C2M2

6.1: Detect Cybersecurity Events

Related tasks

The first level response process to security incidents

Critical

High

Normal

Low

Designation of an incident management team

Critical

High

Normal

Low

RESPONSE-1: Detect Cybersecurity Events

MIL1 requirements
a. Detected cybersecurity events are reported to a specified person or role and documented, at least in an ad hoc manner

MIL2 requirements
b. Criteria are established for cybersecurity event detection (for example, what constitutes a cybersecurity event, where to look for cybersecurity events)
c. Cybersecurity events are documented based on the established criteria

MIL3 requirements
d. Event information is correlated to support incident analysis by identifying patterns, trends, and other common features
e. Cybersecurity event detection activities are adjusted based on identified risks and the organization’s threat profile (THREAT-2e)
f. Situational awareness for the function is monitored to support the identification of cybersecurity events

Related tasks

The first level response process to security incidents

Critical

High

Normal

Low

Designation of an incident management team

Critical

High

Normal

Low

Identification and monitoring of event sources

Critical

High

Normal

Low

RESPONSE-2: Analyze Cybersecurity Events and Declare Incidents

MIL1 requirements
a. Criteria for declaring cybersecurity incidents are established, at least in an ad hoc manner
b. Cybersecurity events are analyzed to support the declaration of cybersecurity incidents, at least in an ad hoc manner

MIL2 requirements
c. Cybersecurity incident declaration criteria are formally established based on potential impact to the function
d. Cybersecurity events are declared to be incidents based on established criteria
e. Cybersecurity incident declaration criteria are updated periodically and according to defined triggers, such as organizational changes, lessons learned from plan execution, or newly identified threats
f. There is a repository where cybersecurity events and incidents are documented and tracked to closure
g. Internal and external stakeholders (for example, executives, attorneys, government agencies, connected organizations, vendors, sector organizations, regulators) are identified and notified of incidents based on situational awareness reporting requirements (SITUATION-3d)

MIL3 requirements
h. Criteria for cybersecurity incident declaration are aligned with cyber risk prioritization criteria (RISK-3b)
i. Cybersecurity incidents are correlated to identify patterns, trends, and other common features across multiple incidents

Related tasks

Defining cyber security metrics for cyber security breaches

Critical

High

Normal

Low

Ensuring sorting of cyber security events

Critical

High

Normal

Low

Defining threshold for cyber security breach

Critical

High

Normal

Low

6.3: Respond to Cybersecurity Incidents

Related tasks

The first level response process to security incidents

Critical

High

Normal

Low

Designation of an incident management team

Critical

High

Normal

Low

RESPONSE-3: Respond to Cybersecurity Incidents

MIL1 requirements
a. Cybersecurity incident response personnel are identified, and roles are assigned, at least in an ad hoc manner
b. Responses to cybersecurity incidents are executed, at least in an ad hoc manner, to limit impact to the function and restore normal operations
c. Reporting of incidents is performed (for example, internal reporting, ICS-CERT, relevant ISACs), at least in an ad hoc manner

MIL2 requirements
d. Cybersecurity incident response plans that address all phases of the incident lifecycle are established and maintained
e. Cybersecurity incident response is executed according to defined plans and procedures
f. Cybersecurity incident response plans include a communications plan for internal and external stakeholders
g. Cybersecurity incident response plan exercises are conducted periodically and according to defined triggers, such as system changes and external events
h. Cybersecurity incident lessons-learned activities are performed and corrective actions are taken, including updates to the incident response plan

MIL3 requirements
i. Cybersecurity incident root-cause analysis is performed and corrective actions are taken, including updates to the incident response plan
j. Cybersecurity incident responses are coordinated with vendors, law enforcement, and other external entities as appropriate, including support for evidence collection and preservation
k. Cybersecurity incident response personnel participate in joint cybersecurity exercises with other organizations
l. Cybersecurity incident responses leverage and trigger predefined states of operation (SITUATION-3g)

Related tasks

The first level response process to security incidents

Critical

High

Normal

Low

Designation of an incident management team

Critical

High

Normal

Low

Communication in accordance with the incident response plan in the event of a incident

Critical

High

Normal

Low

Continuity management

RESPONSE-4: Address Cybersecurity in Continuity of Operations

MIL1 requirements
a. Continuity plans are developed to sustain and restore operation of the function if a cybersecurity event or incident occurs, at least in an ad hoc manner
b. Data backups are available and tested, at least in an ad hoc manner
c. IT and OT assets requiring spares are identified, at least in an ad hoc manner

MIL2 requirements
d. Continuity plans address potential impacts from cybersecurity incidents
e. The assets and activities necessary to sustain minimum operations of the function are identified and documented in continuity plans
f. Continuity plans address IT, OT, and information assets that are important to the delivery of the function, including the availability of backup data and replacement, redundant, and spare IT and OT assets
g. Recovery time objectives (RTOs) and recovery point objectives (RPOs) for assets that are important to the delivery of the function are incorporated into continuity plans
h. Cybersecurity incident criteria that trigger the execution of continuity plans are established and communicated to incident response and continuity management personnel
i. Continuity plans are tested through evaluations and exercises periodically and according to defined triggers, such as system changes and external events
j. Cybersecurity controls protecting backup data are equivalent to or more rigorous than controls protecting source data
k. Data backups are logically or physically separated from source data
l. Spares for selected IT and OT assets are available

MIL3 requirements
m. Continuity plans are aligned with identified risks and the organization’s threat profile (THREAT-2e) to ensure coverage of identified risk categories and threats
n. Continuity plan exercises address higher priority risks
o. The results of continuity plan testing or activation are compared to recovery objectives, and plans are improved accordingly
p. Continuity plans are periodically reviewed and updated

Related tasks

Creating and documenting continuity plans

Critical

High

Normal

Low

Continuity management

Multiple providers for critical network equipment

Critical

High

Normal

Low

Supplier security

Regular testing, evaluation, and recovery instructions for backups

Critical

High

Normal

Low

Backups

Documenting and delegating ownership of own backup processes

Critical

High

Normal

Low

Backups

Agreements and monitoring

THIRD-PARTIES-1: Identify and Prioritize Third Parties

MIL1 requirements
a. Important IT and OT third-party dependencies are identified (that is, internal and external parties on which the delivery of the function depends, including operating partners), at least in an ad hoc manner
b. Third parties that have access to, control of, or custody of any IT, OT, or information assets that are important to the delivery of the function are identified, at least in an ad hoc manner

MIL2 requirements
c. A defined method is followed to identify risks arising from suppliers and other third parties
d. Third parties are prioritized according to established criteria (for example, importance to the delivery of the function, impact of a compromise or disruption, ability to negotiate cybersecurity requirements within contracts)
e. Escalated prioritization is assigned to suppliers and other third parties whose compromise or disruption could cause significant consequences (for example, singlesource suppliers, suppliers with privileged access)

MIL3 requirements
f. Prioritization of suppliers and other third parties is updated periodically and according to defined triggers, such as system changes and external events

Related tasks

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Identifying critical IT partners

Critical

High

Normal

Low

Supplier security

THIRD-PARTIES-2: Manage Third-Party Risk

MIL1 requirements
a. The selection of suppliers and other third parties includes consideration of their cybersecurity qualifications, at least in an ad hoc manner
b. The selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc manner

MIL2 requirements
c. A defined method is followed to identify cybersecurity requirements and implement associated controls that protect against the risks arising from suppliers and other third parties
d. A defined method is followed to evaluate and select suppliers and other third parties
e. More rigorous cybersecurity controls are implemented for higher priority suppliers and other third parties
f. Cybersecurity requirements (for example, vulnerability notification, incident-related SLA requirements) are formalized in agreements with suppliers and other third parties
g. Suppliers and other third parties periodically attest to their ability to meet cybersecurity requirements

MIL3 requirements
h. Cybersecurity requirements for suppliers and other third parties include secure software and secure product development requirements where appropriate
i. Selection criteria for products include consideration of end-of-life and end-of-support timelines
j. Selection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and services
k. Selection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and software
l. Selection criteria for higher priority assets include evaluation of any associated third-party hosting environments and source data
m. Acceptance testing of procured assets includes consideration of cybersecurity requirements

Related tasks

General rules for the procurement of data systems

Critical

High

Normal

Low

Data system procurement

Criteria for high priority partners

Critical

High

Normal

Low

Supplier security

Changes in employment relationships

WORKFORCE-1: Implement Workforce Controls

MIL1 requirements
a. Personnel vetting (for example, background checks, drug tests) is performed at hire, at least in an ad hoc manner
b. Personnel separation procedures address cybersecurity, at least in an ad hoc manner

MIL2 requirements
c. Personnel vetting is performed at hire and periodically for positions that have access to assets that are important to the delivery of the function
d. Personnel separation and transfer procedures address cybersecurity, including supplementary vetting as appropriate
e. Personnel are made aware of their responsibilities for protection and acceptable use of IT, OT, and information assets

MIL3 requirements
f. Vetting is performed for all positions (including employees, vendors, and contractors) at a level commensurate with position risk
g. A formal accountability process that includes disciplinary actions is implemented for personnel who fail to comply with established security policies and procedures

Related tasks

Process for removing hardware and access rights at termination of employment relationship

Critical

High

Normal

Low

Screenings and background checks before recruitment

Critical

High

Normal

Low

Changes in employment relationships

WORKFORCE-2: Increase Cybersecurity Awareness

MIL1 requirements
a. Cybersecurity awareness activities occur, at least in an ad hoc manner

MIL2 requirements
b. Cybersecurity awareness objectives are established and maintained
c. Cybersecurity awareness objectives are aligned with the defined threat profile (THREAT2e)
d. Cybersecurity awareness activities are conducted periodically

MIL3 requirements
e. Cybersecurity awareness activities are tailored to job role
f. Cybersecurity awareness activities address predefined states of operation (SITUATION-3g)
g. The effectiveness of cybersecurity awareness activities is evaluated periodically and according to defined triggers, such as system changes and external events, and improvements are made as appropriate

Related tasks

Staff guidance and training procedure in cyber security

Critical

High

Normal

Low

Cyber security training

General security competence and awareness of personnel

Critical

High

Normal

Low

Informing staff about new, relevant malware

Critical

High

Normal

Low

Malware protection

8.3: Assign Cybersecurity Responsibilities

Related tasks

ISMS description and maintenance

Critical

High

Normal

Low

WORKFORCE-3: Assign Cybersecurity Responsibilities

MIL1 requirements
a. Cybersecurity responsibilities for the function are identified, at least in an ad hoc manner
b. Cybersecurity responsibilities are assigned to specific people, at least in an ad hoc manner

MIL2 requirements
c. Cybersecurity responsibilities are assigned to specific roles, including external service providers
d. Cybersecurity responsibilities are documented

MIL3 requirements
e. Cybersecurity responsibilities and job requirements are reviewed and updated periodically and according to defined triggers, such as system changes and changes to organizational structure
f. Assigned cybersecurity responsibilities are managed to ensure adequacy and redundancy of coverage, including succession planning

Related tasks

Defining security roles and responsibilities

Critical

High

Normal

Low

ISMS description and maintenance

Critical

High

Normal

Low

WORKFORCE-4: Develop Cybersecurity Workforce

MIL1 requirements
a. Cybersecurity training is made available to personnel with assigned cybersecurity responsibilities, at least in an ad hoc manner
b. Cybersecurity knowledge, skill, and ability requirements and gaps are identified for both current and future operational needs, at least in an ad hoc manner

MIL2 requirements
c. Identified cybersecurity knowledge, skill, and ability gaps are addressed through training, recruiting, and retention efforts
d. Cybersecurity training is provided as a prerequisite to granting access to assets that are important to the delivery of the function

MIL3 requirements
e. The effectiveness of training programs is evaluated periodically, and improvements are made as appropriate
f. Training programs include continuing education and professional development opportunities for personnel with significant cybersecurity responsibilities

Related tasks

Maintaining a log of cyber security trainings

Critical

High

Normal

Low

Cyber security training

General security competence and awareness of personnel

Critical

High

Normal

Low

ARCHITECTURE-1: Establish and Maintain Cybersecurity Architecture Strategy and Program

MIL1 requirements
a. The organization has a strategy for cybersecurity architecture, which may be developed and managed in an ad hoc manner

MIL2 requirements
b. A strategy for cybersecurity architecture is established and maintained in alignment with the organization’s cybersecurity program strategy (PROGRAM-1b) and enterprise architecture
c. A documented cybersecurity architecture is established and maintained that includes IT and OT systems and networks and aligns with system and asset categorization and prioritization
d. Governance for cybersecurity architecture (such as an architecture review process) is established and maintained that includes provisions for periodic architectural reviews and an exceptions process
e. Senior management sponsorship for the cybersecurity architecture program is visible and active
f. The cybersecurity architecture establishes and maintains cybersecurity requirements for the organization’s assets
g. Cybersecurity controls are selected and implemented to meet cybersecurity requirements

MIL3 requirements
h. The cybersecurity architecture strategy and program are aligned with the organization’s enterprise architecture strategy and program
i. Conformance of the organization’s systems and networks to the cybersecurity architecture is evaluated periodically and according to defined triggers, such as system changes and external events
j. The cybersecurity architecture is guided by the organization’s risk analysis information (RISK-3d) and threat profile (THREAT-2e)
k. The cybersecurity architecture addresses predefined states of operation (SITUATION-3g)

Related tasks

A strategy for cyber security architecture

Critical

High

Normal

Low

ARCHITECTURE-2: Implement Network Protections as an Element of the Cybersecurity Architecture

MIL1 requirements
a. Network protections are implemented, at least in an ad hoc manner
b. The organization’s IT systems are separated from OT systems through segmentation, either through physical means or logical means, at least in an ad hoc manner

MIL2 requirements
c. Network protections are defined and enforced for selected asset types according to asset risk and priority (for example, internal assets, perimeter assets, assets connected to the organization’s Wi-Fi, cloud assets, remote access, and externally owned devices)
d. Assets that are important to the delivery of the function are logically or physically segmented into distinct security zones based on asset cybersecurity requirements
e. Network protections incorporate the principles of least privilege and least functionality
f. Network protections include monitoring, analysis, and control of network traffic for selected security zones (for example, firewalls, allowlisting, intrusion detection and prevention systems (IDPS))
g. Web traffic and email are monitored, analyzed, and controlled (for example, malicious link blocking, suspicious download blocking, email authentication techniques, IP address blocking)

MIL3 requirements
h. All assets are segmented into distinct security zones based on cybersecurity requirements
i. Separate networks are implemented, where warranted, that logically or physically segment assets into security zones with independent authentication
j. OT systems are operationally independent from IT systems so that OT operations can be sustained during an outage of IT systems
k. Device connections to the network are controlled to ensure that only authorized devices can connect (for example, network access control (NAC))
l. The cybersecurity architecture enables the isolation of compromised assets

Related tasks

Network areas and structurally secure network design

Critical

High

Normal

Low

Network security

Network segmentation and filtering practices within the classification level

Critical

High

Normal

Low

Network security

Choosing and using network protection systems

Critical

High

Normal

Low

Virtualization

Structural security of the network

Critical

High

Normal

Low

Network security

A strategy for cyber security architecture

Critical

High

Normal

Low