CAF 4.0

Process for categorization of security incidents

Critical

High

Normal

Low

Definition and monitoring of alarm policies

Critical

High

Normal

Low

C1.f: Operational threat awareness

Threats to the operation of network and information systems, and corresponding user and system behaviour, are sufficiently understood. These are used to detect cyber security incidents.

Related tasks

The goals of threat intelligence and the collection of information related to information security threats

Critical

High

Normal

Low

Regular analysis and utilization of information related to information security threats

Critical

High

Normal

Low

Consideration of threat intelligence findings in the information security risk management process

Critical

High

Normal

Low

Monitoring the use of the network and information systems to identify anomalies

Critical

High

Normal

Low

Determining the baseline for network and data system usage for monitoring purposes

Critical

High

Normal

Low

C1.a: Logging and monitoring

The data sources and tools that the organisation includes in its logging and monitoring allow for timely identification of events which might adversely affect the security or resiliency of network and information systems supporting the operation of its essential function(s).

Related tasks

Deployment and regular analysis of security system logs

Critical

High

Normal

Low

Definition and monitoring of alarm policies

Critical

High

Normal

Low

Documentation of system logs for self-maintained data systems

Critical

High

Normal

Low

Protecting log information

Critical

High

Normal

Low

Identification and monitoring of event sources

Critical

High

Normal

Low

Monitoring the use of the network and information systems to identify anomalies

Critical

High

Normal

Low

C1.d: Alert contextualisation

The organisation contextualises alerts with knowledge of the threat and its systems, to identify security incidents as well as responding to all alerts appropriately.

Related tasks

Prioritization of security alerts

Critical

High

Normal

Low

Treatment process and documentation of occurred security incidents

Critical

High

Normal

Low

A3: Asset management

Everything required to deliver, maintain or support network and information systems necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).

Related tasks

Asset management strategy

Critical

High

Normal

Low

Cyber security in contracts

Defining cyber security responsibilities and tasks in employment contracts

Critical

High

Normal

Low

Data store listing and owner assignment

Critical

High

Normal

Low

Processing principles and accountability

Data system listing and owner assignment

Critical

High

Normal

Low

Documentation of interfaces for data systems

Critical

High

Normal

Low

Equipment maintenance and safety

Documentation of data sets for data stores

Critical

High

Normal

Low

Management of data sets

Documentation of assets inventories outside the ISMS

Critical

High

Normal

Low

Management of data sets

Documentation of other protected assets

Critical

High

Normal

Low

A2.a: Internal processes for risk management

The organisation has effective internal processes for managing risks to the security and resilience of network and information systems related to the operation of its essential function(s) and communicating associated activities.

Related tasks

Risk management procedure -report publishing and maintenance

Critical

High

Normal

Low

Risk management

Internal communication about the organization's risk situation

Critical

High

Normal

Low

Continuous improvement of the risk management process

Critical

High

Normal

Low

Risk management

A4.b: Secure software development and support

The organisation actively maximises the use of secure and supported software, whether developed internally or sourced externally, within network and information systems supporting the operation of its essential function(s).

Related tasks

Security rules for the development and acquisition of data systems

Critical

High

Normal

Low

General rules for the procurement of data systems

Critical

High

Normal

Low

Change management procedure for significant changes to data processing services

Critical

High

Normal

Low

Process for monitoring and tracking outsourced development work

Critical

High

Normal

Low

Guidelines for secure development

Critical

High

Normal

Low

Separation of production, testing and development environments

Critical

High

Normal

Low

Regular critical code identification and verification

Critical

High

Normal

Low

A4.a: Supplier risk management

The organisation understands and effectively manages the risks associated with suppliers to the security of network and information systems supporting the operation of its essential function(s).

Related tasks

Data processing agreement analysis for most important system providers

Critical

High

Normal

Low

Criteria for suppliers of high priority data systems

Critical

High

Normal

Low

Agreements and monitoring

Criteria for high priority partners

Critical

High

Normal

Low

Supplier security

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Documentation of partner contract status

Critical

High

Normal

Low

Agreements and monitoring

Documentation of other stakeholders

Critical

High

Normal

Low

Agreements and monitoring

Regular security assessment of partners in the supply chain of provided digital services

Critical

High

Normal

Low

Cloud service management

Supply chain cyber security risk management

Critical

High

Normal

Low

Supplier security

A1.b: Roles and responsibilities

The organisation has established roles and responsibilities for the security of network and information systems at all levels, with clear and well-understood channels for communicating and escalating risks.

Related tasks

Defining security roles and responsibilities

Critical

High

Normal

Low

ISMS description and maintenance

Critical

High

Normal

Low

D2.a: Post incident analysis

When an incident occurs, the organisation takes steps to understand its causes, informing appropriate remediating action.

Related tasks

Treatment process and documentation of occurred security incidents

Critical

High

Normal

Low

Regular periodic analysis and learning of incidents

Critical

High

Normal

Low

Follow-up analysis for security incidents

Critical

High

Normal

Low

Forensic investigation of incidents

Critical

High

Normal

Low

D2.b: Learning from incidents

The organisation uses lessons learned from incidents to improve its security measures.

Related tasks

Learning from testing operational resilience

Critical

High

Normal

Low

Regular periodic analysis and learning of incidents

Critical

High

Normal

Low

D1.c: Testing response plans

The organisation carries out exercises to test response plans, using past incidents that affected its own (and other) organisations, as well as scenarios that draw on threat intelligence and its risk assessment.

Related tasks

Conducting incident response exercises

Critical

High

Normal

Low

Regular testing and review of continuity plans

Critical

High

Normal

Low

Continuity management

Consideration of threat intelligence findings in the information security risk management process

Critical

High

Normal

Low

D1.b: Response and recovery capability

The organisation has the capability to enact its incident response plan, including effective limitation of impact on the operation of its essential function(s). During an incident, the organisation has access to timely information on which to base its response decisions.

Related tasks

Defining threshold for incident recovery measures

Critical

High

Normal

Low

Creating and maintaining incident response plans

Critical

High

Normal

Low

The first level response process to security incidents

Critical

High

Normal

Low

Developing an incident response plan for critical information systems

Critical

High

Normal

Low

Continuity management

D1.a: Response plan

The organisation has an up-to-date incident response plan that is grounded in a thorough risk assessment that takes account of network and information systems supporting the operation of its essential function(s) and covers a range of incident scenarios.

Related tasks

Establishing and maintaining an incident response process

Critical

High

Normal

Low

Creating and maintaining incident response plans

Critical

High

Normal

Low

Developing an incident response plan for critical information systems

Critical

High

Normal

Low

Continuity management

B6.a: Cyber security culture

The organisation develops and maintains a positive cyber security culture and a shared sense of responsibility.

Related tasks

Establishing and maintaining security awareness training

Critical

High

Normal

Low

Cyber security in contracts

Defining cyber security responsibilities and tasks in employment contracts

Critical

High

Normal

Low

Regular unit-based cyber security communication

Critical

High

Normal

Low

Evaluating the efficiency of arranged training

Critical

High

Normal

Low

Staff guidance and training procedure in cyber security

Critical

High

Normal

Low

B4.c: Secure management

The organisation manages its own network and information systems that support the operation of its essential function(s) to enable and maintain security.

Related tasks

Ensure that the necessary security functions are implemented in an ICT system

Critical

High

Normal

Low

Description of cyber security structure

Critical

High

Normal

Low

Management commitment to cyber security management and management system

Critical

High

Normal

Low

A strategy for cyber security architecture

Critical

High

Normal

Low