CSA Cloud Controls Matrix (CCM) v4.0.13

csa_ccm_4.0

CSA-CCMv4.0

OfficialVerified

The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, composed of 197 control objectives structured in 17 domains covering all key aspects of cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.

65requirements158checks

Prowler prowler-compliance-csa-ccm

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler azure --compliance csa_ccm_4.0

Requirements (65)

Audit & Assurance212

A&A-02Conduct independent audit and assurance assessments according to relevant standards at least annually.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Audit & Assurance
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

A&A-04Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.7

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Audit & Assurance
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Application & Interface Security316

AIS-04Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: CSP-Owned
CCMLite: Yes
Section: Application & Interface Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

AIS-05Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Application & Interface Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

AIS-07Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Application & Interface Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Business Continuity Management and Operational Resilience311

BCR-08Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.3

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Business Continuity Management and Operational Resilience
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

BCR-09Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Business Continuity Management and Operational Resilience
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

BCR-11Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.6

Attributes

Iaa S: CSP-Owned
Paa S: CSP-Owned
Saa S: CSP-Owned
CCMLite: No
Section: Business Continuity Management and Operational Resilience
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Change Control and Configuration Management222

CCC-04Restrict the unauthorized addition, removal, update, and management of organization assets.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Change Control and Configuration Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

CCC-07Implement detection measures with proactive notification in case of changes deviating from the established baseline.16

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Change Control and Configuration Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Cryptography, Encryption & Key Management633

CEK-03Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.12

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Cryptography, Encryption & Key Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

CEK-04Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.7

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Cryptography, Encryption & Key Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

CEK-08CSPs must provide the capability for CSCs to manage their own data encryption keys.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Cryptography, Encryption & Key Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

CEK-10Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Cryptography, Encryption & Key Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

CEK-12Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Cryptography, Encryption & Key Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

CEK-14Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.1

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Cryptography, Encryption & Key Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Datacenter Security13

DCS-06Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.3

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Datacenter Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Data Security and Privacy Lifecycle Management742

DSP-02Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.3

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Data Security and Privacy Lifecycle Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

DSP-03Create and maintain a data inventory, at least for any sensitive data and personal data.4

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Data Security and Privacy Lifecycle Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

DSP-04Classify data according to its type and sensitivity level.1

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Data Security and Privacy Lifecycle Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

DSP-07Develop systems, products, and business practices based upon a principle of security by design and industry best practices.10

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Data Security and Privacy Lifecycle Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

DSP-10Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Data Security and Privacy Lifecycle Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

DSP-16Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Data Security and Privacy Lifecycle Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

DSP-17Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.13

Attributes

Iaa S: CSP-Owned
Paa S: CSP-Owned
Saa S: CSP-Owned
CCMLite: Yes
Section: Data Security and Privacy Lifecycle Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Governance, Risk and Compliance19

GRC-05Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.9

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Governance, Risk and Compliance
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Identity & Access Management1351

IAM-02Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-03Manage, store, and review the information of system identities, and level of access.1

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-04Employ the separation of duties principle when implementing information system access.4

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-05Employ the least privilege principle when implementing information system access.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-07De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.1

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-08Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.4

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-09Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-10Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-12Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.4

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-13Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-14Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equivalent level of security for system identities.4

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-15Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IAM-16Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Identity & Access Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Interoperability & Portability12

IPY-03Implement cryptographically secure and standardized network protocols for the management, import and export of data.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Interoperability & Portability
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Infrastructure & Virtualization Security636

IVS-02Plan and monitor the availability, quality, and adequate capacity of resources in order to deliver the required system performance as determined by the business.2

Attributes

Iaa S: CSP-Owned
Paa S: CSP-Owned
Saa S: CSP-Owned
CCMLite: No
Section: Infrastructure & Virtualization Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IVS-03Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating controls.11

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: CSP-Owned
CCMLite: Yes
Section: Infrastructure & Virtualization Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IVS-04Harden host and guest OS, hypervisor or infrastructure control plane according to their respective best practices, and supported by technical controls, as part of a security baseline.5

Attributes

Iaa S: Shared
Paa S: CSP-Owned
Saa S: CSP-Owned
CCMLite: Yes
Section: Infrastructure & Virtualization Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IVS-06Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.7

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: CSP-Owned
CCMLite: Yes
Section: Infrastructure & Virtualization Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IVS-07Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Infrastructure & Virtualization Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

IVS-09Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.9

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: CSP-Owned
CCMLite: Yes
Section: Infrastructure & Virtualization Security
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Logging and Monitoring1065

LOG-02Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-03Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.9

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-04Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.1

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-05Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.11

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-07Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-08Generate audit records containing relevant security information.16

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-09The information system protects audit records from unauthorized access, modification, and deletion.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-10Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.3

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-11Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

LOG-13Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.6

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Logging and Monitoring
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Security Incident Management, E-Discovery, & Cloud Forensics312

SEF-03'Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.'3

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Security Incident Management, E-Discovery, & Cloud Forensics
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

SEF-06Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.7

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Security Incident Management, E-Discovery, & Cloud Forensics
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

SEF-08Maintain points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Security Incident Management, E-Discovery, & Cloud Forensics
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Threat & Vulnerability Management532

TVM-02Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.4

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Threat & Vulnerability Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

TVM-03Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.5

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Threat & Vulnerability Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

TVM-04Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.8

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Threat & Vulnerability Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

TVM-05Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.7

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: CSP-Owned
CCMLite: No
Section: Threat & Vulnerability Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

TVM-07Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.8

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: Yes
Section: Threat & Vulnerability Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

Universal Endpoint Management26

UEM-08Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.4

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Universal Endpoint Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]

UEM-11Configure managed endpoints with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment.2

Attributes

Iaa S: Shared
Paa S: Shared
Saa S: Shared
CCMLite: No
Section: Universal Endpoint Management
Scope Applicability: [object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]
[object Object]