FY25_State_of_Oklahoma_Vendor_Security_Assessment.xlsx

XLSX spreadsheet 91 KB Posted

Attached to
SW1050 -Deliverable Based IT Services (DBITS) State and local contract opportunity
Solicitation number
EV00000678
Issued by
Oklahoma

About this file

Written by GovTribe AI ·

The document is a comprehensive State of Oklahoma Vendor Security Assessment spreadsheet designed to evaluate potential suppliers' cybersecurity posture and risk management capabilities across multiple domains. The assessment is aligned with various national and international security standards including NIST, CIS, ISO/IEC, ISA, HIPAA, and COBIT 2019, covering areas such as identity management, data security, incident response, and continuous monitoring. The document provides a detailed questionnaire with sections addressing asset management, governance, risk assessment, protective technologies, detection processes, response planning, and recovery strategies.

The assessment requires vendors to provide extensive details about their organizational security practices, including their ability to protect sensitive/regulated data, manage supply chain risks, handle potential cyber threats, and maintain robust incident response and recovery plans. Each section includes specific questions with options for "Yes", "No", or "N/A" responses, requiring vendors to provide explanations for negative or non-applicable answers. The document emphasizes the State of Oklahoma's commitment to understanding and managing cybersecurity risks through a comprehensive evaluation of potential technology and service providers, with a publish date of September 22, 2023.

View the file

Other files for this state and local contract opportunity

Other files attached to SW1050 -Deliverable Based IT Services (DBITS), newest first.
File Type Posted
AttachmentC-StatewideTerms.docx DOCX document
AttachmentD_Updated_0824.pdf PDF
Attachment_B_negotiable_with_lower_insurance.docx DOCX document
Exhibit_2_Category_Descriptions.docx DOCX document
OMES_Form_CP004.pdf PDF
Attachment_A-1_Lockdown_Language.5.23.24.docx DOCX document
Exhibit_1.docx DOCX document
SW1050_Attachment_A.docx DOCX document
SW1050_-EV678_Amendment_Q_A_04.18.25.docx DOCX document
SW1050_Non-negotiable_Bid_instructions.docx DOCX document
OMES_Form_CP076-Responding_Bidder_Information.pdf PDF
Exhibit_4_Tech_Types_.xlsx XLSX spreadsheet
SW1050_-EV678_Amendment_Q_A_04.21.25.pdf PDF
Show all 13

On GovTribe

Work with this file on GovTribe

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Introduction

State of Oklahoma Vendor Security Assessment
WHEN COMPLETED, THIS VENDOR SECURITY ASSESSMENT IS CONFIDENTIAL

AND PROTECTED FROM DISCLOSURE PURSUANT TO 51 O.S. §24A.28 and 62 O.S. §34.12.C

The purpose of the assessment is for the State of Oklahoma to identify and manage any risk stemming from our business partnerships. This assessment is designed to allow us to gain a better understanding of our supplier’s internal security posture, along with the product, service, and/or solution being offered. Additionally, the State wants to ensure the vendor's overall environment and security protocols will meet the State's minimum-security requirements.
InstructionsAcceptable Answers: "Yes", "No", "N/A". If a "No" or "N/A" answer is provided, please provide explaination in the "Explanaitions/Comments" block to the right. Providing explainations will help minimize the need for follow-up questions during review, prolonging the security review process.
Associated State and Industry Standards
State of Oklahoma Security Statutes, Policies, and Standardshttps://oklahoma.gov/omes/services/information-services/is/policies-and-standards.html
NIST CSFhttps://www.nist.gov/cyberframework
NIST SP 800-53 r5https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
NIST SP800-171 r2https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
CIS CSChttps://www.cisecurity.org/controls
ISO/IEChttps://www.iso.org/standard/27001
ISAhttps://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
HIPAA Security Ruleshttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C
COBIT 2019https://www.isaca.org/resources/cobit
Publish Date: 9/22/2023

https://oklahoma.gov/omes/services/information-services/is/policies-and-standards.htmlhttps://www.nist.gov/cyberframeworkhttps://csrc.nist.gov/pubs/sp/800/53/r5/upd1/finalhttps://csrc.nist.gov/pubs/sp/800/171/r2/upd1/finalhttps://www.cisecurity.org/controlshttps://www.iso.org/standard/27001https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standardshttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-Chttps://www.isaca.org/resources/cobit Vendor Information

Company's Legal Name
Primary Website URL
Company Headquarters Location (City and Country)
Parent Company (If Applicable)
Primary Contact Name
Primary Contact Email
Primary Contact Phone
Alternate Contact Name
Alternate Contact Email
Alternate Contact Phone
Please describe in detail the product or service your organization will be providing the State of Oklahoma.
Please describe the type of service or product being provided the State of Oklahoma. (i.e. SaaS, PaaS, IaaS, Hardware, Staffing, Consulting, App/Dev, etc.)

Product & Service Specific

Service/Product SpecificStatusExplanation/Comments
#Question(Y/N)
S-1Will your service or product include the hosting, storing, transmitting, processing or accessing of sensitive/regulated data (e.g. PII, PHI, FERPA, CJIS, FTI, etc) for, or on behalf of the state of Oklahoma?
S-2Does your organization have resources outside the continental U.S. that will host, store, transmit, process, or access any State of Oklahoma data?
S-3Will a non-U.S. resident individual or corporation have physical or logical access to State of Oklahoma data?
S-4Are any support services be provided for the services or products from outside the continental U.S? (If yes, please describe in comments section to the right)
S-5Do you outsource or subcontract any portion of services that are being purchased by the State of Oklahoma?
S-6Do you have a help desk function that allows for the intake and handling of IT and/or security related activities?
S-7Will your organization engage in E-Commerce on behalf of the State of Oklahoma?

Identify

Information SecurityStatusExplanation/Comments
#Question(Y/N)NIST SP 800-53 r5NIST SP 800-171 r2CIS CSCISO/IECISAHIPAA Security RuleCOBIT 2019
Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.
ID.AM-1Are physical devices and systems inventoried?CM-8, PM-53.4.1127001:2013 A.8.1.1, A.8.1.2ISA 62443-2-1:2009 4.2.3.4, ISA 62443-3-3:2013 SR 7.845 C.F.R. §§

164.308(a)(1)(ii)(A), 164.310(a)(2)(ii),

164.310(d)BAI09.01, BAI09.02
ID.AM-2Is software and applications within the organizaiton inventoried?CM-83.4.1227001:2013 A.8.1.1, A.8.1.2, A.12.5.1ISA 62443-2-1:2009 4.2.3.4, ISA 62443-3-3:2013 SR 7.845 C.F.R. §§
164.308(a)(1)(ii)(A), 164.308(a)(7)(ii)(E )BAI09.01, BAI09.02, BAI09.05
ID.AM-3Are organizational communication and data flows mapped and documented?AC-4, CA-3, CA-9, PL-8, SA-173.1.3, 3.13.11227001:2013 A.13.2.1, A.13.2.2ISA 62443-2-1:2009 4.2.3.445 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(3)(ii)(A),

164.308(a)(8), 164.310(d)DSS05.02, APO14.08
ID.AM-4Are external information systems catalogued and mapped?AC-20, PM-5, SA-93.1.20, 3.1.211227001:2013 A.11.2.645 C.F.R. §§

164.308(a)(4)(ii)(A), 164.308(b), 164.314(a)(1), 164.314(a)(2)(i)(B),

164.314(a)(2)(ii), 164.316(b)(2)APO02.02, APO10.01 APO10.04, DSS01.02
ID.AM-5Are resources (hardware, devices, date, time, personnel, and software) prioritized based on their classification, criticality, and business value?CP-2, RA-2, RA-9, SA-20, SC-613 & 1427001:2013 A.8.2.1ISA 62443-2-1:2009 4.2.3.645 C.F.R. §
164.308(a)(7)(ii)(E )APO03.03, APO03.04, APO12.01, BAI04.02, BAI09.02
ID.AM-6Are information security/Cybersecurity roles and responsibilities for all users within the organization, and third-party stakeholders (e.g., suppliers, customers, partners) established and documented?CP-2, PS-7, PM-2, PM-2917 & 1927001:2013 A.6.1.1ISA 62443-2-1:2009 4.3.2.3.345 C.F.R. §§

164.308(a)(2), 164.308(a)(3), 164.308(a)(4),

164.308(b)(1), 164.314APO01.02, APO01.05, APO07.06, APO13.01, DSS06.03
Business Environment (ID.BE): The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.
ID.BE-1Is your organizations role within your supply chain identified and documented in relation to suppliers, and customers?SR-1, SR-327001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.245 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(4)(ii), 164.308(a)(7)(ii)(C), 164.308(a)(7)(ii)(E), 164.308(a)(8), 164.310(a)(2)(i), 164.314,

164.316APO08.01, APO08.04, APO08.05, APO10.03, APO10.04, APO10.05
ID-BE-2Is your organizations place in critical infrastructure and its industry sector identified and communicated?PM-827001:2013 Clause 4.145 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(4)(ii), 164.308(a)(7)(ii)(C), 164.308(a)(7)(ii)(E), 164.308(a)(8), 164.310(a)(2)(i), 164.314,

164.316APO02.06, APO03.01
ID.BE-3Are priorities for your organizations mission, objectives, and activities established and communicated?PM-11ISA 62443-2-1:2009 4.2.2.1, 4.2.3.645 C.F.R. §§

164.308(a)(7)(ii)(B), 164.308(a)(7)(ii)(C), 164.308(a)(7)(ii)(D), 164.308(a)(7)(ii)(E),

164.310(a)(2)(i), 164.316APO02.01, APO02.06, APO03.01, EDM02.03,
ID.BE-4Are dependencies and critical functions for delivery of primary/critical services by your organization established?CP-2, CP-8, PE-9, PE-11, PM-8, RA-9, SA-20, SR-227001:2013 A.11.2.2, A.11.2.3, A.12.1.345 C.F.R. §§

164.308(a)(7)(i), 164.308.(a)(7)(ii)(E), 164.310(a)(2)(i), 164.312(a)(2)(ii),

164.314(a)(1), 164.314(b)(2)(i)APO10.01, BAI04.02, BAI09.02
ID.BE-5Are resiliency requirements to support delivery of primary/critical services established for all operating states (e.g., during a security incident/cyber attack, during recovery, normal operations)?CP-2, CP-11, RA-9, SA-8, SA-2027001:2013 A.11.1.4, A.17.1.1, A.17.1.2, A.17.2.145 C.F.R. §§

164.308(a)(1)(ii)(B), 164.308(a)(6)(ii), 164.308(a)(7), 164.308(a)(8), 164.310(a)(2)(i),

164.312(a)(2)(ii), 164.314(b)(2)(i)BAI03.02, DSS04.02
Governance (ID.GV): The policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.
ID.GV-1Does your organization have an information security/cybersecurity policy established, documented, and communicated?-1 controls from all security control families1927001:2013 A.5.1.1ISA 62443-2-1:2009 4.3.2.645 C.F.R. §§
164.308(a)(1)(i), 164.316APO01.02, APO01.03, APO13.01, EDM01.02
ID.GV-2Are all cybersecurity roles and responsibilities coordinated and aligned with internal roles and external partners?PS-7, PS-9, PM-1, PM-2, PM-291927001:2013 A.6.1.1, A.7.2.1, A.15.1.1ISA 62443-2-1:2009 4.3.2.3.345 C.F.R. §§

164.308(a)(1)(i), 164.308(a)(2), 164.308(a)(3),

164.308(a)(4), 164.308(b), 164.314APO01.02, APO01.05, APO10.03, APO13.02, DSS05.04
ID.GV-3Are legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, understood and managed?-1 controls from all security control families1927001:2013 A.18.1.1, A.18.1.2, A.18.1.3, A.18.1.4, A.18.1.5ISA 62443-2-1:2009 4.4.3.745 C.F.R. §§ 164.306,
164.308, 164.310, 164.312, 164.314, 164.316BAI02.01, MEA03.01, MEA03.04
ID.GV-4Does your organizations governance and risk management processes address your cybersecurity risks?PM-3, PM-7, PM-9, PM-10, PM-11, PM-28, RA-1, RA-2, RA-3, SA-227001:2013 Clause 6ISA 62443-2-1:2009 4.2.3.1, 4.2.3.3, 4.2.3.8, 4.2.3.9, 4.2.3.11, 4.3.2.4.3, 4.3.2.6.345 C.F.R. §§
164.308(a)(1), 164.308(b)EDM03.02, APO12.02, APO12.05, DSS04.02
Risk Assessment (ID.RA): The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.
ID.RA-1Are asset vulnerabilities (Hardware and Software) identified and documented?CA-2, CA-5, CA-7, CA-8, PM-4, PM-15, RA-3, RA-5, SA-5, SA-11, SI-2, SI-4, SI-53.11.1, 3.11.2, 3.12.1, 3.12.3, 3.14.1, 3.14.3, 3.14.6, 3.14.7427001:2013 A.12.6.1, A.18.2.3ISA 62443-2-1:2009 4.2.3, 4.2.3.7, 4.2.3.9, 4.2.3.1245 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(7)(ii)(E), 164.308(a)(8), 164.310(a)(1), 164.312(a)(1),

164.316(b)(2)(iii)APO12.01, APO12.02, APO12.03, APO12.04, DSS05.01, DSS05.02
ID.RA-2Does your organization gather/receive cyber threat intelligence from information sharing forums and sources?PM-15, PM-16, RA-10, SI-53.14.1, 3.14.3427001:2013 A.6.1.4ISA 62443-2-1:2009 4.2.3, 4.2.3.9, 4.2.3.12No direct analog to HIPAA Security Rule.BAI08.01, BAI08.02, BAI08.03
ID.RA-3Are current and potential threats to both internal and external systems identified and documented?PM-12, PM-16, RA-3, RA-10, SI-53.11.1, 3.14.1, 3.14.3427001:2013 Clause 6.1.2ISA 62443-2-1:2009 4.2.3, 4.2.3.9, 4.2.3.1245 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5)(ii)(A), 164.310(a)(1), 164.310(a)(2)(iii), 164.312(a)(1), 164.312(c),

164.312(e), 164.314, 164.316APO12.01, APO12.02, APO12.03, APO12.04
ID.RA-4Are potential business impacts and likelihoods identified?CP-2, PM-9, PM-11, RA-2, RA-3, RA-93.11.1427001:2013 A.16.1.6, Clause 6.1.2ISA 62443-2-1:2009 4.2.3, 4.2.3.9, 4.2.3.1245 C.F.R. §§

164.308(a)(1)(i), 164.308(a)(1)(ii)(A), 164.308(a)(1)(ii)(B), 164.308(a)(6),

164.308(a)(7)(ii)(E), 164.308(a)(8), 164.316(a)DSS04.02
ID.RA-5Are threats, vulnerabilities, likelihoods, and impacts used to determine risk?CA-2, CA-7, PM-16, PM-28, RA-2, RA-33.11.1427001:2013 A.12.6.145 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(1)(ii)(B), 164.308(a)(1)(ii)(D), 164.308(a)(7)(ii)(D),

164.308(a)(7)(ii)(E), 164.316(a)APO12.02
ID.RA-6Are risk responses identified and prioritized?CA-5, PM-4, PM-9, PM-28, RA-7427001:2013 Clause 6.1.345 C.F.R. §§

164.308(a)(1)(ii)(B), 164.314(a)(2)(i)(C),

164.314(b)(2)(iv)APO12.05, APO13.02
Risk Management Strategy (ID.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.
ID.RM-1Are your organizations risk management processes established, documented, managed, and agreed to by your organizations stakeholders (Suppliers, customers, and partners)?PM-9, PM-28427001:2013 Clause 6.1.3, Clause 8.3, Clause 9.3ISA 62443-2-1:2009 4.3.4.245 C.F.R. §
164.308(a)(1)(ii)(B)APO12.04, APO12.05, APO13.02, BAI02.03, BAI04.02
ID.RM-2Does your organization have a risk tolerance and acceptance level that is determined and clearly expressed?PM-927001:2013 Clause 6.1.3, Clause 8.3ISA 62443-2-1:2009 4.3.2.6.545 C.F.R. §
164.308(a)(1)(ii)(B)APO12.06, EDM03.01
ID.RM-3Is your organizations risk tolerance informed by its role in criticial infrastructure and/or industry specific risk analysis?PM-8, PM-9, PM-11, RA-927001:2013 Clause 6.1.3, Clause 8.345 C.F.R. §§

164.308(a)(1)(ii)(B), 164.308(a)(6)(ii), 164.308(a)(7)(i), 164.308(a)(7)(ii)(C),164.308(a)(7)(ii)(E),

164.310(a)(2)(i)APO12.02
Supply Chain Risk Management (ID.SC):

The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has established and implemented the processes to identify, assess and manage supply chain risks.

ID.SC-1Are your organizations cyber supply chain risk management processes identified, established, assessed, managed, and agreed to by your organizations stakeholders (suppliers, customers, and partners)?PM-30, SA-9, SR-1, SR-2, SR-3, SR-5427001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2ISA 62443-2-1:2009 4.3.4.2APO10.01, APO10.04, APO12.04, APO12.05, APO13.02, BAI01.03, BAI02.03, BAI04.02
ID.SC-2Are all suppliers and third-party partners of information systems, components, and services identified, prioritized, and assessed using an established cyber supply chain risk assessment process?PM-9, RA-3, SA-15, SR-2, SR-3, SR-5, SR-627001:2013 A.15.2.1, A.15.2.2ISA 62443-2-1:2009 4.2.3.1, 4.2.3.2, 4.2.3.3, 4.2.3.4, 4.2.3.6, 4.2.3.8, 4.2.3.9, 4.2.3.10, 4.2.3.12, 4.2.3.13, 4.2.3.14APO10.01, APO10.02, APO10.04, APO10.05, APO12.01, APO12.02, APO12.03, APO12.04, APO12.05, APO12.06, APO13.02, BAI02.03
ID.SC-3Are contracts with suppliers and third-party partners used to implement appropriate measures designed to meet the objectives of an organization's cybersecurity program and cyber supply chain risk managmeent plan?SA-4, SA-9, SR-2, SR-3, SR-527001:2013 A.15.1.1, A.15.1.2, A.15.1.3ISA 62443-2-1:2009 4.3.2.6.4, 4.3.2.6.7APO10.01, APO10.02, APO10.03, APO10.04, APO10.05
ID.SC-4Are suppliers and third-party partners routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations?AU-6, CA-2, CA-7, PS-7, SA-9, SA-1127001:2013 A.15.2.1, A.15.2.2ISA 62443-2-1:2009 4.3.2.6.7 ISA 62443-3-3:2013 SR 6.1APO10.01, APO10.03, APO10.04, APO10.05, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA02.01, MEA02.02, MEA03.03, MEA03.04, MEA04.07
ID.SC-5Is response and recovery planning and testing conducted with suppliers and third-party providers regularly (quarterly, yearly, etc.)?CP-2, CP-4, IR-3, IR-4, IR-8, IR-91927001:2013 A.17.1.3ISA 62443-2-1:2009 4.3.2.5.7, 4.3.4.5.11 ISA 62443-3-3:2013 SR 2.8, SR 3.3, SR.6.1, SR 7.3, SR 7.4DSS04.04

Protect

Information SecurityStatusExplanation/Comments
#Question(Y/N)NIST SP 800-53 r5NIST SP 800-171 r2CIS CSCISO/IECISAHIPAA Security RuleCOBIT 2019
Identity Management, Authentication and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.
PR.AC-1Are user identities and credentials issued, managed, verified, revoked, and auditied for authorized devices, users, and processes?IA-1, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, IA-10, IA-11, IA-123.5.1, 3.5.2, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.5.10, 3.5.111, 5, 15 & 1627001:2013 A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3ISA 62443-2-1:2009 4.3.3.5.1 ISA 62443-3-3:2013 SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.945 C.F.R. §§

164.308(a)(3)(ii)(B), 164.308(a)(3)(ii)(C), 164.308(a)(4)(i), 164.308(a)(4)(ii)(B), 164.308(a)(4)(ii)(C ), 164.312(a)(2)(i), 164.312(a)(2)(ii), 164.312(a)(2)(iii),

164.312(d)DSS05.04, DSS06.03
PR.AC-2 PR.AC-3Is physical and remote access to assets managed and protected?PE-1, PE-2, PE-3, PE-4, PE-5, PE-6, PE-8, PE-9, AC-1, AC-17, AC-19, AC-20, SC-153.1.1, 3.1.2, 3.1.14, 3.1.15, 3.1.18, 3.1.20, 3.10.1, 3.10.2, 3.10.3, 3.10.4, 3.10.5, 3.13.121227001:2013 A.6.2.1, A.6.2.2, A.11.1.1, A.11.1.2, A.11.1.3, A.11.1.4, A.11.1.5, A.11.1.6, A.11.2.1, A.11.2.3, A.11.2.5, A.11.2.6, A.11.2.7, A.11.2.8, A.13.1.1, A.13.2.1ISA 62443-2-1:2009 4.3.3.3.2, 4.3.3.6.6, 4.3.3.3.8, ISA 62443-3-3:2013 SR 1.13, SR 2.645 C.F.R. §§

164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1),

164.312(e)(2)(ii)APO13.01, BAI09.02, BAI09.03 DSS01.04, DSS05.03
PR.AC-4Are access permissions and authorizations managed, incorporating the principles of least privelege and separation of duties for users?AC-1, AC-2, AC-3, AC-5, AC-6, AC-14, AC-16, AC-243.1.1, 3.1.2, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.10, 3.1.11, 3.5.3, 3.5.4, 3.13.3, 3.13.43, 5, 12, 14, 15, 16 & 1827001:2013 A.6.1.2, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5ISA 62443-2-1:2009 4.3.3.7.3 ISA 62443-3-3:2013 SR 2.145 C.F.R. §§

164.308(a)(3), 164.308(a)(4), 164.310(a)(2)(iii), 164.310(b), 164.312(a)(1),

164.312(a)(2)(i), 164.312(a)(2)(ii)DSS05.04
PR.AC-5Is your organizaitons network integrity protected by utilizing network segmentation, network segregation, etc.?AC-4, AC-10, SC-7, SC-10, SC-203.1.3, 3.13.1, 3.13.2, 3.13.5, 3.13.6, 3.13.79, 14, 15 & 1827001:2013 A.13.1.1, A.13.1.3, A.13.2.1, A.14.1.2, A.14.1.3ISA 62443-2-1:2009 4.3.3.4 ISA 62443-3-3:2013 SR 3.1, SR 3.845 C.F.R. §§

164.308(a)(4)(ii)(B), 164.310(a)(1), 164.310(b), 164.312(a)(1), 164.312(b),

164.312(c), 164.312(e)DSS05.02, DSS05.03
PR.AC-6Are user identities proofed and bound to credentials and asserted in interactions?AC-16, IA-1, IA-2, IA-4, IA-5, IA-8, IA-12, PE-2, PS-31627001:2013, A.7.1.1, A.9.2.1ISA 62443-2-1:2009 4.3.3.2.2, 4.3.3.5.2, 4.3.3.7.2, 4.3.3.7.4 ISA 62443-3-3:2013 SR 1.1, SR 1.2, SR 1.4, SR 1.5, SR 1.9, SR 2.1DSS05.04, DSS05.05, DSS05.07, DSS06.03
PR.AC-7Are users, devices, and other assets authenticated (e.g., single-factor, multi-factor) according to the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)?AC-14, IA-1, IA-2, IA-3, IA-5, IA-8, IA-9, IA-10, IA-111, 12, 15 & 1627001:2013 A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, A.18.1.4ISA 62443-2-1:2009 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 ISA 62443-3-3:2013 SR 1.1, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 1.10DSS05.04, DSS06.03
Awareness and Training (PR.AT): The organization’s personnel and partners are provided cybersecurity awareness education and are trained to perform their cybersecurity-related duties and responsibilities consistent with related policies, procedures, and agreements.
PR.AT-1Are all users within your organization informed and trained on cyber security awareness?AT-2, PM-13, PM-143.2.1, 3.2.2,3.2.317 & 18ISA 62443-2-1:2009 4.3.2.4.245 C.F.R. §
164.308(a)(5)APO07.03, BAI05.07
PR.AT-2 PR.AT-3 PR.AT-4 PR.AT-5Do all users (standard, priveleged, third-party stakeholders (suppliers, customers, partners), senior executives, cyber & physical security personnel) understand their roles and responsibilities?AT-3, PM-13, PS-7, SA-9, CP-3, IR-23.2.1, 3.2.25, 17, 18 & 1927001:2013 A.6.1.1, A.7.2.1, A.7.2.2ISA 62443-2-1:2009 4.3.2.4.2, 4.3.2.4.345 C.F.R. §§

164.308(a)(2), 164.308(a)(3)(i), 164.308(a)(5)(i), 164.308(a)(5)(ii)(A), 164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C), 164.308(a)(5)(ii)(D), 164.308(b), 164.314(a)(1), 164.314(a)(2)(i),

164.314(a)(2)(ii)APO01.02, APO07.02, APO07.03, APO07.06, APO10.04, APO10.05, DSS05.04, DSS06.03, EDM01.02
Data Security (PR.DS): Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.
PR.DS-1Is data-at-rest encrypted?MP-2, MP-3, MP-4, MP-5, MP-6, MP-7, MP-8, SC-283.1.19, 3.8.1, 3.8.9, 3.13.10, 3.13.1613 & 1427001:2013 A.8.2.3ISA 62443-3-3:2013 SR 3.4, SR 4.145 C.F.R. §§

164.308(a)(1)(ii)(D), 164.308(b)(1), 164.310(d), 164.312(a)(1), 164.312(a)(2)(iii), 164.312(a)(2)(iv), 164.312(b), 164.312(c),

164.314(b)(2)(i), 164.312(d)APO01.07, APO14.04, APO14.05, APO14.08, BAI02.01, DSS04.07, DSS05.03, DSS06.06
PR.DS-2Is data-in-transit encrypted?SC-8, SC-113.1.13, 3.1.17, 3.8.5, 3.13.8, 3.13.10,13 & 1427001:2013 A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3ISA 62443-3-3:2013 SR 3.1, SR 3.8, SR 4.1, SR 4.245 C.F.R. §§

164.308(b)(1), 164.308(b)(2), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii),

164.314(b)(2)(i)APO01.07, APO14.04, APO14.05, APO14.08, DSS05.02, DSS06.06
PR.DS-3Are assets formally managed throughout removal, transfers, and disposition?CM-8, MP-6, PE-16, PE-203.4.1, 3.8.1, 3.8.2, 3.8.3, 3.8.5127001:2013 A.8.2.3, A.8.3.1, A.8.3.2, A.8.3.3, A.11.2.5, A.11.2.7ISA 62443-2-1:2009 4.3.3.3.9, 4.3.4.4.1 ISA 62443-3-3:2013 SR 4.245 C.F.R. §§

164.308(a)(1)(ii)(A), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(a)(2)(iv),

164.310(d)(1), 164.310(d)(2)BAI09.03
PR.DS-4Is there adequate capacity in the system/service to ensure availability is maintained?AU-4, CP-2, PE-11, SC-51, 2, 1327001:2013 A.12.1.3, A.17.2.1ISA 62443-3-3:2013 SR 7.1, SR 7.245 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(1)(ii)(B), 164.308(a)(7), 164.310(a)(2)(i),

164.310(d)(2)(iv), 164.312(a)(2)(ii)APO13.01, BAI04.04, BAI04.05
PR.DS-5Are there protections against data leaks established, documented, and managed?AC-4, AC-5, AC-6, AU-13, PE-19, PS-6, SC-7, SI-43.1.4, 3.1.13, 3.2.3, 3.9.2, 3.13.1, 3.13.5, 3.13.6, 3.13.7, 3.13.8, 3.13.11, 3.13.6, 3.14.61327001:2013 A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3ISA 62443-3-3:2013 SR 5.245 C.F.R. §§

164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c),

164.312(a), 164.312€APO01.07, APO13.02, DSS05.04, DSS05.07, DSS06.02
PR.DS-6 PR.DS-8Are integrity checking mechanisms used to verify software, hardware, firmware, and information integrity?SI-7, SI-10, SA-102, 327001:2013 A.11.2.4, A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3, A.14.2.4ISA 62443-2-1:2009 4.3.4.4.4, ISA 62443-3-3:2013 SR 3.1, SR 3.3, SR 3.4, SR 3.845 C.F.R. §§

164.308(a)(1)(ii)(D), 164.312(b),

164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i)APO01.07, BAI03.05, BAI06.01, DSS06.02
PR.DS-7Are the development and testing environment(s) separate from the production environment?CM-218, 2027001:2013 A.12.1.445 C.F.R. §
164.308(a)(4)BAI03.07, BAI03.08, BAI07.04
Information Protection Processes and Procedures (PR.IP): Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.
PR.IP-1Does your organization create and maintain copies of baseline images of information Technology/Industrial Control Systems that have been hardened/configured by incorporating industry leading security principles, such as the concept of least functionality?CM-1, CM-2, CM-3, CM-4, CM-5, CM-6, CM-7, CM-9, SA-103.4.1, 3.4.2, 3.4.6, 3.4.7, 3.4.83, 9, 1127001:2013 A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4ISA 62443-2-1:2009 4.3.4.3.2, 4.3.4.3.3 ISA 62443-3-3:2013 SR 7.645 C.F.R. §§

164.308(a)(8), 164.308(a)(7)(i),

164.308(a)(7)(ii)BAI10.01, BAI10.02, BAI10.03, BAI10.05
PR.IP-2Is there an established system development lifecycle to manage systems?SA-3, SA-4, SA-8, SA-10, SA-111827001:2013 A.6.1.5, A.14.1.1, A.14.2.1, A.14.2.5ISA 62443-2-1:2009 4.3.4.3.345 C.F.R. §
164.308(a)(1)(i)APO13.01, BAI03.01, BAI03.02, BAI03.03
PR.IP-3Are there configuration change control processes in place for systems?CM-3, CM-4, SA-103.4.3, 3.4.4, 3.4.53, 1127001:2013 A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4ISA 62443-2-1:2009 4.3.4.3.2, 4.3.4.3.3 ISA 62443-3-3:2013 SR 7.645 C.F.R. §
164.308(a)(8)BAI01.06, BAI06.01
PR.IP-4Are backups of data conducted, maintained, and tested regularly?CP-4, CP-6, CP-91027001:2013 A.12.3.1, A.17.1.2, A.17.1.3, A.18.1.3ISA 62443-2-1:2009 4.3.4.3.9 ISA 62443-3-3:2013 SR 7.3, SR 7.445 C.F.R. §§

164.308(a)(7)(ii)(A), 164.308(a)(7)(ii)(B), 164.308(a)(7)(ii)(D), 164.310(a)(2)(i),

164.310(d)(2)(iv)APO13.01, BAI07.02, DSS01.01, DSS04.07
PR.IP-5Are policies and regulations regarding the phyiscal operating environment for organizational assets met?PE-127001:2013 A.11.1.4, A.11.2.1, A.11.2.2, A.11.2.3ISA 62443-2-1:2009 4.3.3.3.1 4.3.3.3.2, 4.3.3.3.3, 4.3.3.3.5, 4.3.3.3.645 C.F.R. §§

164.308(a)(7)(i), 164.308(a)(7)(ii)(C), 164.310,

164.316(b)(2)(iii)DSS01.04, DSS05.05
PR.IP-6Is data (physical and electronic) destroyed according to policy?MP-6, SR-123.8.327001:2013 A.8.2.3, A.8.3.1, A.8.3.2, A.11.2.7ISA 62443-2-1:2009 4.3.4.4.4 ISA 62443-3-3:2013 SR 4.245 C.F.R. §§
164.310(d)(2)(i), 164.310(d)(2)(ii)BAI09.03, DSS05.06
PR.IP-7 PR.IP-8Are protection processes continually improved, and the effectiveness of protection technologies are shared with third-party stakeholders (suppliers, customers, and partners)?CA-2, CA-7, CA-8, CP-2, CP-4, IR-3, IR-8, PL-2, PM-6, AC-21, CA-7, CP-2, IR-8, SI-427001:2013 A.16.1.6, Clause 9, Clause 10ISA 62443-2-1:2009 4.4.3.1, 4.4.3.2, 4.4.3.3, 4.4.3.4, 4.4.3.5, 4.4.3.6, 4.4.3.7, 4.4.3.845 C.F.R. §§

164.306(e), 164.308(a)(6)(ii), 164.308(a)(7)(ii)(D),

164.308(a)(8), 164.316(b)(2)(iii)APO11.06, APO12.06, DSS04.05, BAI08.04, DSS03.04
PR.IP-9Does your organization have an incident response plan established, documented, and managed?CP-1, CP-2, CP-7, CP-10, IR-1, IR-7, IR-8, IR-93.6.1, 3.6.2, 3.6.31927001:2013 A.16.1.1, A.17.1.1, A.17.1.2,ISA 62443-2-1:2009 4.3.2.5.3, 4.3.4.5.145 C.F.R. §§

164.308(a)(6), 164.308(a)(7), 164.308(a)(7)(ii)(D), 164.310(a)(2)(i),

164.312(a)(2)(ii)APO12.06, DSS04.02, DSS04.03
PR.IP-9Does your organization have a Business Continuity and/or COOP established, documented, and managed?CP-1, CP-2, CP-7, CP-10, IR-1, IR-7, IR-8, IR-93.6.1, 3.6.2, 3.6.31927001:2013 A.16.1.1, A.17.1.1, A.17.1.2,ISA 62443-2-1:2009 4.3.2.5.3, 4.3.4.5.145 C.F.R. §§

164.308(a)(6), 164.308(a)(7), 164.308(a)(7)(ii)(D), 164.310(a)(2)(i),

164.312(a)(2)(ii)APO12.06, DSS04.02, DSS04.03
PR.IP-9Does your organization have a disaster & incident recovery plan established, documented, and managed?CP-1, CP-2, CP-7, CP-10, IR-1, IR-7, IR-8, IR-93.6.1, 3.6.2, 3.6.31927001:2013 A.16.1.1, A.17.1.1, A.17.1.2,ISA 62443-2-1:2009 4.3.2.5.3, 4.3.4.5.145 C.F.R. §§

164.308(a)(6), 164.308(a)(7), 164.308(a)(7)(ii)(D), 164.310(a)(2)(i),

164.312(a)(2)(ii)APO12.06, DSS04.02, DSS04.03
PR.IP-10Are response plans (Incident Response & Business Continuity) and recovery plans (Incident Recovery & Disaster Recovery) tested/exercised regularly?CP-4, IR-3, PM-143.6.1, 3.6.2, 3.6.319, 2027001:2013 A.17.1.3ISA 62443-2-1:2009 4.3.2.5.7, 4.3.4.5.11, ISA 62443-3-3:2013 SR 3.345 C.F.R. §§

164.308(a)(6), 164.308(a)(7), 164.308(a)(7)(ii)(D), 164.310(a)(2)(i),

164.312(a)(2)(ii)DSS04.04
PR.IP-11Is cybersecurity included in human resouceses practices (deprovisioning, personnel screening, etc.)?PS-1, PS-2, PS-3, PS-4, PS-5, PS-6, PS-7, PS-8, PS-9, SA-213.9.1, 3.9.2,527001:2013 A.7.1.1, A.7.1.2, A.7.2.1, A.7.2.2, A.7.2.3, A.7.3.1, A.8.1.4ISA 62443-2-1:2009 4.3.3.2.1, 4.3.3.2.2, 4.3.3.2.345 C.F.R. §§
164.308(a)(1)(ii)(C), 164.308(a)(3)APO07.01, APO07.02, APO07.03, APO07.04, APO07.05, DSS05.04, DSS05.05, DSS06.03
PR.IP-12Does your organizaiotn have a vulnerability management plan developed and implemented?RA-1, RA-3, RA-5, SI-23.11.2, 3.11.3, 3.12.2, 3.12.3, 3.14.1, 3.14.2, 3.14.34, 18, 2027001:2013 A.12.6.1, A.14.2.3, A.16.1.3, A.18.2.2, A.18.2.345 C.F.R. §§

164.308(a)(1)(i), 164.308(a)(1)(ii)(A),

164.308(a)(1)(ii)(B)BAI03.10, DSS05.01, DSS05.02, DSS05.07
Maintenance (PR.MA): Maintenance and repairs of industrial control and information system components are performed consistent with policies and procedures.
PR.MA-1Are maintenance and repair of organizational assets performed and logged, with approved and controlled tools?MA-1, MA-2, MA-3, MA-5, MA-63.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.627001:2013 A.11.1.2, A.11.2.4, A.11.2.5, A.11.2.6ISA 62443-2-1:2009 4.3.3.3.745 C.F.R. §§
164.308(a)(3)(ii)(A), 164.310(a)(2)(iv)BAI03.10, BAI09.02, BAI09.03, DSS01.05
PR.MA-2Is remote maintenance and repair of organizational assets approved, logged, and performed in a manner that prevents unauthorized assets?MA-43.7.53, 527001:2013 A.11.2.4, A.15.1.1, A.15.2.1ISA 62443-2-1:2009 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.845 C.F.R. §§

164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2)(ii), 164.310(d)(2)(iii), 164.312(a), 164.312(a)(2)(ii), 164.312(a)(2)(iv), 164.312(b), 164.312(d),

164.312(e), 164.308(a)(1)(ii)(D)DSS05.04
Protective Technology (PR.PT): Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.
PR.PT-1Are audit/log records determined, documented, implemented, and reviewed in accordance with your organizations policy?AU-1, AU-2, AU-3, AU-6, AU-7, AU-12, AU-13, AU-14, AU-163.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9,1, 3, 5, 6, 14, 15, 1627001:2013 A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1ISA 62443-2-1:2009 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4 ISA 62443-3-3:2013 SR 2.8, SR 2.9, SR 2.10, SR 2.11, SR 2.1245 C.F.R. §§

164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii),

164.312(b)APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01
PR.PT-2Is removable media protected and its use restricted according to your organizations policy?MP-1, MP-2, MP-3, MP-4, MP-5, MP-7, MP-83.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.88, 1327001:2013 A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.11.2.9ISA 62443-3-3:2013 SR 2.345 C.F.R. §§

164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1),

164.312(a)(2)(iv), 164.312(b)APO13.01, DSS05.02, DSS05.06
PR.PT-3Is the principle of least functionality incorporated by configuring systems to provide only essential capabilities?AC-3, CM-73.1.1, 3.1.2, 3.4.6, 3.4.7, 3.4.8,3, 11, 14ISO/IEC 27001:2013 A.9.1.245 C.F.R. §§

164.308(a)(3), 164.308(a)(4), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.312(a)(1), 164.312(a)(2)(i),

164.312(a)(2)(ii), 164.312(a)(2)(iv)BAI10.01, BAI10.02, BAI10.03, DSS05.02, DSS05.05, DSS06.06
PR.PT-4Are communication and control networks protected?AC-12, AC-17, AC-18, CP-8, SC-5, SC-7, SC-10, SC-11, SC-20, SC-21, SC-22, SC-23, SC-31, SC-37, SC-38, SC-473.13.1, 3.13.2, 3.13.5, 3.13.6, 3.13.7, 3.13.158, 12, 1527001:2013 A.13.1.1, A.13.2.1, A.14.1.3ISA 62443-3-3:2013 SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.645 C.F.R. §§

164.308(a)(1)(ii)(D), 164.312(a)(1),

164.312(b), 164.312€DSS05.02, APO13.01
PR.PT-5Are mechanisms (failsafe, load balancing, hot swap, etc.) implemented to achieve resiliance requirements in normal and adverse situations?CP-7, CP-8, CP-11, CP-12, CP-13, PE-11, PL-8, SC-627001:2013 A.17.1.2, A.17.2.1ISA 62443-2-1:2009 4.3.2.5.2 ISA 62443-3-3:2013 SR 7.1, SR 7.2BAI04.01, BAI04.02, BAI04.03, BAI04.04, BAI04.05, BAI09.02, DSS01.05, DSS04.02

Detect

Information SecurityStatusExplanation/Comments
#Question(Y/N)NIST SP 800-53 r5NIST SP 800-171 r2CIS CSCISO/IECISAHIPAA Security RuleCOBIT 2019
Anomalies and Events (DE.AE): Anomalous activity is detected and the potential impact of events is understood.
DE.AE-1Is there a baseline of network operations and expected data flows for users and systems that is established, documented, and managed?AC-4, CA-3, CM-2, SC-16, SI-41, 4, 6, 12, 13, 15, 1627001:2013 A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2ISA 62443-2-1:2009 4.4.3.345 C.F.R. §§
164.308(a)(1)(ii)(D), 164.312(b)DSS03.01
DE.AE-2Are detected anomolous events analyzed to understand attack targets and methods?AU-6, CA-7, RA-5, IR-4, SI-43.3.1, 3.3.2, 3.3.5, 3.6.1, 3.14.6, 3.14.73, 6, 13, 1527001:2013 A.12.4.1, A.16.1.1, A.16.1.4ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8 ISA 62443-3-3:2013 SR 2.8, SR 2.9, SR 2.10, SR 2.11, SR 2.12, SR 3.9, SR 6.1, SR 6.245 C.F.R. §
164.308(6)(i)DSS05.07
DE.AE-3Is anomolous event data collected and correlated from multiple sources and sensors throughout the organizaitons network and systems?AU-6, CA-7, CP-2, IR-4, IR-5, IR-8, SI-43.3.51, 3, 4, 5, 6, 7, 8, 11, 12, 13, 14, 15, 1627001:2013 A.12.4.1, A.16.1.7ISA 62443-3-3:2013 SR 6.145 C.F.R. §§

164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C), 164.308(a)(6)(ii), 164.308(a)(8), 164.310(d)(2)(iii), 164.312(b),

164.314(a)(2)(i)(C), 164.314(a)(2)(iii)BAI08.01, DSS01.03, DSS05.07, APO14.08, APO14.09
DE.AE-4Is the impact of these events determined to help mitigate future events?CP-2, IR-4, RA-3, SI-43.11.14, 627001:2013 A.16.1.445 C.F.R. §
164.308(a)(6)(ii)APO12.06, BAI04.02, DSS03.01
DE.AE-5Are incident alert threasholds on your organizaitons network and systems established and documented?IR-4, IR-5, IR-83.6.1, 3.6.26, 1927001:2013 A.16.1.4ISA 62443-2-1:2009 4.2.3.1045 C.F.R. §
164.308(a)(6)(i)APO12.06, DSS03.01, DSS01.03
Security Continuous Monitoring (DE.CM): The information system and assets are monitored to identify cybersecurity events and verify the effectiveness of protective measures.
DE.CM-1Is your organizaitons network monitored to detect potential cybersecurity events, either through a third-party service, in-house SOC/information security team, and/or tools?AU-12, CA-7, CM-3, SC-5, SC-7, SI-43.13.1, 3.14.6, 3.14.71, 7, 8, 12, 13, 15, 16ISA 62443-3-3:2013 SR 6.245 C.F.R. §§

164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C), 164.308(a)(8),

164.312(b), 164.312(e)(2)(i)DSS01.03, DSS03.05, DSS05.07
DE.CM-2Is your organizations physical environment monitored to detect potential cybersecurity events(i.e. device theft, etc.)?CA-7, PE-6, PE-203.10.2, 3.10.327001:2013 A.11.1.1, A.11.1.2ISA 62443-2-1:2009 4.3.3.3.845 C.F.R. §§
164.310(a)(2)(ii), 164.310(a)(2)(iii)DSS01.04, DSS01.05
DE.CM-3Is personnel activity monitored to detect potential cybersecurity events (i.e. insider threats, etc.)?AC-2, AU-12, AU-13, CA-7, CM-10, CM-113.1.12, 3.3.1, 3.3.2, 3.4.95, 7, 14, 1627001:2013 A.12.4.1, A.12.4.3ISA 62443-3-3:2013 SR 6.245 C.F.R. §§

164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i),

164.312(b), 164.312(d), 164.312(e)DSS05.07
DE.CM-4 DE.CM-5Are information systems, mobile devices, and assets monitored for malicious and unauthorized code?SC-44, SC-18, SI-3, SI-4, SI-83.13.13, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.54, 7, 8, 1227001:2013 A.12.2.1, A.12.5.1, A.12.6.2ISA 62443-2-1:2009 4.3.4.3.8 ISA 62443-3-3:2013 SR 3.2, SR 2.445 C.F.R. §§
164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(B)DSS05.01
DE.CM-6Is your organizations external sevice providor's activity monitored to detect potential cybersecurity events?CA-7, PS-7, SA-4, SA-9, SI-43.14.6, 3.14.727001:2013 A.14.2.7, A.15.2.145 C.F.R. §
164.308(a)(1)(ii)(D)APO07.06, APO10.05
DE.CM-7Does your organizaiton monitor for unauthorized personnel, connections, devices, and software?AU-12, CA-7, CM-3, CM-8, PE-6, PE-20, SI-43.1.12, 3.3.1, 3.10.2, 3.10.3, 3.14.6, 3.14.71, 2, 3, 5, 9, 12, 13, 15, 1627001:2013 A.12.4.1, A.14.2.7, A.15.2.145 C.F.R. §§

164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 164.312(b),

164.314(b)(2)(i)DSS05.02, DSS05.04, DSS05.05
DE.CM-8Are vulnerability scans performed on your organizaitons network, and information systems/assets?RA-53.11.24, 2027001:2013 A.12.6.1ISA 62443-2-1:2009 4.2.3.1, 4.2.3.745 C.F.R. §§
164.308(a)(1)(i), 164.308(a)(8)DSS05.07
Detection Processes (DE.DP): Detection processes and procedures are maintained and tested to ensure awareness of anomalous events.
DE.DP-1Are roles and responsibilities for detection of events well defined to ensure accountibility within your organization?CA-2, CA-7, PM-141927001:2013 A.6.1.1, A.7.2.2ISA 62443-2-1:2009 4.4.3.145 C.F.R. §§

164.308(a)(2), 164.308(a)(3)(ii)(A), 164.308(a)(3)(ii)(B), 164.308(a)(4), 164.310(a)(2)(iii), 164.312(a)(1),

164.312(a)(2)(ii)APO01.05, DSS06.03, MEA04.06
DE.DP-2Do detection activities comply with all applicable requirements within your organizaiton?CA-1, CA-2, CA-7, PM-14, SI-1, SI-4, SR-1, SR-9, SR-10, all -1 controls3.12.1, 3.12.3, 3.14.6, 3.14.727001:2013 A.18.1.4, A.18.2.2, A.18.2.3ISA 62443-2-1:2009 4.4.3.245 C.F.R. §§
164.308(a)(1)(i), 164.308(a)(8)DSS06.01, MEA03.03, MEA03.04
DE.DP-3Are detection processes tested regularly?CA-2, CA-7, SI-3, SI-4, PM-143.10.4, 3.12.1, 3.12.327001:2013 A.14.2.8ISA 62443-2-1:2009 4.4.3.2 ISA 62443-3-3:2013 SR 3.345 C.F.R. § 164.306(e)APO13.03, BAI03.07, BAI03.08, BAI07.05, DSS05.02
DE.DP-4Are detection processes and procedures communicated effectively?AU-6, CA-2, CA-7, RA-5, SI-41927001:2013 A.16.1.2, A.16.1.3ISA 62443-2-1:2009 4.3.4.5.9 ISA 62443-3-3:2013 SR 6.145 C.F.R. §§

164.308(a)(6)(ii), 164.314(a)(2)(i)(C),

164.314(a)(2)(iii)APO08.04, APO12.06, DSS03.02, DSS05.07
DE.DP-5Are detection processes and procedures continuously improved?CA-2, CA-7, PL-2, RA-5, SI-4, PM-1427001:2013 A.16.1.6ISA 62443-2-1:2009 4.4.3.445 C.F.R. §§
164.306(e), 164.308(a)(8)APO11.06, APO12.06, APO13.03, DSS04.05

Respond

Information SecurityStatusExplanation/Comments
#Question(Y/N)NIST SP 800-53 r5NIST SP 800-171 r2CIS CSCISO/IECISAHIPAA Security RuleCOBIT 2019
Response Planning (RS.RP): Response processes and procedures are executed and maintained, to ensure response to detected cybersecurity incidents.
RS.RP-1Is your incident response plan executed during/after an incident?CP-2, CP-10, IR-4, IR-83.6.21927001:2013 A.16.1.5ISA 62443-2-1:2009 4.3.4.5.145 C.F.R. §§

164.308(a)(6)(ii), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.308(a)(7)(ii)(B), 164.308(a)(7)(ii)(C), 164.310(a)(2)(i),

164.312(a)(2)(ii)APO12.06, DSS02.05, DSS03.04
Communications (RS.CO): Response activities are coordinated with internal and external stakeholders (e.g. external support from law enforcement agencies).
RS.CO-1Do all of your employees/users know their roles and responsibilities when a response is needed?CP-2, CP-3, IR-3, IR-83.6.31927001:2013 A.6.1.1, A.7.2.2, A.16.1.1ISA 62443-2-1:2009 4.3.4.5.2, 4.3.4.5.3, 4.3.4.5.445 C.F.R. §§

164.308(a)(2), 164.308(a)(7)(ii)(A), 164.308(a)(7)(ii)(B), 164.308(a)(7)(ii)(C), 164.310(a)(2)(i), 164.308(a)(6)(i),

164.312(a)(2)(ii)EDM03.02, APO01.02, APO01.05
RS.CO-2Are incidents reported consistently with established criteria?AU-6, IR-6, IR-83.6.21927001:2013 A.6.1.3, A.16.1.2ISA 62443-2-1:2009 4.3.4.5.545 C.F.R. §§

164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C), 164.308(a)(6)(ii), 164.314(a)(2)(i)(C),

164.314(a)(2)(iii)DSS01.03
RS.CO-3Is information shared during a response consistent with response plans?CP-2, IR-4, IR-81927001:2013 A.16.1.2, Clause 7.4, Clause 16.1.2ISA 62443-2-1:2009 4.3.4.5.245 C.F.R. §§

164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C),

164.308(a)(6)(ii), 164.314(a)(2)(i)(C)DSS03.03, DSS03.04
RS.CO-4Is the coordination with your organizations stakeholders consistent with response plans?CP-2, PE-6, IR-4, IR-83.6.11927001:2013 Clause 7.4ISA 62443-2-1:2009 4.3.4.5.545 C.F.R. §§

164.308(a)(6), 164.308(a)(7), 164.310(a)(2)(i),

164.312(a)(2)(ii)DSS03.04, DSS03.05
RS-CO-5Does voluntary information sharing occur with external stakeholders to achieve broader cybersecurity situational awareness?SI-5, PM-151927001:2013 A.6.1.445 C.F.R. §
164.308(a)(6)BAI08.03
Analysis (RS.AN): Analysis is conducted to ensure effective response and support recovery activities.
RS.AN-1Are notifications from detections of anomolous events investigated?AU-6, CA-7, IR-4, IR-5, PE-6, RA-5, SI-43.3.5, 3.6.1, 3.6.24, 6, 8, 1927001:2013 A.12.4.1, A.12.4.3, A.16.1.5ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8 ISA 62443-3-3:2013 SR 6.145 C.F.R. §§

164.308(a)(1)(i), 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(B), 164.308(a)(5)(ii)(C),

164.308(a)(6)(ii), 164.312(b)DSS02.04, DSS02.07
RS.AN-2Are impacts of security incidents analyzed and understood for future mitigation?CP-2, IR-4, RA-33.11.127001:2013 A.16.1.4, A.16.1.6ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.845 C.F.R. §§

164.308(a)(6)(ii), 164.308(a)(7)(ii)(B),

164.308(a)(7)(ii)(C), 164.308(a)(7)(ii)(E)DSS02.02, DSS03.01, DSS03.02, APO12.06
RS.AN-3Is digital forensics performed during or after a security incident?AU-7, IR-427001:2013 A.16.1.7ISA 62443-3-3:2013 SR 2.8, SR 2.9, SR 2.10, SR 2.11, SR 2.12, SR 3.9, SR 6.145 C.F.R. §
164.308(a)(6)APO12.06, DSS03.02, DSS05.07
RS.AN-4Are incidents categorized consistent with response plans?CP-2, IR-4, IR-5, IR-8, RA-33.6.1, 3.6.227001:2013 A.16.1.4ISA 62443-2-1:2009 4.3.4.5.645 C.F.R. §
164.308(a)(6)(ii)DSS02.02
RS.AN-5Are processes established to receive, analyze, and respond to vulnerabilities disclosed to the organizaiton from internal and external sources (e.g. internal testing, security bulletins, or security researchers)?CA-1, CA-2, RA-1, PM-4, PM-15, RA-7, SI-5, SR-64, 19EDM02.04, EDM03.02, BAI08.03, DSS05.07,
Mitigation (RS.MI): Activities are performed to prevent expansion of an event, mitigate its effects, and resolve the incident.
RS.MI-1Are incidents contained as soon as possible after detection?IR-43.6.1, 3.6.21927001:2013 A.12.2.1, A.16.1.5ISA 62443-2-1:2009 4.3.4.5.6 ISA 62443-3-3:2013 SR 5.1, SR 5.2, SR 5.445 C.F.R. §
164.308(a)(6)(ii)APO12.06, DSS05.03, DSS05.07
RS.MI-2Are incidents mitigated from lessons learned?IR-43.6.1, 3.6.24, 1927001:2013 A.12.2.1, A.16.1.5ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.1045 C.F.R. §
164.308(a)(6)(ii)APO12.06, DSS05.03, DSS05.07
RS.MI-3Are newly identified vulnerabilities mitigated or documented as acceptable risks?CA-2, CA-7, RA-3, RA-5, RA-73.11.1, 3.11.2, 3.11.3, 3.12.2, 3.12.4, 3.14.1427001:2013 A.12.6.145 C.F.R. §§

164.308(a)(1)(ii)(A), 164.308(a)(1)(ii)(B),

164.308(a)(6)(ii)APO12.06, DSS05.07
Improvements (RS.IM): Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.
RS.IM-1Do response plans incorporate lessons learned?CP-2, IR-4, IR-83.6.1, 3.6.227001:2013 A.16.1.6, Clause 10ISA 62443-2-1:2009 4.3.4.5.10, 4.4.3.445 C.F.R. §§

164.308(a)(7)(ii)(D), 164.308(a)(8),

164.316(b)(2)(iii))BAI01.09
RS.IM-2Are response strategies updated regularly (e.g. Quarterly, Annually, etc)CP-2, IR-4, IR-83.6.227001:2013 A.16.1.6, Clause 1045 C.F.R. §§
164.308(a)(7)(ii)(D), 164.308(a)(8)BAI01.09, DSS04.08

Recover

Information SecurityStatusExplanation/Comments
#Question(Y/N)NIST SP 800-53 r5NIST SP 800-171 r2CIS CSCISO/IECISAHIPAA Security RuleCOBIT 2019
Recovery Planning (RC.RP): Recovery processes and procedures are executed and maintained to ensure restoration of systems or assets affected by cybersecurity incidents.
RC.RP-1Is your recovery plan executed during or after a cybersecurity incident?CP-10, IR-4, IR-83.6.1, 3.6.21027001:2013 A.16.1.545 C.F.R. §§
164.308(a)(7), 164.310(a)(2)(i)APO12.06, DSS02.05, DSS03.04
Improvements (RC.IM): Recovery planning and processes are improved by incorporating lessons learned into future activities.
RC.IM-1Does your recovery plan incorporate lessons learned?CP-2, IR-4, IR-83.6.1, 3.6.2ISA 62443-2-1:2009 4.4.3.445 C.F.R. §§

164.308(a)(7)(ii)(D), 164.308(a)(8),

164.316(b)(2)(iii)APO12.06, BAI05.07, DSS04.08
RC.IM-2Are recovery strategies updated regularly?CP-2, IR-4, IR-83.6.1, 3.6.227001:2013 A.16.1.6, Clause 1045 C.F.R. §§
164.308(a)(7)(ii)(D), 164.308(a)(8)APO12.06, DSS04.08, BAI07.08
Communications (RC.CO): Restoration activities are coordinated with internal and external parties (e.g. coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors).
RC.CO-1Does your organizaiton have steps in place to manage public relations in the event of an incident?IR-427001:2013 Clause 7.445 C.F.R. §
164.308(a)(6)(i)MEA03.02
RC.CO-2Are efforts made to repair any damage to reputations after an incident?IR-427001:2013 Clause 7.445 C.F.R. §
164.308(a)(6)(i)MEA03.02, APO12.06
RC.CO-3Are recovery efforts communicated to internal and external stakeholders as well as executive and management teams?CP-2, IR-43.6.1, 3.6.227001:2013 Clause 7.445 C.F.R. §§

164.308(a)(6)(ii), 164.308(a)(7)(ii)(B), 164.308(a)(7)(ii)(C), 164.310(a)(2)(i), 164.314(a)(2)(i)© APO12.06

Event History

Information SecurityStatusExplanation/Comments
#Question(Y/N)
EH-1Has your organization sustained any network security incidents or data incidents that resulted in a material financial loss in the last 5 years?
EH-2In the last 5 years, has your organization been required to notify any individuals or entities because of a breach of information security?
EH-3In the last 5 years, has your organization received any demands or claims relating to allegations of theft of information or breach of information security?
EH-4In the last 5 years, has your organization beene the subject of any government action, regulatory investigation or subpoena regarding any alleged violation of any privacy/data security law or regulation?
EH-5In the last 5 years, has your organization experienced a network outage, or substantial loss of IT functionality for more than 6 hours?
EH-6Within the last 5 years, has your organization sustained any network security incidents, or outages as the result of actions of a 3rd party vendor (e.g. cloud vendors, IT consultants, payroll, data processing)?

Risk Matrix

ProbabilityRisk Rating =
Impact
Very LowLowModerateHighVery High
RareLOWLOWLOWMEDIUMMEDIUM
12345
UnlikelyLOWMEDIUMMEDIUMHIGHHIGH
246810
PossibleLOWMEDIUMHIGHHIGHEXTREME
3691215
ProbableMEDIUMHIGHHIGHEXTREMEEXTREME
48121620
Highly ProbableMEDIUMHIGHEXTREMEEXTREMEEXTREME
510152025
To Be Completed By OMES Third-Party Cyber Management Team

image1.png

File details come from the government source that posted it. Updated .