FFIEC Cybersecurity Assessment Tool framework

ffiec_aws

FFIEC

OfficialVerified

In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council (FFIEC) developed the Cybersecurity Assessment Tool (Assessment), on behalf of its members, to help institutions identify their risks and determine their cybersecurity maturity.

44requirements88checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance ffiec_aws

Requirements (44)

Cyber Risk Management and Oversight (Domain 1)37

d1-g-it-b-1An inventory of organizational assets (e.g., hardware, software, data, and systems hosted externally) is maintained.3

Attributes

Item Id: d1-g-it-b-1
Section: Cyber Risk Management and Oversight (Domain 1)
Service: aws
Sub Section: Governance (G)

d1-rm-ra-b-2The risk assessment identifies Internet- based systems and high-risk transactions that warrant additional authentication controls.1

Attributes

Item Id: d1-rm-ra-b-2
Section: Cyber Risk Management and Oversight (Domain 1)
Service: aws
Sub Section: Risk Management (RM)

d1-rm-rm-b-1An information security and business continuity risk management function(s) exists within the institution.3

Attributes

Item Id: d1-rm-rm-b-1
Section: Cyber Risk Management and Oversight (Domain 1)
Service: aws
Sub Section: Risk Management (RM)

Threat Intelligence and Collaboration (Domain 2)635

d2-is-is-b-1Information security threats are gathered and shared with applicable internal employees.3

Attributes

Item Id: d2-is-is-b-1
Section: Threat Intelligence and Collaboration (Domain 2)
Service: aws
Sub Section: Information Sharing (IS)

d2-ma-ma-b-1Information security threats are gathered and shared with applicable internal employees.13

Attributes

Item Id: d2-ma-ma-b-1
Section: Threat Intelligence and Collaboration (Domain 2)
Service: aws
Sub Section: Monitoring and Analyzing (MA)

d2-ma-ma-b-2Computer event logs are used for investigations once an event has occurred.12

Attributes

Item Id: d2-ma-ma-b-2
Section: Threat Intelligence and Collaboration (Domain 2)
Service: aws
Sub Section: Monitoring and Analyzing (MA)

d2-ti-ti-b-1The institution belongs or subscribes to a threat and vulnerability information-sharing source(s) that provides information on threats (e.g., FS-ISAC, US- CERT).2

Attributes

Item Id: d2-ti-ti-b-1
Section: Threat Intelligence and Collaboration (Domain 2)
Service: aws
Sub Section: Threat Intelligence (TI)

d2-ti-ti-b-2Threat information is used to monitor threats and vulnerabilities.3

Attributes

Item Id: d2-ti-ti-b-2
Section: Threat Intelligence and Collaboration (Domain 2)
Service: aws
Sub Section: Threat Intelligence (TI)

d2-ti-ti-b-3Threat information is used to enhance internal risk management and controls.2

Attributes

Item Id: d2-ti-ti-b-3
Section: Threat Intelligence and Collaboration (Domain 2)
Service: aws
Sub Section: Threat Intelligence (TI)

Cybersecurity Controls (Domain 3)29159

d3-cc-pm-b-1A patch management program is implemented and ensures that software and firmware patches are applied in a timely manner.3

Attributes

Item Id: d3-cc-pm-b-1
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Corrective Controls (CC)

d3-cc-pm-b-3Patch management reports are reviewed and reflect missing security patches.3

Attributes

Item Id: d3-cc-pm-b-3
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Corrective Controls (CC)

d3-dc-an-b-1The institution is able to detect anomalous activities through monitoring across the environment.3

Attributes

Item Id: d3-dc-an-b-1
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-an-b-2Customer transactions generating anomalous activity alerts are monitored and reviewed.2

Attributes

Item Id: d3-dc-an-b-2
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-an-b-3Logs of physical and/or logical access are reviewed following events.11

Attributes

Item Id: d3-dc-an-b-3
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-an-b-4Access to critical systems by third parties is monitored for unauthorized or unusual activity.12

Attributes

Item Id: d3-dc-an-b-4
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-an-b-5Elevated privileges are monitored.2

Attributes

Item Id: d3-dc-an-b-5
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-ev-b-1A normal network activity baseline is established.9

Attributes

Item Id: d3-dc-ev-b-1
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-ev-b-2Mechanisms (e.g., antivirus alerts, log event alerts) are in place to alert management to potential attacks.1

Attributes

Item Id: d3-dc-ev-b-2
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-ev-b-3Processes are in place to monitor for the presence of unauthorized users, devices, connections, and software.4

Attributes

Item Id: d3-dc-ev-b-3
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-dc-th-b-1Independent testing (including penetration testing and vulnerability scanning) is conducted according to the risk assessment for external-facing systems and the internal network.3

Attributes

Item Id: d3-dc-th-b-1
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Detective Controls (DC)

d3-pc-am-b-1Employee access is granted to systems and confidential data based on job responsibilities and the principles of least privilege.8

Attributes

Item Id: d3-pc-am-b-1
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-10Production and non-production environments are segregated to prevent unauthorized access or changes to information assets. (*N/A if no production environment exists at the institution or the institution's third party.)2

Attributes

Item Id: d3-pc-am-b-10
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-12All passwords are encrypted in storage and in transit.10

Attributes

Item Id: d3-pc-am-b-12
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-13Confidential data is encrypted when transmitted across public or untrusted networks (e.g., Internet).8

Attributes

Item Id: d3-pc-am-b-13
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-15Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication.5

Attributes

Item Id: d3-pc-am-b-15
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-16Administrative, physical, or technical controls are in place to prevent users without administrative responsibilities from installing unauthorized software.3

Attributes

Item Id: d3-pc-am-b-16
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-2Employee access to systems and confidential data provides for separation of duties.3

Attributes

Item Id: d3-pc-am-b-2
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-3Elevated privileges (e.g., administrator privileges) are limited and tightly controlled (e.g., assigned to individuals, not shared, and require stronger password controls6

Attributes

Item Id: d3-pc-am-b-3
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-6Identification and authentication are required and managed for access to systems, applications, and hardware.14

Attributes

Item Id: d3-pc-am-b-6
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-7Access controls include password complexity and limits to password attempts and reuse.5

Attributes

Item Id: d3-pc-am-b-7
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-am-b-8All default passwords and unnecessary default accounts are changed before system implementation.1

Attributes

Item Id: d3-pc-am-b-8
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-im-b-1Network perimeter defense tools (e.g., border router and firewall) are used.18

Attributes

Item Id: d3-pc-im-b-1
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-im-b-2Systems that are accessed from the Internet or by external parties are protected by firewalls or other similar devices.5

Attributes

Item Id: d3-pc-im-b-2
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-im-b-3All ports are monitored.6

Attributes

Item Id: d3-pc-im-b-3
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-im-b-5Systems configurations (for servers, desktops, routers, etc.) follow industry standards and are enforced2

Attributes

Item Id: d3-pc-im-b-5
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-im-b-6Ports, functions, protocols and services are prohibited if no longer needed for business purposes.4

Attributes

Item Id: d3-pc-im-b-6
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-im-b-7Access to make changes to systems configurations (including virtual machines and hypervisors) is controlled and monitored.6

Attributes

Item Id: d3-pc-im-b-7
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

d3-pc-se-b-1Developers working for the institution follow secure program coding practices, as part of a system development life cycle (SDLC), that meet industry standards.0

Attributes

Item Id: d3-pc-se-b1
Section: Cybersecurity Controls (Domain 3)
Service: aws
Sub Section: Preventative Controls (PC)

External Dependency Management (Domain 4)13

d4-c-co-b-2The institution ensures that third-party connections are authorized.3

Attributes

Item Id: d4-c-co-b-2
Section: External Dependency Management (Domain 4)
Service: aws
Sub Section: Connections (C)

Cyber Incident Management and Resilience (Domain 5)529

d5-dr-de-b-1Alert parameters are set for detecting information security incidents that prompt mitigating actions.6

Attributes

Item Id: d5-dr-de-b-1
Section: Cyber Incident Management and Resilience (Domain 5)
Service: aws
Sub Section: Detection, Response, & Mitigation (DR)

d5-dr-de-b-2System performance reports contain information that can be used as a risk indicator to detect information security incidents.0

Attributes

Item Id: d5-dr-de-b-2
Section: Cyber Incident Management and Resilience (Domain 5)
Service: aws
Sub Section: Detection, Response, & Mitigation (DR)

d5-dr-de-b-3Tools and processes are in place to detect, alert, and trigger the incident response program.15

Attributes

Item Id: d5-dr-de-b-3
Section: Cyber Incident Management and Resilience (Domain 5)
Service: aws
Sub Section: Detection, Response, & Mitigation (DR)

d5-er-es-b-4Incidents are classified, logged and tracked.1

Attributes

Item Id: d5-er-es-b-4
Section: Cyber Incident Management and Resilience (Domain 5)
Service: aws
Sub Section: Escalation and Reporting (ER)

d5-ir-pl-b-6The institution plans to use business continuity, disaster recovery, and data backup programs to recover operations following an incident.7

Attributes

Item Id: d5-ir-pl-b-6
Section: Cyber Incident Management and Resilience (Domain 5)
Service: aws
Sub Section: Incident Resilience Planning & Strategy (IR)