| Cybersecurity & Data Protection Governance Program | Cybersecurity & Data Protection Governance | Para 34(a) Board Accountability for Information Security | 10 | |
| Steering Committee & Program Oversight | Cybersecurity & Data Protection Governance | Para 34(b) Steering Committee & Program Oversight | 7 | |
| Publishing Cybersecurity & Data Protection Documentation | Cybersecurity & Data Protection Governance | Para 35 Publishing Cybersecurity & Data Protection Documentation | 10 | |
| Periodic Review & Update of Cybersecurity & Data Protection Program | Cybersecurity & Data Protection Governance | Para 37 Periodic Review & Update of Cybersecurity & Data Protection Program | 7 | |
| Assigned Cybersecurity & Data Protection Responsibilities | Cybersecurity & Data Protection Governance | Para 35 Assigned Cybersecurity & Data Protection Responsibilities | 10 | |
| Contacts With Authorities | Cybersecurity & Data Protection Governance | Para 36 Contacts With Authorities | 5 | |
| Asset Governance | Asset Management | | 10 | |
AST-01.1
| Asset-Service Dependencies | Asset Management | N/A | 5 | |
BCD-02
| Identify Critical Assets | Business Continuity & Disaster Recovery | N/A | 9 | |
CHG-03
| Security Impact Analysis for Changes | Change Management | N/A | 9 | |
| Statutory, Regulatory & Contractual Compliance | Compliance | Para 34-39 Statutory, Regulatory & Contractual Compliance | 10 | |
CPL-01.1
| Non-Compliance Oversight | Compliance | N/A | 9 | |
CPL-02
| Cybersecurity & Data Protection Controls Oversight | Compliance | N/A | 10 | |
CPL-02.1
| Internal Audit Function | Compliance | N/A | 5 | |
CPL-03
| Cybersecurity & Data Protection Assessments | Compliance | N/A | 10 | |
CPL-03.1
| Independent Assessors | Compliance | N/A | 6 | |
DCH-01
| Data Protection | Data Classification & Handling | N/A | 10 | |
DCH-02
| Data & Asset Classification | Data Classification & Handling | N/A | 10 | |
END-01.1
| Unified Endpoint Device Management (UEDM) | Endpoint Security | N/A | 6 | |
END-02
| Endpoint Protection Measures | Endpoint Security | N/A | 9 | |
END-03
| Prohibit Installation Without Privileged Status | Endpoint Security | N/A | 9 | |
END-03.1
| Software Installation Alerts | Endpoint Security | N/A | 8 | |
END-04.2
| Documented Protection Measures | Endpoint Security | N/A | 3 | |
END-04.4
| Heuristic / Nonsignature-Based Detection | Endpoint Security | N/A | 8 | |
END-04.5
| Malware Protection Mechanism Testing | Endpoint Security | N/A | 5 | |
END-04.6
| Evolving Malware Threats | Endpoint Security | N/A | 3 | |
END-04.7
| Always On Protection | Endpoint Security | N/A | 9 | |
END-05
| Software Firewall | Endpoint Security | N/A | 9 | |
END-06
| Endpoint File Integrity Monitoring (FIM) | Endpoint Security | N/A | 8 | |
END-06.1
| Integrity Checks | Endpoint Security | N/A | 6 | |
END-06.2
| Endpoint Detection & Response (EDR) | Endpoint Security | N/A | 9 | |
END-06.3
| Automated Notifications of Integrity Violations | Endpoint Security | N/A | 5 | |
END-06.4
| Automated Response to Integrity Violations | Endpoint Security | N/A | 5 | |
END-06.5
| Boot Process Integrity | Endpoint Security | N/A | 5 | |
END-06.6
| Protection of Boot Firmware | Endpoint Security | N/A | 5 | |
END-06.7
| Binary or Machine-Executable Code | Endpoint Security | N/A | 5 | |
END-06.8
| Extended Detection & Response (XDR) | Endpoint Security | N/A | 5 | |
END-07
| Host Intrusion Detection and Prevention Systems (HIDS / HIPS) | Endpoint Security | N/A | 9 | |
END-08.1
| Central Management | Endpoint Security | N/A | 5 | |
END-08.2
| Automatic Spam and Phishing Protection Updates | Endpoint Security | N/A | 8 | |
END-09
| Trusted Path | Endpoint Security | N/A | 9 | |
END-10
| Mobile Code | Endpoint Security | N/A | 4 | |
END-11
| Thin Nodes | Endpoint Security | N/A | 4 | |
END-12
| Port & Input / Output (I/O) Device Access | Endpoint Security | N/A | 6 | |
END-13
| Sensor Capability | Endpoint Security | N/A | 7 | |
END-13.1
| Authorized Use | Endpoint Security | N/A | 8 | |
END-13.2
| Notice of Collection | Endpoint Security | N/A | 6 | |
END-13.3
| Collection Minimization | Endpoint Security | N/A | 8 | |
END-13.4
| Sensor Delivery Verification | Endpoint Security | N/A | 4 | |
END-14
| Collaborative Computing Devices | Endpoint Security | N/A | 9 | |
END-14.1
| Disabling / Removal In Secure Work Areas | Endpoint Security | N/A | 5 | |
END-14.2
| Explicitly Indicate Current Participants | Endpoint Security | N/A | 5 | |
END-14.3
| Participant Identity Verification | Endpoint Security | N/A | 7 | |
END-14.4
| Participant Connection Management | Endpoint Security | N/A | 5 | |
END-14.5
| Malicious Link & File Protections | Endpoint Security | N/A | 7 | |
END-14.6
| Explicit Indication Of Use | Endpoint Security | N/A | 6 | |
END-15
| Hypervisor Access | Endpoint Security | N/A | 9 | |
END-16
| Restrict Access To Security Functions | Endpoint Security | N/A | 7 | |
END-16.1
| Host-Based Security Function Isolation | Endpoint Security | N/A | 7 | |
HRS-03
| Defined Roles & Responsibilities | Human Resources Security | N/A | 10 | |
| Incident Response Operations | Incident Response | Para 36 Incident Response Operations | 9 | |
| Incident Handling | Incident Response | | 10 | |
IRO-04
| Incident Response Plan (IRP) | Incident Response | N/A | 9 | |
IRO-06
| Incident Response Testing | Incident Response | N/A | 9 | |
IRO-07
| Integrated Security Incident Response Team (ISIRT) | Incident Response | N/A | 9 | |
IRO-09
| Situational Awareness For Incidents | Incident Response | N/A | 8 | |
IRO-13
| Root Cause Analysis (RCA) & Lessons Learned | Incident Response | N/A | 8 | |
PRM-01
| Cybersecurity & Data Protection Portfolio Management | Project & Resource Management | N/A | 8 | |
PRM-01.1
| Strategic Plan & Objectives | Project & Resource Management | N/A | 5 | |
PRM-01.2
| Targeted Capability Maturity Levels | Project & Resource Management | N/A | 5 | |
PRM-02
| Cybersecurity & Data Protection Resource Management | Project & Resource Management | N/A | 8 | |
PRM-03
| Allocation of Resources | Project & Resource Management | N/A | 8 | |
PRM-07
| Secure Development Life Cycle (SDLC) Management | Project & Resource Management | N/A | 10 | |
RSK-08
| Business Impact Analysis (BIA) | Risk Management | N/A | 8 | |
RSK-10
| Data Protection Impact Assessment (DPIA) | Risk Management | N/A | 9 | |
| Secure Engineering Principles | Secure Engineering & Architecture | Para 30 Security Awareness Training | 10 | |
SEA-01.1
| Centralized Management of Cybersecurity & Data Protection Controls | Secure Engineering & Architecture | N/A | 9 | |
SEA-02
| Alignment With Enterprise Architecture | Secure Engineering & Architecture | N/A | 9 | |
SEA-03
| Defense-In-Depth (DiD) Architecture | Secure Engineering & Architecture | N/A | 10 | |
TDA-06.1
| Criticality Analysis | Technology Development & Acquisition | N/A | 9 | |
TPM-01
| Third-Party Management | Third-Party Management | N/A | 10 | |
TPM-02
| Third-Party Criticality Assessments | Third-Party Management | N/A | 9 | |
TPM-03
| Supply Chain Risk Management (SCRM) | Third-Party Management | N/A | 9 | |
TPM-03.2
| Limit Potential Harm | Third-Party Management | N/A | 9 | |
TPM-04
| Third-Party Services | Third-Party Management | N/A | 10 | |
TPM-04.1
| Third-Party Risk Assessments & Approvals | Third-Party Management | N/A | 9 | |
TPM-05
| Third-Party Contract Requirements | Third-Party Management | N/A | 10 | |
TPM-08
| Review of Third-Party Services | Third-Party Management | N/A | 9 | |
| Threat Intelligence Program | Threat Management | Para 30 Threat Intelligence Program | 8 | |
THR-03.1
| Threat Intelligence Reporting | Threat Management | N/A | 8 | |
THR-04
| Insider Threat Program | Threat Management | N/A | 8 | |
THR-05
| Insider Threat Awareness | Threat Management | N/A | 8 | |
THR-06.1
| Security Disclosure Contact Information | Threat Management | N/A | 1 | |
THR-07
| Threat Hunting | Threat Management | N/A | 4 | |
THR-08
| Tainting | Threat Management | N/A | 1 | |
THR-09
| Threat Catalog | Threat Management | N/A | 5 | |
THR-10
| Threat Analysis | Threat Management | N/A | 7 | |
THR-11
| Behavioral Baselining | Threat Management | N/A | 5 | |
VPM-01
| Vulnerability & Patch Management Program (VPMP) | Vulnerability & Patch Management | N/A | 9 | |
VPM-02
| Vulnerability Remediation Process | Vulnerability & Patch Management | N/A | 10 | |
VPM-04
| Continuous Vulnerability Remediation Activities | Vulnerability & Patch Management | N/A | 8 | |
VPM-05
| Software & Firmware Patching | Vulnerability & Patch Management | N/A | 10 | |