical assets.

Information security and cybersecurity risks shall be documented, formally approved, and updated when changes occur.
Guidance
Consider using Risk Management tools.

Related tasks

Identification and documentation of cyber security risks

Critical

High

Normal

Low

Evaluation process and documentation of significant security-related changes

Critical

High

Normal

Low

Assessment of residual risks

Critical

High

Normal

Low

Continuous improvement of the risk management process

Critical

High

Normal

Low

ID.RA-1: Asset vulnerabilities are identified and documented.

Threats and vulnerabilities shall be identified.
Guidance
- A vulnerability refers to a weakness in the organization’s hardware, software, or procedures. It is a gap through which a bad actor can gain access to the organization’s assets. A vulnerability exposes an organization to threats.
- A threat is a malicious or negative event that takes advantage of a vulnerability.
- The risk is the potential for loss and damage when the threat does occur.

A process shall be established to monitor, identify, and document vulnerabilities of the organisation's business critical systems in a continuous manner.
Guidance
- Where safe and feasible, the use of vulnerability scanning should be considered.
- The organization should establish and maintain a testing program appropriate to its size, complexity, and maturity.

To ensure that organization's operations are not adversely impacted by the testing process, performance/load testing and penetration testing on the organization’s systems shall be conducted with care.
Guidance
Consider validating security measures after each penetration test.

Related tasks

Regular vulnerability scanning

Critical

High

Normal

Low

Initial treatment of identified technical vulnerabilities

Critical

High

Normal

Low

Process for managing technical vulnerabilities

Critical

High

Normal

Low

Regular monitoring of the vulnerability management process

Critical

High

Normal

Low

Regular penetration testing

Critical

High

Normal

Low

Security systems and logging

Vulnerability monitoring in used third-party or open source libraries

Critical

High

Normal

Low

Agreements and monitoring

ID.RA-2: Cyber threat intelligence is received from information sharing forums and sources.

A threat and vulnerability awareness program that includes a cross organization information-sharing capability shall be implemented.
Guidance
A threat and vulnerability awareness program should include ongoing contact with security groups and associations to receive security alerts and advisories. (Security groups and associations include, for example, special interest groups, forums, professional associations, news groups, and/or peer groups of security professionals in similar organizations).This contact can include the sharing of information about potential vulnerabilities and incidents. This sharing capability should have an unclassified and classified information sharing capability.

It shall be identified where automated mechanisms can be implemented to make security alert and advisory information available to relevant organization stakeholders.

Related tasks

Procedures and data sources for gathering reliable information about malware

Critical

High

Normal

Low

Malware protection

Contact with industry-specific interest groups

Critical

High

Normal

Low

The goals of threat intelligence and the collection of information related to information security threats

Critical

High

Normal

Low

Sharing threat intelligence

Critical

High

Normal

Low