Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CyberFundamentals framework is created by Centre for Cyber security Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience.
The CyberFundamentals framework is created by Centre for Cybersecurity Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience. The framework is based on:
The Cyberfundamentals are structured in 4 levels, with a subsequent level containing a little more measures than the previous one each time. A beginner level Small, followed by Basic, Important and Essential. The Essential level contains all the basic information security mesures from previous ones and introduces more advanced controls. The essential level is in line with the NIS2 directive.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Changes shall be tested and validated before being implemented into operational systems.
For planned changes to the organization's critical systems, a security impact analysis shall
be performed in a separate test environment before implementation in an operational environment.
Backups for organization's business critical data shall be conducted and stored on a system
different from the device on which the original data resides.
Guidance
- Organization's business critical system's data includes for example software, configurations and
settings, documentation, system configuration data including computer configuration backups,
application configuration backups, etc.
- Consider a regular backup and put it offline periodically.
- Recovery time and recovery point objectives should be considered.
- Consider not storing the organization's data backup on the same network as the system on which the
original data resides and provide an offline copy. Among other things, this prevents file encryption
by hackers (risk of ransomware).
The reliability and integrity of backups shall be verified and tested on regular basis.
Guidance
This should include regular testing of the backup restore procedures.
Backup verification shall be coordinated with the functions in the organization that are
responsible for related plans.
Guidance
- Related plans include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of
Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, and Cyber Incident
response plans.
- Restoration of backup data during contingency plan testing should be provided.
A separate alternate storage site for system backups shall be operated and the same security safeguards as the primary storage location shall be employed.
Guidance
An offline backup of your data is ideally stored in a separate physical location from the original data source
and where feasible offsite for extra protection and security.
Critical system backup shall be separated from critical information backup.
Guidance
Separation of critical system backup from critical information backup should lead to a shorter recovery time.
The organization shall define, implement, and enforce policy and procedures regarding emergency and safety systems, fire protection systems, and environment controls for its critical systems.
Guidance
The below measures should be considered:
- Protect unattended computer equipment with padlocks or a locker and key system.
- Fire suppression mechanisms should take the organization's critical system environment into account
(e.g., water sprinkler systems could be hazardous in specific environments).
The organization shall implement fire detection devices that activate and notify key
personnel automatically in the event of a fire.
The organization shall ensure that its critical system's data is destroyed according to policy.
Guidance
- Disposal actions include media sanitization actions (See PR.DS-3)
- There are two primary types of media in common use:
- Hard copy media (physical representations of information)
- Electronic or soft copy media (the bits and bytes contained in hard drives, random access
memory (RAM), read-only memory (ROM), disks, memory devices, phones, mobile
computing devices, networking equipment…)
Sanitation processes shall be documented and tested.
Guidance
- Sanitation processes include procedures and equipment.
- Consider applying non-destructive sanitization techniques to portable storage devices.
- Consider sanitation procedures in proportion to confidentiality requirements.
The organization shall incorporate improvements derived from the monitoring, measurements, assessments, and lessons learned into protection process updates (continuous improvement).
The organization shall implement independent teams to assess the protection process(es).
Guidance
- Independent teams may include internal or external impartial personnel.
- Impartiality implies that assessors are free from any perceived or actual conflicts of interest regarding
the development, operation, or management of the organization's critical system under assessment
or to the determination of security control effectiveness.
The organization shall ensure that the security plan for its critical systems facilitates the
review, testing, and continual improvement of the security protection processes.
The organization shall collaborate and share information about its critical system's related security incidents and mitigation measures with designated partners.
Guidance
No additional guidance on this topic.
Communication of effectiveness of protection technologies shall be shared with appropriate parties.
Guidance
No additional guidance on this topic.
The organization shall implement, where feasible, automated mechanisms to assist in information collaboration.
Incident response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) shall be established, maintained, approved, and tested to determine the effectiveness of the plans, and the readiness to execute the plans.
Guidance
- The incident response plan is the documentation of a predetermined set of instructions or
procedures to detect, respond to, and limit consequences of a malicious cyber-attack.
- Plans should incorporate recovery objectives, restoration priorities, metrics, contingency roles,
personnel assignments and contact information.
- Maintaining essential functions despite system disruption, and the eventual restoration of the
organization’s systems, should be addressed.
- Consider defining incident types, resources and management support needed to effectively maintain
and mature the incident response and contingency capabilities.
The organization shall coordinate the development and the testing of incident response
plans and recovery plans with stakeholders responsible for related plans.
Guidance
Related plans include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of
Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber incident response
plans, and Occupant Emergency Plans.
Personnel having access to the organization’s most critical information or technology shall be verified.
Guidance
- The access to critical information or technology should be considered when recruiting, during
employment and at termination.
- Background verification checks should take into consideration applicable laws, regulations, and ethics
in proportion to the business requirements, the classification of the information to be accessed and
the perceived risks.
Develop and maintain a human resource information/cyber security process that is
applicable when recruiting, during employment and at termination of employment.
Guidance
The human resource information/cyber security process should include access to critical information or
technology; background verification checks; code of conduct; roles, authorities, and responsibilities…
The organization shall establish and maintain a documented process that allows continuous
review of vulnerabilities and strategies to mitigate them.
Guidance
- Consider inventorying sources likely to report vulnerabilities in the identified components and
distribute updates (software publisher websites, CERT website, ENISA website).
- The organization should identify where its critical system's vulnerabilities may be exposed to
adversaries.
Patches and security updates for Operating Systems and critical system components shall be installed.
Guidance
The following should be considered:
- Limit yourself to only install those applications (operating systems, firmware, or plugins ) that you
need to run your business and patch/update them regularly.
- You should only install a current and vendor-supported version of software you choose to use. It may
be useful to assign a day each month to check for patches.
- There are products which can scan your system and notify you when there is an update for an
application you have installed. If you use one of these products, make sure it checks for updates for
every application you use.
- Install patches and security updates in a timely manner.
The organization shall plan, perform, and document preventive maintenance and repairs on its critical system components according to approved processes and tools.
Guidance
The following should be considered:
- Perform security updates on all software in a timely manner.
- Automate the update process and audit its effectiveness.
- Introduce an internal patching culture on desktops, mobile devices, servers, network components,
etc. to ensure updates are tracked.
The organization shall prevent the unauthorized removal of maintenance equipment containing organization's critical system information.
Guidance
This requirement mainly focuses on OT/ICS environments.
The organization shall enforce approval requirements, control, and monitoring of maintenance tools for use on its critical systems.
Guidance
Maintenance tools can include hardware/software diagnostic test equipment, hardware/software packet
sniffers and laptops.
Maintenance tools and portable storage devices shall be inspected when brought into the
facility and shall be protected by anti-malware solutions so that they are scanned for
malicious code before they are used on organization's systems.
The organization shall verify security controls following hardware and software
maintenance or repairs/patching and take action as appropriate.
Remote maintenance shall only occur after prior approval, monitoring to avoid unauthorised access, and approval of the outcome of the maintenance activities as described in approved processes or procedures.
The organization shall require that diagnostic services pertaining to remote maintenance be performed from a system that implements a security capability comparable to the capability implemented on the equivalent organization's critical system.
The organization shall make sure that strong authenticators, record keeping, and session termination for remote maintenance is implemented.
Logs shall be maintained, documented, and reviewed.
Guidance
- Ensure the activity logging functionality of protection / detection hardware or software (e.g. firewalls,
anti-virus) is enabled.
- Logs should be backed up and saved for a predefined period.
- The logs should be reviewed for any unusual or unwanted trends, such as a large use of social media
websites or an unusual number of viruses consistently found on a particular computer. These trends
may indicate a more serious problem or signal the need for stronger protections in a particular area.
The organization shall ensure that the log records include an authoritative time source or internal clock time stamp that are compared and synchronized to an authoritative time source.
Guidance
Authoritative time sources include for example, an internal Network Time Protocol (NTP) server, radio
clock, atomic clock, GPS time source.
The organization shall ensure that audit processing failures on the organization's systems
generate alerts and trigger defined responses.
Guidance
The use of System Logging Protocol (Syslog) servers can be considered.
The organization shall enable authorized individuals to extend audit capabilities when
required by events.
The usage restriction of portable storage devices shall be ensured through an appropriate
documented policy and supporting safeguards.
Portable storage devices containing system data shall be controlled and protected while in
transit and in storage.
Guidance
Protection and control should include the scanning of all portable storage devices for malicious code
before they are used on organization's systems.
The organization should technically prohibit the connection of removable media unless
strictly necessary; in other instances, the execution of autoruns from such media should be
disabled.
The organization shall configure the business-critical systems to provide only essential
capabilities.
Guidance
Consider applying the principle of least functionality to access systems and assets (see also PR.AC-4).
The organization shall disable defined functions, ports, protocols, and services within its critical systems that it deems unnecessary.
The organization shall implement technical safeguards to enforce a deny-all, permit-byexception policy to only allow the execution of authorized software programs.
Guidance
- E-mail filters should detect malicious e-mails, and filtering should be configured based on the type of
message attachments so that files of the specified types are automatically processed (e.g. deleted).
- Web-filters should notify the user if a website may contain malware and potentially preventing users
from accessing that website.
The organization shall control the information flows/data flows within its critical systems
and between interconnected systems.
Guidance
Consider the following:
- Information flow may be supported, for example, by labelling or colouring physical connectors as an
aid to manual hook-up.
- Inspection of message content may enforce information flow policy. For example, a message
containing a command to an actuator may not be permitted to flow between the control network
and any other network.
- Physical addresses (e.g., a serial port) may be implicitly or explicitly associated with labels or
attributes (e.g., hardware I/O address). Manual methods are typically static. Label or attribute policy
mechanisms may be implemented in hardware, firmware, and software that controls or has device access, such as
device drivers and communications controllers.
The organization shall manage the interface for external communication services by
establishing a traffic flow policy, protecting the confidentiality and integrity of the
information being transmitted; This includes the review and documenting of each exception
to the traffic flow policy.
The organization shall ensure that a baseline of network operations and expected data flows for its critical
systems is developed, documented, and maintained to track events.
Guidance
- Consider enabling local logging on all your systems and network devices and keep them for a certain
period, for example up to 6 months.
- Ensure that your logs contain enough information (source, date, user, timestamp, etc.) and that you
have enough storage space for their generation.
- Consider centralizing your logs.
- Consider deploying a Security Information and Event Management tool (SIEM) that will facilitate the
correlation and analysis of your data.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.