Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CyberFundamentals framework is created by Centre for Cyber security Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience.
The CyberFundamentals framework is created by Centre for Cybersecurity Belgium. It provides a set of concrete measures to protect your data, significantly reduce the risk of the most common cyber-attacks, and increase your organisation's cyber resilience. The framework is based on:
The Cyberfundamentals are structured in 4 levels, with a subsequent level containing a little more measures than the previous one each time. A beginner level Small, followed by Basic, Important and Essential. The Essential level contains all the basic information security mesures from previous ones and introduces more advanced controls. The essential level is in line with the NIS2 directive.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
An incident response process, including roles, responsibilities, and authorities, shall be executed during or after an information/cybersecurity event on the organization's critical systems.
Guidance
- The incident response process should include a predetermined set of instructions or procedures to detect, respond to, and limit consequences of a malicious cyber-attack.
- The roles, responsibilities, and authorities in the incident response plan should be specific on involved people, contact info, different roles and responsibilities, and who makes the decision to initiate recovery procedures as well as who will be the contact with appropriate external stakeholders.
- It should be considered to determine the causes of an information/cybersecurity event and implement a corrective action in order that the event does not recur or occur elsewhere (an infection by malicious code on one machine did not have spread elsewhere in the network). The effectiveness of any corrective action taken should be reviewed. Corrective actions should be appropriate to the effects of the information/cybersecurity event encountered.
The organization shall ensure that personnel understand their roles, objectives, restoration priorities, task sequences (order of operations) and assignment responsibilities for event response.
Guidance
Consider the use the CCB Incident Management Guide to guide you through this exercise and consider bringing in outside experts if needed. Test your plan regularly and adjust it after each incident.
The organization shall implement reporting on information/cybersecurity incidents on its
critical systems in an organization-defined time frame to organization-defined personnel or roles.
Guidance
All users should have a single point of contact to report any incident and be encouraged to do so.
Events shall be reported consistent with established criteria.
Guidance
Criteria to report should be included in the incident response plan.
Information/cybersecurity incident information shall be communicated and shared with the
organization’s employees in a format that they can understand.
The organization shall share information/cybersecurity incident information with relevant
stakeholders as foreseen in the incident response plan.
The organization shall coordinate information/cybersecurity incident response actions with all predefined stakeholders.
Guidance
- Stakeholders for incident response include for example, mission/business owners, organization's critical system owners, integrators, vendors, human resources offices, physical and personnel security offices, legal departments, operations personnel, and procurement offices.
- Coordination with stakeholders occurs consistent with incident response plans.
The organization shall share information/cybersecurity event information voluntarily, as
appropriate, with external stakeholders, industry security groups… to achieve broader
information/cybersecurity situational awareness.
The organization shall investigate information/cybersecurity-related notifications
generated from detection systems.
The organization shall implement automated mechanisms to assist in the investigation and
analysis of information/cybersecurity-related notifications.
Thorough investigation and result analysis shall be the base for understanding the full
implication of the information/cybersecurity incident.
Guidance
- Result analysis can involve the outcome of determining the correlation between the information of the detected event and the outcome of risk assessments. In this way, insight is gained into the impact
of the event across the organization.
- Consider including detection of unauthorized changes to its critical systems in its incident response capabilities.
The organization shall implement automated mechanisms to support incident impact analysis.
Guidance
Implementation could vary from a ticketing system to a Security Information and Event Management (SIEM).
The organization shall provide on-demand audit review, analysis, and reporting for after-the-fact investigations of information/cybersecurity incidents.
The organization shall conduct forensic analysis on collected information/cybersecurity
event information to determine root cause.
Guidance
Consider determining the root cause of an incident. If necessary, use forensics analysis on collected information/cybersecurity event information to achieve this.
Information/cybersecurity incidents shall be categorized according to the level of severity and impact consistent with the evaluation criteria included the incident response plan.
Guidance
- It should be considered to determine the causes of an information/cybersecurity incident and implement a corrective action in order that the incident does not recur or occur elsewhere.
- The effectiveness of any corrective action taken should be reviewed.
- Corrective actions should be appropriate to the effects of the information/cybersecurity incident encountered.
The organization shall implement vulnerability management processes and procedures that
include processing, analysing and remedying vulnerabilities from internal and external
sources.
Guidance
Internal and external sources could be e.g. internal testing, security bulletins, or security researchers.
The organization shall implement automated mechanisms to disseminate and track
remediation efforts for vulnerability information, captured from internal and external
sources to key stakeholders.
The organization shall implement an incident handling capability for information/cybersecurity incidents on its business-critical systems that includes
preparation, detection and analysis, containment, eradication, recovery, and documented
risk acceptance.
Guidance
A documented risk acceptance deals with risks that the organization assesses as not dangerous to the organization’s business critical systems and where the risk owner formally accepts the risk (related with the risk appetite of the organization)
The organization shall conduct post-incident evaluations to analyse lessons learned from
incident response and recovery, and consequently improve processes/procedures/technologies to enhance its cyber resilience.
Guidance
Consider bringing involved people together after each incident and reflect together on ways to improve what happened, how it happened, how we reacted, how it could have gone better, what should be done to prevent it from happening again, etc.
Lessons learned from incident handling shall be translated into updated or new incident
handling procedures that shall be tested, approved and trained.
The organization shall update the response and recovery plans to address changes in its
context.
Guidance
The organization’s context relates to the organizational structure, its critical systems, attack vectors, new threats, improved technology, environment of operation, problems encountered during plan implementation/execution/testing and lessons learned.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.