Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CyberFundamentals framework is created by Centre for Cyber security Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience.
The CyberFundamentals framework is created by Centre for Cybersecurity Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience. The framework is based on:
The Cyberfundamentals are structured in 4 levels, with a subsequent level containing a little more measures than the previous one each time. A beginner level Small, followed by Basic, Important and Essential. The Essential level contains all the basic information security mesures from previous ones and introduces more advanced controls. The essential level is in line with the NIS2 directive.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
The organization shall perform a documented risk assessment on organization's critical system transactions and authenticate users, devices, and other assets (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).
Guidance
Consider a security-by-design approach for new systems; For existing systems a separate risk assessment
should be used.
Employees shall be trained as appropriate.
Guidance
- Employees include all users and managers of the ICT/OT systems, and they should be trained
immediately when hired and regularly thereafter about the company’s information security policies
and what they will be expected to do to protect company’s business information and technology.
- Training should be continually updated and reinforced by awareness campaigns.
The organization shall incorporate insider threat recognition and reporting into security
awareness training.
Guidance
Consider to:
- Communicate and discuss regularly to ensure that everyone is aware of their responsibilities.
- Develop an outreach program by gathering in a document the messages you want to convey to your
staff (topics, audiences, objectives, etc.) and your communication rhythm on a calendar (weekly,
monthly, one-time, etc.). Communicate continuously and in an engaging way, involving management,
IT colleagues, the ICT service provider and HR and Communication managers.
- Cover topics such as: recognition of fraud attempts, phishing, management of sensitive information,
incidents, etc. The goal is for all employees to understand ways to protect company information.
- Discuss with your management, your ICT colleagues, or your ICT service provider some practice
scenarios (e.g. what to do if a virus alert is triggered, if a storm cuts off the power, if data is blocked,
if an account is hacked, etc.), determine what behaviours to adopt, document and communicate
them to all your staff. The central point of contact in the event of an incident should be known to all.
- Organize a simulation of a scenario to test your knowledge. Consider performing the exercise for
example at least once a year.
The organization shall implement an evaluation method to measure the effectiveness of the
awareness trainings.
Privileged users shall be qualified before privileges are granted, and these users shall be
able to demonstrate the understanding of their roles, responsibilities, and authorities.
The organization shall establish and enforce security requirements for business-critical third-party providers and users.
Guidance
Enforcement should include that ‘third party stakeholder’-users (e.g. suppliers, customers, partners) can
demonstrate the understanding of their roles and responsibilities.'
Third-party providers shall be required to notify any personnel transfers, termination, or
transition involving personnel with physical or logical access to organization's business
critical system's components.
Guidance
Third-party providers include, for example, service providers, contractors, and other organizations
providing system development, technology services, outsourced applications, or network and security
management.
The organization shall monitor business-critical service providers and users for security compliance.
Guidance
Third party audit results can be used as audit evidence.
The organization shall audit business-critical external service providers for security compliance.
Guidance
Third party audit results can be used as audit evidence.
Senior executives shall demonstrate the understanding of their roles, responsibilities, and authorities.
Guidance
Guidance on role profiles along with their identified titles, missions, tasks, skills, knowledge,
competences is available in the "European Cybersecurity Skills Framework Role Profiles" by ENISA.
(https://www.enisa.europa.eu/publications/european-cybersecurity-skills-framework-role-profiles )
The organization shall ensure that personnel responsible for the physical protection and security of the organization's critical systems and facilities are qualified through training before privileges are granted, and that they understand their responsibilities.
The organization shall protect its critical system information determined to be critical/
sensitive while at rest.
Guidance
- Consider using encryption techniques for data storage, data transmission or data transport (e.g., laptop,
USB).
- Consider encrypting end-user devices and removable media containing sensitive data (e.g. hard disks,
laptops, mobile device, USB storage devices, …). This could be done by e.g. Windows BitLocker®,
VeraCrypt, Apple FileVault®, Linux® dm-crypt,…
- Consider encrypting sensitive data stored in the cloud.
- Implement dedicated safeguards to prevent unauthorized access, distortion, or modification of system
data and audit records (e.g. restricted access rights, daily backups, data encryption, firewall installation).
- Encrypt hard drives, external media, stored files, configuration files and data stored in the cloud.
The organization shall protect its critical system information determined to be critical when in transit.
Guidance
If you send sensitive documents or emails, you may want to consider encrypting those documents and/or emails with appropriate, supported, and authorized software tools.
Assets and media shall be disposed of safely.
Guidance
- When eliminating tangible assets like business computers/laptops, servers, hard drive(s) and other
storage media (USB drives, paper…), ensure that all sensitive business or personal data are securely
deleted (i.e. electronically “wiped”) before they are removed and then physically destroyed (or recommissioned). This is also known as “sanitization” and thus related to the requirement and guidance in PR.IP-6.
- Consider installing a remote-wiping application on company laptops, tablets, cell phones, and other
mobile devices.
The organization shall enforce accountability for all its business-critical assets throughout
the system lifecycle, including removal, transfers, and disposition.
Guidance
Accountability should include:
- The authorization for business-critical assets to enter and exit the facility.
- Monitoring and maintaining documentation related to the movements of business-critical assets.
The organization shall ensure that disposal actions are approved, tracked, documented, and verified.
Guidance
Disposal actions include media sanitization actions (See PR.IP-6).
The organization shall ensure that the necessary measures are taken to deal with loss, misuse, damage, or theft of assets.
Guidance
This can be done by policies, processes & procedures (reporting), technical & organizational means
(encryption, Access Control (AC), Mobile Device Management (MDM), monitoring, secure wipe, awareness, signed user agreement, guidelines & manuals, backups, inventory update …).
Capacity planning shall ensure adequate resources for organization's critical system information processing, networking, telecommunications, and data storage.
The organization’s critical systems shall be protected against denial-of-service attacks or at least the effect of such attacks will be limited.
Audit data from the organization's critical systems shall be moved to an alternative system.
Guidance
Be aware that log services can become a bottleneck and hinder the correct functioning of the source
systems.
The organization shall take appropriate actions resulting in the monitoring of its critical
systems at external borders and critical internal points when unauthorized access and activities, including data leakage, is detected.
Guidance
- Consider implementing dedicated protection measures (restricted access rights, daily backups, data
encryption, installation of firewalls, etc.) for the most sensitive data.
- Consider frequent audit of the configuration of the central directory (Active Directory in Windows
environment), with specific focus on the access to data of key persons in the company.
The organization shall implement software, firmware, and information integrity checks to detect unauthorized changes to its critical system components during storage, transport, start-up and when determined necessary.
Guidance
State-of-the-practice integrity-checking mechanisms (e.g., parity checks, cyclical redundancy checks,
cryptographic hashes) and associated tools can automatically monitor the integrity of information systems and hosted applications.
The organization shall implement automated tools where feasible to provide notification upon discovering discrepancies during integrity verification.
The organization shall implement automatic response capability with pre-defined security
safeguards when integrity violations are discovered
The development and test environment(s) shall be isolated from the production environment.
Guidance
- Any change one wants to make to the ICT/OT environment should first be tested in an environment
that is different and separate from the production environment (operational environment) before
that change is effectively implemented . That way, the effect of those changes can be analysed and
adjustments can be made without disrupting operational activities.
- Consider adding and testing cybersecurity features as early as during development (secure development lifecycle principles).
The organization shall implement hardware integrity checks to detect unauthorized tampering to its critical
system's hardware.
Guidance
State-of-the-practice integrity-checking mechanisms (e.g., parity checks, cyclical redundancy checks,
cryptographic hashes) and associated tools can automatically monitor the integrity of information
systems and hosted applications.
The organization shall incorporate the detection of unauthorized tampering to its critical
system's hardware into the organization incident response capability.
The organization shall develop, document, and maintain a baseline configuration for its business-critical systems.
Guidance
- This control includes the concept of least functionality.
- Baseline configurations include for example, information about organization's business critical
systems, current version numbers and patch information on operating systems and applications,
configuration settings/parameters, network topology, and the logical placement of those
components within the system architecture.
- Network topology should include the nerve points of the IT/OT environment (external connections,
servers hosting data and/or sensitive functions, DNS services security, etc.).
The organization shall configure its business-critical systems to provide only essential capabilities.
Therefore, the baseline configuration shall be reviewed, and unnecessary capabilities shall be disabled.
Guidance
- Configuration of a system to provide only organization-defined mission essential capabilities is known
as the “concept of least functionality”.
- Capabilities include functions, ports, protocols, software, and/or services.
The system and application development life cycle shall include security considerations.
Guidance
- System and application development life cycle should include the acquisition process of the
organization's business critical systems and its components.
- Vulnerability awareness and prevention training for (web application) developers, and advanced
social engineering awareness training for high-profile roles should be considered.
- When hosting internet facing applications the implementation of a web application firewall (WAF)
should be considered.
The development process for critical systems and system components shall cover the full
design cycle and shall provide a description of the functional properties of security controls,
and design and implementation information for security-relevant system interfaces.
Guidance
The development cycle includes:
- All development phases: specification , design, development, implementation.
- Configuration management for planned and unplanned changes and change control during the
development.
- Flaw tracking & resolution.
- Security testing.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.