Identify and document information and assets within an organization, including physical assets, as well as information such as data and software.

• Incident Response Plan Comp onents (12.10.1)

  Incident Response Plan Components refer to the essential elements that organizations must include in their incident response plan. A well-defined and tested incident response plan is crucial to effectively detect, respond to, and mitigate security incidents.

• Incident Response Plan Components (12.10.1)

  Incident Response Plan Components refer to the essential elements that organizations must include in their incident response plan. A well-defined and tested incident response plan is crucial to effectively detect, respond to, and mitigate security incidents.

• Plan Testing (12.10.2)

  Plan Testing involves conducting tests and drills of the incident response plan to assess its effectiveness, identify gaps, and improve response capabilities.

• Availability of Personnel to Respond to Alerts (12.10.3)

  Availability of Personnel to Respond to Alerts refers to ensuring that designated personnel are readily available to respond promptly to security alerts and incidents.

• Staff Training for Breach Response (12.10.4)

  Staff Training for Breach Response involves providing training and awareness programs to employees to educate them on identifying, reporting, and responding to security incidents and breaches.

• Alerts From Security Monitoring Systems (12.10.5)

  Alerts From Security Monitoring Systems refer to promptly detecting and responding to alerts triggered by security monitoring systems.

• Incorporating Lessons Learned and Industry Developments (12.10.6)

  Incorporating Lessons Learned and Industry Developments refers to an organization's practice of regularly updating and enhancing its incident response plan based on insights gained from real incidents, lessons learned, and emerging industry best practices.

• Quarterly Reviews (12.11)

  Quarterly Reviews refer to the periodic assessment and review of the organization's incident response activities, procedures, and effectiveness.

• Documentation of Quarterly Review Process (12.11.1)

  Documentation of Quarterly Review Process involves creating and maintaining records of the organization's quarterly reviews, including assessment findings, recommendations, and actions taken.

• Device and System Management (ID.AM-1)

  Manage assets (physical and virtual) and their associated risks, including identifying, classifying, and prioritizing assets based on their criticality and value to the organization.

• Software and Applications Management (ID.AM-2)

  Software and Applications Management (ID.AM-2) sub-control involves the management of software and applications used by an organization to ensure they are secure, up-to-date, and meet the organization's needs. This sub-control aims to protect against the exploitation of vulnerabilities in software and applications that may be used by malicious actors to gain unauthorized access to an organization's assets or data.

• Organizational Communication (ID.AM-3)

  ID.AM-3 Organizational Communications is a sub-control of the Identify (ID) function, under the Asset Management (AM) category. This sub-control aims to establish and maintain a process for the timely and secure communication of information within the organization regarding cybersecurity risks and incidents.

• External Information Systems (ID.AM-4)

  This sub-control requires organizations to establish and maintain policies and procedures for managing the risks associated with external information systems, which are systems owned, managed, and operated by other organizations. External information systems can include cloud computing services, mobile devices, third-party vendors, and other systems outside the organization's physical and logical boundaries.

• Resources Classification (ID.AM-5)

  ID.AM-5.2: Classify Resources: The organization should classify each resource based on its criticality, sensitivity, and value to the organization. This classification should take into account the potential impact on the organization if the resource were lost, stolen, or compromised.

• Roles and Responsibilities (ID.AM-6)

  Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established

Understand the organization's business context, including their mission, goals, stakeholders, and risk tolerance.

• Formal Firewall and Router Configurations Process (1.1.1)

  Formal Firewall and Router Configurations Process refers to the establishment of well-defined and documented procedures for configuring, managing, and reviewing firewall and router settings.

• Current Network Diagram (1.1.2)

  Current Network Diagram refers to maintaining an up-to-date and accurate representation of the organization's network topology and architecture.

• Cardholder data Flows Diagram (1.1.3)

  Cardholder Data Flows Diagram refers to creating and maintaining a visual representation of the flow of cardholder data through the organization's systems and networks.

• Firewall Network Requirements (1.1.4)

  Firewall Network Requirements refer to establishing and enforcing firewall rules and configurations to protect cardholder data and control network traffic.

• Roles and Responsibilities for Managing Network Components (1.1.5)

  Roles and Responsibilities for Managing Network Components refer to defining and communicating the responsibilities of personnel involved in configuring, monitoring, and managing network components.

• Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

  Documentation of All Services, Protocols, and Ports Allowed involves maintaining an up-to-date record of all services, protocols, and ports allowed within the organization's network.

• Six Month Firewall and Router Reviews (1.1.7)

  Six Month Firewall and Router Reviews involve conducting periodic reviews and assessments of firewall and router configurations every six months.

• Firewall and Router Configurations For Untrusted Networks (1.2)

  Firewall and Router Configurations for Untrusted Networks refer to defining specific security measures and access controls for connections with untrusted networks.

• Restricting Inbound and Outbound Traffic (1.2.1)

  Restricting Inbound and Outbound Traffic refers to configuring firewalls and routers to restrict inbound and outbound network traffic based on business requirements and security policies.

• Securing and Synchronizing Router Configuration Files (1.2.2)

  Securing and Synchronizing Router Configuration Files involves implementing measures to protect the confidentiality and integrity of router configuration files and ensuring they are synchronized across network devices.

• Perimeter Firewalls Between Wireless Networks and Cardholder Data Environment (1.2.3)

  Perimeter Firewalls Between Wireless Networks and Cardholder Data Environment refers to implementing firewalls to protect the connection between wireless networks and the cardholder data environment.

• Restricting Public Internet Access (1.3)

  Restricting Public Internet Access involves implementing measures to limit direct access to the cardholder data environment from the public internet.

• Implementing a DMZ to Limit Inbound Traffic (1.3.1)

  Implementing a DMZ to Limit Inbound Traffic refers to creating and maintaining a Demilitarized Zone (DMZ) to isolate external-facing systems from the internal network.

• Limiting DMZ InBound Traffic (1.3.2)

  Limiting DMZ Inbound Traffic involves configuring firewalls and access controls to restrict inbound traffic to the DMZ from untrusted networks.

• Implementing Anti-spoofing Measures (1.3.3)

  Implementing Anti-spoofing Measures involves configuring network devices to detect and prevent IP address spoofing attacks.

• Restricting Traffic Between the Internet and the Cardholder Data Environment (1.3.4)

  Restricting Traffic Between the Internet and the Cardholder Data Environment involves configuring firewalls and access controls to limit traffic flow between the public internet and the cardholder data environment.

• Permit only established connections into the network (1.3.5)

  Permit Only Established Connections into the Network involves configuring network devices to allow only established connections into the cardholder data environment.

• Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

  Segregate Cardholder Data Environment on Internal Network Zone involves creating a distinct internal network zone for the cardholder data environment, separating it from other internal networks.

• Disclosure of Private IPs and Routing Information (1.3.7)

  Disclosure of Private IPs and Routing Information refers to preventing the unintentional disclosure of private IP addresses and routing details to external parties.

• Preventing the Disclosure of Private IP Addresses and Routing Information to Unauthorized Parties (1.3.8)

  Preventing the Disclosure of Private IP Addresses and Routing Information involves protecting internal network information from unauthorized access.

• Installing Personal Firewall Software on Mobile Devices (1.4)

  Installing Personal Firewall Software on Mobile Devices involves deploying firewall software on mobile devices to protect them from unauthorized network access and potential security threats.

• Documenting Security Policies and Firewall Management (1.5)

  Documenting Security Policies and Firewall Management involves creating comprehensive policies and procedures for managing firewalls and documenting changes made to firewall configurations.

• Supply Chain (ID.BE-1)

  Establish a formal, documented, and verifiable process for managing the organization's suppliers and the products and services they provide. This process should be based on risk management principles and should take into consideration the criticality and sensitivity of the products and services being provided.

• Industry Sector (ID.BE-2)

  The NIST Cybersecurity Framework (CSF) Industry Sector ID.BE-2 sub-control pertains to the identification of key individuals and groups responsible for the management of industrial control systems (ICS) security.

• Organizational Mission (ID.BE-3)

  ID.BE-3 is a sub-control within the NIST Cybersecurity Framework's Identify (ID) function. Its mission is to describe the specific actions and strategies that an organization must implement in order to achieve the broader goal of managing its cybersecurity risk. The purpose of this sub-control is to ensure that the organization has a clear and concise understanding of its cybersecurity objectives and is able to effectively communicate these objectives to all relevant stakeholders.

• Dependencies (ID.BE-4)

  The ID.BE-4 sub-control requires organizations to identify and manage dependencies on external systems, applications, and services that are used for identity and access management (IAM) purposes.

• Resilience Requirements (ID.BE-5)

  ID.BE-5 requires organizations to develop and implement procedures for restoring their systems and data after a disruption or compromise. This includes the establishment of clear and well-defined processes for identifying and responding to incidents, as well as for restoring systems and data to a functional state.

The Governance control (ID.GV) is designed to establish and maintain a cybersecurity governance framework that enables the organization to manage cybersecurity risks effectively.

• Changing Vendor-supplied Defaults (2.1)

  Changing Vendor-supplied Defaults involves modifying default settings and passwords provided by vendors for system components and software.

• Changing Vendor Defaults in Wireless Environments (2.1.1)

  Changing Vendor Defaults in Wireless Environments involves modifying default settings and passwords provided by vendors for wireless devices and access points.

• Developing Configuration Standards for All System Components (2.2)

  Developing Configuration Standards for All System Components involves creating a set of configuration standards that apply to all system components within the organization.

• Implementing One Primary Function Per Server (2.2.1)

  Implementing One Primary Function Per Server involves assigning specific roles to servers, ensuring that each server has a single primary function.

• Enabling Only Necessary Services (2.2.2)

  Enabling Only Necessary Services involves disabling or deactivating unnecessary services and features on system components.

• Implementing Additional Security Features (2.2.3)

  Implementing Additional Security Features involves adding supplementary security measures to system components beyond default configurations.

• Configuring System Security Parameters to Prevent Misuse (2.2.4)

  Configuring System Security Parameters to Prevent Misuse involves adjusting system settings to prevent intentional or unintentional misuse of resources and privileges.

• Removing Unnecessary Functionality (2.2.5)

  Removing Unnecessary Functionality involves eliminating or disabling any features, services, or components that are not essential for the intended operation of a system.

• Encrypting Non-console Administrative Access (2.3)

  Encrypting Non-console Administrative Access involves securing remote administrative access to systems through encryption mechanisms.

• Maintaining an Inventory of System Components (2.4)

  Maintaining an Inventory of System Components involves creating and maintaining a comprehensive record of all hardware and software components within an organization's IT infrastructure.

• Security Policies and Procedures for Managing Vendor Defaults (2.5)

  Security Policies and Procedures for Managing Vendor Defaults involves establishing clear guidelines and procedures for managing vendor-provided default configurations and credentials.

• Protection Within Shared Hosting Providers (2.6)

  Protection Within Shared Hosting Providers involves implementing security measures to protect hosted environments within shared hosting platforms.

• Information Security Policy (ID.GV-1)

  Effective asset management is critical for maintaining the security and resilience of an organization's information and technology infrastructure. By implementing this sub-control, organizations can ensure that they have a comprehensive understanding of their assets, their associated risks, and the appropriate controls needed to protect them.

• Roles and Responsibilities (ID.GV-2)

  The Roles and Responsibilities sub-control of the Identify (ID) function within the NIST Cybersecurity Framework (CSF) focuses on ensuring that appropriate roles and responsibilities are established and managed within an organization's cybersecurity program. This sub-control involves several steps to ensure that all personnel involved in cybersecurity activities understand their roles, responsibilities, and the level of authority they have in the organization.

• Regulatory Requirements (ID.GV-3)

  Regulatory Requirement ID.GV-3 pertains to the implementation of sub-controls that are necessary for the protection of organizational assets and data. Specifically, ID.GV-3 requires organizations to "establish and implement appropriate access controls to sensitive information, including physical access controls, logical access controls, and network access controls."

• Governance and Risk Management Processes (ID.GV-4)

  Governance and Risk Management Processes (ID.GV-4) control requires organizations to develop and implement a risk management program that includes governance processes for identifying, assessing, evaluating, and mitigating risks to the organization's information systems, data, and assets.

The organization conducts periodic assessments of the risk to organizational operations (including mission, functions, image, and reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of organizational information.

• Minimizing Cardholder Data Storage (3.1)

  Minimizing Cardholder Data Storage involves reducing the amount of cardholder data stored within an organization's systems and applications.

• Storing Sensitive Authentication Data After Authorization (3.2)

  Storing Sensitive Authentication Data After Authorization involves securely storing authentication data after it has been authorized for use.

• Storing of Card Track Data After Authorization (3.2.1)

  Storing of Card Track Data After Authorization involves securely storing track data from the magnetic stripe on payment cards after it has been authorized for use.

• Storing of Card Verification Codes (3.2.2)

  Storing of Card Verification Codes involves securely storing the three- or four-digit card verification codes (CVV or CVC) after they have been authorized for use.

• Storing the Personal Identification Number (PIN) (3.2.3)

  Storing the Personal Identification Number (PIN) involves securely storing personal identification numbers used in cardholder authentication.

• Restricting PAN (3.3)

  Restricting PAN involves limiting the display and transmission of payment card numbers (PAN) to only those with a legitimate business need.

• Managing PAN Data Storage (3.4)

  Managing PAN Data Storage involves implementing secure storage practices for payment card numbers (PAN) to prevent unauthorized access.

• Access and Authentication with Disk Encryption (3.4.1)

  Access and Authentication with Disk Encryption involves ensuring that access to encrypted data on disk is restricted to authorized users.

• Protecting Keys Used in Storing Cardholder Data (3.5)

  Protecting Keys Used in Storing Cardholder Data involves implementing robust security measures to safeguard cryptographic keys used for encrypting cardholder data.

• Maintain a Description of the Cryptographic Architecture (3.5.1)

  Maintain a Description of the Cryptographic Architecture involves creating and updating documentation that describes the organization's cryptographic architecture.

• Restricting Access to Cryptographic Keys (3.5.2)

  Restricting Access to Cryptographic Keys involves limiting access to cryptographic keys to only authorized personnel.

• Storing Keys Used to Encrypt / Decrypt Cardholder Data (3.5.3)

  Storing Keys Used to Encrypt / Decrypt Cardholder Data involves securely storing cryptographic keys used for the encryption and decryption of cardholder data.

• Storing Cryptographic Keys in the Fewest Possible Locations (3.5.4)

  Storing Cryptographic Keys in the Fewest Possible Locations involves minimizing the number of places where cryptographic keys are stored.

• Document and Implement Key Management Processes and Procedures (3.6)

  Document and Implement Key Management Processes and Procedures involves creating and following comprehensive documentation for key management practices.

• Generation of Strong Cryptographic Keys (3.6.1)

  Generation of Strong Cryptographic Keys involves creating cryptographic keys using algorithms and procedures that ensure a high level of randomness and unpredictability.

• Securing Cryptographic Key Distribution (3.6.2)

  Securing Cryptographic Key Distribution involves ensuring the secure transfer of cryptographic keys from the key generation point to authorized users or systems.

• Securing Cryptographic Key Storage (3.6.3)

  Securing Cryptographic Key Storage involves implementing robust security measures to protect cryptographic keys from unauthorized access and compromise.

• Cryptographic Key Changes (3.6.4)

  Cryptographic Key Changes involves periodically changing cryptographic keys to mitigate the impact of potential key compromise.

• Retirement or Replacement of Keys (3.6.5)

  Retirement or Replacement of Keys involves securely retiring or replacing cryptographic keys that have reached the end of their lifecycle.

• Clear-text Cryptographic Key Management (3.6.6)

  Clear-text Cryptographic Key Management involves ensuring that cryptographic keys are not stored or transmitted in clear-text format.

• Prevention of Unauthorized Substitution of Cryptographic Keys (3.6.7)

  Prevention of Unauthorized Substitution of Cryptographic Keys involves implementing measures to prevent the unauthorized replacement of cryptographic keys with unauthorized or compromised keys.

• Key-custodian Responsibilities (3.6.8)

  Key-custodian Responsibilities involves defining and assigning specific responsibilities for key custodians to manage cryptographic keys securely.

• Security Policies and Operational Procedures (3.7)

  Security Policies and Operational Procedures involve the development and implementation of comprehensive security policies and procedures to guide the organization's security practices.

• Asset Vulnerabilities (ID.RA-1)

  The NIST Cybersecurity Framework (CSF) ID.RA (Risk Assessment) control focuses on the organization's ability to identify, assess, and prioritize cybersecurity risks to support the development of an effective cybersecurity risk management strategy. This control has several sub-controls, each with its own specific description and purpose.

• Threat Information (ID.RA-2)

  subcontrol ID.RA-2 falls under the Respond function of the framework, which aims to ensure that organizations can respond effectively to a cybersecurity event.

• Threat Identification (ID.RA-3)

  The ID.RA-3 sub-control requires organizations to develop and maintain a comprehensive list of potential threats that could impact their information and assets. This includes identifying both internal and external threats, such as those posed by employees, contractors, or third-party vendors, as well as those originating from outside the organization, such as cybercriminals, hackers, or nation-state actors.

• Business Impacts (ID.RA-4)

  Sub-control ID.RA-4a: Consequences of Risk Scenarios
  Description: The organization assesses the potential business impacts of identified risk scenarios to enable prioritization of risk responses.

• Threat Analysis (ID.RA-5)

  ID.RA-5: "Threat Intelligence and Information Sharing" - The organization should establish and maintain a threat intelligence program that collects, analyzes, and shares information about emerging threats to the organization's information systems and assets. The organization should also engage in information sharing with other organizations, such as government agencies and industry partners, to improve its overall awareness of the threat landscape.

• Risk Responses (ID.RA-6)

  defines the ID.RA-6 sub-control as "Response plans (Incident Response and Business Continuity) incorporate lessons learned and communicate the changes enterprise-wide." This sub-control is part of the Respond function of the CSF and focuses on the need for organizations to continually learn from their experiences and update their response plans accordingly.

The Risk Management Strategy control requires organizations to develop and implement a risk management strategy that is consistent with their business objectives, risk tolerance, and resources. The strategy should be based on a thorough understanding of the organization's assets, threats, vulnerabilities, and potential impacts. The risk management strategy should include the following components:

• Use of Strong Cryptography and Security Protocols (4.1)

  Use of Strong Cryptography and Security Protocols involves implementing robust encryption algorithms and secure protocols to protect sensitive data during transmission.

• Wireless Networks Transmitting Cardholder Data (4.1.1)

  Wireless Networks Transmitting Cardholder Data involves securing wireless networks that transmit cardholder data to prevent unauthorized access.

• Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

  Transmission of Unprotected PANs By End-user Messaging Technologies involves preventing the transmission of unprotected Primary Account Numbers (PANs) through messaging applications and technologies.

• Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

  Policies and Procedures for Encrypting Transmissions of Cardholder Data involve the development and implementation of clear guidelines for encrypting cardholder data during transmission.

• Risk Management Processes (ID.RM-1)

  The purpose of this sub-control is to establish a risk management strategy that is tailored to the organization's needs and objectives. The following steps should be taken to develop a comprehensive risk management strategy:

• Risk Tolerance (ID.RM-2)

  The organization's risk tolerance is defined, documented, and approved by senior management. Risk tolerance is based on the organization's mission, objectives, and priorities, as well as legal and regulatory requirements and industry standards Risk tolerance defines the acceptable level of risk that the organization is willing to accept for each of its information systems, assets, and activities.

• Sector Risk Analysis (ID.RM-3)

  ID.RM-3 focuses on conducting a sector-specific risk analysis to understand and assess the unique cybersecurity risks faced by the organization.

One of the core functions of the framework is Access Control (PR.AC), which is designed to ensure that access to systems and information is granted only to authorized personnel and devices.

• Deploy Anti-virus Software (5.1)

  Deploy Anti-virus Software involves installing and using anti-virus software on systems and devices to protect against malicious software.

• Anti-virus Capabilities (5.1.1)

  Anti-virus Capabilities involve ensuring that anti-virus software has the necessary features and configurations to effectively detect and remove malware.

• Evaluating Systems Not Commonly Affected By Malicious Software (5.1.2)

  Evaluating Systems Not Commonly Affected By Malicious Software involves assessing devices and systems that may not typically be targeted by malware.

• Anti-virus Maintenance (5.2)

  Anti-virus Maintenance involves managing and updating anti-virus software to maintain its effectiveness and protect against new malware threats.

• Disabling Anti-virus (5.3)

  Disabling Anti-virus involves preventing users from disabling or uninstalling anti-virus software without proper authorization.

• Policies and Procedures for Protecting Against Malware (5.4)

  Policies and Procedures for Protecting Against Malware involve developing and implementing guidelines to defend against malware threats.

• Credential Management (PR.AC-1)

  The access control (PR.AC) category includes several sub-controls that focus on managing access to systems, assets, and data.

• Physical Access (PR.AC-2)

  One of the sub-controls of PR.AC-2 is to "limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals." This sub-control requires organizations to restrict access to their information systems and equipment to authorized personnel only.

• Remote Access (PR.AC-3)

  The PR.AC-3 control has several sub-controls that describe specific steps that organizations should take to ensure secure remote access. One such sub-control is:

• Access Permissions (PR.AC-4)

  The NIST Cybersecurity Framework (CSF) Access Permissions (PR.AC-4) control specifies the rules and procedures for granting, modifying, and revoking access to organizational systems, applications, and data. This control requires that access to sensitive data and systems be limited to authorized personnel only, and that the access granted to individuals is based on the principle of least privilege.

• Network Integrity (PR.AC-5)

  PR.AC-5 is a sub control under the asset protection category of the NIST CSF. This sub control aims to ensure the integrity of the organization's network by monitoring network traffic to detect and respond to anomalous activity. The objective is to identify potentially malicious activity on the network and take corrective action to prevent any damage.

• Identity Management (PR.AC-6)

  Identity Management sub-control PR.AC-6, or "Authorize access to assets," involves ensuring that only authorized individuals or systems are granted access to an organization's assets, including information systems, data, and physical resources.

• Asset Authentication (PR.AC-7)

  Asset Authentication (PR.AC-7) is a control that focuses on ensuring that all assets are authenticated prior to granting access to them. This control is critical to protect against unauthorized access, theft, or modification of an organization's assets.

Identify: Develop and maintain an inventory of all products and services that are part of the organization's supply chain, including hardware, software, and services.

• Establishing a Process to Assess and Identify Security Vulnerabilities (6.1)

  Establishing a Process to Assess and Identify Security Vulnerabilities involves implementing a structured approach to identify and assess potential security vulnerabilities.

• Installing Critical Security Patches (6.2)

  Installing Critical Security Patches involves promptly applying important security patches to address known vulnerabilities in software and systems.

• Developing Internal and External Software Applications (6.3)

  Developing Internal and External Software Applications involves ensuring that all software applications are designed and implemented with security considerations.

• Security of Custom Application Accounts (6.3.1)

  Security of Custom Application Accounts involves implementing security measures to protect user accounts used in custom applications.

• Reviewing of Custom Code Prior to Release (6.3.2)

  Reviewing of Custom Code Prior to Release involves conducting code reviews and testing custom application code before deployment.

• Change Control Processes and Procedures (6.4)

  Change Control Processes and Procedures involve establishing processes to manage and authorize changes to IT systems and applications.

• Separating Development/test Environments From Production Environments (6.4.1)

  Separating Development/test Environments From Production Environments involves segregating development and testing environments from the production environment to prevent unintended impacts on production systems.

• Separating Duties Between Development/test and Production Environments (6.4.2)

  Separating Duties Between Development/test and Production Environments involves assigning different responsibilities to personnel in development/test and production environments to reduce the risk of unauthorized changes.

• Production Data for Development (6.4.3)

  Production Data for Development involves using sanitized or fictional data in development and testing environments instead of actual production data.

• Removal of Test Data and Accounts (6.4.4)

  Removal of Test Data and Accounts involves removing test data and user accounts from development and testing environments after their intended use.

• Change Control Procedures for Security Patches and Software Modifications (6.4.5)

  Change Control Procedures for Security Patches and Software Modifications involve implementing formalized processes for handling security patches and software changes.

• Documentation of Impact (6.4.5.1)

  Documentation of Impact involves recording the expected impact of proposed security patches and software modifications.

• Documented Change Approval (6.4.5.2)

  Documented Change Approval involves recording approvals for security patches and software modifications.

• Functionality Testing (6.4.5.3)

  Functionality Testing involves testing security patches and software modifications for potential functional issues before deployment.

• Back-out Procedures (6.4.5.4)

  Back-out Procedures involve establishing processes to revert changes in case of issues or failures after deploying security patches and software updates.

• Significant Changes (6.4.6)

  Significant Changes involve subjecting significant modifications to IT systems to additional controls and scrutiny.

• Addressing Coding Vulnerabilities (6.5)

  Addressing Coding Vulnerabilities involves implementing secure coding practices to prevent common vulnerabilities in software applications.

• Injection Flaws (6.5.1)

  Injection Flaws involve preventing malicious code injection into software applications.

• Buffer Overflows (6.5.2)

  Buffer Overflows involve implementing safeguards against buffer overflow vulnerabilities in software applications.

• Insecure Cryptographic Storage (6.5.3)

  Insecure Cryptographic Storage involves using strong encryption and secure storage methods to protect sensitive data.

• Insecure Communications (6.5.4)

  Insecure Communications involve securing data transmitted over networks to prevent interception and unauthorized access.

• Improper Error Handling (6.5.5)

  Improper Error Handling involves implementing proper error handling mechanisms to prevent the disclosure of sensitive information.

• Addressing “High Risk” Vulnerabilities (6.5.6)

  Addressing "High Risk" Vulnerabilities involves prioritizing the mitigation of high-risk vulnerabilities in software applications.

• Cross-site Scripting (XSS) (6.5.7)

  Cross-site Scripting (XSS) involves implementing measures to prevent XSS attacks on web applications.

• Improper Access Control (6.5.8)

  Improper Access Control involves implementing strong access controls to prevent unauthorized access to sensitive resources.

• Cross-site Request Forgery (CSRF) (6.5.9)

  Cross-site Request Forgery (CSRF) involves implementing mechanisms to prevent CSRF attacks on web applications.

• Broken Authentication and Session Management (6.5.10)

  Broken Authentication and Session Management involve implementing secure authentication and session handling mechanisms.

• Public-facing Web Applications (6.6)

  Public-facing Web Applications involve securing web applications accessible to the public.

• Policies and Procedures (6.7)

  Policies and Procedures involve creating and enforcing information security policies and procedures.

• Organization - Cyber Supply Chain Risk Management Process (ID.SC-1)

  ID.SC-4 Sub-Control Description:
  To effectively manage supply chain risk, organizations must identify and assess risks associated with their suppliers and implement appropriate risk mitigation strategies. This sub-control focuses on the supplier risk assessment and management process, which includes the following activities:

• Supplier - Cyber Supply Chain Risk Management Process (ID.SC-2)

  This sub-control aims to establish and document cyber supply chain risk management processes for the organization's suppliers. The organization should develop comprehensive processes to identify, assess, mitigate, and manage cyber supply chain risks across its supply chain ecosystem. These processes should be clearly documented, regularly reviewed, and updated as necessary to ensure their effectiveness.

• Supplier Contracts (ID.SC-3)

  Supplier Contracts (ID.SC-3) is a sub-control under the Identification (ID) function of the NIST Cybersecurity Framework (CSF). This sub-control is focused on ensuring that supplier contracts incorporate cybersecurity requirements to protect organizational assets and information

• Supplier Assessments (ID.SC-4)

  The organization requires suppliers to undergo security assessments to ensure they are capable of meeting the security requirements of the organization's systems and data. The assessments are conducted prior to contracting with the supplier and periodically thereafter based on the risk and criticality of the supplier's access to the organization's systems or data.

• Response and Recovery Planning and Testing (ID.SC-5)

  The NIST Cybersecurity Framework (CSF) sub-control ID.SC-5 focuses on Response Planning and Testing. This sub-control involves developing and implementing an incident response plan to ensure an organization's ability to respond effectively to a cybersecurity event.

Awareness and Training (PR.AT) control is designed to ensure that all employees, contractors, and third-party users who access an organization's systems and information are aware of the cybersecurity risks and their responsibilities for protecting the organization's assets. This control aims to improve the security posture of an organization by promoting a culture of security awareness and ensuring that all users are equipped with the necessary knowledge and skills to identify and respond to security threats.

• Limiting Access to Cardholder Data (7.1)

  Limiting Access to Cardholder Data involves restricting access to sensitive cardholder data based on the principle of least privilege.

• Defining Access Needs (7.1.1)

  Defining Access Needs involves determining the specific access requirements for individuals based on their job roles and responsibilities.

• Least Privilege Access (7.1.2)

  Least Privilege Access involves granting individuals the minimum necessary access rights required to perform their job functions.

• Job classifications and functions (7.1.3)

  Job Classifications and Functions involve grouping job roles and functions based on common access requirements.

• Documented Privileges Approval (7.1.4)

  Documented Privileges Approval involves obtaining formal approval for granting access privileges.

• Access Control System Restrictions (7.2)

  Access Control System Restrictions involve limiting access to the access control systems themselves.

• Coverage of All System Components (7.2.1)

  Coverage of All System Components involves ensuring that all relevant system components are subject to access control measures.

• Assignment of Privileges (7.2.2)

  Assignment of Privileges involves assigning access privileges based on business needs and job responsibilities.

• Default “deny-all” Setting (7.2.3)

  Default "deny-all" Setting involves setting access controls to deny all access by default.

• Policies & Procedures (7.3)

  Policies & Procedures involve creating and enforcing access control policies and procedures.

• Employee Training (PR.AT-1)

  Personnel, Processes, and Procedures" called "Awareness and Training" (PR.AT). This sub-control is designed to ensure that all personnel within an organization are adequately trained and aware of their roles and responsibilities regarding cybersecurity.

• Privileged Users (PR.AT-2)

  The NIST Cybersecurity Framework (CSF) includes a sub-control under the category of "Access Control (PR)" called "Privileged Users (PR.AT-2)." This sub-control is designed to help organizations manage access to sensitive information and systems by limiting privileges to only those users who require them to perform their job functions. The following is a description of this sub-control:

• Third Party Stakeholders (PR.AT-3)

  PR.AT-3, or "Third Party Stakeholders," requires organizations to identify and manage cybersecurity risks associated with their interactions with third-party stakeholders, such as suppliers, vendors, contractors, and partners.

• Senior Executives (PR.AT-4)

  PR.AT-4 sub-category is part of the Protect function and pertains to the senior executives within an organization.
  
  This sub-category focuses on ensuring that senior executives understand their role in cybersecurity risk management and are committed to prioritizing and allocating resources towards the protection of their organization's critical assets

• Security Personnel (PR.AT-5)

  PR.AT-5: Security Personnel - Develop and implement security awareness and training programs for personnel, including training on information security policies and procedures, to enhance personnel awareness of the importance of cybersecurity and to reduce the risk of insider threats.

PR.DS involves implementing policies, procedures, and controls to safeguard sensitive information throughout its lifecycle, from creation to disposal. This includes identifying and categorizing data based on its sensitivity level, implementing access controls to restrict unauthorized access, and encrypting data to protect it in transit and at rest.

• Policies and Procedures for User Identification Management (8.1)

  Policies and Procedures for User Identification Management involve creating and enforcing policies related to user identification and authentication.

• Unique User IDs (8.1.1)

  Unique User IDs involve assigning distinct user identification credentials to each user.

• User ID Management (8.1.2)

  User ID Management involves maintaining and managing user identification credentials.

• Revoking Access for Terminated Users (8.1.3)

  Revoking Access for Terminated Users involves promptly terminating access for users who are no longer employed or authorized to access resources.

• Removing/disabling Inactive User Accounts (8.1.4)

  Removing/Disabling Inactive User Accounts involves identifying and deactivating user accounts that have been inactive for a prolonged period.

• Vendor ID Management (8.1.5)

  Vendor ID Management involves managing user identifiers for external vendors and third-party partners.

• Limiting Access Attempts (8.1.6)

  Limiting Access Attempts involves enforcing restrictions on the number of failed login attempts to prevent brute-force attacks.

• Lockout Duration (8.1.7)

  Lockout Duration involves determining the duration for which a user account remains locked after exceeding the maximum number of login attempts.

• Session Time Out (8.1.8)

  Session Time Out involves setting a period of inactivity after which a user's session automatically terminates.

• User Authentication Management (8.2)

  User Authentication Management involves managing user authentication credentials and practices.

• Cryptography (8.2.1)

  Cryptography involves protecting sensitive data through encryption and other cryptographic techniques.

• Verifying User Identities (8.2.2)

  Verifying User Identities involves ensuring the accuracy and legitimacy of user identities during authentication.

• Password Requirements (8.2.3)

  Password Requirements involve setting standards and criteria for password creation and complexity.

• Passwords Change Schedule (8.2.4)

  Passwords Change Schedule involves determining the frequency at which users are required to change their passwords.

• Reusing Old Passwords (8.2.5)

  Reusing Old Passwords involves preventing users from reusing previously used passwords.

• Passwords Issued / Reset Requirements (8.2.6)

  Passwords Issued/Reset Requirements involve defining the rules and procedures for issuing and resetting passwords.

• Incorporating Multi-factor Authentication (8.3)

  Incorporating Multi-factor Authentication (MFA) involves combining multiple authentication factors to enhance user identity verification.

• MFA for non-console access to CDE (8.3.1)

  MFA for Non-console Access to CDE involves enforcing MFA for users accessing the Cardholder Data Environment (CDE) from external locations or devices.

• MFA for remote access (8.3.2)

  MFA for Remote Access involves enforcing MFA for users accessing organizational systems or data remotely.

• Documenting and Communicating Authentication Policies and Procedures (8.4)

  Documenting and Communicating Authentication Policies and Procedures involve creating and sharing documentation related to authentication practices.

• Use of Group, Shared, or Generic Authentication Methods (8.5)

  Use of Group, Shared, or Generic Authentication Methods involves avoiding the use of common authentication credentials shared among multiple users.

• Service Providers with Remote Access (8.5.1)

  Service Providers with Remote Access involves managing the access of service providers to the organization's systems and data.

• Use of Other Authentication Mechanisms (8.6)

  Use of Other Authentication Mechanisms involves implementing alternative authentication methods beyond traditional passwords.

• Access to Databases Containing Cardholder Data (8.7)

  Access to Databases Containing Cardholder Data involves managing and controlling access to databases storing cardholder data.

• Policies and Procedures (8.8)

  Policies and Procedures involve developing comprehensive documentation outlining the organization's security practices.

• Data-at-Rest (PR.DS-1)

  Data-at-rest refers to data that is stored on electronic devices such as hard drives, servers, or other storage media. This sub-control aims to protect this data from unauthorized access, theft, or tampering while it is stored.

• Data-in-transit (PR.DS-2)

  The PR.DS-2 sub-control requires organizations to implement security measures to protect the confidentiality, integrity, and availability of data while it is in transit. This can be achieved through various methods, such as encryption, secure communication protocols, and network segmentation.

• Asset Management (PR.DS-3)

  PR.DS-3: Asset Management - Data-at-rest protection: Data-at-rest refers to data that is stored in databases, file servers, backup media, or other data storage devices. This sub-control involves protecting data-at-rest by identifying and classifying sensitive data, implementing appropriate access controls, and employing encryption technologies to safeguard data from unauthorized access, modification, or deletion.

• Capacity (PR.DS-4)

  The NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) Capacity (PR.DS-4) sub-control is designed to help organizations develop and maintain the capacity to identify, analyze, and respond to cybersecurity events.

• Data Leaks (PR.DS-5)

  The NIST Cybersecurity Framework (CSF) includes a sub-control under the category of "Protect" that addresses data leaks. The sub-control, PR.DS-5, is designed to help organizations protect their sensitive data from accidental or intentional disclosure, modification, or destruction.

• Integrity Verification (PR.DS-6)

  Integrity Verification (PR.DS-6) sub-control requires organizations to verify the integrity of all software and hardware assets within their network to ensure that they have not been modified in an unauthorized or malicious way. This sub-control aims to prevent unauthorized changes or tampering with critical information, systems, and assets.

• Development and Testing (PR.DS-7)

  The PR.DS-7 subcategory focuses on ensuring that all software and hardware used by an organization are developed and tested to be secure and resilient against cybersecurity threats. The subcategory has one control description:

• Hardware Integrity Checking (PR.DS-8)

  Hardware Integrity Checking involves establishing and implementing procedures for regularly verifying the authenticity and integrity of hardware components, including servers, workstations, and network devices. This process helps to ensure that the hardware components are free from unauthorized modifications, tampering, or other forms of compromise.

The PR.IP control is focused on the development and implementation of policies, procedures, and processes that are designed to manage the protection of information systems and data. These measures are essential to ensuring the confidentiality, integrity, and availability of information and reducing the risk of data breaches.

• Facility Entry Controls (9.1)

  Facility Entry Controls involve implementing security measures to control physical access to facilities.

• Monitoring Physical Access (9.1.1)

  Monitoring Physical Access involves continuously monitoring and logging physical access to facilities.

• Access to Publicly Accessible Network Jacks (9.1.2)

  Access to Publicly Accessible Network Jacks involves securing network access points available in publicly accessible areas.

• Physical Access to Wireless Access Points, Gateways, Handheld Devices, Networking/communications Hardware, and Telecommunication Lines (9.1.3)

  Physical Access to Wireless Access Points, Gateways, Handheld Devices, Networking/communications Hardware, and Telecommunication Lines involves securing physical access to wireless infrastructure and network components.

• Onsite Personnel and Visitors (9.2)

  Onsite Personnel and Visitors involve managing and controlling physical access for employees and visitors on the premises.

• Access For Onsite Personnel to Sensitive Areas (9.3)

  Access For Onsite Personnel to Sensitive Areas involves managing and controlling physical access for authorized employees to sensitive areas within the facility.

• Visitor Identification and Authorization (9.4)

  Visitor Identification and Authorization involves verifying the identity of visitors and authorizing their access to the facility.

• Visitor Escorting (9.4.1)

  Visitor Escorting involves providing a designated escort to accompany visitors within the facility.

• Issuing Visitor Badges (9.4.2)

  Issuing Visitor Badges involves providing identification badges to visitors for easy identification.

• Retrieving Visitor Badges (9.4.3)

  Retrieving Visitor Badges involves collecting identification badges from visitors upon their departure.

• Visitor Logs (9.4.4)

  Visitor Logs involve maintaining a record of all visitors entering the facility.

• Physically Securing Media (9.5)

  Physically Securing Media involves protecting physical storage media that contain sensitive information.

• Storing Media Backups (9.5.1)

  Storing Media Backups involves protecting backup media to ensure data recoverability in case of a system failure or data loss.

• Control Over the Distribution of Media (9.6)

  Control Over the Distribution of Media involves managing the distribution of media containing sensitive data.

• Media Classification (9.6.1)

  Media Classification involves categorizing media based on the sensitivity of the data it contains.

• Media Delivery (9.6.2)

  Media Delivery involves securely transmitting sensitive data to authorized recipients.

• Media Delivery Approvals (9.6.3)

  Media Delivery Approvals involves obtaining proper authorization before transmitting sensitive data.

• Media Storage and Accessibility (9.7)

  Media Storage and Accessibility involves managing the storage of media containing sensitive data and controlling access to it.

• Media Inventory Logs (9.7.1)

  Media Inventory Logs involve maintaining a record of all media containing sensitive data in the organization's inventory.

• Media Destruction (9.8)

  Media Destruction involves securely disposing of sensitive data stored on various media types.

• Hard-copy Data Destruction (9.8.1)

  Hard-copy Data Destruction involves securely disposing of sensitive data stored in physical paper format.

• Electronic Media Protection (9.8.2)

  Electronic Media Protection involves securely disposing of sensitive data stored on electronic media.

• Protecting Payment Card Devices (9.9)

  Protecting Payment Card Devices involves implementing security measures for devices used to process payment card transactions.

• Maintaining Up-to-date Device Lists (9.9.1)

  Maintaining Up-to-date Device Lists involves keeping an accurate inventory of payment card devices used within the organization.

• Inspection of Device Surfaces (9.9.2)

  Inspection of Device Surfaces involves regular examination of payment card devices for signs of tampering or skimming devices.

• Employee Training (9.9.3)

  Employee Training involves educating personnel on proper payment card device handling and security practices.

• Policies and Procedures (9.10)

  Policies and Procedures involve establishing guidelines for the secure handling and management of payment card devices.

• Baseline Configuration (PR.IP-1)

  PR.IP-1: Baseline Configuration - This sub-control involves establishing and maintaining a baseline configuration for information technology (IT) systems. This includes identifying and documenting the standard configuration for hardware, software, and network components, as well as ensuring that all systems are configured in accordance with the baseline.

• System Development Lifecycle (PR.IP-2)

  The NIST CSF (Cybersecurity Framework) System Development Lifecycle control (PR.IP-2) is designed to ensure that cybersecurity is integrated into the system development lifecycle (SDLC) process. To achieve this, the following sub-controls are recommended:

• Configuration Change Control (PR.IP-3)

  NIST CSF Configuration Change Control (PR.IP-3) is a sub-control under the category of "Protect" in the NIST Cybersecurity Framework (CSF). This sub-control aims to manage and control changes to the organization's hardware, software, and firmware configurations to prevent unauthorized changes and ensure the integrity and availability of critical assets and systems.

• Information Backups (PR.IP-4)

  The PR.IP-4 sub-control requires organizations to create and maintain backups of important information. This includes ensuring that backups are performed on a regular basis and that the backup data is stored in a secure location that is separate from the primary system.

• Physical Operating Environment (PR.IP-5)

  The PR.IP-5 sub-control requires organizations to establish and maintain policies and procedures that control physical access to information systems, equipment, and facilities. This includes the use of physical access controls such as locks, badges, biometric scanners, or security guards to restrict access to authorized personnel only.

• Data Destruction (PR.IP-6)

  The PR.IP-6 sub-control requires organizations to establish and maintain policies, procedures, and controls for the proper disposal of data and information systems. This includes the secure destruction of data and media in a manner that prevents the recovery or reconstruction of the information.

• Protection Processes (PR.IP-7)

  PR.IP-7 is focused on ensuring that all personnel within an organization are aware of their roles and responsibilities when it comes to cybersecurity, and that they are trained on how to properly implement security protocols and procedures.

• Protection Technologies (PR.IP-8)

  This sub-control aims to identify and implement protection technologies to secure an organization's systems, assets, data, and capabilities.

• Response Plans (PR.IP-9)

  Preparation: Develop and document procedures for detecting, analyzing, and containing cybersecurity incidents. This should include processes for identifying and prioritizing critical assets, establishing incident response teams, defining roles and responsibilities, and ensuring that all necessary tools and resources are available.

• Plan Testing (PR.IP-10)

  The organization tests its security controls to ensure their effectiveness and efficiency in protecting against cybersecurity threats and vulnerabilities. The testing includes evaluating the security controls' ability to detect and prevent attacks, as well as the organization's ability to respond to and recover from security incidents.

• HR Practices (PR.IP-11)

  The NIST Cybersecurity Framework (CSF) HR Practices (PR.IP-11) sub-control is designed to address the people-related aspects of cybersecurity risk management within an organization. The purpose of this sub-control is to ensure that human resources policies, procedures, and practices are designed to support the organization's overall cybersecurity strategy.

• Vulnerability Management Plan (PR.IP-12)

  Vulnerability Scanning and Assessment: The organization must conduct regular vulnerability scans and assessments of all information systems and networks to identify potential vulnerabilities and threats. This includes utilizing automated tools, as well as manual methods, to identify vulnerabilities.

The objective of the NIST CSF Maintenance (PR.MA) control is to ensure the continued maintenance and updating of the organization's cybersecurity framework, policies, and procedures to address changes in the threat landscape, organizational requirements, and other factors that may impact the effectiveness of the cybersecurity program.

• Implementing Audit Trails (10.1)

  Implementing Audit Trails involves recording and monitoring activities related to payment card devices.

• Implementing Automated Audit Trails for All System Components (10.2)

  Implementing Automated Audit Trails for All System Components involves automatically generating audit logs for all systems, including payment card devices.

• Logging User Access to Cardholder Data (10.2.1)

  Logging User Access to Cardholder Data involves recording user access to sensitive cardholder data.

• Logging Root or Administrative Privilege Actions (10.2.2)

  Logging Root or Administrative Privilege Actions involves recording activities performed with elevated privileges.

• Logging Audit Trails (10.2.3)

  Logging Audit Trails involves capturing and storing audit logs securely.

• Logging Invalid Logical Access Attempts (10.2.4)

  Logging Invalid Logical Access Attempts involves recording failed attempts to access the system or cardholder data.

• Logging Identification and Authentication Mechanisms (10.2.5)

  Logging Identification and Authentication Mechanisms involves recording user identification and authentication activities.

• Logging the Initialization, Stoppage or Pausing of Audit Logs (10.2.6)

  Logging the Initialization, Stoppage, or Pausing of Audit Logs involves recording events related to audit log management.

• Logging the Creation and Deletion of System-level Objects (10.2.7)

  Logging the Creation and Deletion of System-level Objects involves recording events related to the creation or deletion of critical system objects.

• Record Audit Trail Entries For All System Components (10.3)

  Record Audit Trail Entries For All System Components involves capturing audit logs for all critical system components.

• User Identification is Logged (10.3.1)

  User Identification is Logged involves recording the identity of users who perform specific actions.

• Type of Event is Logged (10.3.2)

  Type of Event is Logged involves recording the nature and category of events in audit logs.

• Date and Time is Logged (10.3.3)

  Date and Time is Logged involves recording the timestamps of events in audit logs.

• Success or Failure Indication is Logged (10.3.4)

  Success or Failure Indication is Logged involves recording whether an event was successful or resulted in failure.

• Origination of Event is Logged (10.3.5)

  Origination of Event is Logged involves recording the source or location of an event in audit logs.

• Name of Affected Data, System Component, or Resource is Logged (10.3.6)

  Name of Affected Data, System Component, or Resource is Logged involves recording the specific data, system components, or resources impacted by an event.

• Synchronization of All Critical System Clocks and Times (10.4)

  Synchronization of All Critical System Clocks and Times involves ensuring consistent timekeeping across all critical system components.

• Critical Systems Have the Correct and Consistent Time (10.4.1)

  Critical Systems Have the Correct and Consistent Time involves ensuring that critical systems maintain accurate and synchronized time.

• Time Data is Protected (10.4.2)

  Time Data is Protected involves safeguarding time data from unauthorized modification or tampering.

• Time Settings Are From Industry-accepted Time Sources (10.4.3)

  Time Settings Are From Industry-accepted Time Sources involves obtaining time settings from reputable and reliable sources.

• Audit Trails Are Secured (10.5)

  Audit Trails Are Secured involves protecting audit logs from unauthorized access, modification, or deletion.

• Viewing of Audit Trails (10.5.1)

  Viewing of Audit Trails involves controlling access to audit logs and limiting viewing privileges.

• Protection of Audit Trail Files (10.5.2)

  Protection of Audit Trail Files involves safeguarding audit log files from unauthorized access and modification.

• Audit Trail Files Back-up (10.5.3)

  Audit Trail Files Back-up involves creating copies of audit log files for redundancy and disaster recovery purposes.

• Logs for External-facing Technologies (10.5.4)

  Logs for External-facing Technologies involves generating audit logs for systems and technologies exposed to external networks.

• File-integrity Monitoring On Logs (10.5.5)

  File-integrity Monitoring On Logs involves implementing mechanisms to detect unauthorized changes to audit log files.

• Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

  Reviewing of Log Data to Identify Anomalies or Suspicious Activity involves regularly examining log data to detect potential security incidents.

• Daily Log Reviews (10.6.1)

  Daily Log Reviews involves conducting log data reviews on a daily basis.

• Log Reviews of Other Systems (10.6.2)

  Log Reviews of Other Systems involves conducting log data reviews for systems beyond critical systems.

• Exceptions and Anomalies Are Identified and Addressed (10.6.3)

  Exceptions and Anomalies Are Identified and Addressed involves promptly investigating and addressing identified log anomalies.

• Audit Trail History (10.7)

  Audit Trail History involves maintaining historical audit logs for a specific retention period.

• Detection of Failures (service providers only) (10.8)

  Detection of Failures (service providers only) involves monitoring for system failures and malfunctions.

• Response to Failures (service providers only) (10.8.1)

  Response to Failures (service providers only) involves taking appropriate actions to address system failures.

• Policies and Procedures (10.9)

  Policies and Procedures involves developing and implementing cybersecurity-related policies and procedures.

• Assets Maintenance and Repair (PR.MA-1)

  PR.MA stands for "Maintenance of the CSF." This sub-control is designed to ensure that the CSF is regularly reviewed, updated, and maintained to reflect changes in the organization's cybersecurity environment. The PR.MA sub-control includes the following activities:

• Remote Maintenance (PR.MA-2)

  PR.MA-2: The organization manages remote maintenance of systems to minimize the risk associated with the support of organizational operations.

Access Control: Access controls are implemented to restrict unauthorized access to information systems and assets. This includes implementing user authentication, password management, and user permissions.

• Testing Wireless Access Points (11.1)

  Testing Wireless Access Points involves evaluating the security of wireless access points.

• Inventory of Authorized Wireless Access Points (11.1.1)

  Inventory of Authorized Wireless Access Points involves maintaining an up-to-date list of authorized wireless access points.

• Incident Response Procedures (11.1.2)

  Incident Response Procedures involves establishing procedures for responding to security incidents.

• Vulnerability Scanning (11.2)

  Vulnerability Scanning involves using automated tools to identify potential vulnerabilities in systems and applications.

• Internal Vulnerability Scanning (11.2.1)

  Internal Vulnerability Scanning involves scanning internal systems and applications for potential vulnerabilities.

• External Vulnerability Scanning (11.2.2)

  External Vulnerability Scanning involves scanning external-facing systems and applications for potential vulnerabilities.

• Scanning Due to Significant Change (11.2.3)

  Scanning Due to Significant Change involves conducting vulnerability scans after significant changes to systems and applications.

• Penetration Testing Methodology (11.3)

  Penetration Testing Methodology involves defining a systematic approach for conducting penetration tests.

• External Penetration Testing (11.3.1)

  External Penetration Testing involves conducting penetration tests from an external perspective to evaluate the security of external-facing systems.

• Internal Penetration Testing (11.3.2)

  Internal Penetration Testing involves conducting penetration tests from an internal perspective to evaluate the security of the organization's internal network.

• Correcting Exploitable Vulnerabilities (11.3.3)

  Correcting Exploitable Vulnerabilities involves promptly addressing vulnerabilities identified during penetration testing.

• CDE Segmentation (11.3.4)

  CDE Segmentation involves isolating the Cardholder Data Environment (CDE) from other network segments.

• Testing Changes to Segmentation Controls (service providers only) (11.3.4.1)

  Testing Changes to Segmentation Controls involves validating the effectiveness of segmentation controls after making network changes.

• Intrusion-detection/intrusion-prevention (11.4)

  Intrusion-detection/Intrusion-prevention involves deploying systems to detect and prevent unauthorized access and malicious activities.

• Change-detection Alerts (11.5)

  Change-detection Alerts involve monitoring and generating alerts for changes to critical files and system configurations.

• Responding to Change-detection Alerts (11.5.1)

  Responding to Change-detection Alerts involves investigating and mitigating unauthorized changes indicated by alerts.

• Policies and Procedures (11.6)

  Policies and Procedures involve developing and maintaining a comprehensive set of security policies and procedures.

• Audit/log Records (PR.PT-1)

  This sub-control requires organizations to encrypt sensitive data that is stored on digital devices, such as laptops, servers, and mobile devices. The encryption should be based on an industry-standard algorithm and should be applied to the entire storage device or to specific files and folders containing sensitive data. Encryption keys should be managed securely and should be protected from unauthorized access.

• Removable Media (PR.PT-2)

  PR.PT-2: "Protect against unauthorized access, loss, or exfiltration of sensitive information stored on removable media"

• Controlled Access (PR.PT-3)

  Define Access Controls: The organization should identify and define the types of access controls needed to protect its assets. This includes physical access controls (such as locks, gates, and guards) and logical access controls (such as passwords, authentication tokens, and encryption).

• Communications and Control Networks (PR.PT-4)

  The NIST Cybersecurity Framework (CSF) is a set of guidelines and best practices for organizations to manage and reduce cybersecurity risk. One of the controls in the framework is Communications and Control Networks (PR.PT-4), which is focused on ensuring that an organization's networks and communications are secure.

• Mechanisms for Resilience Requirements (PR.PT-5)

  Backup and recovery: Organizations should establish backup and recovery procedures to ensure critical data and systems are recoverable in the event of a disruption. This includes regularly backing up data and testing the recovery process to ensure it is effective.

Within the Detection category, the Anomalies and Events (AE) subcategory focuses on identifying and detecting events that could indicate a cybersecurity incident, such as unauthorized access or malware infection. To achieve this, the CSF recommends implementing the DE.AE control,

• Establish, Publish, Maintain, and Disseminate a Security Policy (12.1)

  Establish, Publish, Maintain, and Disseminate a Security Policy involves creating a comprehensive security policy document.

• Policy Reviews and Updates (12.1.1)

  Policy Reviews and Updates involve periodically evaluating and revising security policies.

• Risk-assessment Process (12.2)

  Risk-assessment Process involves evaluating and managing information security risks.

• Usage Policies (12.3)

  Usage Policies involve developing policies that define appropriate and acceptable usage of technology and systems.

• Usage Approvals By Authorized Parties (12.3.1)

  Usage Approvals By Authorized Parties involve obtaining approvals for specific technology usage scenarios.

• Authentication For Use of Technology (12.3.2)

  Authentication For Use of Technology involves implementing secure authentication mechanisms for accessing technology resources.

• List of Authorized Usage of Devices (12.3.3)

  List of Authorized Usage of Devices involves maintaining a list of approved devices for use within the organization.

• Inventorying of Devices (12.3.4)

  Inventorying of Devices involves creating and maintaining a comprehensive inventory of all technology devices within the organization.

• Acceptable Uses of Technology (12.3.5)

  Acceptable Uses of Technology involve defining the permissible ways technology resources can be utilized.

• Acceptable Network Locations of Technologies (12.3.6)

  Acceptable Network Locations of Technologies involve specifying the permitted network locations for various technology resources.

• List of Company-approved Products (12.3.7)

  List of Company-approved Products involves maintaining a list of approved software and hardware products for use within the organization.

• Automatic Remote-access Disconnect (12.3.8)

  Automatic Remote-access Disconnect involves implementing mechanisms to automatically terminate remote-access sessions.

• Activation of Remote-access Technologies for Vendors and Business Partners (12.3.9)

  Activation of Remote-access Technologies for Vendors and Business Partners involves the secure activation and management of remote-access solutions for external entities.

• Accessing Cardholder Data Via Remote-access Technologies (12.3.10)

  Accessing Cardholder Data Via Remote-access Technologies involves defining the procedures and controls for accessing cardholder data remotely.

• Information Security Responsibilities (12.4)

  Information Security Responsibilities involves assigning and documenting the responsibilities for information security within the organization.

• Additional Requirement for Service Providers Only: Executive Management Responsibility for Protecting Cardholder Data and PCI DSS Compliance (12.4.1)

  Additional Requirement for Service Providers Only focuses on the executive management's accountability for protecting cardholder data and ensuring PCI DSS compliance.

• Assigning Information Security Management Responsibilities (12.5)

  Assigning Information Security Management Responsibilities involves designating roles responsible for overseeing information security initiatives.

• Establish, Document, and Distribute Security Policies and Procedures (12.5.1)

  Establish, Document, and Distribute Security Policies and Procedures involves developing and disseminating formal security policies and procedures.

• Monitoring and Analyzing Security Alerts and Information (12.5.2)

  Monitoring and Analyzing Security Alerts and Information involves actively monitoring security alerts and events to identify potential security incidents.

• Incident Response and Escalation Procedures (12.5.3)

  Incident Response and Escalation Procedures involves developing formal procedures for handling security incidents and escalating them as needed.

• Administering User Accounts (12.5.4)

  Administering User Accounts involves managing user accounts throughout their lifecycle, including creation, modification, and removal.

• Monitoring and Controlling All Access to Data (12.5.5)

  Monitoring and Controlling All Access to Data involves implementing measures to track and control access to sensitive data.

• Security Awareness Program (12.6)

  Security Awareness Program involves implementing a structured program to educate employees about security best practices.

• Personnel Education (12.6.1).

  Personnel Education involves providing ongoing education to employees on information security topics.

• Verifying Personnel Understands Security Policies and Procedures (12.6.2)

  Verifying Personnel Understands Security Policies and Procedures involves assessing employees' comprehension of security policies and procedures.

• New Hire Screening (12.7)

  New Hire Screening involves conducting background checks and vetting processes for newly hired employees.

• Managing Service Providers (12.8)

  Managing Service Providers involves implementing processes to oversee and ensure compliance with security requirements by third-party service providers.

• Maintaining a List of Service Providers (12.8.1)

  Maintaining a List of Service Providers involves keeping an up-to-date inventory of all third-party service providers.

• Service Provider Responsibility Agreements (12.8.2)

  Service Provider Responsibility Agreements involves establishing formal agreements that define security responsibilities between the organization and its service providers.

• Process for Engaging Service Providers (12.8.3)

  Process for Engaging Service Providers involves establishing procedures for evaluating, selecting, and engaging third-party service providers.

• Monitoring Service Provider Compliance (12.8.4)

  Monitoring Service Provider Compliance involves conducting regular assessments to verify that service providers comply with agreed-upon security requirements.

• Managing PCI DSS Requirements by Service Providers (12.8.5)

  Managing PCI DSS Requirements by Service Providers involves ensuring that service providers comply with applicable PCI DSS requirements.

• Written Acknowledgement of Service Provider Responsibility (12.9)

  Written Acknowledgement of Service Provider Responsibility involves obtaining written acknowledgment from service providers regarding their security responsibilities.

• Incident Response Plan (12.10)

  Incident Response Plan involves developing a comprehensive plan for responding to security incidents.

• Network Operations Baseline (DE.AE-1)

  This sub-control focuses on detecting anomalies and events that could indicate a potential security breach or threat to the organization's systems, data, or personnel. Anomalies can be defined as any deviation from normal system behavior or expected patterns of activity, while events refer to specific occurrences that can be correlated to security incidents or breaches.

• Event Analysis (DE.AE-2)

  DE.AE-2 is a sub-control of the Detect (DE) category in the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). This sub-control aims to identify anomalies, events, and indicators of compromise (IoCs) that could indicate a potential cybersecurity incident.

• Event Data Aggregation (DE.AE-3)

  Aggregating Event Data: This sub-control requires organizations to collect and consolidate event data from various sources, such as network devices, servers, applications, and security devices. By aggregating event data, organizations can gain a comprehensive view of their IT environment and identify potential security threats.

• Impact of Events (DE.AE-4)

  DE.AE-4 states that organizations should identify the potential impact of cybersecurity events and incorporate this information into their risk management processes. This sub-control involves the following description:

• Incident Alerting (DE.AE-5)

  This sub-control requires organizations to implement automated tools to help detect anomalous activity on their network or systems. These tools can include intrusion detection systems (IDS), security information and event management (SIEM) solutions, and other threat detection technologies.

The DE.CM control is intended to provide organizations with the capability to detect and respond to cybersecurity threats in real-time. This control is essential because threats to an organization's information systems and data can emerge at any time, and if left unchecked, they can cause significant damage.

• Network Monitoring (DE.CM-1)

  DE.CM: The organization develops and implements a continuous monitoring strategy to achieve situational awareness and maintain the effectiveness of security controls.

• Physical Environment (DE.CM-2)

  DE.CM-2 Physical Security: Physical security measures are implemented to protect against unauthorized access to facilities and equipment.

• Personnel Activity (DE.CM-3)

  This sub-control includes a number of measures that organizations can implement to increase awareness of cybersecurity threats, reduce the risk of human error, and ensure that all personnel are equipped to respond appropriately to any security incidents that may occur. These measures include:

• Malicious Code (DE.CM-4)

  The DE.CM-4 control has several sub-controls that provide specific guidelines for preventing and managing the risk of malicious code.

• Unauthorized Mobile Code (DE.CM-5)

  The sub-control for DE.CM-5 involves the implementation of specific measures to mitigate the risks associated with unauthorized mobile code. These measures include:

• Service Provider Monitoring (DE.CM-6)

  DE.CM-6 (Service Provider Monitoring) is a sub-control under the Detection and Response (DE) category of the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). This sub-control is aimed at ensuring that service providers are monitored and their activities are properly supervised to reduce the risk of cybersecurity incidents.

• Environment Monitoring (DE.CM-7)

  DE.CM-7 is a sub-control that focuses on the need for organizations to monitor their information systems and networks to detect potential cybersecurity events. This sub-control involves the continuous monitoring of information systems, assets, and data to identify any unusual or unauthorized activity that may indicate a potential security breach.

• Vulnerability Scanning (DE.CM-8)

  DE.CM-8: The organization identifies, prioritizes, and remediates vulnerabilities in organizational systems and software.

The "Detect" function is further broken down into several categories, one of which is "DE.DP: Detection Processes," which outlines the importance of establishing and maintaining processes for timely and effective detection of cybersecurity events.

• Roles and Responsibilities (DE.DP-1)

  DE.DP control description emphasizes the importance of implementing and maintaining a comprehensive set of detection processes to identify potential cybersecurity events. This includes identifying and defining the types of events that should be monitored, determining the sources of event data, establishing criteria for triggering alerts, and defining the roles and responsibilities of personnel involved in the detection process.

• Detection Compliance (DE.DP-2)

  The DE.DP-2 sub-control requires organizations to develop and implement processes for detecting and responding to cybersecurity events. Specifically, it requires organizations to:

• Detection Testing (DE.DP-3)

  The NIST Cybersecurity Framework (CSF) is a comprehensive guide that helps organizations to manage and reduce cybersecurity risks. One of the key controls under the Detection (DE) category is DE.DP-3, which involves the detection and response to unauthorized wireless access points (WAPs) within an organization's network.

• Event Detection (DE.DP-4)

  Organizations should continuously monitor and analyze security alerts and activities to detect potential cybersecurity events and incidents. This sub-control involves establishing and maintaining a monitoring system that can collect and analyze security-related data from various sources, including security devices, systems, and applications.

• Detection Process Improvement (DE.DP-5)

  This sub-control focuses on the continuous improvement of detection processes by leveraging the lessons learned from current and past detection activities. The objective is to enhance the effectiveness and efficiency of the detection processes and thereby improve the organization's ability to detect and respond to cybersecurity events.

The RS.RP control requires organizations to establish response plans that define the procedures, roles, and responsibilities for responding to cybersecurity incidents. The response plans should be based on identified risks and take into account the organization's business objectives, legal and regulatory requirements, and industry standards.

• Response Plan (RS.RP-1)

  The Response Planning sub-control within the Respond function of the NIST CSF involves developing and documenting an incident response plan that outlines the organization's process for responding to a cybersecurity event. This plan should include procedures for detecting, analyzing, containing, eradicating, and recovering from incidents.

1.1.1: Develop and implement formal communication processes to manage and respond to cybersecurity incidents. This includes establishing incident response teams, defining roles and responsibilities, and developing procedures for reporting, escalation, and communication.

• Roles and Responsibilities (RS.CO-1)

  This sub-control involves developing and maintaining communication plans that ensure timely and effective communication in the event of a cybersecurity incident. It includes testing the communication plan regularly to ensure its effectiveness and readiness.

• Incident Reporting (RS.CO-2)

  RS.CO-2: Establish and maintain a standardized incident reporting process that includes, at a minimum, a method for employees to anonymously report suspected incidents.

• Information Sharing (RS.CO-3)

  The objective of RS.CO-3 is to ensure that relevant information is shared in a timely and accurate manner to support response activities and improve situational awareness. This sub-control is critical for organizations to effectively respond to cybersecurity incidents, as timely and accurate information sharing can help identify the nature and scope of the incident, assess its impact, and develop appropriate response strategies.

• Stakeholder Coordination (RS.CO-4)

  To implement this control, an organization should establish and maintain a stakeholder coordination program to ensure that cybersecurity requirements are clearly understood and prioritized. This program should identify key stakeholders, including internal and external parties, who have a vested interest in the organization's cybersecurity posture.

• External Information Sharing (RS.CO-5)

  Develop and maintain a process for sharing cybersecurity information with external stakeholders, including relevant industry groups, government agencies, and other partners as appropriate.

• Recovery Communications (RC.CO-3)

  The RS.CO-5 sub-control requires organizations to establish and maintain processes for sharing cybersecurity information with external stakeholders, such as partners, customers, and industry peers. This sub-control can help organizations improve their cybersecurity posture by providing a mechanism for detecting and responding to threats and vulnerabilities in a timely manner.

Control Objective: The objective of this control is to ensure that the organization has a formal process in place to analyze cybersecurity events and incidents in order to improve its overall cybersecurity posture and to prevent similar incidents from occurring in the future.

• Notifications (RS.AN-1)

  RS.AN: Risk Assessment is a sub-control within the NIST CSF's Risk Management (RM) function. This sub-control involves the identification, analysis, and evaluation of risks that could affect an organization's critical assets, systems, and operations. The goal of this sub-control is to enable the organization to make informed decisions about managing risk based on an understanding of the likelihood and impact of potential threats.

• Incident Impact (RS.AN-2)

  The RS.AN-2 sub-control requires organizations to establish and maintain procedures to determine the potential impact of a cybersecurity incident. This involves assessing the severity of the incident, evaluating the scope and extent of the incident, and identifying the potential consequences to the organization's operations, assets, and individuals.

• Forensics (RS.AN-3)

  RS.AN-3 is a sub-control that aims to ensure that cybersecurity incidents are investigated using a consistent and well-documented approach. The sub-control requires organizations to conduct a thorough forensic analysis of incidents and document their findings.

• Incident Categorization (RS.AN-4)

  RS.AN-4 Incident Categorization: The organization categorizes incidents based on an established taxonomy that reflects relevant information regarding the incident. The incident categorization provides the foundation for initial response activities.

• Vulnerability Management (RS.AN-5)

  The NIST Cybersecurity Framework (CSF) is a set of guidelines and best practices designed to help organizations manage and reduce cybersecurity risks. One of the sub-controls under the CSF's Risk Assessment (RS) category is RS.AN-5, which pertains to vulnerability management.

Mitigation (RS.MI) control is designed to help organizations identify, prioritize, and implement risk mitigation activities to reduce the impact of cybersecurity threats. The control includes a set of measures that aim to minimize or prevent the impact of cybersecurity events that could negatively affect an organization's ability to provide essential services or cause harm to its assets.

• Incident Containment (RS.MI-1)

  This sub-control requires organizations to have procedures in place that enable them to identify and isolate affected systems in a timely manner in order to contain a cybersecurity incident and prevent further damage. This is an important step in the mitigation process as it can prevent the spread of malware, limit access to compromised systems, and reduce the overall impact of the incident.

• Incident Mitigation (RS.MI-2)

  The NIST Cybersecurity Framework (CSF) is a widely recognized set of guidelines and best practices for managing and improving an organization's cybersecurity posture. The Incident Mitigation (RS.MI-2) sub-control is part of the Respond function within the framework and focuses on the specific actions an organization should take to mitigate the impact of a cybersecurity incident.

• Vulnerability Identification (RS.MI-3)

  This sub-control involves the continuous identification of vulnerabilities and weaknesses in organizational systems, assets, and networks, and the timely assessment of potential impacts to the confidentiality, integrity, and availability of information and systems.

Develop and maintain an organizational risk management strategy that outlines the process for managing and mitigating cybersecurity risks. The strategy should align with the organization's overall goals and objectives, as well as its risk tolerance level, and be regularly reviewed and updated.

• Lessons Learned (RS.IM-1)

  This sub-control aims to establish and maintain an inventory of organizational assets and associated information, including their value, criticality, and sensitivity. This includes hardware, software, data, personnel, and facilities that support the delivery of critical services and products. The organization should identify and track the location, ownership, and use of assets, as well as their physical and logical connections and dependencies, to facilitate risk management decisions.

• Response Strategies (RS.IM-2)

  RS.IM-2 is a sub-control under the Respond category of the NIST Cybersecurity Framework (CSF). The purpose of this sub-control is to establish response strategies that can be implemented in the event of a cybersecurity incident.

Recovery Planning (RC.RP) control is designed to ensure that an organization can efficiently and effectively recover from a cybersecurity incident. The control involves developing and implementing a recovery plan that outlines the steps an organization must take to recover from a cybersecurity incident. The following is a detailed description of the RC.RP control:

• Recovery Plan (RC.RP-1)

  The Recovery Planning sub-control of the NIST Cybersecurity Framework (CSF) outlines the process of developing, implementing, and maintaining plans for recovering from cybersecurity incidents. Recovery planning is a critical aspect of an organization's overall cybersecurity strategy, as it ensures that the organization can quickly and effectively respond to incidents and resume normal operations.

• Lessons Learned (RC.IM-1)

  The sub-control RC.IM-1 requires organizations to establish a process for identifying, reviewing, and incorporating lessons learned from previous incidents into their incident response plans and procedures.

• Recovery Strategies (RC.IM-2)

  RC.IM-2 is a sub-control of the Respond (RC) category in the CSF, which focuses on the development and implementation of response plans to detect, contain, and eradicate cybersecurity threats. Recovery is the final stage of the incident response process, in which organizations aim to restore their systems and operations to their normal state.

Communications (RC.CO) control requires organizations to establish and maintain appropriate communication channels to manage cybersecurity-related information sharing within and outside the organization. This control is aimed at ensuring that cybersecurity information is communicated effectively to relevant stakeholders and that the communication channels are secure and reliable.

• Public Relations (RC.CO-1)

  The Communications sub-control aims to ensure that cybersecurity risks and incidents are communicated effectively within an organization. This involves establishing clear lines of communication between the various stakeholders involved in managing cybersecurity risks, including senior management, IT staff, and other relevant personnel.

• Reputation Management (RC.CO-2)

  NIST CSF Reputation Management (RC.CO-2) sub-control pertains to the establishment and implementation of processes to manage the organization's reputation in response to a cybersecurity event. The sub-control involves developing a plan that outlines how the organization will manage its reputation, including how it will communicate with stakeholders and the media.

• Recovery Communications (RC.CO-3)

  Identify the internal and external stakeholders who need to be notified during a cybersecurity incident, including incident response team members, senior management, legal, public relations, and external partners such as vendors, customers, and regulatory bodies.