Appendix_6.10 _Vendor_Assessment_Guidelines_for_20_Critical_Security_Controls.pdf

Appendix 6.10

VENDOR ASSESSMENT GUIDELINES FOR TWENTY CRITICAL SECURITY CONTROLS FOR

EFFECTIVE CYBER DEFENSE: CONSENSUS AUDIT GUIDELINES (CAG)

General: Organizations should compare all 20 control areas against their current status.

The 20 Critical Controls are:

1. Inventory of Authorized and Unauthorized Devices

2. Inventory of Authorized and Unauthorized Software

3. Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers

4. Secure Configurations for Network Devices such as Firewalls, Routers, and Switches

5. Boundary Defense

6. Maintenance, Monitoring, and Analysis of Security Audit Logs

7. Application Software Security

8. Controlled Use of Administrative Privileges

9. Controlled Access Based on the Need to Know

10. Continuous Vulnerability Assessment and Remediation

11. Account Monitoring and Control

12. Malware Defenses

13. Limitation and Control of Network Ports, Protocols, and Services

14. Wireless Device Control

15. Data Loss Prevention

16. Secure Network Engineering

17. Penetration Tests and Red Team Exercises

18. Incident Response Capability

19. Data Recovery Capability

20. Security Skills Assessment and Appropriate Training to Fill Gaps

The entire text of the 20 Critical Security Controls is available for reference at:

http://www.sans.org/critical-security-controls/

Procedures:

1. Review each control.

2. Determine what procedures and tools exist within your organization to meet this control.

3. Document the result of 1-2 using the suggested template provided.

4. Provide any additional information about your company’s cyber security posture.

Company (Name): Information Assurance Report

Executive Summary: (descriptive self-assessment of the company’s overall information security posture)

A. Assessment of Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines

(CAG)

1. Control 1. Inventory of Authorized and Unauthorized Devices

a. Procedures and Tools supporting this control:

(List the procedures and tools used in your organization for this control)

b. Method to achieve control metric:

2. (Continue for remaining 19 controls).

If a particular control does not exist or is not used within your organization, please state this.

B. Assessment of Additional Security Measures for Effective Cyber Defense

1. Measure. (Title of additional measure/control)

a. Procedures and Tools supporting this measure/control:

(List the procedures and tools used in your organization)

b. Method to achieve measure/control metric:

2. (Continue for remaining measures/controls)