Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CyberFundamentals framework is created by Centre for Cyber security Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience.
The CyberFundamentals framework is created by Centre for Cybersecurity Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience. The framework is based on:
The Cyberfundamentals are structured in 4 levels, with a subsequent level containing a little more measures than the previous one each time. A beginner level Small, followed by Basic, Important and Essential. The Essential level contains all the basic information security mesures from previous ones and introduces more advanced controls. The essential level is in line with the NIS2 directive.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
The organization shall review and analyse detected events to understand attack targets and methods.
The organization shall implement automated mechanisms where feasible to review and analyse detected events.
Guidance
Consider reviewing your logs regularly to identify anomalies or abnormal events.
The activity logging functionality of protection / detection hardware or software (e.g. firewalls, anti-virus)
shall be enabled, backed-up and reviewed.
Guidance
- Logs should be backed up and saved for a predefined period.
- The logs should be reviewed for any unusual or unwanted trends, such as a large use of social media
websites or an unusual number of viruses consistently found on a particular computer. These trends
may indicate a more serious problem or signal the need for stronger protections in a particular area.
The organization shall ensure that event data is compiled and correlated across its critical
systems using various sources such as event reports, audit monitoring, network monitoring,
physical access monitoring, and user/administrator reports.
The organization shall integrate analysis of events where feasible with the analysis of
vulnerability scanning information; performance data; its critical system's monitoring, and
facility monitoring to further enhance the ability to identify inappropriate or unusual
activity.
Negative impacts to organization’s operations, assets, and individuals resulting from
detected events shall be determined and correlated with risk assessment outcomes.
The organization shall implement automated mechanisms and system generated alerts to
support event detection and to assist in the identification of security alert thresholds.
The organization shall define incident alert thresholds.
Firewalls shall be installed and operated on the network boundaries and completed with firewall protection on the endpoints.
Guidance
- Endpoints include desktops, laptops, servers...
- Consider, where feasible, including smart phones and other networked devices when installing and
operating firewalls.
- Consider limiting the number of interconnection gateways to the Internet.
The organization shall monitor and identify unauthorized use of its business-critical systems
through the detection of unauthorized local connections, network connections and remote connections.
Guidance
- Monitoring of network communications should happen at the external boundary of the
organization's business critical systems and at key internal boundaries within the systems.
- When hosting internet facing applications the implementation of a web application firewall (WAF)
should be considered.
The organization shall conduct ongoing security status monitoring of its network to detect
defined information/cybersecurity events and indicators of potential information/cybersecurity events.
Guidance
Security status monitoring should include:
- The generation of system alerts when indications of compromise or potential compromise occur.
- Detection and reporting of atypical usage of organization's critical systems.
- The establishment of audit records for defined information/cybersecurity events.
- Boosting system monitoring activity whenever there is an indication of increased risk.
- Physical environment, personnel, and service provider.
The physical environment of the facility shall be monitored for potential
information/cybersecurity events.
The physical access to organization's critical systems and devices shall be, on top of the
physical access monitoring to the facility, increased through physical intrusion alarms, surveillance equipment, independent surveillance teams.
Guidance
It is recommended to log all visitors.
Endpoint and network protection tools to monitor end-user behaviour for dangerous
activity shall be implemented.
Guidance
Consider deploying an Intrusion Detection/Prevention system (IDS/IPS).
Endpoint and network protection tools that monitor end-user behaviour for dangerous
activity shall be managed.
Guidance
• Consider using a centralized log platform for the consolidation and exploitation of log files.
• Consider to actively investigate the alerts generated because of suspicious activities and take the
appropriate actions to remediate the threat, e.g. through the deployment of a security operations
centre (SOC).
Software usage and installation restrictions shall be enforced.
Guidance
Only authorized software should be used, and user access rights should be limited to the specific data,
resources and applications needed to complete a required task (least privilege principle).
Anti-virus, -spyware, and other -malware programs shall be installed and updated.
Guidance
- Malware includes viruses, spyware, and ransomware and should be countered by installing, using,
and regularly updating anti-virus and anti-spyware software on every device used in company’s
business (including computers, smart phones, tablets, and servers).
- Anti-virus and anti-spyware software should automatically check for updates in “real-time” or at least
daily followed by system scanning as appropriate.
- It should be considered to provide the same malicious code protection mechanisms for home
computers (e.g. teleworking) or personal devices that are used for professional work (BYOD).
The organization shall set up a system to detect false positives while detecting and eradicating malicious code.
The organization shall define acceptable and unacceptable mobile code and mobile code technologies;
and authorize, monitor, and control the use of mobile code within the system.
Guidance
- Mobile code includes any program, application, or content that can be transmitted across a network
(e.g., embedded in an email, document, or website) and executed on a remote system. Mobile code technologies
include for example Java applets, JavaScript, HTML5, WebGL, and VBScript.
- Decisions regarding the use of mobile code in organizational systems should be based on the
potential for the code to cause damage to the systems if used maliciously. Usage restrictions and
implementation guidance should apply to the selection and use of mobile code installed.
All external connections by vendors supporting IT/OT applications or infrastructure shall be
secured and actively monitored to ensure that only permissible actions occur during the connection.
Guidance
This monitoring includes unauthorized personnel access, connections, devices, and software.
External service providers' conformance with personnel security policies and procedures
and contract security requirements shall be monitored relative to their cybersecurity risks.
The organization's business critical systems shall be monitored for unauthorized personnel access, connections, devices, access points, and software.
Guidance
- Unauthorized personnel access includes access by external service providers.
- System inventory discrepancies should be included in the monitoring.
- Unauthorized configuration changes to organization's critical systems should be included in the
monitoring.
Unauthorized configuration changes to organization's systems shall be monitored and
addressed with the appropriate mitigation actions.
The organization shall monitor and scan for vulnerabilities in its critical systems and hosted
applications ensuring that system functions are not adversely impacted by the scanning
process.
Guidance
Consider the implementation of a continuous vulnerability scanning program; Including reporting and
mitigation plans.
The vulnerability scanning process shall include analysis, remediation, and information
sharing.
The organization shall conduct detection activities in accordance with applicable federal and regional laws, industry regulations and standards, policies, and other applicable
requirements.
The organization shall validate that event detection processes are operating as intended.
Guidance
- Validation includes testing.
- Validation should be demonstrable.
The organization shall communicate event detection information to predefined parties.
Guidance
Event detection information includes for example, alerts on atypical account usage, unauthorized remote access, wireless connectivity, mobile device connection, altered configuration settings, contrasting system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, use of Voice over Internet Protocol (VoIP), and malware disclosure.
Improvements derived from the monitoring, measurement, assessment, testing, review,
and lessons learned, shall be incorporated into detection process revisions.
Guidance
- This results in a continuous improvement of the detection processes.
- The use of independent teams to assess the detection process could be considered.
The organization shall conduct specialized assessments including in-depth monitoring, vulnerability scanning, malicious user testing, insider threat assessment, performance/load testing, and verification and validation testing on the organization's critical systems.
Guidance
These activities can be outsourced, preferably to accredited organizations.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.