Attachment_11_IT_Security_Questionniare_CAIQ-v3.1_Final.xlsx

437 KB Posted

Attached to
Mobile App Replacement
Solicitation number
S-177000-00016166
Issued by
Marion County, Oregon

About this file

Written by GovTribe AI ·

This document is the Consensus Assessments Initiative Questionnaire (CAIQ) Version 3.1, maintained by the Cloud Security Alliance (CSA), a global consortium focused on cloud security best practices. The CAIQ serves as a standardized assessment tool enabling cloud consumers and auditors to evaluate the security posture and compliance capabilities of cloud service providers against established industry standards and frameworks. The questionnaire does not constitute a procurement document but rather functions as a comprehensive security control assessment matrix containing over 300 yes-or-no questions organized across 16 control domains including Application & Interface Security, Audit Assurance & Compliance, Business Continuity Management, Data Security & Information Lifecycle Management, Datacenter Security, Encryption & Key Management, Governance and Risk Management, Human Resources, Identity & Access Management, Infrastructure & Virtualization Security, Interoperability & Portability, Mobile Security, Security Incident Management, Supply Chain Management, and Threat and Vulnerability Management.

The CAIQ Version 3.1, published on September 30, 2019, incorporates updates and revisions to its predecessor CAIQ v3.0.1 and maps assessed controls to multiple compliance frameworks including ISO/IEC 27001:2013, NIST SP 800-53 R3, PCI DSS v3.2, HIPAA/HITECH, FedRAMP, SOC 2, COBIT 5.0, and numerous other regulatory and standards bodies such as GDPR, PIPEDA, and industry-specific requirements. The document includes detailed control specifications, consensus assessment questions, answer options, compliance mappings, change logs documenting substantive and editorial modifications, and guiding principles establishing the questionnaire's structure and intended use. No pricing, contract terms, renewal options, incumbent contractors, or funding mechanisms are specified, as the CAIQ functions as a voluntary security assessment framework rather than a solicitation for goods or services.

View the file

Other files

File Type Posted
Attachment_13_Vendor_Personal_Disclosure_Form_Final.pdf PDF
Attachment_12_Major_Procurement_Vendor_Disclosure_Final.pdf PDF
Attachment_15_Proposer_Information_and_Certification_Final.docx DOCX document
Attachment_03_Functional_and_Technical_Requirements_Matrix_Final.xlsx XLSX spreadsheet
Attachment_10_Preliminary_Security_Questionnaire_Final.pdf PDF
Attachment_14_601.13_Vendor_Employee_Disclosure_Final.pdf PDF
Addend-No1_RFP_S-177000-00016166_Mobile App Replacement and Associated Technology Solutions.pdf PDF
Addend-No4_RFP_S-177000-00016166_Mobile App Replacement and Associated Technology Solutions.pdf PDF
Attachment_16-A_Sample_Discovery_Phase_Contract_Final.docx DOCX document
Attachment_04_Discovery-Phase-Commitment_Final.docx DOCX document
Attachment_08_COBID_Outreach_Plan_Final.docx DOCX document
Addend-No2_RFP_S-177000-00016166_Mobile App Replacement and Associated Technology Solutions~1.pdf PDF
Attachment_01_Key-Persons-Resumes_Final.docx DOCX document
Attachment_06_Questions_Clarifications_Template_Final.docx DOCX document
Attachment_07_Disclosure_Exemption_Affidavit_Form_Final.docx DOCX document
Attachment_09_Procurement_Pre-Assessment_Checklist_Final.pdf PDF
S-177000-00016166_RFP_Mobile App Replacement and Associated Technology Solutions_Final.docx DOCX document
Attachment_17_Confidentiality_and_Non-Disclosure_Final.docx DOCX document
Attachment_05_Pricing_Proposal_Final.docx DOCX document
Attachment_02_Proposer-Past-Performance-and-References_Final.docx DOCX document
Attachment_16-B_Sample_Long-Term_Contract_Final.docx DOCX document
Addend-No3_RFP_S-177000-00016166_Mobile App Replacement and Associated Technology Solutions.pdf PDF
Show all 22

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Introduction

Description
This document is the CAIQ v3.1, that contains an updated questionnaire since its predecessor CAIQ v3.0.1.

CAIQ provices a cloud consumer and cloud auditor with the opportunity to ascertain that their cloud service provider is compliant to the Cloud Controls Matrix (CCM). Therefore, it helps cloud customers to gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure.

The document is structured as follows. The "CSA CAIQ v3.1" tab contains the CAIQ questionnaire, in which columns A-D contain the CCM v3.0.1 controls, column E the consensus assessment questions and W-Y the column for the answers. The "Changelog" provides the list of changes applied to the CAIQ in terms of edited/shifted/ new created questions.

The CSA and the CCM working group hope that organizations will find this document useful for their cloud security compliance programs.

The contents of this document could contain technical inaccuracies, typographical errors and out-of-date information.

If you would like to volunteer in the CCM working group, please sign up here: https://cloudsecurityalliance.org/research/join-working-group/

Acknowledgements
Contributors
Jon-Michael Brook

Kevin Bugin Angela Dogan Shawn Harris Harry Lu Kevin Pike Michael Roza Dinesh Udaiwal Andrew Williams

CSA Staff

Daniele Catteddu Victor Chin Alain Pannetrat Eleftherios Skoutaris

Change Log
DateVersionNotes
30/09/20191Publication of the Consensus Assessments Initiative Questionnaire (CAIQ) version 3.1.
© Copyright 2019, Cloud Security Alliance. All rights reserved

CAIQ v3.1

CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.1
Control DomainControl IDQuestion IDControl SpecificationConsensus Assessment QuestionsConsensus Assessment AnswersNotesCCM v3.0.1 Compliance Mapping
AICPA TSC 2009AICPA
Trust Service Criteria (SOC 2SM Report)AICPA TSC 2014BITS Shared Assessments
AUP v5.0BITS Shared Assessments
SIG v6.0BSI GermanyCanada PIPEDACIS-AWS-Foundations v1.1COBIT 4.1COBIT 5.0COPPACSA Enterprise Architecture (formerly the Trusted Cloud Initiative)CSA Guidance V3.0ENISA IAFFedRAMP Security Controls

(Final Release, Jan 2012) --LOW IMPACT LEVEL-- FedRAMP Security Controls (Final Release, Jan 2012)

--MODERATE IMPACT LEVEL--FERPAGAPP (Aug 2009)HIPAA/HITECH (Omnibus Rule)HITRUST CSF v8.1ISO/IEC 27001:2005ISO/IEC 27001:2013ITARJericho ForumMexico - Federal Law on Protection of Personal Data Held by Private PartiesNERC CIPNIST SP800-53 R3NIST SP800-53 R4 Appendix JNZISMNZISM v2.5ODCA UM: PA R2.0PCI DSS v2.0PCI DSS v3.0PCI DSS v3.2Shared Assessments 2017 AUP
YesNoNot ApplicableDomain > Container > CapabilityPublicPrivatePA IDPA level
Application & Interface Security
Application SecurityAIS-01AIS-01.1Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.Do you use industry standards (i.e. OWASP Software Assurance Maturity Model, ISO 27034) to build in security for your Systems/Software Development Lifecycle (SDLC)?S3.10.0(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies. CC7.1 I.4 G.16.3, I.3 - Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 - AI2.4 APO09.03

APO13.01

BAI03.01

BAI03.02

BAI03.03

BAI03.05

MEA03.01

MEA03.02 312.8 and 312.10 Application Services > Development Process > Software Quality Assurance shared x Domain 10 6.03.01. ( c ) NIST SP 800-53 R3 SC-5

NIST SP 800-53 R3 SC-6

NIST SP 800-53 R3 SC-7

NIST SP 800-53 R3 SC-12

NIST SP 800-53 R3 SC-13

NIST SP 800-53 R3 SC-14 NIST SP 800-53 R3 SA-8

NIST SP 800-53 R3 SC-2

NIST SP 800-53 R3 SC-4

NIST SP 800-53 R3 SC-5

NIST SP 800-53 R3 SC-6

NIST SP 800-53 R3 SC-7

NIST SP 800-53 R3 SC-7 (1)

NIST SP 800-53 R3 SC-7 (2)

NIST SP 800-53 R3 SC-7 (3)

NIST SP 800-53 R3 SC-7 (4)

NIST SP 800-53 R3 SC-7 (5)

NIST SP 800-53 R3 SC-7 (7)

NIST SP 800-53 R3 SC-7 (8)

NIST SP 800-53 R3 SC-7 (12)

NIST SP 800-53 R3 SC-7 (13)

NIST SP 800-53 R3 SC-7 (18)

NIST SP 800-53 R3 SC-8

NIST SP 800-53 R3 SC-8 (1)

NIST SP 800-53 R3 SC-9

NIST SP 800-53 R3 SC-9 (1)

NIST SP 800-53 R3 SC-10

NIST SP 800-53 R3 SC-11

NIST SP 800-53 R3 SC-12

NIST SP 800-53 R3 SC-12 (2)

NIST SP 800-53 R3 SC-12 (5)

NIST SP 800-53 R3 SC-13

NIST SP 800-53 R3 SC-13 (1)

NIST SP 800-53 R3 SC-14

NIST SP 800-53 R3 SC-17

NIST SP 800-53 R3 SC-18 - 1.2.6 45 CFR 164.312(e)(2)(i) 10.b;10.c;10.e A.11.5.6 A.11.6.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.5.2 A.12.5.4 A.12.5.5 A.12.6.1 A.15.2.1 A9.4.2 A9.4.1, 8.1*Partial, A14.2.3, 8.1*partial, A.14.2.7 A12.6.1, A18.2.2 - Commandment #1 Commandment #2 Commandment #4 Commandment #5 Commandment #11 - CIP-007-3 - R5.1 SC-2

SC-3

SC-4

SC-5

SC-6

SC-7

SC-8

SC-9

SC-10

SC-11

SC-12

SC-13

SC-14

SC-17

SC-18

SC-20

SC-21

SC-22

SC-23AR-7 The organization designs information systems to support privacy by automating privacy controls.14.5
14.64.3.8.C.01.

14.4.4.C.01.

14.4.5.C.01.

14.4.6.C.01.

14.4.6.C.02.

14.4.6.C.03.

14.5.6.C.01.

14.5.7.C.01.

14.5.8.C.01.PA17
PA31SGP
BSGP6.56, 6.56, 6.5I.13
AIS-01.2Do you use an automated source code analysis tool to detect security defects in code prior to production?
AIS-01.3Do you use manual source-code analysis to detect security defects in code prior to production?
AIS-01.4Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?
AIS-01.5(SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?
Application & Interface Security
Customer Access RequirementsAIS-02AIS-02.1Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed.Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?S3.2a(S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.CC5.1-C.2.1, C.2.3, C.2.4, C.2.6.1, H.110 (B)
11 (A+)Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3--APO09.01

APO09.02

APO09.03

APO13.01

BAI02

DSS05

312.3, 312.8 and 312.10 BOSS > Legal Services > Contracts shared x Domain 10 - NIST SP 800-53 R3 CA-1

NIST SP 800-53 R3 CA-2

NIST SP 800-53 R3 CA-2 (1)

NIST SP 800-53 R3 CA-5

NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-1

NIST SP 800-53 R3 CA-2

NIST SP 800-53 R3 CA-2 (1)

NIST SP 800-53 R3 CA-5

NIST SP 800-53 R3 CA-6 - 1.2.2

1.2.6 6.2.1

6.2.2 - 05.j A.11.5.6 A.11.6.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.5.2 A.12.5.4 A.12.5.5 A.12.6.1 A.15.2.1 A9.1.1. - Commandment #6 Commandment #7 Commandment #8 - - CA-1

CA-2

CA-5

CA-6 AP-1 The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need. 9.2 9.2.5.C.01.

9.2.6.C.01.

9.2.6.C.02.

9.2.7.C.01.

9.2.8.C.01.

9.2.8.C.02.

9.2.9.C.01.

9.2.10.C.01.

9.2.10.C.02.

9.2.11.C.01.

9.2.12.C.01.

9.2.12.C.02.

9.2.13.C.01.

9.2.14.C.01.

9.2.14.C.02.

9.2.14.C.03.

9.2.14.C.04.

9.2.15.C.01. - - - 4.1.1; 4.2; 4.3 4.1.1; 4.2; 4.3 L.3 P.4 P.5 A.8

AIS- 02.2Are all requirements and trust levels for customers’ access defined and documented?
Application & Interface Security
Data IntegrityAIS-03AIS-03.1Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.Does your data management policies and procedures require audits to verify data input and output integrity routines?S3.4(I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies.

(I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.

(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies.

(I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa. PI1.2

PI1.3

PI1.5I.4G.16.3, I.3-Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3--DSS06.02
DSS06.04312.8 and 312.10Application Services > Programming Interfaces > Input ValidationsharedxDomain 10-NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3NIST SP 800-53 R3 SI-2

NIST SP 800-53 R3 SI-2 (2)

NIST SP 800-53 R3 SI-3

NIST SP 800-53 R3 SI-3 (1)

NIST SP 800-53 R3 SI-3 (2)

NIST SP 800-53 R3 SI-3 (3)

NIST SP 800-53 R3 SI-4

NIST SP 800-53 R3 SI-4 (2)

NIST SP 800-53 R3 SI-4 (4)

NIST SP 800-53 R3 SI-4 (5)

NIST SP 800-53 R3 SI-4 (6)

NIST SP 800-53 R3 SI-6

NIST SP 800-53 R3 SI-7

NIST SP 800-53 R3 SI-7 (1)

NIST SP 800-53 R3 SI-9

NIST SP 800-53 R3 SI-10

NIST SP 800-53 R3 SI-11 - 1.2.6 45 CFR 164.312 (c)(1) (New) 45 CFR 164.312 (c)(2)(New) 45 CFR 164.312(e)(2)(i)(New) 10.b;10.e A.10.9.2 A.10.9.3 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.6.1 A.15.2.1 A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4 - Commandment #1 Commandment #9 Commandment #11 - CIP-003-3 - R4.2 SI-10

SI-11

SI-2

SI-3

SI-4

SI-6

SI-7

SI-9AR-7 The organization designs information systems to support privacy by automating privacy controls.14.5
14.614.4.4.C.01.

14.4.5.C.01.

14.4.6.C.01.

14.4.6.C.02.

14.4.6.C.03.

14.5.6.C.01.

14.5.7.C.01.

14.5.8.C.01.

20.3.13.C.01.

20.3.13.C.02.PA25GP6.3.1
6.3.26.3.1
6.3.26.3.1
6.3.2N.4
AIS-03.2Are data input and output integrity routines (i.e. MD5/SHA checksums) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data?
Application & Interface Security
Data Security / IntegrityAIS-04AIS-04.1Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity, and availability) across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alternation, or destruction.Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?-(S3.4) Procedures exist to protect against unauthorized access to system resources.CC5.6B.1G.8.2.0.2, G.8.2.0.3, G.12.1, G.12.4, G.12.9, G.12.10, G.16.2, G.19.2.1, G.19.3.2, G.9.4, G.17.2, G.17.3, G.17.4, G.20.16 (B)
26 (A+)Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.31.1;1.2;1.3;1.4;1.5;1.6;1.7;1.8;1.12;1.11;1.13;2.1;2.4;2.7;2.8;3.1;3.2;3.3;3.4;3.5;3.6;3.7;3.8;3.9;3.10;3.11;3.12;3.13;3.14DS5.11APO09.01

APO09.02

APO09.03

APO13.01

DSS05.02

DSS06.06

MEA03.01

MEA03.02312.8 and 312.10BOSS > Data Governance > Rules for Information Leakage PreventionsharedxDomain 106.02. (b)
6.04.03. (a)NIST SP 800-53 R3 AC-1

NIST SP 800-53 R3 SC-1

NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 AC-1

NIST SP 800-53 R3 AC-4

NIST SP 800-53 R3 SC-1

NIST SP 800-53 R3 SC-8 - 1.1.0

1.2.2 1.2.6 4.2.3 5.2.1 7.1.2 7.2.1 7.2.2 7.2.3 7.2.4 8.2.1 8.2.2 8.2.3 8.2.5

9.2.1 - 01.t;09.s A.10.8.1 A.10.8.2 A.11.1.1 A.11.6.1 A.11.4.6 A.12.3.1 A.12.5.4 A.15.1.4 A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4 - All - - AC-1

AC-4

SC-1

SC-16 AR-7 The organization designs information systems to support privacy by automating privacy controls. 16.5 16.8

17.4 17.5.5.C.01.

17.5.6.C.01.

17.5.6.C.02.

17.5.7.C.01.

17.5.7.C.02.

17.5.7.C.03.

17.5.8.C.01.

17.5.9.C.01.

17.8.10.C.01.

17.8.10.C.02.

17.8.11.C.01.

17.8.12.C.01.

17.8.13.C.01.

17.8.14.C.01.

17.8.15.C.01.

17.8.16.C.01.

17.8.17.C.01.

18.3.7.C.01.

18.3.8.C.01.

18.3.8.C.02.

18.3.9.C.01.

18.3.10.C.01.

18.3.10.C.02.

18.3.11.C.01.

18.3.11.C.02.

18.3.12.C.01.

18.3.12.C.02.

18.3.12.C.03.

18.3.13.C.01.

18.3.13.C.02.

18.3.14.C.01.

18.3.14.C.02.

18.3.15.C.01.

18.3.15.C.02.

18.3.15.C.03.

18.3.16.C.01.

18.3.17.C.01.

18.3.18.C.01. PA20

PA25

PA29 GP

P

SGP 2.3

3.4.1, 4.1 4.1.1 6.1 6.3.2a 6.5c 8.3 10.5.5

11.5 2.3 3.4.1 4.1 4.1.1 6.1 6.3.2a 6.5c, 7.1, 7.2, 7.3, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8 10.5.5, 10.8 11.5, 11.6 2.3 3.4.1 4.1 4.1.1 6.1 6.3.2 6.5b; 7.1; 7.2; 7.3; 8.1; 8.2; 8.3; 8.3.1;8.3.2; 8.4; 8.5; 8.6; 8.7; 8.8 10.5.5; 10.9

11.5; 11.6B.1
Audit Assurance & Compliance
Audit PlanningAAC-01AAC-01.1Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.Do you develop and maintain an agreed upon audit plan (e.g., scope, objective, frequency, resources,etc.) for reviewing the efficiency and effectiveness of implemented security controls?S4.1.0
S4.2.0(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.

(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. CC4.1 - L.1, L.2, L.7, L.9, L.11 58 (B) - - ME 2.1, ME 2.2 PO 9.5 PO 9.6 APO12.04

APO12.05

APO12.06

MEA02.01

MEA02.02 Title 16 Part 312 BOSS > Compliance > Audit Planning shared x Domain 2, 4 6.01. (d) NIST SP 800-53 R3 CA-2

NIST SP 800-53 R3 CA-2 (1)

NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CA-2

NIST SP 800-53 R3 CA-2 (1)

NIST SP 800-53 R3 CA-7

NIST SP 800-53 R3 CA-7 (2)

NIST SP 800-53 R3 PL-6 - 10.2.5 45 CFR 164.312(b) 06.i Clause 4.2.3 e) Clause 4.2.3b Clause 5.1 g Clause 6 A.15.3.1 Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 6.2(e), 9.1, 9.1(e), 9.2, 9.3(f), A12.7.1 - Commandment #1 Commandment #2 Commandment #3 - - CA-2

CA-7

PL-6 AR-4 Privacy Auditing and Monitoring. To promote accountability, organizations identify and address gaps in privacy compliance, management, operational, and technical controls by conducting regular assessments (e.g., internal risk assessments). Audit for effective implementation of all privacy controls identified in this appendix, organizations assess whether they: (i) implement a process to embed privacy considerations into the life cycle of personally identifiable information (PII), programs, information systems, mission/business processes, and technology; (ii) monitor for changes to applicable privacy laws, regulations, and policies; (iii) track programs, information systems, and applications that collect and maintain PII to ensure compliance; (iv) ensure that access to PII is only on a need-to-know basis; and (v) ensure that PII is being maintained and used only for the legally authorized purposes identified in the public notice(s). 5.1, 5.3, 5.4 4.2.10.C.01.

4.2.11.C.01.

4.2.12.C.01 4.5.17.C.01.

4.5.18.C.01.

4.5.18.C.02.

4.5.18.C.03.

4.3.7.C.01.

4.3.8.C.01.

4.3.9.C.01.

4.3.9.C.02.

4.3.9.C.03.

4.3.9.C.04.

4.3.9.C.05.

4.3.10.C.01.

4.3.11.C.01.

4.3.11.C.02.

4.3.11.C.03.

4.3.12.C.01.

4.4.4.C.01.

4.4.5.C.04. PA15 SGP 2.1.2.b - - A.1 A.2

AAC-01.2Does your audit program take into account effectiveness of implementation of security operations?
Audit Assurance & Compliance
Independent AuditsAAC-02AAC-02.1Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports?S4.1.0
S4.2.0(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.

(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. CC4.1 - L.2, L.4, L.7, L.9, L.11 58 (B) 59 (B) 61 (C+, A+) 76 (B)

77 (B) - - DS5.5, ME2.5, ME 3.1 PO 9.6 APO12.04

APO12.05

DSS05.07

MEA02.06

MEA02.07

MEA02.08

MEA03.01

Title 16 Part 312 BOSS > Compliance > Independent Audits shared x Domain 2, 4 6.03. (e)

6.07.01. (m)

6.07.01. (n) NIST SP 800-53 R3 CA-1

NIST SP 800-53 R3 CA-2

NIST SP 800-53 R3 CA-2 (1)

NIST SP 800-53 R3 CA-6

NIST SP 800-53 R3 RA-5 NIST SP 800-53 R3 CA-1

NIST SP 800-53 R3 CA-2

NIST SP 800-53 R3 CA-2 (1)

NIST SP 800-53 R3 CA-6

NIST SP 800-53 R3 RA-5

NIST SP 800-53 R3 RA-5 (1)

NIST SP 800-53 R3 RA-5 (2)

NIST SP 800-53 R3 RA-5 (3)

NIST SP 800-53 R3 RA-5 (6)

NIST SP 800-53 R3 RA-5 (9) - 1.2.5

1.2.7 4.2.1 8.2.7 10.2.3

10.2.545 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(D)05.h;06.i;06.jClause 4.2.3e

Clause 5.1 g Clause 5.2.1 d) Clause 6 A.6.1.8 Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 9.1, 9.2, 9.3(f), A18.2.1 - Commandment #1 Commandment #2 Commandment #3 Chapter VI, Section 1 Article 39, I. and VIII.

Chapter 8 Article 59 CIP-003-3 - R1.3 - R4.3

CIP-004-3 R4 - R4.2

CIP-005-3a - R1 - R1.1 - R1.2 CA-1

CA-2

CA-6

RA-5 AR-4 Privacy Auditing and Monitoring. To promote accountability, organizations identify and address gaps in privacy compliance, management, operational, and technical controls by conducting regular assessments (e.g., internal risk assessments). Audit for effective implementation of all privacy controls identified in this appendix, organizations assess whether they: (i) implement a process to embed privacy considerations into the life cycle of personally identifiable information (PII), programs, information systems, mission/business processes, and technology; (ii) monitor for changes to applicable privacy laws, regulations, and policies; (iii) track programs, information systems, and applications that collect and maintain PII to ensure compliance; (iv) ensure that access to PII is only on a need-to-know basis; and (v) ensure that PII is being maintained and used only for the legally authorized purposes identified in the public notice(s). 6.1 6.1.6.C.01.

6.1.7.C.01.

6.1.8.C.01. PA18 GP 11.2

11.3 6.6 12.1.2.b 11.2 11.3 6.3.2, 6.6 11.2.1, 11.2.2, 11.2.3, 11.3.1, 11.3.2, 12.1.2.b, 12.8.4 11.2 11.3 6.3.2; 6.6

11.2.1; 11.2.2; 11.2.3; 11.3.1; 11.3.2; 11.3.3; 11.3.4; 12.8.4L.2
AAC-02.2Do you conduct network penetration tests of your cloud service infrastructure at least annually?
AAC-02.3Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?
AAC-02.4Do you conduct internal audits at least annually?
AAC-02.5Do you conduct independent audits at least annually?
AAC-02.6Are the results of the penetration tests available to tenants at their request?
AAC-02.7Are the results of internal and external audits available to tenants at their request?
Audit Assurance & Compliance
Information System Regulatory MappingAAC-03AAC-03.1Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements?-CC3.1----2.8;3.7ME 3.1APO12.01

APO12.02

APO12.03

MEA03.01 312.4 BOSS > Compliance > Information System Regulatory Mapping shared x Domain 2, 4 - - - - - - 06.a Clause 4.2.1 b) 2) Clause 4.2.1 c) 1) Clause 4.2.1 g) Clause 4.2.3 d) 6) Clause 4.3.3 Clause 5.2.1 a - f Clause 7.3 c) 4) A.7.2.1 A.15.1.1 A.15.1.3 A.15.1.4 A.15.1.6 Clauses 4.2(b), 4.4, 5.2(c), 5.3(ab), 6.1.2, 6.1.3, 6.1.3(b), 7.5.3(b), 7.5.3(d), 8.1, 8.3 9.2(g), 9.3, 9.3(b), 9.3(f), 10.2, A.8.2.1, A.18.1.1, A.18.1.3, A.18.1.4, A.18.1.5 - - - - - - 1.2 2.2 3.3

5.2 1.2.13.C.01.

1.2.13.C.02.

2.2.5.C.01.

2.2.5.C.02.

2.2.6.C.01.

2.2.6.C.02.

2.2.7.C.01.

3.3.4.C.01.

3.3.4.C.02.

3.3.4.C.03.

3.3.4.C.04.

3.3.4.C.05.

3.3.5.C.01.

3.3.5.C.02.

3.3.6.C.01.

3.3.6.C.02.

3.3.6.C.03.

3.3.6.C.04.

3.3.6.C.05.

3.3.6.C.06.

3.3.6.C.07.

3.3.7.C.01.

3.3.8.C.01.

3.3.8.C.02.

3.3.8.C.03.

3.3.8.C.04.

3.3.8.C.05.

3.3.9.C.01.

3.3.10.C.01.

3.3.10.C.02.

3.3.10.C.03.

3.3.10.C.04.

3.3.11.C.01.

3.3.12.C.01.

3.3.13.C.01.

3.3.13.C.02.

3.3.14.C.01.

3.3.14.C.02.

3.3.14.C.03.

3.3.15.C.01.

4.4.4.C.01.

4.4.5.C.01 4.4.5.C.02.

4.4.5.C.03.

4.4.5.C.04.

4.4.6.C.01.

4.4.7.C.01.

4.4.7.C.02.

4.4.8.C.01.

4.4.8.C.02.

4.4.8.C.03.

4.4.8.C.04.

4.4.9.C.01.

4.4.10.C.01.

4.4.11.C.01.

4.4.12.C.01.

4.4.12.C.02.

4.4.12.C.03.

4.4.12.C.04.

4.4.12.C.05.--3.1.1
3.13.13.1L.3
Business Continuity Management & Operational Resilience
Business Continuity PlanningBCR-01BCR-01.1A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following:

• Defined purpose and scope, aligned with relevant dependencies

• Accessible to and understood by those who will use them

• Owned by a named person(s) who is responsible for their review, update, and approval

• Defined lines of communication, roles, and responsibilities

• Detailed recovery procedures, manual work-around, and reference information

• Method for plan invocation Does your organization have a plan or framework for business continuity management or disaster recovery management? A3.1.0 A3.3.0 A3.4.0 (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.

(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.

(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. CC3.1 A1.2 A1.3 - K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6, K.1.2.7, K.1.2.11, K.1.2.13, K.1.2.15 - - - - DSS04.01

DSS04.02

DSS04.03

DSS04.05 - BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 6.07. (a)

6.07. (b)

6.07. © NIST SP800-53 R3 CP-1

NIST SP800-53 R3 CP-2

NIST SP800-53 R3 CP-3

NIST SP800-53 R3 CP-4

NIST SP800-53 R3 CP-9

NIST SP800-53 R3 CP-10 NIST SP800-53 R3 CP-1

NIST SP800-53 R3 CP-2

NIST SP800-53 R3 CP-2 (1)

NIST SP800-53 R3 CP-2 (2)

NIST SP800-53 R3 CP-3

NIST SP800-53 R3 CP-4

NIST SP800-53 R3 CP-4 (1)

NIST SP800-53 R3 CP-6

NIST SP800-53 R3 CP-6 (1)

NIST SP800-53 R3 CP-6 (3)

NIST SP800-53 R3 CP-7

NIST SP800-53 R3 CP-7 (1)

NIST SP800-53 R3 CP-7 (2)

NIST SP800-53 R3 CP-7 (3)

NIST SP800-53 R3 CP-7 (5)

NIST SP800-53 R3 CP-8

NIST SP800-53 R3 CP-8 (1)

NIST SP800-53 R3 CP-8 (2)

NIST SP800-53 R3 CP-9

NIST SP800-53 R3 CP-9 (1)

NIST SP800-53 R3 CP-9 (3)

NIST SP800-53 R3 CP-10

NIST SP800-53 R3 CP-10 (2)

NIST SP800-53 R3 CP-10 (3)

NIST SP800-53 R3 PE-17 - - 45 CFR 164.308 (a)(7)(i) 45 CFR 164.308 (a)(7)(ii)(B) 45 CFR 164.308 (a)(7)(ii)(C) 45 CFR 164.308 (a)(7)(ii)(E) 45 CFR 164.310 (a)(2)(i) 45 CFR 164.312 (a)(2)(ii) 12.d Clause 5.1 A.6.1.2 A.14.1.3 A.14.1.4 Clause 5.1(h) A.17.1.2 A.17.1.2 - Commandment #1 Commandment #2 Commandment #3 - - CP-1

CP-2

CP-3

CP-4

CP-6

CP-7

CP-8

CP-9

CP-10

PE-17 UL-2 INFORMATION SHARING WITH THIRD PARTIES - a. Shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes; b. Where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used; c. Monitors, audits, and trains its staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII; and d. Evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required. 6.4 6.4.4.C.01.

6.4.5.C.01.

6.4.6.C.01.

6.4.7.C.01. - - 12.9.1 12.9.3 12.9.4

12.9.6 12.9.1 12.9.3 12.9.4

12.9.6-K.1
BCR-01.2Do you have more than one provider for each service you depend on?
BCR-01.3Do you provide a disaster recovery capability?
BCR-01.4Do you monitor service continuity with upstream providers in the event of provider failure?
BCR-01.5Do you provide access to operational redundancy reports, including the services you rely on?
BCR-01.6Do you provide a tenant-triggered failover option?
BCR-01.7Do you share your business continuity and redundancy plans with your tenants?
Business Continuity Management & Operational Resilience
Business Continuity TestingBCR-02BCR-02.1Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?A3.3(A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.A1.2-K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6, K.1.2.7, K.1.2.11, K.1.2.13, K.1.2.1552 (B)
55 (A+)---DSS04.04-BOSS > Operational Risk Management > Business ContinuityproviderxDomain 7, 86.07.01. (b)

6.07.01. (j)

6.07.01. (l) NIST SP800-53 R3 CP-2

NIST SP800-53 R3 CP-3

NIST SP800-53 R3 CP-4 NIST SP800-53 R3 CP-2

NIST SP800-53 R3 CP-2 (1)

NIST SP800-53 R3 CP-2 (2)

NIST SP800-53 R3 CP-3

NIST SP800-53 R3 CP-4

NIST SP800-53 R3 CP-4 (1) - - 45 CFR 164.308 (a)(7)(ii)(D) 12.e A.14.1.5 A17.3.1 - Commandment #1 Commandment #2 Commandment #3 - - CP-2

CP-3

CP-4 - 4.4

5.2(time limit) 6.3(whenever change occurs) 5.4.5.C.01.

5.4.5.C.02.

5.4.5.C.03.

4.4.4.C.01.

4.4.5.C.01 4.4.5.C.02.

4.4.5.C.03.

4.4.5.C.04.

4.4.6.C.01.

4.4.7.C.01.

4.4.7.C.02.

4.4.8.C.01.

4.4.8.C.02.

4.4.8.C.03.

4.4.8.C.04.

4.4.9.C.01.

4.4.10.C.01.

4.4.11.C.01.

4.4.12.C.01.

4.4.12.C.02.

4.4.12.C.03.

4.4.12.C.04.

4.4.12.C.05.

6.3.5.C.01.

6.3.5.C.02.

6.3.6.C.01.

6.3.6.C.02.

6.3.6.C.03.

6.3.7.C.01.PA15SGP12.9.212.9.2,
12.10.212.10.2K.6
Business Continuity Management & Operational Resilience
Power / TelecommunicationsBCR-03BCR-03.1Data center utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.Does your organization adhere to any international or industry standards when it comes to securing, monitoring, maintaining and testing of datacenter utilities services and environmental conditions?A3.2.0
A3.4.0(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

(A3.4.0) Procedures exist to protect against unauthorized access to system resource. A1.1 A1.2

A1.3F.1F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.129 (B)
10 (B)Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3--DSS01.03

DSS01.04

DSS01.05

DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (c)

6.09. (f)

6.09. (g) NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-13

NIST SP800-53 R3 PE-13 (1)

NIST SP800-53 R3 PE-13 (2)

NIST SP800-53 R3 PE-13 (3 NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-4

NIST SP800-53 R3 PE-13

NIST SP800-53 R3 PE-13 (1)

NIST SP800-53 R3 PE-13 (2)

NIST SP800-53 R3 PE-13 (3)---08.h;08.iA.9.2.2
A.9.2.3A11.2.2,
A11.2.3-Commandment #1

Commandment #2 Commandment #3 Commandment #4 Commandment #9 Commandment #11 - - PE-1

PE-4

PE-13 - 10.1

10.2 10.3 10.4 10.5

10.6 10.1.17.C.01.

10.1.17.C.02.

10.1.18.C.01.

10.1.18.C.02.

10.1.18.C.03.

10.1.18.C.04.

10.1.19.C.01.

10.1.20.C.01.

10.1.20.C.02.

10.1.21.C.01.

10.1.21.C.02.

10.1.21.C.03.

10.1.21.C.04.

10.1.22.C.01.

10.1.22.C.02.

10.1.23.C.01.

10.1.23.C.02.

10.1.23.C.03.

10.1.24.C.01.

10.1.25.C.01.

10.1.25.C.02.

10.1.25.C.03.

10.1.25.C.04.

10.2.4.C.01.

10.2.4.C.02.

10.2.5.C.01.

10.3.4.C.01.

10.3.5.C.01.

10.3.5.C.02.

10.3.6.C.01.

10.3.7.C.01.

10.3.8.C.01.

10.3.9.C.01.

10.3.10.C.01.

10.3.11.C.01.

10.3.12.C.01.

10.4.4.C.01.

10.4.4.C.02.

10.4.5.C.01.

10.4.5.C.02.

10.4.6.C.01.

10.4.6.C.02.

10.4.6.C.03.

10.4.7.C.01.

10.4.7.C.02.

10.4.8.C.01.

10.4.9.C.01.

10.4.9.C.02.

10.4.9.C.03.

10.4.9.C.04.

10.4.10.C.01.

10.4.11.C.01.

10.4.12.C.01.

10.4.13.C.01.

10.4.13.C.02.

10.5.4.C.01.

10.5.5.C.01.

10.5.6.C.01.

10.5.6.C.02.

10.5.7.C.01.

10.5.8.C.01.

10.5.8.C.02.

10.5.9.C.01.

10.5.9.C.02.

10.5.10.C.01.

10.5.10.C.02.

10.5.11.C.01.

10.6.5.C.01.

10.6.6.C.01.

10.6.6.C.02.

10.6.6.C.03.

10.6.6.C.04.

10.6.7.C.01.

10.6.7.C.02.

10.6.8.C.01.PA15SGP-4.1, 4.1.1, 9.1, 9.24.1, 4.1.1, 9.1, 9.2F.1
BCR-03.2Has your organization implemented environmental controls, fail-over mechanisms or other redundancies to secure utility services and mitigate environmental conditions?
Business Continuity Management & Operational Resilience
DocumentationBCR-04BCR-04.1Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following:

• Configuring, installing, and operating the information system

• Effectively using the system’s security featuresAre information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system?
S3.11.0
A.2.1.0(S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities.

(A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users. CC1.3

CC1.4

CC2.1-G.1.156 (B)
57 (B)Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3-DS 9, DS 13.1BAI08

BAI10

DSS01.01 312.8 and 312.10 SRM > Policies and Standards > Job Aid Guidelines shared x Domain 7, 8 - NIST SP 800-53 R3 CP-9

NIST SP 800-53 R3 CP-10

NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 CP-9

NIST SP 800-53 R3 CP-9 (1)

NIST SP 800-53 R3 CP-9 (3)

NIST SP 800-53 R3 CP-10

NIST SP 800-53 R3 CP-10 (2)

NIST SP 800-53 R3 CP-10 (3)

NIST SP 800-53 R3 SA-5

NIST SP 800-53 R3 SA-5 (1)

NIST SP 800-53 R3 SA-5 (3)

NIST SP 800-53 R3 SA-10

NIST SP 800-53 R3 SA-11

NIST SP 800-53 R3 SA-11 (1)-1.2.6-09.a;09.rClause 4.3.3
A.10.7.4Clause 9.2(g)-Commandment #1

Commandment #2 Commandment #4 Commandment #5

Commandment #11-CIP-005-3a - R1.3
CIP-007-3 - R9CP-9

CP-10

SA-5

SA-10

SA-11 - 10.5

13.5

17.1 10.5.4.C.01.

10.5.5.C.01.

10.5.6.C.01.

10.5.6.C.02.

10.5.7.C.01.

10.5.8.C.01.

10.5.8.C.02.

10.5.9.C.01.

10.5.9.C.02.

10.5.10.C.01.

10.5.10.C.02.

10.5.11.C.01.

13.6.5.C.01.

13.6.6.C.01.

13.6.7.C.01.

13.6.8.C.01.

13.6.9.C.01.

13.6.9.C.02.

18.1.8.C.01.

18.1.8.C.02.

18.1.8.C.03.

18.1.8.C.04.

18.1.8.C.05.

18.1.9.C.01.

18.1.9.C.02.

18.1.9.C.03.

18.1.9.C.04.

18.1.10.C.01.

18.1.11.C.01.

18.1.11.C.02.

18.1.12.C.01.

18.1.12.C.02.

18.1.13.C.01 18.1.14.C.01 18.1.14.C.02 18.1.14.C.03 18.1.14.C.04 - 12.1 12.2 12.3

12.4 12.1 12.2 12.3

12.41.1.2, 1.1.3, 2.2, 12.3
12.61.1.2, 1.1.3, 2.2, 12.3
12.6I.16

U.1

Business Continuity Management & Operational Resilience
Environmental RisksBCR-05BCR-05.1Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.Is physical damage anticipated and are countermeasures included in the design of physical protections?A3.1.0
A3.2.0(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.

(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. CC3.1 A1.1 A1.2 F.1 F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.8 - Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 - 2.8;3.7 DSS01.03

DSS01.04

DSS01.05 - Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d) NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-13

NIST SP800-53 R3 PE-14

NIST SP800-53 R3 PE-15 NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-13

NIST SP800-53 R3 PE-13 (1)

NIST SP800-53 R3 PE-13 (2)

NIST SP800-53 R3 PE-13 (3)

NIST SP800-53 R3 PE-14

NIST SP800-53 R3 PE-15

NIST SP800-53 R3 PE-18-8.2.445 CFR 164.308 (a)(7)(i)
45 CFR 164.310(a)(2)(ii) (New)08.dA.9.1.4
A.9.2.1A11.1.4,
A11.2.1-Commandment #1

Commandment #2 Commandment #3 - CIP-004-3 R3.2 PE-1

PE-13

PE-14

PE-15

PE-18-8.1
8.48.1.9.C.01.

8.1.10.C.01.

8.1.10.C.02.

8.1.11.C.01.

8.1.12.C.01.

8.4.8.C.01.

8.4.9.C.01.

8.4.10.C.01.

8.4.11.C.01.

8.4.12.C.01.

8.4.13.C.01. PA15 SGP 3.5.2,

3.6.3, 3.7, 5.1, 5.2, 5.3, 6.1, 6.2, 7.1, 7.2, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9,

12.2 3.5.2, 3.6.3, 3.7, 5.1, 5.2, 5.3, 6.1, 6.2, 7.1, 7.2, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9,

12.2 K.3

K.4

Business Continuity Management & Operational Resilience
Equipment LocationBCR-06BCR-06.1To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?A3.1.0
A3.2.0"(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.

(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable." CC3.1 A1.1

A1.2F.1F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.853 (A+)
75 (C+, A+)Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3--DSS01.04
DSS01.05312.8 and 312.10Infra Services > Facility Security > Environmental Risk ManagementproviderxDomain 7, 86.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d) NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-14

NIST SP800-53 R3 PE-15 NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-5

NIST SP800-53 R3 PE-14

NIST SP800-53 R3 PE-15

NIST SP800-53 R3 PE-18 - - 45 CFR 164.310 © 08.g A.9.2.1 A11.2.1 - Commandment #1 Commandment #2 Commandment #3 - PE-1

PE-5

PE-14

PE-15

PE-18 - 8.1 8.1.9.C.01.

8.1.10.C.01.

8.1.10.C.02.

8.1.11.C.01.

8.1.12.C.01. PA15 SGP 9.1.3

9.5 9.6 9.9

9.9.1 9.1.3 9.5 9.6 9.9 9.9.1,

12.2 9.1.3 9.5 9.6 9.9 9.9.1,

12.2K.3
Business Continuity Management & Operational Resilience
Equipment MaintenanceBCR-07BCR-07.1Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.Do you have documented policies, procedures and supporting business processes for equipment and datacenter maintenance?A3.2.0
A4.1.0(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies. A1.1 A1.2

CC4.1 - F.2.19 1 (B) - - - BAI03.10

BAI04.03

BAI04.04

DSS03.05 - Infra Services > Equipment Maintenance > provider x Domain 7, 8 6.09. (h) NIST SP 800-53 R3 MA-2

NIST SP 800-53 R3 MA-4

NIST SP 800-53 R3 MA-5 NIST SP 800-53 R3 MA-2

NIST SP 800-53 R3 MA-2 (1)

NIST SP 800-53 R3 MA-3

NIST SP 800-53 R3 MA-3 (1)

NIST SP 800-53 R3 MA-3 (2)

NIST SP 800-53 R3 MA-3 (3)

NIST SP 800-53 R3 MA-4

NIST SP 800-53 R3 MA-4 (1)

NIST SP 800-53 R3 MA-4 (2)

NIST SP 800-53 R3 MA-5

NIST SP 800-53 R3 MA-6 - 5.2.3

8.2.2 8.2.3 8.2.4 8.2.5 8.2.6

8.2.7 45 CFR 164.310 (a)(2)(iv) 08.j A.9.2.4 A11.2.4 - Commandment #2 Commandment #5 Commandment #11 - CIP-007-3 - R6.1 - R6.2 - R6.3 - R6.4 MA-2

MA-3

MA-4

MA-5

MA-6 - 3.3

12.1 12.5

14.5 (software) 3.3.12.C.01.

3.3.13.C.01.

3.3.13.C.02.

3.3.14.C.01.

3.3.14.C.02.

3.3.14.C.03.

3.3.15.C.01.

12.1.24.C.01.

12.1.24.C.02.

12.1.24.C.03.

12.1.25.C.01.

12.1.26.C.01.

12.1.26.C.02.

12.1.26.C.03.

12.1.27.C.01.

12.1.28.C.01.

12.1.28.C.02.

12.1.29.C.01.

12.1.30.C.01.

12.1.31.C.01.

12.5.3.C.01.

12.5.3.C.02.

12.5.4.C.01.

12.5.4.C.02.

12.5.4.C.03.

12.5.4.C.04.

12.5.5.C.01.

12.5.6.C.01.

12.5.6.C.02.

14.4.4.C.01.

14.4.5.C.01.

14.4.6.C.01.

14.4.6.C.02.

14.4.6.C.03.PA8
PA15BSGP
SGP-10.8,
11.610.8,
11.6D.1

G.5

BCR-07.2Do you have an equipment and datacenter maintenance routine or plan?
Business Continuity Management & Operational Resilience
Equipment Power FailuresBCR-08BCR-08.1Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific business impact assessment.Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)?A3.2.0(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.A1.1
A1.2F.1F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.1254 (A+)Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.32.1A13.3DSS01.04

DSS01.05

DSS04.01

DSS04.02

DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (e)

6.09. (f) NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-12

NIST SP800-53 R3 PE-13

NIST SP800-53 R3 PE-14 NIST SP800-53 R3 CP-8

NIST SP800-53 R3 CP-8 (1)

NIST SP800-53 R3 CP-8 (2)

NIST SP800-53 R3 PE-1

NIST SP800-53 R3 PE-9

NIST SP800-53 R3 PE-10

NIST SP800-53 R3 PE-11

NIST SP800-53 R3 PE-12

NIST SP800-53 R3 PE-13

NIST SP800-53 R3 PE-13 (1)

NIST SP800-53 R3 PE-13 (2)

NIST SP800-53 R3 PE-13 (3)

NIST SP800-53 R3 PE-14 - - - 08.h A.9.2.2 A.9.2.3 A 9.2.4 A.11.2.2, A.11.2.3, A.11.2.4 - Commandment #1 Commandment #2 Commandment #3 - CP-8

PE-1

PE-9

PE-10

PE-11

PE-12

PE-13

PE-14 - 8.1

8.2 8.3

8.4 8.1.9.C.01.

8.1.10.C.01.

8.1.10.C.02.

8.1.11.C.01.

8.1.12.C.01.

8.2.5.C.01.

8.2.5.C.02.

8.2.6.C.01.

8.2.6.C.02.

8.2.7.C.01.

8.2.8.C.01.

8.3.3.C.01.

8.3.3.C.02.

8.3.4.C.01.

8.3.4.C.02.

8.3.5.C.01.

8.4.8.C.01.

8.4.9.C.01.

8.4.10.C.01.

8.4.11.C.01.

8.4.12.C.01.

8.4.13.C.01.PA15SGP---K.4
Business Continuity Management & Operational Resilience
Impact AnalysisBCR-09BCR-09.1There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:

• Identify critical products and services

• Identify all dependencies, including processes, applications, business partners, and third party service providers

• Understand threats to critical products and services

• Determine impacts resulting from planned or unplanned disruptions and how these vary over time

• Establish the maximum tolerable period for disruption

• Establish priorities for recovery

• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption

• Estimate the resources required for resumption Do you use industry standards and frameworks to determine the impact of any disruption to your organization (i.e. criticality of services and recovery priorities, disruption tolerance, RPO and RTO etc) ? A3.1.0 A3.3.0 A3.4.0 "(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.

(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.

(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies."

CC3.1

A1.2

A1.3 - K.2 - - - BAI06.01

BAI10.01

BAI10.02

BAI10.03

DSS04.01

DSS04.02 - ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis provider x Domain 7, 8 6.02. (a)

6.03.03. (c)

6.07. (a)

6.07. (b)

6.07. © NIST SP 800-53 R3 CP-1

NIST SP 800-53 R3 CP-2

NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 CP-1

NIST SP 800-53 R3 CP-2

NIST SP 800-53 R3 RA-3--45 CFR 164.308 (a)(7)(ii)€12.a;12.b;12.cA.14.1.2
A 14.1.4A.17.1.1
A.17.1.2-Commandment #1

Commandment #2 Commandment #3 - CIP-007-3 - R8 - R8.1 - R8.2 - R8.3 RA-3 - 6.4 6.4.4.C.01.

6.4.5.C.01.

6.4.6.C.01.

6.4.7.C.01.PA8
PA15BSGP
SGP---K.2
BCR-09.2Does your organization conduct impact analysis pertaining to possible disruptions to the cloud service?
Business Continuity Management & Operational Resilience
PolicyBCR-10BCR-10.1Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.Are policies and procedures established and made available for all personnel to adequately support services operations’ roles?S2.3.0(S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.CC3.2-G.1.145 (B)-2.1DS13.1APO01

APO07.01

APO07.03

APO09.03

DSS01.01 - SRM > Policies and Standards > Operational Security Baselines shared x Domain 7, 8 6.03. © NIST SP 800-53 R3 CM-2

NIST SP 800-53 R3 CM-4

NIST SP 800-53 R3 CM-6

NIST SP 800-53 R3 MA-4

NIST SP 800-53 R3 SA-3

NIST SP 800-53 R3 SA-4

NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 CM-2

NIST SP 800-53 R3 CM-2 (1)

NIST SP 800-53 R3 CM-2 (3)

NIST SP 800-53 R3 CM-2 (5)

NIST SP 800-53 R3 CM-3

NIST SP 800-53 R3 CM-3 (2)

NIST SP 800-53 R3 CM-4

NIST SP 800-53 R3 CM-5

NIST SP 800-53 R3 CM-6

NIST SP 800-53 R3 CM-6 (1)

NIST SP 800-53 R3 CM-6 (3)

NIST SP 800-53 R3 CM-9

NIST SP 800-53 R3 MA-4

NIST SP 800-53 R3 MA-4 (1)

NIST SP 800-53 R3 MA-4 (2)

NIST SP 800-53 R3 SA-3

NIST SP 800-53 R3 SA-4

NIST SP 800-53 R3 SA-4 (1)

NIST SP 800-53 R3 SA-4 (4)

NIST SP 800-53 R3 SA-4 (7)

NIST SP 800-53 R3 SA-5

NIST SP 800-53 R3 SA-5 (1)

NIST SP 800-53 R3 SA-5 (3)

NIST SP 800-53 R3 SA-8

NIST SP 800-53 R3 SA-10

NIST SP 800-53 R3 SA-11

NIST SP 800-53 R3 SA-11 (1)

NIST SP 800-53 R3 SA-12 - 8.2.1 - 09.a Clause 5.1 A 8.1.1 A.8.2.1 A 8.2.2 A.10.1.1 Clause 5.1(h) A.6.1.1 A.7.2.1 A.7.2.2 A.12.1.1 - Commandment #1 Commandment #2 Commandment #3 Commandment #6 Commandment #7 - CM-2

CM-3

CM-4

CM-5

CM-6

CM-9

MA-4

SA-3

SA-4

SA-5

SA-8

SA-10

SA-11

SA-12 - - - - - 12.1

12.2 12.3

12.4 4.3, 10.8, 11.1.2, 12.1 12.2 12.3 12.4 12.5, 12.5.3, 12.6, 12.6.2,

12.10 4.3;

10.9;

11.1.2;

12.1;

12.2;

12.3;

12.4;

12.4.1;

12.5;

12.5.3;

12.6;

12.6.1;

12.6.2;

12.10 C.1

G.5

Business Continuity Management & Operational Resilience
Retention PolicyBCR-11BCR-11.1Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.Do you have technical capabilities to enforce tenant data retention policies?A3.3.0

A3.4.0 I3.20.0 I3.21.0 (A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.

(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

(I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies.

(I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems. A1.2 A1.3 I3.21 - D.2.2.9 36 (B) Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.5.2 2.1;2.8;3.7 DS 4.1, DS 4.2, DS 4.5, DS 4.9, DS 11.6 BAI09.01

BAI09.02

BAI09.03

DSS04.01

DSS04.02

DSS04.03

DSS04.04

DSS04.07

MEA03.01312.3BOSS > Data Governance > Data Retention RulessharedxDomain 56.03. (h)
6.07.01. ©NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-9NIST SP 800-53 R3 CP-2

NIST SP 800-53 R3 CP-2 (1)

NIST SP 800-53 R3 CP-2 (2)

NIST SP 800-53 R3 CP-6

NIST SP 800-53 R3 CP-6 (1)

NIST SP 800-53 R3 CP-6 (3)

NIST SP 800-53 R3 CP-7

NIST SP 800-53 R3 CP-7 (1)

NIST SP 800-53 R3 CP-7 (2)

NIST SP 800-53 R3 CP-7 (3)

NIST SP 800-53 R3 CP-7 (5)

NIST SP 800-53 R3 CP-8

NIST SP 800-53 R3 CP-8 (1)

NIST SP 800-53 R3 CP-8 (2)

NIST SP 800-53 R3 CP-9

NIST SP 800-53 R3 CP-9 (1)

NIST SP 800-53 R3 CP-9 (3) - 5.1.0

5.1.1 5.2.2

8.2.6 45 CFR 164.308 (a)(7)(ii)(A) 45 CFR 164.310 (d)(2)(iv) 45 CFR 164.308(a)(7)(ii)(D) (New) 45 CFR 164.316(b)(2)(i) (New) 09.l Clause 4.3.3 A.10.5.1 A.10.7.3 Clauses 9.2(g) 7.5.3(b)

5.2 (c) 7.5.3(d) 5.3(a) 5.3(b) 8.1 8.3 A.12.3.1

A.8.2.3EAR 15 § 762.6 Period of Retention
EAR 15 CFR § 786.2 RecordkeepingCommandment #11Chapter II
Article 11, 13CIP-003-3 - R4.1CP-2

CP-6

CP-7

CP-8

CP-9

SI-12

AU-11 FTC Fair Information Principles

Integrity/Security

Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm6.4
13.16.4.4.C.01.

6.4.5.C.01.

6.4.6.C.01.

6.4.7.C.01.

13.2.10.C.01.

13.2.11.C.01.

13.2.11.C.02.

13.2.11.C.03.

13.2.11.C.04.

13.2.12.C.01.

13.2.13.C.01.

13.2.13.C.02.PA10
PA29BSGP
SGP3.1

3.1.1 3.2 .9.1 9.5 9.6

10.7 3.1 3.1.a 3.2 9.9.1

9.5. 9.5.1

9.6. 9.7, 9.8 10.7, 12.10.1 3.1;3.2;3.2.1;3.2.2;3.2.3;9.9.1;9.5;9.5.1;9.6;9.7;9.8;10.7;12.10.1 D.1 K.5

BCR-11.2Do you have documented policies and procedures demonstrating adherence to data retention periods as per legal, statutory or regulatory compliance requirements?
BCR-11.3Have you implemented backup or recovery mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?
BCR-11.4If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities?
BCR-11.5If using virtual infrastructure, do you provide tenants with a capability to restore a virtual machine to a previous configuration?
BCR-11.6Does your cloud solution include software/provider independent restore and recovery capabilities?
BCR-11.7Do you test your backup or redundancy mechanisms at least annually?
Change Control & Configuration Management

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .