Supply Chain Security Activity

ChristianaKorir

CSA_CCM_ACME-Corp.xlsx

Home >Computer Science homework help > Supply Chain Security Activity

CSA CCM V3.0.1

CLOUD CONTROLS MATRIX VERSION 3.0.1

Control Domain

CCM V3.0 Control ID

Updated Control Specification

Architectural Relevance

Corp Gov Relevance

Cloud Service Delivery Model Applicability

Supplier Relationship

Scope Applicability

ACME Corporation Rating

ACME Corporation Explanation

Phys

Network

Compute

Storage

App

Data

SaaS

PaaS

IaaS

Service Provider

Tenant / Consumer

AICPA 2009 TSC Map

AICPA Trust Service Criteria (SOC 2SM Report)

AICPA 2014 TSC

BITS Shared Assessments AUP v5.0

BITS Shared Assessments SIG v6.0

BSI Germany

Canada PIPEDA

CCM V1.X

COBIT 4.1

COBIT 5.0

COPPA

CSA Enterprise Architecture (formerly Trusted Cloud Initiative)

CSA Guidance V3.0

ENISA IAF

95/46/EC - European Union Data Protection Directive

FedRAMP Security Controls (Final Release, Jan 2012) --LOW IMPACT LEVEL--

FedRAMP Security Controls (Final Release, Jan 2012) --MODERATE IMPACT LEVEL--

FERPA

GAPP (Aug 2009)

HIPAA / HITECH Act

ISO/IEC 27001-2005

ISO/IEC 27001-2013

ITAR

Jericho Forum

Mexico - Federal Law on Protection of Personal Data Held by Private Parties

NERC CIP

NIST SP800-53 R3

NIST SP800-53 R3 App J

NZISM

ODCA UM: PA R2.0

PCI DSS v2.0

PCI DSS v3.0

Domain > Container > Capability

Public

Private

PA ID

PA level

Application & Interface Security Application Security

AIS-01

Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

S3.10.0 S3.10.0

(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access. (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies.

CC7.1

I.4

G.16.3, I.3

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-04

AI2.4

APO09.03 APO13.01 BAI03.01 BAI03.02 BAI03.03 BAI03.05 MEA03.01 MEA03.02

312.8 and 312.10

Application Services > Development Process > Software Quality Assurance

shared

Domain 10

6.03.01. (c)

Article: 27 (3)

NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-14

NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SC-2 NIST SP 800-53 R3 SC-4 NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18) NIST SP 800-53 R3 SC-8 NIST SP 800-53 R3 SC-8 (1) NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1) NIST SP 800-53 R3 SC-10 NIST SP 800-53 R3 SC-11 NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-12 (2) NIST SP 800-53 R3 SC-12 (5) NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-13 (1) NIST SP 800-53 R3 SC-14 NIST SP 800-53 R3 SC-17 NIST SP 800-53 R3 SC-18

1.2.6

45 CFR 164.312(e)(2)(i)

A.11.5.6 A.11.6.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.5.2 A.12.5.4 A.12.5.5 A.12.6.1 A.15.2.1

A9.4.2 A9.4.1, 8.1*Partial, A14.2.3, 8.1*partial, A.14.2.7 A12.6.1, A18.2.2

Commandment #1 Commandment #2 Commandment #4 Commandment #5 Commandment #11

CIP-007-3 - R5.1

SC-2 SC-3 SC-4 SC-5 SC-6 SC-7 SC-8 SC-9 SC-10 SC-11 SC-12 SC-13 SC-14 SC-17 SC-18 SC-20 SC-21 SC-22 SC-23

AR-7 The organization designs information systems to support privacy by automating privacy controls.

14.5 14.6

PA17 PA31

SGP BSGP

6.5

6, 6.5

Compliant

ACME Corporation uses a formal documented SDLC process, relying heavily on the Agile development methodology built into its own product. ACME Corporation SLDC includes: 1) Security teams are involved in the Agile SCRUM teams 2) Code reviews, both manual and automated, throughout the development process. 3) Multiple levels of penetration testing including internal and external testing. 4) Security test cases with every ACME Corporation release undergoing over 6000 standard tests cases covering security, functionality and high availability. ACME Corporation reviews its software throughout development using a number of approaches including manual and static code reviews, 3rd party continuous testing, and 3rd party application penetration testing. Additionally, to validate secure coding efforts, a combination of rolling security testing of the current codebase by a 3rd party, static code analysis & peer review and annual/major release penetration testing by another 3rd party is performed. ACME Corporation does not use third parties for code development. Please see more information regarding automated source code analysis as described in the Application Vulnerability Management SOP here: https://community.acme.com Penetration test reports performed by an independent third-party for each major ACME Corporation release are available on the ACME Corporation CORE here: https://community.acme.com

Application & Interface Security Customer Access Requirements

AIS-02

Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed.

S3.2.a

(S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1

C.2.1, C.2.3, C.2.4, C.2.6.1, H.1

10 (B) 11 (A+)

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3

SA-01

APO09.01 APO09.02 APO09.03 APO13.01 BAI02 DSS05

312.3, 312.8 and 312.10

BOSS > Legal Services > Contracts

shared

Domain 10

Article 17 (1), (2)

NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-5 NIST SP 800-53 R3 CA-6

1.2.2 1.2.6 6.2.1 6.2.2

A.6.2.1 A.6.2.2 A.11.1.1

A9.1.1.

Commandment #6 Commandment #7 Commandment #8

CA-1 CA-2 CA-5 CA-6

AP-1 The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need.

9.2

4.1.1, 4.2, 4.3

Compliant

Customers control the access to their instance, and are the owner of all information entered into their instance. ACME Corporation does not participate in the user provisioning process to customer instances, nor does it monitor or dictate the type of data stored within the instance. ACME Corporation treats all customer data equally. Any customer data that is stored or processed by a ACME Corporation instance is classified as 'Customer Confidential’ regardless of the data criticality and sensitivity level deemed by the customer. Customer, as data owner, is responsible for classifying their data according to their business needs. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA. ACME Corporation doesn't dictate the type of data stored within a customer's instance. Please see additional information here: https://docs.ACME Corporation.com/bundle/geneva-ACME Corporation-platform/page/integrate/single_sign_on/concept/c_Authentication.html

Application & Interface Security Data Integrity

AIS-03

Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

I3.2.0 I3.3.0 I3.4.0 I3.5.0

(I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies. (I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies. (I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies. (I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa.

PI1.2 PI1.3 PI1.5

I.4

G.16.3, I.3

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-05

DSS06.02 DSS06.04

312.8 and 312.10

Application Services > Programming Interfaces > Input Validation

shared

Domain 10

NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-3

NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-2 (2) NIST SP 800-53 R3 SI-3 NIST SP 800-53 R3 SI-3 (1) NIST SP 800-53 R3 SI-3 (2) NIST SP 800-53 R3 SI-3 (3) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 SI-6 NIST SP 800-53 R3 SI-7 NIST SP 800-53 R3 SI-7 (1) NIST SP 800-53 R3 SI-9 NIST SP 800-53 R3 SI-10 NIST SP 800-53 R3 SI-11

1.2.6

45 CFR 164.312 (c)(1) 45 CFR 164.312 (c)(2) 45 CFR 164.312(e)(2)(i)

A.10.9.2 A.10.9.3 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.6.1 A.15.2.1

A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4

Commandment #1 Commandment #9 Commandment #11

CIP-003-3 - R4.2

SI-10 SI-11 SI-2 SI-3 SI-4 SI-6 SI-7 SI-9

AR-7 The organization designs information systems to support privacy by automating privacy controls.

14.5 14.6

PA25

6.3.1 6.3.2

Compliant

The ACME Corporation application supports both native input validation and more advanced validation through RegEx (regular expression) scripts. Customers are able to customize their instances to put in place additional checks to suit their data integrity needs, particularly those related to any customized business logic that they implement. Output sanitation is also carried out to prevent XSS and associated vulnerabilities. In addition to its input validation and output sanitation, ACME Corporation has processes in place to report any vulnerabilities and to produce patches to fix any discovered issues. ACME Corporation allows customers to chose patches and upgrades from a list of available patches and upgrade. In addition, ACME Corporation runs a Quarterly Patching Process to insure that customers are on the latest general customer-facing patch of their release family. Please refer to the Product Documentation about using Regular Expressions in scripts here: https://docs.ACME Corporation.com/bundle/istanbul-application-development/page/script/general-scripting/concept/c_RegularExpressionsInScripts.html

Application & Interface Security Data Security / Integrity

AIS-04

Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces, jurisdictions and business functions to prevent improper disclosure, alteration, or destruction.

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

B.1

G.8.2.0.2, G.8.2.0.3, G.12.1, G.12.4, G.12.9, G.12.10, G.16.2, G.19.2.1, G.19.3.2, G.9.4, G.17.2, G.17.3, G.17.4, G.20.1

6 (B) 26 (A+)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-03

DS5.11

APO09.01 APO09.02 APO09.03 APO13.01 DSS05.02 DSS06.06 MEA03.01 MEA03.02

312.8 and 312.10

BOSS > Data Governance > Rules for Information Leakage Prevention

shared

Domain 10

6.02. (b) 6.04.03. (a)

Article 17 (1), (2),(3), (4)

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-13

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-8

1.1.0 1.2.2 1.2.6 4.2.3 5.2.1 7.1.2 7.2.1 7.2.2 7.2.3 7.2.4 8.2.1 8.2.2 8.2.3 8.2.5 9.2.1

A.10.8.1 A.10.8.2 A.11.1.1 A.11.6.1 A.11.4.6 A.12.3.1 A.12.5.4 A.15.1.4

A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4

All

AC-1 AC-4 SC-1 SC-16

AR-7 The organization designs information systems to support privacy by automating privacy controls.

16.5 16.8 17.4

PA20 PA25 PA29

GP P SGP

2.3 3.4.1 4.1 4.1.1 6.1 6.3.2a 6.5c 8.3 10.5.5 11.5

2.3 3.4.1 4.1 4.1.1 6.1 6.3.2a 6.5c, 7.1, 7.2, 7.3, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8 10.5.5, 10.8 11.5, 11.6

Compliant

ACME Corporation has a documented Information Security Policy (ISP) that covers access to ACME Corporation and its Customer data, which has specific policies to address Identity, authentication, and authorization pertaining to information systems that store or access ACME Corporation or customer data. Please refer to the Information Security Policy here: https://community.acme.com

Audit Assurance & Compliance Audit Planning

AAC-01

Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

S4.1.0 S4.2.0

(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies. (S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

CC4.1

L.1, L.2, L.7, L.9, L.11

58 (B)

CO-01

ME 2.1 ME 2.2 PO 9.5 PO 9.6

APO12.04 APO12.05 APO12.06 MEA02.01 MEA02.02

Title 16 Part 312

BOSS > Compliance > Audit Planning

shared

Domain 2, 4

6.01. (d)

NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-7

NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CA-7 (2) NIST SP 800-53 R3 PL-6

10.2.5

45 CFR 164.312(b)

Clause 4.2.3 e) Clause 4.2.3b Clause 5.1 g Clause 6 A.15.3.1

Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 6.2(e), 9.1, 9.1(e), 9.2, 9.3(f), A12.7.1

Commandment #1 Commandment #2 Commandment #3

CA-2 CA-7 PL-6

AR-4 Privacy Auditing and Monitoring. To promote accountability, organizations identify and address gaps in privacy compliance, management, operational, and technical controls by conducting regular assessments (e.g., internal risk assessments). Audit for effective implementation of all privacy controls identified in this appendix, organizations assess whether they: (i) implement a process to embed privacy considerations into the life cycle of personally identifiable information (PII), programs, information systems, mission/business processes, and technology; (ii) monitor for changes to applicable privacy laws, regulations, and policies; (iii) track programs, information systems, and applications that collect and maintain PII to ensure compliance; (iv) ensure that access to PII is only on a need-to-know basis; and (v) ensure that PII is being maintained and used only for the legally authorized purposes identified in the public notice(s).

5.1, 5.3, 5.4

PA15

SGP

2.1.2.b

Compliant

ACME Corporation provides a software-as-a-service (SaaS) solution to our enterprise customers whose regulatory requirements scope, in many cases, extends to include ACME Corporation's application and business processes. Customers are responsible for determining the regulatory requirements for the data in their instances and are able to customize the solution to meet their internal and regulatory requirements. ACME Corporation has a dedicated team to manage and drive compliance efforts, including commercial and Federal certifications, regulatory compliance, and legal compliance. ACME Corporation is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE18 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME Corporation undergoes multiple internal audits and customer audits each year. Please refer to the CORE for copies of ACME Corporation's Third Party Attestations here: https://community.acme.com

Audit Assurance & Compliance Independent Audits

AAC-02

Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.

S4.1.0 S4.2.0

CC4.1

L.2, L.4, L.7, L.9, L.11

58 (B) 59 (B) 61 (C+, A+) 76 (B) 77 (B)

CO-02

DS5.5 ME2.5 ME 3.1 PO 9.6

APO12.04 APO12.05 DSS05.07 MEA02.06 MEA02.07 MEA02.08 MEA03.01

Title 16 Part 312

BOSS > Compliance > Independent Audits

shared

Domian 2, 4

6.03. (e) 6.07.01. (m) 6.07.01. (n)

NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 RA-5

NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 RA-5 NIST SP 800-53 R3 RA-5 (1) NIST SP 800-53 R3 RA-5 (2) NIST SP 800-53 R3 RA-5 (3) NIST SP 800-53 R3 RA-5 (6) NIST SP 800-53 R3 RA-5 (9)

1.2.5 1.2.7 4.2.1 8.2.7 10.2.3 10.2.5

45 CFR 164.308 (a)(8) 45 CFR 164.308(a)(1)(ii)(D)

Clause 4.2.3e Clause 5.1 g Clause 5.2.1 d) Clause 6 A.6.1.8

Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 9.1, 9.2, 9.3(f), A18.2.1

Commandment #1 Commandment #2 Commandment #3

Chapter VI, Section 1 Article 39, I. and VIII. Chapter 8 Article 59

CIP-003-3 - R1.3 - R4.3 CIP-004-3 R4 - R4.2 CIP-005-3a - R1 - R1.1 - R1.2

CA-1 CA-2 CA-6 RA-5

AR-4. Privacy Auditing and Monitoring. These assessments can be self-assessments or thirdparty audits that result in reports on compliance gaps identified in programs, projects, and information systems.

6.1

PA18

11.2 11.3 6.6 12.1.2.b

11.2 11.3 6.3.2, 6.6 11.2.1, 11.2.2, 11.2.3, 11.3.1, 11.3.2, 12.1.2.b, 12.8.4

Compliant

ACME Corporation is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE18 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME Corporation undergoes multiple internal audits and customer audits each year. Please refer to the CORE for copies of ACME Corporation's Third Party Attestations here: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924

Audit Assurance & Compliance Information System Regulatory Mapping

AAC-03

Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.

S3.1.0 x3.1.0

(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operations that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats.

CC3.1

L.1, L.2, L.4, L.7, L.9

76 (B) 77 (B) 78 (B) 83 (B) 84 (B) 85 (B)

Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3

CO-05

ME 3.1

APO12.01 APO12.02 APO12.03 MEA03.01

312.4

BOSS > Compliance > Information System Regulatory Mapping

shared

Domain 2, 4

6.10. (a) 6.10. (b) 6.10. (c) 6.10. (d) 6.10. (e) 6.10. (f) 6.10. (g) 6.10. (h) 6.10. (i)

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-7 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SI-1

1.2.2 1.2.4 1.2.6 1.2.11 3.2.4 5.2.1

ISO/IEC 27001:2005 Clause 4.2.1 b) 2) Clause 4.2.1 c) 1) Clause 4.2.1 g) Clause 4.2.3 d) 6) Clause 4.3.3 Clause 5.2.1 a - f Clause 7.3 c) 4) A.7.2.1 A.15.1.1 A.15.1.3 A.15.1.4 A.15.1.6

Clauses 4.2(b), 4.4, 5.2(c), 5.3(ab), 6.1.2, 6.1.3, 6.1.3(b), 7.5.3(b), 7.5.3(d), 8.1, 8.3 9.2(g), 9.3, 9.3(b), 9.3(f), 10.2, A.8.2.1, A.18.1.1, A.18.1.3, A.18.1.4, A.18.1.5

Commandment #1 Commandment #2 Commandment #3

AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IA-7 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 RA-1 RA-2 SA-1 SA-6 SC-1 SC-13 SI-1

1.2 2.2 3.3 5.2

3.1.1 3.1

3.1

Compliant

ACME Corporation's information security program is based on NIST 800-53 and ISO 27001. ACME Corporation is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE16 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME Corporation undergoes multiple internal audits and customer audits each year. ACME Corporation's third party attestations are available on the ACME Corporation CORE: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924

Business Continuity Management & Operational Resilience Business Continuity Planning

BCR-01

A consistent unified framework for business continuity planning and plan development shall be established, documented and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: • Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval • Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information • Method for plan invocation

A3.1.0 A3.3.0 A3.4.0

(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats. (A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. (A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

CC3.1 A1.2 A1.3

K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6, K.1.2.7, K.1.2.11, K.1.2.13, K.1.2.15

RS-03

DSS04.01 DSS04.02 DSS04.03 DSS04.05

BOSS > Operational Risk Management > Business Continuity

provider

Domain 7, 8

6.07. (a) 6.07. (b) 6.07. (c)

Article 17 (1), (2)

NIST SP800-53 R3 CP-1 NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4 NIST SP800-53 R3 CP-9 NIST SP800-53 R3 CP-10

NIST SP800-53 R3 CP-1 NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-2 (1) NIST SP800-53 R3 CP-2 (2) NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4 NIST SP800-53 R3 CP-4 (1) NIST SP800-53 R3 CP-6 NIST SP800-53 R3 CP-6 (1) NIST SP800-53 R3 CP-6 (3) NIST SP800-53 R3 CP-7 NIST SP800-53 R3 CP-7 (1) NIST SP800-53 R3 CP-7 (2) NIST SP800-53 R3 CP-7 (3) NIST SP800-53 R3 CP-7 (5) NIST SP800-53 R3 CP-8 NIST SP800-53 R3 CP-8 (1) NIST SP800-53 R3 CP-8 (2) NIST SP800-53 R3 CP-9 NIST SP800-53 R3 CP-9 (1) NIST SP800-53 R3 CP-9 (3) NIST SP800-53 R3 CP-10 NIST SP800-53 R3 CP-10 (2) NIST SP800-53 R3 CP-10 (3) NIST SP800-53 R3 PE-17

45 CFR 164.308 (a)(7)(i) 45 CFR 164.308 (a)(7)(ii)(B) 45 CFR 164.308 (a)(7)(ii)(C) 45 CFR 164.308 (a)(7)(ii)(E) 45 CFR 164.310 (a)(2)(i) 45 CFR 164.312 (a)(2)(ii)

Clause 5.1 A.6.1.2 A.14.1.3 A.14.1.4

Clause 5.1(h) A.17.1.2 A.17.1.2

Commandment #1 Commandment #2 Commandment #3

CP-1 CP-2 CP-3 CP-4 CP-6 CP-7 CP-8 CP-9 CP-10 PE-17

UL-2 INFORMATION SHARING WITH THIRD PARTIES - a. Shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes; b. Where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used; c. Monitors, audits, and trains its staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII; and d. Evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required.

6.4

12.9.1 12.9.3 12.9.4 12.9.6

Compliant

ACME Corporation has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME Corporation's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME Corporation's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME Corporation activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME Corporation is providing customers with business continuity as opposed to disaster recovery. The ISCP is tested annually to validate and improve the ISCP. Additionally, the failover process is informally tested on a daily basis as ACME Corporation uses failover to reduce the impact of maintenance on its service. ACME Corporation's ISCP controls are validated on an annual basis during its ISO 27001 assessment. ACME Corporation's ISCP is reviewed at least annually by senior management and is available electronically to all employees. The ISCP is replicated between both data centers in the pair. Key ACME Corporation personnel have been trained in their emergency response and recovery roles. The executive sponsor of the ISCP is the Chief Product Officer. The ISCP is based on National Institute of Standards and Technology (NIST) Special Publication 800-34 ""Contingency Planning Guide for Information Technology (IT) Systems"" which provides instructions, recommendations, and considerations for government IT contingency planning. Please refer to the AHA whitepaper here: https://community.ACME.com/community?id=community_article&sys_id=97aca625dbd0dbc01dcaf3231f9619a9 Please refer to the Information System Contingency Plan here: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2 Please refer to the Information System Contingency Plan Test Report here: https://community.ACME.com/community?id=community_article&sys_id=e7fca6a5dbd0dbc01dcaf3231f961992

Business Continuity Management & Operational Resilience Business Continuity Testing

BCR-02

Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

A3.3

(A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.

A1.2

K.1.3, K.1.4.3, K.1.4.6, K.1.4.7, K.1.4.8, K.1.4.9, K.1.4.10, K.1.4.11, K.1.4.12

52 (B) 55 (A+)

RS-04

DSS04.04

BOSS > Operational Risk Management > Business Continuity

provider

Domain 7, 8

6.07.01. (b) 6.07.01. (j) 6.07.01. (l)

NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4

NIST SP800-53 R3 CP-2 NIST SP800-53 R3 CP-2 (1) NIST SP800-53 R3 CP-2 (2) NIST SP800-53 R3 CP-3 NIST SP800-53 R3 CP-4 NIST SP800-53 R3 CP-4 (1)

45 CFR 164.308 (a)(7)(ii)(D)

A.14.1.5

A17.3.1

Commandment #1 Commandment #2 Commandment #3

CP-2 CP-3 CP-4

4.4 5.2(time limit) 6.3(whenever change occurs)

PA15

SGP

12.9.2

12.9.2, 12.10.2

Compliant

ACME Corporation has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME Corporation's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME Corporation's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME Corporation activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME Corporation is providing customers with business continuity as opposed to disaster recovery. The ISCP is tested annually to validate and improve the ISCP. Additionally, the failover process is informally tested on a daily basis as ACME Corporation uses failover to reduce the impact of maintenance on its service. ACME Corporation's ISCP controls are validated on an annual basis during its ISO 27001 assessment. ACME Corporation's ISCP is reviewed at least annually by senior management and is available electronically to all employees. The ISCP is replicated between both data centers in the pair. Key ACME Corporation personnel have been trained in their emergency response and recovery roles. The executive sponsor of the ISCP is the Chief Product Officer. The ISCP is based on National Institute of Standards and Technology (NIST) Special Publication 800-34 ""Contingency Planning Guide for Information Technology (IT) Systems"" which provides instructions, recommendations, and considerations for government IT contingency planning. Please refer to the Information System Contingency Plan here: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2 Please refer to the Information System Contingency Plan Test Report here: https://community.ACME.com/community?id=community_article&sys_id=e7fca6a5dbd0dbc01dcaf3231f961992

Business Continuity Management & Operational Resilience Datacenter Utilities / Environmental Conditions

BCR-03

Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications,and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.

A3.2.0 A3.4.0

(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. (A3.4.0) Procedures exist to protect against unauthorized access to system resource.

A1.1 A1.2 A1.3

F.1

F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.12

9 (B) 10 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RS-08

DSS01.03 DSS01.04 DSS01.05 DSS04.03

312.8 and 312.10

Infra Services > Facility Security > Environmental Risk Management

provider

Domain 7, 8

6.08. (a) 6.09. (c) 6.09. (f) 6.09. (g)

Article 17 (1), (2)

NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3)

NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-4 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3)

A.9.2.2 A.9.2.3

A11.2.2, A11.2.3

Commandment #1 Commandment #2 Commandment #3 Commandment #4 Commandment #9 Commandment #11

PE-1 PE-4 PE-13

10.1 10.2 10.3 10.4 10.5 10.6

PA15

SGP

4.1, 4.1.1, 9.1, 9.2

Compliant

ACME Corporation's data centers inherit physical security and environmental controls from the colocation providers. All providers enforce access to the data centers via multiple levels of locking mechanisms, including pin codes, biometrics, and access cards. ACME Corporation must pre-approve all (ACME Corporation) visitors to the data centers. Government / state-issued identification is required to authenticate visitors upon arriving. Visitors must be escorted at all times by authorized personnel. ACME Corporation reviews access control lists, access activity, and visitor logs on a monthly basis. All data centers are staffed with uniformed security guards, are designed to thwart crash/ram physical attacks, use camera surveillance (e.g. building exterior, all ingress/egress points, data center floor), and have audible alarms on controlled doors. Most data centers do not have exterior windows and no data centers have windows on the data halls; any exterior glass is alarmed for breakage. Cameras and alarms are monitored by the provider's on-site security staff. In all data centers, ACME Corporation has its own cages with its own card readers and biometric controls. All data centers are equipped with uninterruptible power supply (UPS), fire detection and suppression systems, backup generators, and heating, ventilation, and air conditioning (HVAC) systems. ACME Corporation performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits to ensure that physical security and environmental controls are operating effectively. ACME Corporation's data center providers' SOC reports can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb

Business Continuity Management & Operational Resilience Documentation

BCR-04

Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following: • Configuring, installing, and operating the information system • Effectively using the system’s security features

S3.11.0 A.2.1.0

(S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities. (A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users.

CC1.3 CC1.4 CC2.1

G.1.1

56 (B) 57 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

OP-02

DS 9 DS 13.1

BAI08 BAI10 DSS01.01

312.8 and 312.10

SRM > Policies and Standards > Job Aid Guidelines

shared

Domain 7, 8

Article 17

NIST SP 800-53 R3 CP-9 NIST SP 800-53 R3 CP-10 NIST SP 800-53 R3 SA-5

NIST SP 800-53 R3 CP-9 NIST SP 800-53 R3 CP-9 (1) NIST SP 800-53 R3 CP-9 (3) NIST SP 800-53 R3 CP-10 NIST SP 800-53 R3 CP-10 (2) NIST SP 800-53 R3 CP-10 (3) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1)

1.2.6

Clause 4.3.3 A.10.7.4

Clause 9.2(g)

Commandment #1 Commandment #2 Commandment #4 Commandment #5 Commandment #11

CIP-005-3a - R1.3 CIP-007-3 - R9

CP-9 CP-10 SA-5 SA-10 SA-11

10.5 13.5 17.1

12.1 12.2 12.3 12.4

1.1.2, 1.1.3, 2.2, 12.3 12.6

Compliant

Please see product documentation here: https://docs.ACME Corporation.com/

Business Continuity Management & Operational Resilience Environmental Risks

BCR-05

Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.

A3.1.0 A3.2.0

(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats. (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

CC3.1 A1.1 A1.2

F.1

F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.8

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RS-05

DSS01.03 DSS01.04 DSS01.05

Infra Services > Facility Security > Environmental Risk Management

provider

Domain 7, 8

6.07. (d) 6.08. (a) 6.09. (a) 6.09. (b) 6.09. (d)

Article 17 (1), (2)

NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15

NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3) NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15 NIST SP800-53 R3 PE-18

8.2.4

45 CFR 164.308 (a)(7)(i) 45 CFR 164.310(a)(2)(ii)

A.9.1.4 A.9.2.1

A11.1.4, A11.2.1

Commandment #1 Commandment #2 Commandment #3

CIP-004-3 R3.2

PE-1 PE-13 PE-14 PE-15 PE-18

8.1 8.4

PA15

SGP

3.5.2, 3.6.3, 3.7, 5.1, 5.2, 5.3, 6.1, 6.2, 7.1, 7.2, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 12.2

Compliant

Business Continuity Management & Operational Resilience Equipment Location

BCR-06

To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.

A3.1.0 A3.2.0

(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats. (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

CC3.1 A1.1 A1.2

F.1

F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.8

53 (A+) 75 (C+, A+)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RS-06

DSS01.04 DSS01.05

312.8 and 312.10

Infra Services > Facility Security > Environmental Risk Management

provider

Domain 7, 8

6.07. (d) 6.08. (a) 6.09. (a) 6.09. (b) 6.09. (d)

Article 17 (1), (2)

NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15

NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-5 NIST SP800-53 R3 PE-14 NIST SP800-53 R3 PE-15 NIST SP800-53 R3 PE-18

45 CFR 164.310 (c)

A.9.2.1

A11.2.1

Commandment #1 Commandment #2 Commandment #3

PE-1 PE-5 PE-14 PE-15 PE-18

8.1

PA15

SGP

9.1.3 9.5 9.6 9.9 9.9.1

9.1.3 9.5 9.6 9.9 9.9.1, 12.2

Compliant

See BCR-05 above.

Business Continuity Management & Operational Resilience Equipment Maintenance

BCR-07

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

A3.2.0 A4.1.0

(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. (A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies.

A1.1 A1.2 CC4.1

F.2.19

1 (B)

OP-04

A13.3

BAI03.10 BAI04.03 BAI04.04 DSS03.05

Infra Services > Equipment Maintenance >

provider

Domain 7, 8

6.09. (h)

Article 17 (1)

NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-5

NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-2 (1) NIST SP 800-53 R3 MA-3 NIST SP 800-53 R3 MA-3 (1) NIST SP 800-53 R3 MA-3 (2) NIST SP 800-53 R3 MA-3 (3) NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-4 (1) NIST SP 800-53 R3 MA-4 (2) NIST SP 800-53 R3 MA-5 NIST SP 800-53 R3 MA-6

5.2.3 8.2.2 8.2.3 8.2.4 8.2.5 8.2.6 8.2.7

45 CFR 164.310 (a)(2)(iv)

A.9.2.4

A11.2.4

Commandment #2 Commandment #5 Commandment #11

CIP-007-3 - R6.1 - R6.2 - R6.3 - R6.4

MA-2 MA-3 MA-4 MA-5 MA-6

3.3 12.1 12.5 14.5 (software)

PA8 PA15

BSGP SGP

10.8, 11.6

Compliant

ACME Corporation’s production environment is monitored 365x7x24 (everyday of the year) for network, infrastructure, performance and availability with alerts attended to by our SRE team, events are addressed and escalated based on the SLAs documented in the customer contract.

Business Continuity Management & Operational Resilience Equipment Power Failures

BCR-08

Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment

A3.2.0

(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

A1.1 A1.2

F.1

F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.12

54 (A+)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RS-07

DSS01.04 DSS01.05 DSS04.01 DSS04.02 DSS04.03

312.8 and 312.10

Infra Services > Facility Security > Environmental Risk Management

provider

Domain 7, 8

6.08. (a) 6.09. (e) 6.09. (f)

Article 17 (1), (2)

NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-12 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-14

NIST SP800-53 R3 CP-8 NIST SP800-53 R3 CP-8 (1) NIST SP800-53 R3 CP-8 (2) NIST SP800-53 R3 PE-1 NIST SP800-53 R3 PE-9 NIST SP800-53 R3 PE-10 NIST SP800-53 R3 PE-11 NIST SP800-53 R3 PE-12 NIST SP800-53 R3 PE-13 NIST SP800-53 R3 PE-13 (1) NIST SP800-53 R3 PE-13 (2) NIST SP800-53 R3 PE-13 (3) NIST SP800-53 R3 PE-14

A.9.2.2 A.9.2.3 A 9.2.4

A.11.2.2, A.11.2.3, A.11.2.4

Commandment #1 Commandment #2 Commandment #3

CP-8 PE-1 PE-9 PE-10 PE-11 PE-12 PE-13 PE-14

8.1 8.2 8.3 8.4

PA15

SGP

Compliant

ACME Corporation's data center pairs are strategically located to be resiliant to natural and man made threats based on upon their geography. ACME Corporation performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits to ensure that physical security and environmental controls are operating effectively. ACME Corporation's data center providers' SOC reports can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb

Business Continuity Management & Operational Resilience Impact Analysis

BCR-09

There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following: • Identify critical products and services • Identify all dependencies, including processes, applications, business partners, and third party service providers • Understand threats to critical products and services • Determine impacts resulting from planned or unplanned disruptions and how these vary over time • Establish the maximum tolerable period for disruption • Establish priorities for recovery • Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption • Estimate the resources required for resumption

A3.1.0 A3.3.0 A3.4.0

CC3.1 A1.2 A1.3

K.2

RS-02

BAI06.01 BAI10.01 BAI10.02 BAI10.03 DSS04.01 DSS04.02

ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis

provider

Domain 7, 8

6.02. (a) 6.03.03. (c) 6.07. (a) 6.07. (b) 6.07. (c)

Article 17 (1), (2)

NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 CP-2 NIST SP 800-53 R3 RA-3

45 CFR 164.308 (a)(7)(ii)(E)

ISO/IEC 27001:2005 A.14.1.2 A 14.1.4

A.17.1.1 A.17.1.2

Commandment #1 Commandment #2 Commandment #3

CIP-007-3 - R8 - R8.1 - R8.2 - R8.3

RA-3

6.4

PA8 PA15

BSGP SGP

Compliant

The annual Business Impact Analysis (BIA) includes the identification of critical resources and an assessment of potential disruption impacts, allowable availability thresholds, and recovery priorities. When combined, the operational risks provide ACME Corporation with a comprehensive assessment of its business continuity posture. Due to the sensitivity of content, ACME Corporation's BIA is not shared externally.

Business Continuity Management & Operational Resilience Policy

BCR-10

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.

S2.3.0

(S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2

G.1.1

45 (B)

OP-01

DS13.1

APO01 APO07.01 APO07.03 APO09.03 DSS01.01

SRM > Policies and Standards > Operational Security Baselines

shared

Domain 7, 8

6.03. (c)

NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-4 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5

NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 CM-3 NIST SP 800-53 R3 CM-3 (2) NIST SP 800-53 R3 CM-4 NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 CM-6 (1) NIST SP 800-53 R3 CM-6 (3) NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-4 (1) NIST SP 800-53 R3 MA-4 (2) NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1) NIST SP 800-53 R3 SA-12

8.2.1

Clause 5.1 A 8.1.1 A.8.2.1 A 8.2.2 A.10.1.1

Clause 5.1(h) A.6.1.1 A.7.2.1 A.7.2.2 A.12.1.1

Commandment #1 Commandment #2 Commandment #3 Commandment #6 Commandment #7

CM-2 CM-3 CM-4 CM-5 CM-6 CM-9 MA-4 SA-3 SA-4 SA-5 SA-8 SA-10 SA-11 SA-12

12.1 12.2 12.3 12.4

4.3, 10.8, 11.1.2, 12.1 12.2 12.3 12.4 12.5, 12.5.3, 12.6, 12.6.2, 12.10

Compliant

ACME Corporation develops and maintains controlled documents for internal and external use. Documents are created in a controlled manner that meets ACME Corporation's policy and contractual commitments. The Document Control SOPs ensure consistency in the generation and management of ACME Corporation controlled documents. Controlled documents are created based upon defined templates and undergo multiple reviews before being published. In addition to change requests, documents are reviewed periodically. The review period will be no less than biennially; however, reviews can also be triggered annually as determined by regulations, customer contracts, or by management decisions. A defined process exists to obsolete a document. Operational documents are used for the development, implementation, and support of customer products and services; corporate documents are used for the internal business operations of ACME Corporation. Please refer the Document Control SOP (Operational documents) here: https://community.ACME.com/community?id=community_article&sys_id=63ace625dbd0dbc01dcaf3231f96190b Please refer the SURF Managed Document Control SOP (Corporate documents): here: https://community.ACME.com/community?id=community_article&sys_id=e66d2e29dbd0dbc01dcaf3231f961951

Business Continuity Management & Operational Resilience Retention Policy

BCR-11

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.

A3.3.0 A3.4.0 I3.20.0 I3.21.0

(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. (A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. (I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies. (I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems.

A1.2 A1.3 I3.21

D.2.2.9

36 (B)

Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.5.2

DG-04

DS 4.1 DS 4.2 DS 4.5 DS 4.9 DS 11.6

BAI09.01 BAI09.02 BAI09.03 DSS04.01 DSS04.02 DSS04.03 DSS04.04 DSS04.07 MEA03.01

312.3

BOSS > Data Governance > Data Retention Rules

shared

Domain 5

6.03. (h) 6.07.01. (c)

Article 6(1) e

NIST SP 800-53 R3 CP-2 NIST SP 800-53 R3 CP-9

NIST SP 800-53 R3 CP-2 NIST SP 800-53 R3 CP-2 (1) NIST SP 800-53 R3 CP-2 (2) NIST SP 800-53 R3 CP-6 NIST SP 800-53 R3 CP-6 (1) NIST SP 800-53 R3 CP-6 (3) NIST SP 800-53 R3 CP-7 NIST SP 800-53 R3 CP-7 (1) NIST SP 800-53 R3 CP-7 (2) NIST SP 800-53 R3 CP-7 (3) NIST SP 800-53 R3 CP-7 (5) NIST SP 800-53 R3 CP-8 NIST SP 800-53 R3 CP-8 (1) NIST SP 800-53 R3 CP-8 (2) NIST SP 800-53 R3 CP-9 NIST SP 800-53 R3 CP-9 (1) NIST SP 800-53 R3 CP-9 (3)

5.1.0 5.1.1 5.2.2 8.2.6

45 CFR 164.308 (a)(7)(ii)(A) 45 CFR 164.310 (d)(2)(iv) 45 CFR 164.308(a)(7)(ii)(D) 45 CFR 164.316(b)(2)(i) (New)

Clause 4.3.3 A.10.5.1 A.10.7.3

Clauses 9.2(g) 7.5.3(b) 5.2 (c) 7.5.3(d) 5.3(a) 5.3(b) 8.1 8.3 A.12.3.1 A.8.2.3

EAR 15 § 762.6 Period of Retention EAR 15 CFR § 786.2 Recordkeeping

Commandment #11

Chapter II Article 11, 13

CIP-003-3 - R4.1

CP-2 CP-6 CP-7 CP-8 CP-9 SI-12 AU-11

FTC Fair Information Principles Integrity/Security Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm

6.4 13.1

PA10 PA29

BSGP SGP

3.1 3.1.1 3.2 9.9.1 9.5 9.6 10.7

3.1 3.1.a 3.2 9.9.1 9.5. 9.5.1 9.6. 9.7, 9.8 10.7, 12.10.1

Compliant

ACME Corporation has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME Corporation's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME Corporation's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME Corporation activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME Corporation is providing customers with business continuity as opposed to disaster recovery. The ISCP is tested annually to validate and improve the ISCP. Additionally, the failover process is informally tested on a daily basis as ACME Corporation uses failover to reduce the impact of maintenance on its service. ACME Corporation's ISCP controls are validated on an annual basis during its ISO 27001 assessment. ACME Corporation's ISCP is reviewed at least annually by senior management and is available electronically to all employees. The ISCP is replicated between both data centers in the pair. Key ACME Corporation personnel have been trained in their emergency response and recovery roles. The executive sponsor of the ISCP is the Chief Product Officer. The ISCP is based on National Institute of Standards and Technology (NIST) Special Publication 800-34 ""Contingency Planning Guide for Information Technology (IT) Systems"" which provides instructions, recommendations, and considerations for government IT contingency planning. Please refer to the Information System Contingency Plan here: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2 Please refer to the Information System Contingency Plan Test Report here: https://community.ACME.com/community?id=community_article&sys_id=e7fca6a5dbd0dbc01dcaf3231f961992

Change Control & Configuration Management New Development / Acquisition

CCC-01

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the organization's business leadership or other accountable business role or function.

S3.12.0 S3.10.0 S3.13.0

(S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies. (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies. (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.2 CC7.1 CC7.4

I.2

I.1.1, I.1.2, I.2. 7.2, I.2.8, I.2.9, I.2.10, I.2.13, I.2.14, I.2.15, I.2.18, I.2.22.6, L.5

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RM-01

A12 A16.1

APO01.02 APO01.06 BAI02.04 BAI06.01

ITOS > IT Operation > Architecture Governance

shared

None

6.03. (a)

NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4

NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7)

1.2.6

A.6.1.4 A.6.2.1 A.12.1.1 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.5 A.15.1.3 A.15.1.4

A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* (partial) A.14.2.7 A.18.1.3 A.18.1.4

Commandment #1 Commandment #2 Commandment #3

CA-1 CM-1 CM-9 PL-1 PL-2 SA-1 SA-3 SA-4

12.1

6.3.2

6.3.2, 12.3.4

Compliant

ACME Corporation's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME Corporation, and to customers of ACME Corporation. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, active existing vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed. ACME Corporation reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively. Please refer to the VSRA SOP here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993

Change Control & Configuration Management Outsourced Development

CCC-02

External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

S3.10.0 S3.13

(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies. (S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1 CC7.4

C.2 I.1 I.2 I.4

C.2.4, G.4, G6, I.1, I.4.4, I.4.5, I.2.7.2, I.2.8, I.2.9, I.2.15, I.2.18, I.2.22.6, I.2.7.1, I.2.13, I.2.14, I.2.17, I.2.20, I.2.22.2, I.2.22.4, I.2.22.7, I.2.22.8, I.2.22.9, I.2.22.10, I.2.22.11, I.2.22.12, I.2.22.13, I.2.22.14, I.3, J.1.2.10, L.7, L.9, L.10

27 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RM-04

APO07.06 APO09.03 APO09.04 APO10.01 APO10.04 APO10.05 APO11.01 APO11.02 APO11.04 APO11.05

ITOS > IT Operation > Architecture Governance

shared

None

NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-9

NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SA-9 (1) NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1) NIST SP 800-53 R3 SA-12

A.6.1.8 A.6.2.1 A.6.2.3 A.10.1.4 A.10.2.1 A.10.2.2 A.10.2.3 A.10.3.2 A.12.1.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.1 A.12.5.2 A.12.5.3 A.12.5.5 A.12.6.1 A.13.1.2 A.15.2.1 A.15.2.2

A18.2.1 A.15.1.2 A.12.1.4 8.1* (partial) 8.1* (partial) A.15.2.1 8.1* (partial) A.15.2.2 A.14.2.9 A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* (partial) A.14.2.2 8.1* (partial) A.14.2.3 8.1* (partial) A.14.2.4 8.1* (partial) A.14.2.7 A.12.6.1 A.16.13 A.18.2.2 A.18.2.3

Commandment #1 Commandment #2 Commandment #3

SA-4 SA-5 SA-8 SA-9 SA-10 SA-11 SA-12 SA-13

2.2 4.1

PA17

SGP

3.6.7 6.4.5.2 7.1.3 8.5.1 9.1 9.1.2 9.2b 9.3.1 10.5.2 11.5 12.3.1 12.3.3

2.1, 2.2.4, 2.3, 2.5 3.3, 3.4, 3.6 4.1, 4.2 6.3.1, 6.3.2, 6.4.2, 6.4.3, 6.4.4, 6.4.5.2 6.7 7.1, 7.1.3, 7.1.4 8.3, 8.5.1, 8.7 9.1 9.1.2 9.2 10.5 11.5 12.3 12.8

N/A

ACME Corporation does not use third parties for development. All development is performed in house.

Change Control & Configuration Management Quality Testing

CCC-03

Organization shall follow a defined quality change control and testing process (e.g. ITIL Service Management) with established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.

A3.13.0 C3.16.0 I3.14.0 S3.10.0 S3.13

(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies. (S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1 CC7.1 CC7.1 CC7.1 CC7.4

C.1.7, G.1, G.6, I.1, I.4.5, I.2.18, I.22.1, I.22.3, I.22.6, I.2.23, I.2.22.2, I.2.22.4, I.2.22.7. I.2.22.8, I.2.22.9, I.2.22.10, I.2.22.11, I.2.22.12, I.2.22.13, I.2.22.14,I.2.20, I.2.17, I.2.7.1, I.3, J.2.10, L.9

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RM-03

PO 8.1

APO11.01 APO11.02 APO11.04 APO11.05 BAI02.04 BAI03.06 BAI03.08 BAI07.03 BAI07.05

ITOS > Service Support > Release Management

shared

None

6.03.01. (b) 6.03.01. (d)

NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5

NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 SA-3 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SA-5 NIST SP 800-53 R3 SA-5 (1) NIST SP 800-53 R3 SA-5 (3) NIST SP 800-53 R3 SA-8 NIST SP 800-53 R3 SA-10 NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1)

9.1.0 9.1.1 9.2.1 9.2.2

A.6.1.3 A.10.1.1 A.10.1.4 A.10.3.2 A.12.1.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.1 A.12.5.2 A.12.5.3 A.12.6.1 A.13.1.2 A.15.2.1 A.15.2.2

A.6.1.1 A.12.1.1 A.12.1.4 A.14.2.9 A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* partial A.14.2.2 8.1* partial A.14.2.3 8.1* partial A.14.2.4 A.12.6.1 A.16.1.3 A.18.2.2 A.18.2.3

Commandment #1 Commandment #2 Commandment #3

CM-1 CM-2 SA-3 SA-4 SA-5 SA-8 SA-10 SA-11 SA-13

12.1 14.1 14.2

1.1.1 6.1 6.4

6.1 6.2 6.3 6.4 6.5 6.6 6.7

Compliant

Infrastructure changes go through the Change Management process. Changes with a significant impact need to be tested and peer reviewed by Cloud Operations staff prior to being taken to the CAB for approval. Additionally, ACME Corporation has a physically and logically separate TEST and DEV environment to test selected infrastructure changes before deployment. ACME Corporation's patch deployment process is closely integrated to the Change Management process; patches are deployed after testing and with Change Approval Board (CAB) approvals. The Change Management SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=140d2aa5dbd0dbc01dcaf3231f961900 Software changes follow the Software Development Lifecycle SOP. ACME Corporation’s software development lifecycle (SDLC) consists of five high‐level phases: Release Planning, Development, Hardening, Release and Support. ACME Corporation’s SDLC is based off of and uses the agile development methodology called Scrum. Scrum is a development framework in which cross-functional teams develop products or projects in an iterative, incremental manner. ACME Corporation’s SDLC is driven by milestones as opposed to process steps. Meetings support the milestones, through discussing issues, making decisions, refining plans and sharing information. ACME Corporation follows its SDLC SOP for software development and follows its Maintenance Release Management SOP when releasing software. The SDLC SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=bb1c6e21dbd0dbc01dcaf3231f961923 The Maintenance Release Managmeent SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=716c2ea1dbd0dbc01dcaf3231f961995

Change Control & Configuration Management Unauthorized Software Installations

CCC-04

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

A3.6.0 S3.5.0 S3.13.0

(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software. (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC5.5 CC5.8 CC7.4

G.1 I.2

G.2.13, G.20.2,G.20.4, G.20.5, G.7, G.7.1, G.12.11, H.2.16, I.2.22.1, I.2.22.3, I.2.22.6, I.2.23

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RM-05

APO13.01 BAI06.01 BAI10 DSS05.03 DSS05.04 DSS05.05 DSS05.07 DSS06.03

312.8 and 312.10

ITOS > Service Support > Configuration Management -> Software Mangement

shared

None

NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-3

NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 CM-3 NIST SP 800-53 R3 CM-3 (2) NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1) NIST SP 800-53 R3 CM-5 (5) NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1) NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1) NIST SP 800-53 R3 CM-8 (3) NIST SP 800-53 R3 CM-8 (5) NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-3 NIST SP 800-53 R3 SI-3 (1) NIST SP 800-53 R3 SI-3 (2) NIST SP 800-53 R3 SI-3 (3) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 SI-7 NIST SP 800-53 R3 SI-7 (1)

3.2.4 8.2.2

A.10.1.3 A.10.4.1 A.11.5.4 A.11.6.1 A.12.4.1 A.12.5.3

A.6.1.2 A.12.2.1 A.9.4.4 A.9.4.1 A.12.5.1 8.1* (partial) A.14.2.4

Commandment #1 Commandment #2 Commandment #3 Commandment #5 Commandment #11

CM-1 CM-2 CM-3 CM-5 CM-7 CM-8 CM-9 SA-6 SA-7 SI-1 SI-3 SI-4 SI-7

FTC Fair Information Principles Involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm

14.1

1.3.3 2.1, 2.2.2 3.6 4.1 5.1, 5.2, 5.3, 5.4 6.2 7.1 9.1 9.1.1 9.1.2 9.1.3 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7 11.1, 11.4, 11.5 12.3

Compliant

The ACME Corporation Information Security and System Engineering groups maintains a list of packages for servers that have been authorized to run on Linux servers that support the Customer environment. Only the software identified on the list of packages is allowed to run on systems in the operating environment. ACME Corporation uses Puppet as its standard configuration tool. In case a server doesn't have a standard configuration, the tool overwrites the system with the standard configuration; alerts are issued and attended to by Security staff on standard configuration deviations. In addition, ACME Corporation employees do not have administrator access to their workstations and do not have the ability to install unauthorized software onto their systems.

Change Control & Configuration Management Production Changes

CCC-05

Policies and procedures shall be established for managing the risks associated with applying changes to: • business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations • infrastructure network and systems components Technical measures shall be implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.

A3.16.0 S3.13.0

(A3.16.0, S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4 CC7.4

I.2.17, I.2.20, I.2.22

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

RM-02

A16.1 A17.6

BAI06.01 BAI06.02 BAI06.03 BAI06.04 BAI07.01 BAI07.03 BAI07.04 BAI07.05 BAI07.06

ITOS > Service Support > Release Management

shared

None

6.03. (a)

NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 PL-5 NIST SP 800-53 R3 SI-2

NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CA-7 (2) NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 CM-3 NIST SP 800-53 R3 CM-3 (2) NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1) NIST SP 800-53 R3 CM-5 (5) NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 CM-6 (1) NIST SP 800-53 R3 CM-6 (3) NIST SP 800-53 R3 CM-9 NIST SP 800-53 R3 PL-2 NIST SP 800-53 R3 PL-5 NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-2 (2) NIST SP 800-53 R3 SI-6 NIST SP 800-53 R3 SI-7 NIST SP 800-53 R3 SI-7 (1)

1.2.6

45 CFR 164.308 (a)(5)(ii)(C) 45 CFR 164.312 (b)

A.10.1.4 A.12.5.1 A.12.5.2

A.12.1.4 8.1* (partial) A.14.2.2 8.1* (partial) A.14.2.3

Commandment #1 Commandment #2 Commandment #3 Commandment #11

CIP-003-3 - R6

CA-1 CA-6 CA-7 CM-2 CM-3 CM-5 CM-6 CM-9 PL-2 PL-5 SI-2 SI-6 SI-7

AR- 4. Privacy Monitoring and Auditing. Organizations also: (i) implement technology to audit for the security, appropriate use, and loss of PII; (ii) perform reviews to ensure physical security of documents containing PII; (iii) assess contractor compliance with privacy requirements; and (iv) ensure that corrective actions identified as part of the assessment process are tracked and monitored until audit findings are corrected. The organization Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) coordinates monitoring and auditing efforts with information security officials and ensures that the results are provided to senior managers and oversight officials.

12.1 12.4

PA14

SGP

1.1.1 6.3.2 6.4 6.1

1.1.1 6.3.2 6.4.5

Compliant

Refer to CCC-03 above.

Data Security & Information Lifecycle Management Classification

DSI-01

Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

S3.8.0 C3.14.0

(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.

CC3.1 CC3.1

D.1.3, D.2.2

DG-02

PO 2.3 DS 11.6

APO01.06 APO03.02 APO08.01 APO09.03 APO13.01 BAI09.01 BAI09.02 BAI09.03 DSS04.07 DSS05.04 DSS05.05 DSS06.06

312.3

BOSS > Data Governance > Data Classification

shared

Domain 5

6.04.03. (a)

Article 4 (1), Article 12, Article 17

NIST SP 800-53 R3 RA-2

NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 AC-4

1.2.3 1.2.6 4.1.2 8.2.1 8.2.5 8.2.6

A.7.2.1

A.8.2.1

Commandment #9

General Provisions, Article 3, V. and VI.

CIP-003-3 - R4 - R5

RA-2 AC-4

DM-1 Minimization of Personsally Identifidable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research.

PA10

SGP

9.7.1 9.10 12.3

3.1 9.6.1, 9.7.1 9.10 12.3

Compliant

ACME Corporation has formal documented information security policies. The information security policy and standards (ISP/ISS) address information classification and data handling requirments. Any customer data that is stored or processed by a ACME Corporation instance is classified as 'Customer Confidential' regardless of whether the customer deems the data to be sensitive or non-sensitive. All customer data is only accessible by your organization and by authorized ACME Corporation personnel for the purpose of performing upgrades, system maintenance and for providing customer support. The Information Security Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 The Information Security Standards can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5

Data Security & Information Lifecycle Management Data Inventory / Flows

DSI-02

Policies and procedures shall be established to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's applications and infrastructure network and systems. In particular, providers shall ensure that data that is subject to geographic residency requirements not be migrated beyond its defined bounds.

APO01.06 APO03.01 APO03.02 APO09.01 APO09.01 BAI06.03 BAI09.01 BAI10.01 BAI10.02 BAI10.03 BAI10.04 BAI10.05

BOSS > Data Governance > Handling / Labeling / Security Policy

Domain 5

6.10. (a) 6.10. (b) 6.10. (c) 6.10. (d) 6.10. (e)

NIST SP 800-53 R3 SC-30

Clause 4.2 5.2, 7.5, 8.1

TR-2 SYSTEM OF RECORDS NOTICES AND PRIVACY ACT STATEMENTS

1.1.3 12.3.3

Compliant

Please refer to your customer contract for details regarding the location of your data center pair. Customers can dictate which data center pair their data is housed in and can manage IP address restrictions to limit the transmission of data. Customers would be notified should a data center move be required.

Data Security & Information Lifecycle Management eCommerce Transactions

DSI-03

Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

S3.6 I13.3.a-e I3.4.0

(S3.6) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (I13.3.a-e) The procedues related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies. (I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policiies.

CC5.7 PI1.5

G.4 G.11 G.16 G.18 I.3 I.4

G.19.1.1, G.19.1.2, G.19.1.3, G.10.8, G.9.11, G.14, G.15.1

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-28

DS 5.10 5.11

APO01.06 APO03.02 APO08.01 APO13.01 APO13.02 DSS05 DSS06

312.8 and 312.10

SRM > Cryptographic Services > Data in Transit Encryption

shared

Domain 2

Article 17

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-22 NIST SP 800-53 R3 AU-1

NIST SP 800-53 R3 AC-22 NIST SP 800-53 R3 AU-10 NIST SP 800-53 R3 AU-10 (5) NIST SP 800-53 R3 SC-8 NIST SP 800-53 R3 SC-8 (1) NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1)

3.2.4 4.2.3 7.1.2 7.2.1 7.2.2 8.2.1 8.2.5

45 CFR 164.312(e)(1) 45 CFR 164.312(e)(2)(i)

A.7.2.1 A.10.6.1 A.10.6.2 A.10.9.1 A.10.9.2 A.15.1.4

A.8.2.1 A.13.1.1 A.13.1.2 A.14.1.2 A.14.1.3 A.18.1.4

Commandment #4 Commandment #5 Commandment #9 Commandment #10 Commandment #11

AC-14 AC-21 AC-22 IA-8 AU-10 SC-4 SC-8 SC-9

TR-2 SYSTEM OF RECORDS NOTICES AND PRIVACY ACT STATEMENTS

PA25 PA21 PA5

GP GP BSGP

2.1.1 4.1 4.1.1 4.2

2.1.1 3.1 4.1 4.1.1 4.2

Compliant

Data Security & Information Lifecycle Management Handling / Labeling / Security Policy

DSI-04

Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

S3.2.a

(S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1

G.13

D.2.2

DG-03

PO 2.3 DS 11.6

APO01.06 APO03.02 APO08.01 APO09.03 APO13.01 BAI09.01 BAI09.02 BAI09.03 DSS04.07 DSS05.04 DSS05.05 DSS06.06

312.2

BOSS > Data Governance > Handling / Labeling / Security Policy

shared

Domain 5

6.03.05. (b)

Article 22 Article 23

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PE-16 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-12

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-16 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-3 NIST SP 800-53 R3 PE-16 NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1) NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-12

99.31.(a)(1)(ii)

1.1.2 5.1.0 7.1.2 8.1.0 8.2.5 8.2.6

A.7.2.2 A.10.7.1 A.10.7.3 A.10.8.1

A.8.2.2 A.8.3.1 A.8.2.3 A.13.2.1

Commandment #8 Commandment #9 Commandment #10

Chapter II Article 8, 9, 11, 12, 14, 18, 19, 20, 21

CIP-003-3 - R4 - R4.1

AC-16 MP-1 MP-3 PE-16 SI-12 SC-9

DM-1 Minimization of Personsally Identifidable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research. SE-1 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION

13.1

9.5 9.6 9.7.1 9.7.2 9.10

9.5, 9.5.1 9.6 9.7 9.8 9.9

Compliant

ACME Corporation has defined the information labeling and handling procedures in its Media Handling SOP, which describes how the reuse, disposal and destruction of physical media must be handled. Equipment (with customer data), such as hard drives, that need to be destroyed or sanitized is stored in a lockbox in the ACME Corporation cage; a label is attached to identify customer sensitive, and the associated HI ticket number for tracking. Per the Disk Destruction SOP, annually, or when the contained media device count reaches 50, a third party vendor destroys the media on site within the ACME Corporation cage. Please refer to Datacenter Media Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=293c2a61dbd0dbc01dcaf3231f961924 Please refer to Disk Destruction SOP here: https://community.ACME.com/community?id=community_article&sys_id=67bc6e25dbd0dbc01dcaf3231f9619d1 Please refer the Customer Data Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=967ca2e1dbd0dbc01dcaf3231f96190e

Data Security & Information Lifecycle Management Non-Production Data

DSI-05

Production data shall not be replicated or used in non-production environments.

C3.5.0 S3.4.0 C3.21.0

(C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies. (S3.4.0) Procedures exist to protect against unauthorized access to system resources. (C3.21.0) Procedures exist to provide that confidential information is protected during the system development, testing, and change processes in accordance with defined system confidentiality and related security policies.

C1.3 CC5.6 C1.1

I.2.18

DG-06

APO01.06 BAI01.01 BAI03.07 BAI07.04

SRM > Policies and Standards > Technical Standard (Data Management Security Standard)

shared

Domain 5

6.03. (d)

NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1)

1.2.6

45 CFR 164.308(a)(4)(ii)(B)

A.7.1.3 A.10.1.4 A.12.4.2 A.12.5.1

A.8.1.3 A.12.1.4 A.14.3.1 8.1* (partial) A.14.2.2.

Commandment #9 Commandment #10 Commandment #11

CIP-003-3 - R6

SA-11 CM-04

DM-1 Minimization of Personsally Identifidable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research.

17.8

6.4.3

Compliant

ACME Corporation does not use customer data in in our non-production environments by policy, unless the customer specifically approves the use. Additionally, ACME Corporation maintains its test data in the test environment, which is segregated from the production environment. ACME Corporation typically does not use customer data as test data, except in the case of testing certain qualities including without limitation the interoperability and stability of the next release of the Subscription Service, in such case, ACME Corporation and the subject customer will enter into a “Data Test Agreement” with specific terms and conditions stipulating the handling of the test data, which covers the terms on, scope, access, reproduction and destruction of the test data. Please refer the Customer Data Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=967ca2e1dbd0dbc01dcaf3231f96190e

Data Security & Information Lifecycle Management Ownership / Stewardship

DSI-06

All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

S2.2.0 S2.3.0 S3.8.0

(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. (S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary

CC2.3 CC3.1

C.2.5.1, C.2.5.2, D.1.3, L.7

Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3

DG-01

DS5.1 PO 2.3

APO01.06 APO03.02 APO13.01 APO13.03

312.4

BOSS > Data Governance > Data Ownership / Stewadship

shared

Domain 5

Article 4

NIST SP 800-53 R3 CA-2 NIST SP 800-53 R3 CA-2 (1) NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 SA-2

6.2.1

45 CFR 164.308 (a)(2)

A.6.1.3 A.7.1.2 A.15.1.4

A.6.1.1 A.8.1.2 A.18.1.4

Commandment #6 Commandment #10

Chapter IV Article 30

CIP-007-3 - R1.1 - R1.2

CA-2 PM-5 PS-2 RA-2 SA-2

AP-1 AUTHORITY TO COLLECT. AP-2 PURPOSE SPECIFICATION.

3.4

3.7 12.5.5 12.10.4

Compliant

ACME Corporation has a documented Information Security Policy (ISP) and Customer Data Handling SOP that cover access to ACME Corporation and its Customer’s data; of which has specific policies to address Identity, Authentication and Authorization pertaining to information systems that store or access ACME Corporation or customer data. Please refer the Customer Data Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=967ca2e1dbd0dbc01dcaf3231f96190e The Information Security Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 The Information Security Standards can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5 ACME Corporation operates the infrastructure that supports its services however it is ACME Corporation's customers who place ALL data in the system and ACME Corporation does not attempt to analyze its customers data. As a result ACME Corporation classifies all customer data with the same classification "Customer Restricted" and applies controls and policies to that data classification. ACME Corporation does not modify, label or classify its customer data. Customers are responsible for classifying their data according to their business needs.

Data Security & Information Lifecycle Management Secure Disposal

DSI-07

Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

C3.5.0 S3.4.0

C1.3 CC5.6

D.2.2.10, D.2.2.11, D.2.2.14,

37 (B)

Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.7.5 and 4.5.3

DG-05

DS 11.4

APO01.06 APO13.01 BAI09.03 DSS01.01

312.3

BOSS > Data Governance > Secure Disposal of Data

shared

Domain 5

6.03. (h)

Article 16 Article 17

NIST SP 800-53 R3 MP-6 NIST SP 800-53 R3 PE-1

NIST SP 800-53 R3 MP-6 NIST SP 800-53 R3 MP-6 (4) NIST SP 800-53 R3 PE-1

5.1.0 5.2.3

45 CFR 164.310 (d)(2)(i) 45 CFR 164.310 (d)(2)(ii)

A.9.2.6 A.10.7.2

A.11.2.7 A.8.3.2

Commandment #11

CIP-007-3 - R7 - R7.1 - R7.2 R7.3

MP-6 PE-1

DM-2 DATA RETENTION AND DISPOSAL

13.4 13.5

PA10 PA39 PA34 PA40

BSGP SGP SGP SGP

3.1.1 9.10 9.10.1 9.10.2 3.1

3.1.1 9.8, 9.8.1, 9.8.2, 3.1

Compliant

See DSI-05. ACME Corporation has a defined Media Handling and Secure Data Deletion processes in place that guides how media containing customer data is sanitize prior to its destruction. ACME Corporation does not use other types of media in its service offering. Drives that are to be replaced or decommissioned go into a drive safe in each cage will the serial numbers recorded centrally. On a periodic basis, not more than every three months a ACME Corporation employee will visit the cage and along with a representative from disk destruction company and witness the drives being destroyed. A certificate of destruction will be produced for each drive. The destruction must follow NIST 800-88 standards. Please refer to the Disk Destruction SOP here: https://community.ACME.com/community?id=community_article&sys_id=67bc6e25dbd0dbc01dcaf3231f9619d1 Please refer to the Datacenter Media Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=293c2a61dbd0dbc01dcaf3231f961924 Please refer to the Secure Data Deletion SOP here: https://community.ACME.com/community?id=community_article&sys_id=5b3d2ee5dbd0dbc01dcaf3231f9619b1

Datacenter Security Asset Management

DCS-01

Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities.

S3.1.0 C3.14.0 S1.2.b-c

(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies. (S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies. c. Assessing risks on a periodic basis.

CC3.1 CC3.1

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3

FS-08

APO01.06 APO03.02 APO08.01 APO09.03 BAI09.01 BAI09.02 BAI09.03 DSS04.07 DSS05.04 DSS05.05 DSS06.06

ITOS > Service Support > Configuration Management - Physical Inventory

provider

Domain 8

Article 17

Annex A.8

12.3

PA4 PA8 PA37 PA38

BSGP BSGP SGP SGP

9.7.1 9.9 9.9.1

Compliant

ACME Corporation has a formally documented Data Center Asset Management SOP which defines how assets are commissioned, tracked, managed, and decommissioned in a way that protects the confidentiality, integrity, and availability of ACME Corporation assets. Please refer to the Datacenter Asset Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=d30d2ea5dbd0dbc01dcaf3231f9619c0 ACME Corporation's CMDB has a built-in IT Asset Management (ITAM) module that enables the deployment and discovery process to ensure that every asset is registered in CMDB. ACME Corporation does not deploy an asset until it is registered in CMDB to ensure all assets are in CMDB.

Datacenter Security Controlled Access Points

DCS-02

Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

A3.6.0

CC5.5

F.2

F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18

7 (B)

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3

FS-03

DS 12.2 DS 12.3

APO13.01 DSS01.01 DSS01.05 DSS05.05 DSS06.03 DSS06.06

312.8 and 312.10

Infra Services > Facility Security > Controlled Physical Access

provider

Domain 8

6.08. (a) 6.09. (i)

Article 17

NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-8

NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-6 (1) NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-7 (1) NIST SP 800-53 R3 PE-8 NIST SP 800-53 R3 PE-18

99.31.a.1.ii

8.2.3

A.9.1.1 A.9.1.2

A.11.1.1 A.11.1.2

Commandment #1 Commandment #2 Commandment #3 Commandment #5

CIP-006-3c R1.2 - R1.3 - R1.4 - R1.6 - R1.6.1 - R2 - R2.2

PE-2 PE-3 PE-6 PE-7 PE-8 PE-18

8.1 8.2

PA4

BSGP

9.1 9.1.1 9.1.2 9.1.3 9.2

9.1 9.1.1 9.1.2, 9.1.3 9.2, 9.3, 9.4, 9.4.1, 9.4.2, 9.4.3, 9.4.4

Compliant

Sensitive data and information systems reside within the data centers only. ACME Corporation's data centers inherit physical security and environmental controls from the colocation providers. All providers enforce access to the data centers via multiple levels of locking mechanisms, including pin codes, biometrics, and access cards. ACME Corporation must pre-approve all (ACME Corporation) visitors to the data centers. Government / state-issued identification is required to authenticate visitors upon arriving. Visitors must be escorted at all times by authorized personnel. ACME Corporation reviews access control lists, access activity, and visitor logs on a monthly basis. All data centers are staffed with uniformed security guards, are designed to thwart crash/ram physical attacks, use camera surveillance (e.g. building exterior, all ingress/egress points, data center floor), and have audible alarms on controlled doors. Most data centers do not have exterior windows and no data centers have windows on the data halls; any exterior glass is alarmed for breakage. Cameras and alarms are monitored by the provider's on-site security staff. In all data centers, ACME Corporation has its own cages with its own card readers and biometric controls. All data centers are equipped with uninterruptible power supply (UPS), fire detection and suppression systems, backup generators, and heating, ventilation, and air conditioning (HVAC) systems. ACME Corporation performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits to ensure that physical security and environmental controls are operating effectively. Please refer to the Datacenter Third Party Attestation reports here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb Please refer to the Datacenter Access Control SOP here: https://community.ACME.com/community?id=community_article&sys_id=d24d6229dbd0dbc01dcaf3231f961929

Datacenter Security Equipment Identification

DCS-03

Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

S3.2.a

(S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1

D.1

D.1.1, D.1.3

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-13

DS5.7

APO13.01 DSS05.02 DSS05.03

312.3, 312.8 and 312.10

> >

Domain 10

6.05. (a)

Article 17

NIST SP 800-53 R3 IA-4

NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-4 (4)

A.11.4.3

Commandment #1 Commandment #2 Commandment #3 Commandment #5 Commandment #8

IA-3 IA-4

PA22 PA33

GP SGP

Compliant

ACME Corporation uses certificate based authentication in conjuction with other authentication methods in its environment that meet this requirement. ACME Corporation has a formally documented Datacenter Asset Management SOP, with the purpose to ensure that assets are commissioned, tracked, managed, and decommissioned in a way that protects the confidentiality, integrity, and availability of ACME Corporation assets. Please refer to the Datacenter Asset Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=d30d2ea5dbd0dbc01dcaf3231f9619c0 ACME Corporation's CMDB has a built-in IT Asset Management (ITAM) module that enables the deployment and discovery process to ensure that every asset is registered in CMDB. ACME Corporation does not deploy an asset until it is registered in CMDB to ensure all assets are in CMDB.

Datacenter Security Off-Site Authorization

DCS-04

Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

S3.2.f C3.9.0

(S3.2.f) f. Restriction of access to offline storage, backup data, systems, and media. (C3.9.0) Procedures exist to restrict physical access to the defined system including, but not limited to: facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.1 CC5.5

F.2.18, F.2.19,

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5

FS-06

EDM05.02 APO01.02 APO03.02 BAI02.03 BAI02.04 BAI03.09 BAI06.01

312.8 and 312.10

SRM > Facility Security > Asset Handling

provider

Domain 8

6.08. (a) 6.09. (j)

Article 17

NIST SP 800-53 R3 AC-17 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PE-16

45 CFR 164.310 (c ) 45 CFR 164.310 (d)(1) 45 CFR 164.310 (d)(2)(i)

A.9.2.5 A.9.2.6

A.11.2.6 A.11.2.7

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #4 Commandment #5 Commandment #11

AC-17 MA-1 PE-1 PE-16 PE-17

12.5 19.1

PA4

BSGP

9.8 9.9 9.10

9.6.3

Compliant

Customer data does not leave the data center and would not be moved from one physical location to another. Drives that are to be replaced or decommissioned go into a drive safe in each cage will the serial numbers recorded centrally. On a periodic basis, not more than every three months a ACME Corporation employee will visit the cage and along with a representative from disk destruction company and witness the drives being destroyed. A certificate of destruction will be produced for each drive. The destruction must follow NIST 800-88 standards.

Datacenter Security Off-Site Equipment

DCS-05

Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory for reuse and deployment, or securely stored until it can be destroyed.

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

D.1

D.1.1, D.2.1. D.2.2,

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5

FS-07

APO09.03 APO10.04 APO10.05 APO13.01 DSS01.02

312.8 and 312.10

BOSS > Data Governance > Secure Disposal of Data

provider

Domain 8

6.05. (a) 6.05. (b) 6.05. (c)

Article 17

NIST SP 800-53 R3 CM-8

NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1) NIST SP 800-53 R3 CM-8 (3) NIST SP 800-53 R3 CM-8 (5) NIST SP 800-53 R3 SC-30

45 CFR 164.310 (d)(2)(iii)

A.7.1.1 A.7.1.2

A.8.1.1 A.8.1.2

Commandment #6 Commandment #7 Commandment #8

CM-8

12.6

PA4

BSGP

9.9.1 12.3.3 12.3.4

9.8, 9.8.1, 9.8.2 12.3

Compliant

ACME Corporation has a defined Media Handling and Secure Data Deletion processes in place that guides how media containing customer data is sanitize prior to its destruction. ACME Corporation does not use other types of media in its service offering. Drives that are to be replaced or decommissioned go into a drive safe in each cage will the serial numbers recorded centrally. On a periodic basis, not more than every three months a ACME Corporation employee will visit the cage and along with a representative from disk destruction company and witness the drives being destroyed. A certificate of destruction will be produced for each drive. The destruction must follow NIST 800-88 standards. Please refer to the Disk Destruction SOP here: https://community.ACME.com/community?id=community_article&sys_id=67bc6e25dbd0dbc01dcaf3231f9619d1 Please refer to the Datacenter Media Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=293c2a61dbd0dbc01dcaf3231f961924 Please refer to the Secure Data Deletion SOP here: https://community.ACME.com/community?id=community_article&sys_id=5b3d2ee5dbd0dbc01dcaf3231f9619b1

Datacenter Security Policy

DCS-06

Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

A3.6.0

CC5.5

H.6

F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.4.2, F1.4.6, F.1.4.7, F.1.7, F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18

7 (B)

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3

FS-01

APO13.01 DSS01.04 DSS01.05 DSS04.01 DSS04.03

SRM > Policies and Standards > Information Security Policies (Facility Security Policy)

provider

Domain 8

6.08. (a) 6.09. (i)

Article 17

NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6

NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-4 NIST SP 800-53 R3 PE-5 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-6 (1)

99.31.a.1.ii

8.2.1 8.2.2 8.2.3

45 CFR 164.310(a)(1) 45 CFR 164.310(a)(2)(ii) 45 CFR 164.310(b) 45 CFR 164.310 ( c) (New)

A.9.1.1 A.9.1.2

A.11.1.1 A.11.1.2

Commandment #1 Commandment #2 Commandment #3 Commandment #5

CIP-006-3c R1.2 - R1.3 - R1.4 -R2 - R2.2

PE-2 PE-3 PE-4 PE-5 PE-6

4.2 8.1

PA4

BSGP

9.1

9.1 9.1.1 9.1.2 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 9.4.4

Compliant

Datacenter Security - Secure Area Authorization

DCS-07

Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

A3.6.0

CC5.5

F.2

7 (B)

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3

FS-04

DS 12.3

APO13.01 APO13.02 DSS05.05

312.8 and 312.10

SRM > Policies and Standards > Information Security Policy (Facility Security Policy)

provider

Domain 8

6.08. (a) 6.09. (i)

Article 17

NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-16

NIST SP 800-53 R3 PE-7 NIST SP 800-53 R3 PE-7 (1) NIST SP 800-53 R3 PE-16 NIST SP 800-53 R3 PE-18

99.31.a.1.ii

8.2.3

A.9.1.6

A.11.1.6

Commandment #1 Commandment #2 Commandment #3 Commandment #5

CIP-006-3c R1.2 - R1.3 - R1.4

PE-7 PE-16 PE-18

8.2 8.1

PA4

BSGP

9.1 9.1.1 9.1.3

Compliant

ACME Corporation's data centers inherit physical security and environmental controls from the colocation providers. All providers enforce access to the data centers via multiple levels of locking mechanisms, including pin codes, biometrics, and access cards. ACME Corporation must pre-approve all (ACME Corporation) visitors to the data centers. Government / state-issued identification is required to authenticate visitors upon arriving. Visitors must be escorted at all times by authorized personnel. ACME Corporation reviews access control lists, access activity, and visitor logs on a monthly basis. All data centers are staffed with uniformed security guards, are designed to thwart crash/ram physical attacks, use camera surveillance (e.g. building exterior, all ingress/egress points, data center floor), and have audible alarms on controlled doors. Most data centers do not have exterior windows and no data centers have windows on the data halls; any exterior glass is alarmed for breakage. Cameras and alarms are monitored by the provider's on-site security staff. In all data centers, ACME Corporation has its own cages with its own card readers and biometric controls. All data centers are equipped with uninterruptible power supply (UPS), fire detection and suppression systems, backup generators, and heating, ventilation, and air conditioning (HVAC) systems. ACME Corporation performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits to ensure that physical security and environmental controls are operating effectively. Please refer to the Datacenter Third Party Attestation reports here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb

Datacenter Security Unauthorized Persons Entry

DCS-08

Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

A3.6.0

CC5.5

G.21

F.2.18

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3

FS-05

APO13.01 APO13.02 DSS05.05 DSS06.03

312.8 and 312.10

SRM > Policies and Standards > Information Security Policy (Facility Security Policy)

provider

Domain 8

6.08. (a) 6.09. (j)

Article 17

NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 PE-16

NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-2 (1) NIST SP 800-53 R3 PE-16

99.31.a.1.ii

8.2.5 8.2.6

45 CFR 164.310 (d)(1)

A.9.2.7 A.10.1.2

A.11.2.5 8.1* (partial) A.12.1.2

Commandment #6 Commandment #7

MA-1 MA-2 PE-16

8.1 8.2 8.3 8.4

PA4

BSGP

9.8 9.9

9.1 9.1.1 9.1.2 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 9.4.4 9.5 9.5.1

Compliant

ACME Corporation's data centers inherit physical security and environmental controls from the colocation providers. All providers enforce access to the data centers via multiple levels of locking mechanisms, including pin codes, biometrics, and access cards. ACME Corporation must pre-approve all (ACME Corporation) visitors to the data centers. Government / state-issued identification is required to authenticate visitors upon arriving. Visitors must be escorted at all times by authorized personnel. ACME Corporation reviews access control lists, access activity, and visitor logs on a monthly basis. All data centers are staffed with uniformed security guards, are designed to thwart crash/ram physical attacks, use camera surveillance (e.g. building exterior, all ingress/egress points, data center floor), and have audible alarms on controlled doors. Most data centers do not have exterior windows and no data centers have windows on the data halls; any exterior glass is alarmed for breakage. Cameras and alarms are monitored by the provider's on-site security staff. In all data centers, ACME Corporation has its own cages with its own card readers and biometric controls. All data centers are equipped with uninterruptible power supply (UPS), fire detection and suppression systems, backup generators, and heating, ventilation, and air conditioning (HVAC) systems. ACME Corporation performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits to ensure that physical security and environmental controls are operating effectively. Please refer to the Datacenter Third Party Attestation reports here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb

Datacenter Security User Access

DCS-09

Physical access to information assets and functions by users and support personnel shall be restricted.

A3.6.0

CC5.5

F.2

7 (B) 10 (B)

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3

FS-02

DS 12.3

APO13.01 APO13.02 DSS05.04 DSS05.05 DSS06.03

312.8 and 312.10

Infra Services > Facility Security >

Domain 8

6.08. (a) 6.09. (i)

Article 17

NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6

NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 PE-6 NIST SP 800-53 R3 PE-6 (1) NIST SP 800-53 R3 PE-18

99.31.a.1.ii

8.2.3

A.9.1.1

A.11.1.1

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #1 Commandment #2 Commandment #3 Commandment #5

Chapter II, Article 19

CIP-006-3c R1.2 - R1.3 - R1.4 - R1.6 - R1.6.1 - R2 - R2.2

PE-2 PE-3 PE-6 PE-18

8.1 8.2

PA4 PA13 PA24

BSGP SGP P

9.1

9.1 9.1.1 9.1.2 9.2 9.3 9.4 9.4.1 9.4.2 9.4.3 9.4.4 9.5 9.5.1

Compliant

Encryption & Key Management Entitlement

EKM-01

Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.

APO01.06 APO13.01 DSS05.04 DSS05.06 DSS06.03 DSS06.06

SRM > Cryptographic Services > Key Management

Annex A.10.1 A.10.1.1 A.10.1.2

PA36

3.5, 7.1.3 8.1 8.1.1 8.2.2 8.5 8.5.1

Compliant

ACME Corporation has documented Cryptography Standards that provide governance over the design and implementation of cryptographic controls. The document applies to all resources (e.g., employees, contractors, and vendors) involved in managing or implementing cryptographic controls. These standards apply to all cryptographic mechanisms, including approved algorithms and key strengths and key management, used to protect the confidentiality, authenticity, and integrity of sensitive ACME Corporation and customer data in the production datacenter environment. Procedures are reviewed on a minimum biennial basis as per ACME Corporation's formal managed document program. Please refer to the Cryptography Standards here: https://community.ACME.com/community?id=community_article&sys_id=f21d62e5dbd0dbc01dcaf3231f9619a6

Encryption & Key Management Key Generation

EKM-02

Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control.

S3.6.0 S3.4

(S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7 CC5.6

L.6

38 (B) 39 (C+)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-19

DS5.8

APO13.01 APO13.02 APO09.03 BAI06.01 BAI09.01 BAI09.02 BAI09.03

312.8 and 312.10

SRM > Cryptographic Services > Key Management

shared

Domain 2

6.04.04. (a) 6.04.04. (b) 6.04.04. (c) 6.04.04. (d) 6.04.04. (e) 6.04.05. (d) 6.04.05. (e) 6.04.08.02. (b)

Article 17

NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-13

NIST SP 800-53 R3 SC-12 NIST SP 800-53 R3 SC-12 (2) NIST SP 800-53 R3 SC-12 (5) NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-13 (1) NIST SP 800-53 R3 SC-17

8.1.1 8.2.1 8.2.5

45 CFR 164.312 (a)(2)(iv) 45 CFR 164.312(e)(1)

Clause 4.3.3 A.10.7.3 A.12.3.2 A.15.1.6

Clauses 5.2(c) 5.3(a) 5.3(b) 7.5.3(b) 7.5.3(d) 8.1 8.3 9.2(g) A.8.2.3 A.10.1.2 A.18.1.5

Commandment #9 Commandment #10 Commandment #11

SC-12 SC-13 SC-17 SC-28

16.2

PA36

3.4.1 3.5 3.5.1 3.5.2 3.6 3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 3.6.6 3.6.7 3.6.8

3.4.1 3.5 3.5.1 3.5.2 3.6 3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 3.6.6 3.6.7 3.6.8, 4.1 6.5.3 8.2.1 8.2.2

Compliant

See EKM-01.

Encryption & Key Management Sensitive Data Protection

EKM-03

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

C3.12.0 S3.6.0 S3.4

(C3.12.0, S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7 CC5.6

G.4 G.15 I.3

G.10.4, G.11.1, G.11.2, G.12.1, G.12.2, G.12.4, G.12.10, G.14.18, G.14.19, G.16.2, G.16.18, G.16.19, G.17.16, G.17.17, G.18.13, G.18.14, G.19.1.1, G.20.14

23 (B) 24 (B) 25 (B)

Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3

IS-18

DS5.8 DS5.10 DS5.11

APO13.01 DSS05.02 DSS05.03 DSS06.06

312.8 and 312.10

SRM > Data Protection > Cryptographic Services - Data-At-Rest Encryption, Cryptographic Services - Data-in-Transit Encryption

shared

Domain 2

6.04.05. (a) 6.04.05. (c)

Article 17

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 IA-7 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-13

NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-18 (1) NIST SP 800-53 R3 AC-18 (2) NIST SP 800-53 R3 IA-7 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-8 NIST SP 800-53 R3 SC-8 (1) NIST SP 800-53 R3 SC-9 NIST SP 800-53 R3 SC-9 (1) NIST SP 800-53 R3 SC-13 NIST SP 800-53 R3 SC-13 (1) NIST SP 800-53 R3 SC-23 NIST SP 800-53 R3 SC-28 NIST SP 800-53 R3 SI-8

8.1.1 8.2.1 8.2.5

45 CFR 164.312 (a)(2)(iv) 45 CFR 164.312 (e)(1) 45 CFR 164.312 (e)(2)(ii)

A.10.6.1 A.10.8.3 A.10.8.4 A.10.9.2 A.10.9.3 A.12.3.1 A.15.1.3 A.15.1.4

A.13.1.1 A.8.3.3 A.13.2.3 A.14.1.3 A.14.1.2 A.10.1.1 A.18.1.3 A.18.1.4

Commandment #4 Commandment #5 Commandment #9 Commandment #10 Commandment #11

CIP-003-3 - R4.2

AC-18 IA-3 IA-7 SC-7 SC-8 SC-9 SC-13 SC-16 SC-23 SI-8

16.1

PA25

2.1.1 3.4 3.4.1 4.1 4.1.1 4.2

2.1.1 2.3 3.3 3.4 3.4.1 4.1 4.1.1 4.2 4.3 6.5.3 6.5.4 8.2.1

Compliant

See EKM-01.

Encryption & Key Management Storage and Access

EKM-04

Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

APO01.06 BAI09.02 BAI09.03

SRM > Cryptographic Services > Key Management

shared

Domain 11

Annex A.10.1 A.10.1.1 A.10.1.2

3.5.2, 3.5.3 3.6.1, 3.6.3

Compliant

See EKM-01.

Governance and Risk Management Baseline Requirements

GRM-01

Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and authorized based on business need.

S1.1.0 S1.2.0(a-i)

(S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group. (S1.2.0(a-i)) The entity's security policies include, but may not be limited to, the following matters:

CC3.2

L.2

L.2, L.5, L.7 L.8, L.9, L.10

12 (B) 14 (B) 13 (B) 15 (B) 16 (C+, A+) 21 (B)

Schedule 1 (Section 5), 4.7 - Safeguards

IS-04

AI2.1 AI2.2 AI3.3 DS2.3 DS11.6

APO01.06 APO03.02 APO13.01 APO13.02 BAI02.01 BAI02.03 BAI02.04 BAI06.01 BAI10.01 BAI10.02 MEA02.01

312.8 and 312.10

SRM > Governance Risk & Compliance > Technical Standards

shared

Domain 2

6.03.01. (a) 6.03.04. (a) 6.03.04. (b) 6.03.04. (c) 6.03.04. (e) 6.07.01. (o)

Article 17

NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 SA-2 NIST SP 800-53 R3 SA-4

NIST SP 800-53 R3 CM-2 NIST SP 800-53 R3 CM-2 (1) NIST SP 800-53 R3 CM-2 (3) NIST SP 800-53 R3 CM-2 (5) NIST SP 800-53 R3 SA-2 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7) NIST SP 800-53 R3 SC-30

1.2.6 8.2.1 8.2.7

A.12.1.1 A.15.2.2

A.14.1.1 A.18.2.3

Commandment #2 Commandment #4 Commandment #5 Commandment #11

Chapter II, Article 19 and Chapter VI, Section I, Article 39

CM-2 SA-2 SA-4

AR-1 Governance and Privacy Program. TR-1 PRIVACY NOTICE. TR-3 DISSEMINATION OF PRIVACY PROGRAM INFORMATION

4.4 5.1

1.1 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 2.2 2.2.1 2.2.2 2.2.3 2.2.4

Compliant

ACME Corporation has documented System Architecture Server Hardening SOP and Checklist, that requires system provisioning with configurations be based on industry standards, including, but not limited to, • The US National Security Agency (NSA) Guide to Secure Configuration of RHEL Linux 5: • The US Government Configuration Baseline (USGCB) [NIST/DoD/RHEL]: • CIS_RHEL_5.0-‐5.1_Benchmark_v.1.1.2. System services or functionalities are disabled and/or removed based on the SOP. ACME Corporation uses Puppet as their standard configuration tool. In case the server doesn't have a standard configuration, which includes the antivirus solution, the tool overwrites the system with the standard configuration, alerts are issued and attended to by Security staffs on standard configuration deviations.

Governance and Risk Management Data Focus Risk Assessments

GRM-02

Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following: • Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements • Data classification and protection from unauthorized use, access, loss, destruction, and falsification

S3.1.0 C3.14.0 S1.2.b-c

(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies. (S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies. c. Assessing risks on a periodic basis.

CC3.1 CC3.1

L.4, L.5, L.6, L.7

34 (B)

Schedule 1 (Section 5), 4.7 - Safeguards

DG-08

PO 9.1 PO 9.2 PO 9.4 DS 5.7

EDM03.02 APO01.03 APO12.01 APO12.02 APO12.03 APO12.04 BAI09.01

312.1

BOSS > Operational Risk Management > Independent Risk Management

shared

Domain 5

6.01. (d) 6.04.03. (a)

Article 6, Article 8, Article 17 (1)

NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SI-12

1.2.4 8.2.1

45 CFR 164.308(a)(1)(ii)(A) 45 CFR 164.308(a)(8)

Clause 4.2.1 c) & g) Clause 4.2.3 d) Clause 4.3.1 & 4.3.3 Clause 7.2 & 7.3 A.7.2 A.15.1.1 A.15.1.3 A.15.1.4

Clauses 5.2(c) 5.3(a) 5.3(b) 6.1.2 6.1.2(a)(2) 6.1.3(b) 7.5.3(b) 7.5.3(d) 8.1 8.2 8.3 9.2(g) A.18.1.1 A.18.1.3 A.18.1.4 A.8.2.2

EAR 15 CFR §736.2 (b)

Commandment #1 Commandment #2 Commandment #3 Commandment #6 Commandment #7 Commandment #9 Commandment #10 Commandment #11

CA-3 RA-2 RA-3 MP-8 PM-9 SI-12

AR-2 Privacy Impact and Risk Assessment

3.3 4.3 8.4

PA10 PA18

BSGP GP

12.1 12.1.2

12.2

Compliant

ACME Corporation has a formal Information Security Risk Assessment (ISRA) program to ensure risks are documented in Risk Register and evaluated against impact to business and event likelihood; owners to risks are assigned to provide remediation plans and follow through with risk mitigations. The risk program is run at minimum annually. The Risk Assessment SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=9b8c6ae1dbd0dbc01dcaf3231f961933

Governance and Risk Management Management Oversight

GRM-03

Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

S1.2.f S2.3.0

(S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2

E.1

E.4

5 (B) 65 (B)

Schedule 1 (Section 5) 4.1 Accountability; 4.7 Safeguards, Sub 4.7.4

IS-14

DS5.3 DS5.4 DS5.5

APO01.03 APO01.04 APO01.08 DSS01.01

312.8 and 312.10

BOSS > Human Resources Security > Roles and Responsibilities

shared

Domain 3, 9

NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-5 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7

NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-5 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 CA-7 (2)

1.1.2 8.2.1

Clause 5.2.2 A.8.2.1 A.8.2.2 A 11.2.4 A.15.2.1

Clause 7.2(a,b) A.7.2.1 A.7.2.2 A.9.2.5 A.18.2.2

Commandment #6 Commandment #7 Commandment #8

AT-2 AT-3 CA-1 CA-5 CA-6 CA-7 PM-10

AR-1 Governance and Privacy Program

3.2

12.6.1 12.6.2

12.6, 7.3, 8.8, 9.10

Compliant

ACME Corporation has a formal, multifaceted training program that includes on-the-job training, role based training, onboarding training, general security training (i.e. acceptable use, handling of sensitive data), specialized security training (i.e. for developers: OWASP top 10 Vulnerabilities and Countermeasures), and legal & human resources training (i.e. Insider Trading, Ethics & International Business). Additionally, Employees are required to (re-)complete Security and Awareness Training/Internal Company Training on an annual basis. ACME Corporation provides instructor-led classes, in-person, online self-paced, and external training options. All ACME Corporation staff undergo security awareness training (SAT) upon new hire and on an annual basis. The information security policy is also communicated to employees on an annual basis. The SAT training covers various topics from phishing, password management, data privacy and various other security topics. Please refer to the Training Policy here: here:https://community.ACME.com/community?id=community_article&sys_id=051daea5dbd0dbc01dcaf3231f9619fb Please refer the Training SOP here: https://community.ACME.com/community?id=community_article&sys_id=aa3deae5dbd0dbc01dcaf3231f961931

Governance and Risk Management Management Program

GRM-04

An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business: • Risk management • Security policy • Organization of information security • Asset management • Human resources security • Physical and environmental security • Communications and operations management • Access control • Information systems acquisition, development, and maintenance

x1.2.

(x1.2.) The entity’s system [availability, processing integrity, confidentiality and related] security policies include, but may not be limited to, the following matters:

A.1, B.1

2 (B) 3 (B) 5 (B)

Schedule 1 (Section 5), 4.1 - Accountability; 4.7 Safeguards

IS-01

R2 DS5.2 R2 DS5.5

APO13.01 APO13.02 APO13.03

312.8 and 312.10

SRM > InfoSec Management > Capabilitiy Mapping

shared

Domain 2

Article 17

99.31.(a)(1)(ii)

8.2.1

45 CFR 164.308(a)(1)(i) 45 CFR 164.308(a)(1)(ii)(B) 45 CFR 164.316(b)(1)(i) 45 CFR 164.308(a)(3)(i) (New) 45 CFR 164.306(a) (New)

Clause 4.2 Clause 5 A.6.1.1 A.6.1.2 A.6.1.3 A.6.1.4 A.6.1.5 A.6.1.6 A.6.1.7 A.6.1.8

All in sections 4, 5, 6, 7, 8, 9, 10. A.6.1.1 A.13.2.4 A.6.1.3 A.6.1.4 A.18.2.1

Commandment #1 Commandment #2

Chapter II, Article 19

CIP-001-1a - R1 - R2 CIP-003-3 - R1 - R1.1 - R4 CIP-006-3c R1

PM-1 PM-2 PM-3 PM-4 PM-5 PM-6 PM-7 PM-8 PM-9 PM-10 PM-11

AR-1 Governance and Privacy Program

4.1

PA8

BSGP

12.1 12.2

Compliant

ACME Corporation has formal documented information security policies. The information security policy and standards (ISP/ISS) address purpose, scope, responsibilities, management commitment, coordination among organizational entities, compliance, and relevant security controls. The ISP/ISS are communicated to all employees on an annual basis. The Information Security Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 The Information Security Standards can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5 ACME Corporation's information security program is based on NIST 800-53 and ISO 27001. ACME Corporation has chosen the ISO 27001 certification to provide internal and external stakeholders with a high level of assurance that our information security policy and processes are robust and a strong control environment exists around our software-as-a-service (SaaS) instance. ACME Corporation is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE16 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME Corporation undergoes multiple internal audits and customer audits each year. ACME Corporation's third party attestations are available on the ACME Corporation CORE: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924

Governance and Risk Management Management Support/Involvement

GRM-05

Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

S1.3.0

(S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned. The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC1.2

C.1

5 (B)

Schedule 1 (Section 5), 4.1 Safeguards, Subsec. 4.1.1

IS-02

DS5.1

APO01.02 APO01.03 APO01.04 APO01.08 APO13.01 APO13.02 APO13.03

312.8 and 312.10

SRM > Governance Risk & Compliance > Compliance Management

shared

Domain 2

Article 17

NIST SP 800-53 R3 CM-1

8.2.1

45 CFR 164.316 (b)(2)(ii) 45 CFR 164.316 (b)(2)(iii)

Clause 5 A.6.1.1

All in section 5 plus clauses 4.4 4.2(b) 6.1.2(a)(1) 6.2 6.2(a) 6.2(d) 7.1 7.4 9.3 10.2 7.2(a) 7.2(b) 7.2(c) 7.2(d) 7.3(b) 7.3(c)

Commandment #3 Commandment #6

Chapter VI, Section I, Article 39

CIP-003-3 - R1 - R1.1

CM-1 PM-1 PM-11

4.1

12.5

12.4

Compliant

The security responsibilities at ACME Corporation are carried out by various teams within the company as information systems rely on many parts of the organization. Below shows the various groups and functions within the organization and their roles and responsibilities as they relate to its Information Security Program. Security Management Council (COO, Development, Global Support and Cloud Operations and Vice President [VP], Chief Information Security Officer [CISO]) - Authorize and approve ISMS program, Oversee security program (including ISMS), Review security policies and standards, Review certification schedule and result, Review internal audit schedule and results, Review progress on remediation of security incidents and findings, Communicate ISMS and Information Security Policy and Standards. Security Engineering - Provide an information security baseline and architecture service, Manage and operate security system, Advise on system development and technology initiatives to ensure security is adequately considered, Monitor, manage and report on significant Information Security issues (e.g. violations, exposures, trends), Monitor compliance with information security policies through technical tools, Coordinate and promote of security, Establish security awareness programs for employees, contractors and third parties to improve the security culture. Governance, Risk and Compliance (GRC) - Define policies, and requirements for standards, processes, procedures, baselines, guidelines and risk assessments, Monitor compliance with Information Security policies through internal and external audit, Ensure compliance with government, regulatory and contractual information system security related requirements, Coordinate customer audits, audit response, and audit mitigation, Perform internal and external audits and report results to Security Management Council, Perform risk assessments in support of identifying and managing risks related to the operation of the ISMS. Field Security - Perform datacenter security reviews, Customer pre-sales security questionnaires and contracts security reviews. Product and Application Security - Manage end-to-end customer application penetration test process, Manage 3rd party application penetration testing for major product releases, Perform security assessments on internal applications, Provide input to software development lifecycle (SDLC) via Development team, Administer secure code training program, Provide Sales with customer facing support for application security related escalations, Implement, operate, and administer information security, Adhere to the information security policy and standards as it relates to secure product development, release management, and change management.

Governance and Risk Management Policy

GRM-06

Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.

S1.1.0 S1.3.0 S2.3.0

(S1.1.0) The entity's security policies are established and periodically reviewed and approved by a designated individual or group. (S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned. (S2.3.0) Responsibility and accountability for the entity's system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 CC1.2 CC2.3

B.1

Schedule 1 (Section 5) 4.1 Accountability, Subsec 4.1.4

IS-03

DS5.2

APO01.03 APO01.04 APO13.01 APO13.02

312.8 and 312.10

SRM > Policies and Standards > Information Security Policies

shared

Domain 2

6.02. (e)

Article 17

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1

8.1.0 8.1.1

45 CFR 164.316 (a) 45 CFR 164.316 (b)(1)(i) 45 CFR 164.316 (b)(2)(ii) 45 CFR 164.308(a)(2)

Clause 4.2.1 Clause 5 A.5.1.1 A.8.2.2

Clause 4.3 Clause 5 4.4 4.2(b) 6.1.2(a)(1) 6.2 6.2(a) 6.2(d) 7.1 7.4 9.3 10.2 7.2(a) 7.2(b) 7.2(c) 7.2(d) 7.3(b) 7.3(c) A5.1.1 A.7.2.2

Commandment #1 Commandment #2 Commandment #3

Chapter VI, Section I, Article 39

CIP-003-3 - R1 -R1.1 - R1.2 - R2 - R2.1 - R2.2 - R2.3

AC-1 AT-1 AU-1 CA-1 CM-1 IA-1 IR-1 MA-1 MP-1 MP-1 PE-1 PL-1 PS-1 SA-1 SC-1 SI-1

4.2 4.3 4.4 4.5

PA30

BSGP

12.1 12.2

7.3, 8.8, 9.10, 12.1 12.2

Compliant

See GRM-04 and GRM-05.

Governance and Risk Management Policy Enforcement

GRM-07

A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

S3.9 S2.4.0

(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis. (S2.4.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC6.2 CC2.5

B.1.5

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4

IS-06

PO 7.7

APO01.03 APO01.08 APO07.04

312.8 and 312.10

SRM > Governance Risk & Compliance >

shared

Domain 2

Article 17

NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-8

99.31(a)(i)(ii)

10.2.4

45 CFR 164.308 (a)(1)(ii)(C)

A.8.2.3

A7.2.3

Commandment #6 Commandment #7

Chapter X, Article 64

PL-4 PS-1 PS-8

Compliant

If ACME Corporation determines that an employee is responsible for a violation of conduct and ethical standards, he or she will be subject to disciplinary action, up to and including, termination of employment and, in appropriate cases, civil action or referral for criminal prosecution. Appropriate action may also be taken to deter any future violation. The Acceptable Use Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967

Governance and Risk Management Policy Impact on Risk Assessments

GRM-08

Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.

B.2 G.21 L.2

B.1.1, B.1.2, B.1.6, B.1.7.2, G.2, L.9, L.10

Schedule 1 (Section 5), 4.7 - Safeguards

RI-04

PO 9.6

APO12 APO13.01 APO13.03

312.8 and 312.10

BOSS > Operational Risk Management > Risk Management Framework

shared

Domian 2, 4

6.03. (a)

Article 17 (1), (2)

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1

Clause 4.2.3 Clause 4.2.4 Clause 4.3.1 Clause 5 Clause 7 A.5.1.2 A.10.1.2 A.10.2.3 A.14.1.2 A.15.2.1 A.15.2.2

Clause 4.2.1 a, 4.2(b) 4.3 c, 4.3(a&b) 4.4 5.1(c) 5.1(d) 5.1(e) 5.1(f) 5.1(g) 5.1(h) 5.2 5.2 e, 5.2(f) 5.3 6.1.1(e)(2), 6.1.2(a)(1) 6.2 6.2(a) 6.2(d) 6.2 e, 6.12 (a) (2), 7.1 7.2(a), 7.2(b) 7.2(c) 7.2(d) 7.3(b), 7.3(c) 7.4 7.5.1 (a) 8.1*, partial 8.2 9.1 9.1 e, 9.2, 9.3 9.3(a) 9.3(b&f) 9.3(c), 9.3(c)(1) 9.3(c)(2), 9.3(c)(3) 9.3(d) 9.3(e) 10.1(c) 10.2, A.5.1.2 A.12.1.2 A.15.2.2 A.17.1.1 A.18.2.2 A.18.2.3

CIP-009-3 - R2

CP-2 RA-2 RA-3

AR-2 Privacy Impact and Risk Assessment

4.3

12.1.3

12.2

Compliant

ACME Corporation has a formal Information Security Risk Assessment program to ensure risks are documented in Risk Register and evaluated against impact to business and event likelihood; owners to risks are assigned to provide remediation plans and follow through with risk mitigations. The risk program is run annually. The Information Security Risk Assessment SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=9b8c6ae1dbd0dbc01dcaf3231f961933

Governance and Risk Management Policy Reviews

GRM-09

The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

S1.1.0

(S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.

CC3.2

B.2

B.1.33. B.1.34,

IS-05

DS 5.2 DS 5.4

APO12 APO13.01 APO13.03 MEA03.01 MEA03.02

312.8 and 312.10

SRM > Governance Risk & Compliance > Policy Management

shared

Domain 2

Article 17

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1

1.2.1 8.2.7 10.2.3

45 CFR 164.316 (b)(2)(iii) 45 CFE 164.306€

Clause 4.2.3 f) A.5.1.2

Clause 8.1 A.5.1.2

Commandment #1 Commandment #2 Commandment #3

CIP-003-3 - R3.2 - R3.3 - R1.3 R3 - R3.1 - R3.2 - R3.3

AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IA-5 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 RA-1 SA-1 SC-1 SI-1

4.1 6.1

12.1.3

12.1.1

Compliant

ACME Corporation has formal documented information security policies. The information security policy and standards (ISP/ISS) address information classification and data handling requirments. Proceudres are reviewed on a minimum biennial basis as per ACME Corporation's formal managed document program. The Information Security Policy can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 The Information Security Standards can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5

Governance and Risk Management Risk Assessments

GRM-10

Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

S3.1 x3.1.0 S4.3.0

(S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats. (S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality of data, processing integrity, and system security is assessed on a timely basis; policies are updated for that assessment.

CC3.1 CC3.3

I.1 I.4

C.2.1, I.4.1, I.5, G.15.1.3, I.3

46 (B) 74 (B)

Schedule 1 (Section 5), 4.7 - Safeguards

RI-02

PO 9.4

APO12

312.8 and 312.10

BOSS > Operational Risk Management > Risk Management Framework

shared

Domain 2, 4

6.03. (a) 6.08. (a)

Article 17 (1), (2)

NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3

NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SC-30

1.2.4 1.2.5

45 CFR 164.308 (a)(1)(ii)(A)

Clause 4.2.1 c) through g) Clause 4.2.3 d) Clause 5.1 f) Clause 7.2 & 7.3 A.6.2.1 A.12.5.2 A.12.6.1 A.14.1.2 A.15.1.1 A.15.2.1 A.15.2.2

Clause 4.2(b), 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.17.1.1 A.18.1.1 A.18.2.2 A.18.2.3

CIP-002-3 - R1.1 - R1.2 CIP-005-3a - R1 - R1.2 CIP-009-3 - R.1.1

PL-5 RA-2 RA-3

1.1 3.3 5.1 5.2 5.3 5.4 7.1 12.2 17.7 18.1 18.3

PA2 PA15

BSGP SGP

12.1.2

12.2

Compliant

See GRM-08.

Governance and Risk Management Risk Management Framework

GRM-11

Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and stakeholder approval.

S3.1 x3.1.0

CC3.1

L.2

A.1, L.1

Schedule 1 (Section 5), 4.7 - Safeguards

RI-01

PO 9.1

EDM03.02 APO01.03 APO12

312.8 and 312.10

BOSS > Operational Risk Management > Risk Management Framework

shared

Domain 2, 4

Article 17 (1), (2)

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-6 NIST SP 800-53 R3 CA-7 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-3 NIST SP 800-53 R3 SA-9 (1) NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 CM-1

1.2.4

45 CFR 164.308 (a)(8) 45 CFR 164.308(a)(1)(ii)(B)

Clause 4.2.1 c) through g) Clause 4.2.2 b) Clause 5.1 f) Clause 7.2 & 7.3 A.6.2.1 A.12.6.1 A.14.1.2 A.15.2.1 A.15.2.2

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.12.6.1 A.17.1.1 A.18.2.2 A.18.2.3

Chapter II Article 19

CIP-009-3 - R4

AC-4 CA-2 CA-6 PM-9 RA-1

AR-2 Privacy Impact and Risk Assessment

3.2 (responsibility) 3.3 3.4 4.1 4.3 5.2 (residual Risk)

12.1.2

12.2

Compliant

See GRM-08.

Human Resources Asset Returns

HRS-01

Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

D.1

E.6.4

Schedule 1 (Section 5) 4.5 Limiting Use, Disclosure and Retention; 4.7 Safeguards, Subs. 4.7.5

IS-27

APO01.08 APO07.06 APO13.01 BAI09.03

312.3, 312.8 and 312.10

BOSS > Human Resources Security > Employee Termination

provider

Domain 2

Article 17

NIST SP 800-53 R3 PS-4

5.2.3 7.2.2 8.2.1 8.2.6

45 CFR 164.308 (a)(3)(ii)(C)

A.7.1.1 A.7.1.2 A.8.3.2

A.8.1.1 A.8.1.2 A.8.1.4

PS-4

2.2

9.3

Compliant

ACME Corporation has formal HR and IT Off-boarding SOPs which govern granting, termination and transfer of access. All de-provisioning of employees is initiated via HR. HR sends notification to IT Support who executes the Off-boarding process for users accounts and resources, contacting other departments as necessary. When an employee is terminated, the IT department or the system owner is notified by HR. User access to company servers, and systems and accounts are disabled. This includes the user's access badge that controls access to the building and physical areas. The HR Offboarding SOP and IT Support Offboarding SOP can be viewed on the ACME Corporation CORE here: HR Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=4dcc2265dbd0dbc01dcaf3231f961909 IT Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=6c4c6e61dbd0dbc01dcaf3231f961948 Management of access to the customer's instance is the responsibility of the customer administration team. Access that is no longer needed is removed within 24 hours. Access removal is documented in ACME Corporation's internal ACME Corporation instance.

Human Resources Background Screening

HRS-02

Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

S3.11.0

(S3.11.0) Procedures exist to help ensure that personnel responsible for the design, development, implementation, and operation of systems affecting confidentiality and security have the qualifications and resources to fulfill their responsibilities.

CC1.3 CC1.4

E.2

63 (B)

Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3

HR-01

PO 7.6

APO07.01 APO07.05 APO07.06

312.8 and 312.10

BOSS > Human Resources Security > Background Screening

shared

None

6.01. (a)

Article 17

NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3

1.2.9

A.8.1.2

A.7.1.1

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #2 Commandment #3 Commandment #6 Commandment #9

CIP-004-3 - R2.2

PS-2 PS-3

9.29

PA27

BSGP

12.7 12.8.3

Compliant

ACME Corporation performs background screening on all employees and internal contractors prior to employment. The elements of the background screening vary according to local law, but generally include employment checks, criminal/court checks, and global sanctions and enforcement checks. ACME Corporation has the right to re-screen backgrounds for cause. If adverse information is found during the course of the re-screening, continued employment will be at the discretion of the Director of Staffing based on what is permissible by law. The following background screening SOPs can be viewed on the ACME Corporation CORE: - Background Screening US SOP: https://community.ACME.com/community?id=community_article&sys_id=e12d66e5dbd0dbc01dcaf3231f96193b - Background Screening Canada SOP: https://community.ACME.com/community?id=community_article&sys_id=375d2a29dbd0dbc01dcaf3231f96197d - Background Screening EMEA and APAC SOP: https://community.ACME.com/community?id=community_article&sys_id=686caaa1dbd0dbc01dcaf3231f9619d2 - Background Screening LATAM SOP: https://community.ACME.com/community?id=community_article&sys_id=63bc6e25dbd0dbc01dcaf3231f9619d0

Human Resources Employment Agreements

HRS-03

Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

S2.2.0

(S2.2.0) The security obligations of users and the entity's security commitments to users are communicated to authorized users

CC2.2 CC2.3

C.1

E.3.5

66 (B)

Schedule 1 (Section 5) 4.7 Safeguards, Subsec. 4.7.4

HR-02

DS 2.1

APO01.03 APO13.01 APO07.06 APO09.03 APO10.01

312.3, 312.8 and 312.10

BOSS > Human Resources Security > Employee Code of Conduct

shared

None

Article 17

NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7

1.2.9 8.2.6

45 CFR 164.310(a)(1) 45 CFR 164.308(a)(4)(i)

A.6.1.5 A.8.1.3

A.13.2.4 A.7.1.2

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #6 Commandment #7

PL-4 PS-6 PS-7

9.2

PA27

BSGP

12.4 12.8.2

Compliant

ACME Corporation requires all new hires sign non-disclosure agreements as well as review and acknowledge the Code of Conduct and Acceptable Use Policy at time of hire. ACME Corporation provides all employees (new and existing) with security awareness training using web-based tools on an annual basis. ACME Corporation also distributes the Acceptable Use Policy and Information Security Policy and Standards to its employees annually. The Acceptable Use Policy can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967 The Code of Conduct and Ethics Policy can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=119c2ee1dbd0dbc01dcaf3231f961970 The Information Security Policy can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 The Information Security Standards can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5

Human Resources Employment Termination

HRS-04

Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

S3.2.d S3.8.e

(S3.2.d) Procedures exist to restrict logical access to the system and information resources maintained in the system including, but not limited to, the following matters: d. The process to make changes and updates to user profiles (S3.8.e) e. Procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own

CC5.4

E.6

HR-03

PO 7.8

APO01.02 APO07.05 APO07.06

312.8 and 312.10

BOSS > Human Resources Security > Roles and Responsibilities

shared

None

Article 17

NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-5 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-8

8.2.2 10.2.5

45 CFR 164.308 (a)(3)(ii)(C)

A.8.3.1

A.7.3.1

Commandment #6 Commandment #7

PS-4 PS-5

PA27

BSGP

Compliant

See HRS-01.

Human Resources Mobile Device Management

HRS-05

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

G.11, G12, G.20.13, G.20.14

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-32

DS5.11 DS5.5

APO01.08 APO13.01 APO13.02 DSS05.01 DSS05.02 DSS05.03 DSS05.07 DSS06.03 DSS06.06

312.8 and 312.10

Presentation Servies > Presentation Platform > Endpoints - Mobile Devices - Mobile Device Management

shared

Domain 2

Article 17

NIST SP 800-53 R3 AC-17 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-19 NIST SP 800-53 R3 MP-2 NIST SP 800-53 R3 MP-6

NIST SP 800-53 R3 AC-17 NIST SP 800-53 R3 AC-17 (1) NIST SP 800-53 R3 AC-17 (2) NIST SP 800-53 R3 AC-17 (3) NIST SP 800-53 R3 AC-17 (4) NIST SP 800-53 R3 AC-17 (5) NIST SP 800-53 R3 AC-17 (7) NIST SP 800-53 R3 AC-17 (8) NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-18 (1) NIST SP 800-53 R3 AC-18 (2) NIST SP 800-53 R3 AC-19 NIST SP 800-53 R3 AC-19 (1) NIST SP 800-53 R3 AC-19 (2) NIST SP 800-53 R3 AC-19 (3) NIST SP 800-53 R3 MP-2 NIST SP 800-53 R3 MP-2 (1) NIST SP 800-53 R3 MP-4 NIST SP 800-53 R3 MP-4 (1) NIST SP 800-53 R3 MP-6 NIST SP 800-53 R3 MP-6 (4)

1.2.6 3.2.4 8.2.6

45 CFR 164.310 (d)(1)

A.7.2.1 A.10.7.1 A.10.7.2 A.10.8.3 A.11.7.1 A.11.7.2 A.15.1.4

A.8.2.1 A.8.3.1 A.8.3.2 A.8.3.3 A.6.2.1 A.6.2.2 A.18.1.4

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

All

CIP-007-3 - R7.1

AC-17 AC-18 AC-19 MP-2 MP-4 MP-6

19.1 19.2 19.3

PA33 PA34

SGP SGP

9.7 9.7.2 9.8 9.9 11.1 12.3

11.1 12.3

Compliant

ACME Corporation support employees are not able to access support infrastructure via mobile devices. ACME Corporation requires all remote production access connect through Cisco Client-to-site VPN with RSA two- factor authentication and is only accessible to authorized personnel with appropriate credentials. VPN can only be installed on company-issued laptops. The Mobile and BYO Device Access SOP can be viewed on the ACME Corporation CORE: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Human Resources Non-Disclosure Agreements

HRS-06

Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

S4.1.0

(S4.1.0) The entity’s system availability, confidentiality, processing integrity and security performance is periodically reviewed and compared with the defined system availability and related security policies.

CC4.1

C.2.5

Schedule 1 (Section 5), 4.7 - Safeguards

LG-01

APO01.02 APO01.03 APO01.08 APO07.06 APO09.03 APO10.04 APO13.01 APO13.03

312.8 and 312.10

BOSS > Compliance > Intellectual Property Protection

shared

Domain 3

Article 16

NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-9

NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SA-9 (1)

1.2.5

ISO/IEC 27001:2005 Annex A.6.1.5

A.13.2.4

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #6 Commandment #7 Commandment #8 Commandment #9

PL-4 PS-6 SA-9

DI-2 DATA INTEGRITY AND DATA INTEGRITY BOARD a. Documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls; and b. Establishes a Data Integrity Board when appropriate to oversee organizational Computer Matching Agreements123 and to ensure that those agreements comply with the computer matching provisions of the Privacy Act. IP-1 CONSENT a. Provides means, where feasible and appropriate, for individuals to authorize the collection, use, maintaining, and sharing of personally identifiable information (PII) prior to its collection; b. Provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection, use, dissemination, and retention of PII; c. Obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII; and d. Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII.

PA7

BSGP

12.8.2 12.8.3 12.8.4

Compliant

ACME Corporation has a formally documented Acceptable Use Policy (AUP). All employees and contractors who are given access to sensitive information must sign a non-disclosure agreement and acceptable use policy prior to being given access to information processing facilities. The Acceptable Use Policy can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967

Human Resources Roles / Responsibilities

HRS-07

Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.

S1.2.f

(S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security.

B.1

B.1.5, D.1.1,D.1.3.3, E.1, F.1.1, H.1.1, K.1.2

5 (B)

Schedule 1 (Section 5) 4.1 Accountability

IS-13

DS5.1

APO01.02 APO01.03 APO01.08 APO07.06 APO09.03 APO10.04 APO13.01 APO13.03

312.3, 312.8 and 312.10

BOSS > Human Resources Security > Roles and Responsibilities

shared

Domain 2

Article 17

NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii)

1.2.9 8.2.1

Clause 5.1 c) A.6.1.2 A.6.1.3 A.8.1.1

Clause 5.3 A.6.1.1 A.6.1.1

Commandment #6 Commandment #7 Commandment #8

AT-3 PL-4 PM-10 PS-1 PS-6 PS-7

AR-1 GOVERNANCE AND PRIVACY PROGRAM Control: The organization: Supplemental Guidance: The development and implementation of a comprehensive governance and privacy program demonstrates organizational accountability for and commitment to the protection of individual privacy. Accountability begins with the appointment of an SAOP/CPO with the authority, mission, resources, and responsibility to develop and implement a multifaceted privacy program. The SAOP/CPO, in consultation with legal counsel, information security officials, and others as appropriate: (i) ensures the development, implementation, and enforcement of privacy policies and procedures; (ii) defines roles and responsibilities for protecting PII; (iii) determines the level of information sensitivity with regard to PII holdings; (iv) identifies the laws, regulations, and internal policies that apply to the PII; (v) monitors privacy best practices; and (vi) monitors/audits compliance with identified privacy controls. AR-3 PRIVACY REQUIREMENTS FOR CONTRACTORS AND SERVICE PROVIDERS Control: The organization: a. Establishes privacy roles, responsibilities, and access requirements for contractors and service providers; and b. Includes privacy requirements in contracts and other acquisition-related documents.

2.2

PA9 PA24

BSGP

12.8.5

Compliant

See HRS-06.

Human Resources Technology Acceptable Use

HRS-08

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

S1.2 S3.9

(S1.2) The entity’s security policies include, but may not be limited to, the following matters: (S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC3.2 CC6.2

B.3

B.1.7, D.1.3.3, E.3.2, E.3.5.1, E.3.5.2

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4

IS-26

DS 5.3

APO01.03 APO01.08 APO13.01 APO13.02 DSS05.04 DSS06.06

312.4, 312.8 and 312.10

SRM > Policies and Standards > Information Security Policies

shared

Domain 2

Article 5, Article 6 Article 7

NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-8 NIST SP 800-53 R3 AC-20 NIST SP 800-53 R3 PL-4

NIST SP 800-53 R3 AC-8 NIST SP 800-53 R3 AC-20 NIST SP 800-53 R3 AC-20 (1) NIST SP 800-53 R3 AC-20 (2) NIST SP 800-53 R3 PL-4

8.1.0

45 CFR 164.310 (b)

A.7.1.3

A.8.1.3

Commandment #1 Commandment #2 Commandment #3

AC-8 AC-20 PL-4

2.2 5.2 4.2

12.3.5

12.3

Compliant

ACME Corporation provides at no additional cost a plugin called the 'SNC Access Control Plugin'. Customers may use this plugin to restrict instance level access to named ACME Corporation support personal and can specify who from ACME Corporation can access their instance(s) and when. This can also be configured to prevent any ACME Corporation support access to the instance unless this is explicitly updated to allow access. Note, implementing this plug-in will effect support SLAs and response times. ACME Corporation support employees are not able to access support infrastructure via mobile devices. ACME Corporation requires all remote production access connect through Cisco Client-to-site VPN with RSA two- factor authentication and is only accessible to authorized personnel with appropriate credentials. VPN can only be installed on company-issued laptops. The Mobile and BYO Device Access SOP can be viewed on the ACME Corporation CORE: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Human Resources Training / Awareness

HRS-09

A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

S1.2.k S2.2.0

(S1.2.k) The entity's security policies include, but may not be limited to, the following matters: k. Providing for training and other resources to support its system security policies (S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC2.2 CC2.3

E.1

E.4

65 (B)

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4

IS-11

PO 7.4

APO01.03 APO01.08 APO07.03 APO07.06 APO13.01 APO13.03

312.8 and 312.10

SRM > GRC >

shared

Domain 2

6.01. (c) 6.02. (e)

NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4

99.31(a)(1)(ii)

1.2.10 8.2.1

45 CFR 164.308 (a)(5)(i) 45 CFR 164.308 (a)(5)(ii)(A)

Clause 5.2.2 A.8.2.2

Clause 7.2(a), 7.2(b) A.7.2.2

Commandment #3 Commandment #6

Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41

CIP-004-3 - R1 - R2 - R2.1

AT-1 AT-2 AT-3 AT-4

AR-5 PRIVACY AWARENESS AND TRAINING Control: The organization: a. Develops, implements, and updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures; b. Administers basic privacy training [Assignment: organization-defined frequency, at least annually] and targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII [Assignment: organization-defined frequency, at least annually]; and c. Ensures that personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements [Assignment: organization-defined frequency, at least annually].

9.1

PA28

BSGP

12.6 12.6.1 12.6.2

12.6

Compliant

All ACME Corporation staff undergo security awareness training (SAT) upon new hire and on an annual basis. The information security policy is also communicated to employees on an annual basis. The SAT training covers various topics from phishing, password management, data privacy and various other security topics. The Training SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=051daea5dbd0dbc01dcaf3231f9619fb

Human Resources User Responsibility

HRS-10

All personnel shall be made aware of their roles and responsibilities for: • Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. • Maintaining a safe and secure working environment

S2.3.0

(S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality, processing integrity and security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2

E.1

E.4

65 (B) 66 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.4

IS-16

PO 4.6

APO01.02 APO01.03 APO01.08 APO07.03 APO07.06 APO13.01 APO13.03

312.8 and 312.10

BOSS > Human Resources Security > Employee Awareness

shared

Domain 2

Article 17

NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3 NIST SP 800-53 R3 AT-4 NIST SP 800-53 R3 PL-4

1.2.10 8.2.1

45 CFR 164.308 (a)(5)(ii)(D)

Clause 5.2.2 A.8.2.2 A.11.3.1 A.11.3.2

Clause 7.2(a), 7.2(b) A.7.2.2 A.9.3.1 A.11.2.8

Commandment #5 Commandment #6 Commandment #7

Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41

AT-2 AT-3 AT-4 PL-4

UL-1 INTERNAL USE Control: The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.

9.1

8.5.7 12.6.1

12.4

Compliant

See HRS-06 and HRS-09.

Human Resources Workspace

HRS-11

Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.

S3.3.0 S3.4.0

(S3.3.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.4.0) Procedures exist to protect against unauthorized access to system resources.

CC5.5 CC5.6

E.1

E.4

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-17

APO01.02 APO01.03 APO01.08 APO07.03 APO07.06 APO13.01 APO13.03 DSS05.03 DSS06.06

312.8 and 312.10

BOSS > Data Governance > Clear Desk Policy

shared

Domain 2

NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-2

NIST SP 800-53 R3 AC-11 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-2 NIST SP 800-53 R3 MP-2 (1) NIST SP 800-53 R3 MP-3 NIST SP 800-53 R3 MP-4 NIST SP 800-53 R3 MP-4 (1)

8.2.3

Clause 5.2.2 A.8.2.2 A.9.1.5 A.11.3.1 A.11.3.2 A.11.3.3

Clause 7.2(a), 7.2(b) A.7.2.2 A.11.1.5 A.9.3.1 A.11.2.8 A.11.2.9

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #5 Commandment #6 Commandment #7 Commandment #11

AC-11 MP-2 MP-3 MP-4

8.1

8.1.8

Compliant

Principal of clear desk and clear screen has been entirely defined and implemented within the company. It is defined in the Information Security Policy, which can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0

Identity & Access Management Audit Tools Access

IAM-01

Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

S3.2.g

(S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-29

DS 5.7

APO01.03 APO01.08 APO13.01 APO13.02 DSS05.03 DSS05.05

312.8 and 312.10

SRM > Privilege Management Infrastructure > Privilege Usage Management

shared

Domain 2

6.03. (i) 6.03. (j)

NIST SP 800-53 R3 AU-9

NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-9 (2)

8.2.1

A.15.3.2

Commandment #2 Commandment #5 Commandment #11

CIP-003-3 - R5.2

AU-9 AU-11 AU-14

15.4

10.5.5

10.5 7.1.2 7.1.4 7.2 8.1 8.1.5 8.5

Compliant

Internally, ACME Corporation utilizes Splunk to centralize audit logs and to support the audit review process. Access to these logs is restricted to security personnel with a need to know. **Regarding support: Management of access to the customer's instance is the responsibility of the customer administration team. ACME Corporation does not access any data stored by customers beyond what is required to provide support to its customer, except with customer's permission. Additionally, ACME Corporation controls remote access to its sensitive resources and the production systems and network. Remote access is controlled through Cisco VPN and SecurID, which prevent users from gaining access to these resources. ACME Corporation utilizes RSA SecurID for multi-factor authentication for network access to privileged (including administrative access) accounts for production. Access is governed by internal policy. ACME Corporation provides at no additional cost a plugin called the 'SNC Access Control Plugin'. Customers may use this plugin to restrict instance level access to named ACME Corporation support personal and can specify who from ACME Corporation can access the instance and when. This can also be configured to prevent any ACME Corporation support access to the instance unless this is explicitly updated to allow access. **With regard to logs: The ACME Corporation application writes detailed log information that is stored in tables within a customer's instance. As this is customer data in a customer's instance, ACME Corporation does not attempt to monitor or view this data unless specifically requested by a customer. As a result the customer is responsible for monitoring the contents of these logs files. The log data is protected in the same manner as all other customer data. Event logs can also be configured to feed into a customer's environment via ACME Corporation's Syslog probe allowing the logs to be stored within the customer's environment in a syslog repository or SIEM and retained according to the customer's requirements. ACME Corporation's application logging includes verbose transaction logs, these logs are retained within the instance for 30 days. Event logs are stored for seven days and audit histories are retained indefinitely in the instance. Transaction logs represent every click, view, and system event that occurs in an instance and as a result, will grow very large, quickly. They provide a level of detail that is frequently used for troubleshooting issues with an instance. They can also provide detailed intelligence on the behaviors within an instance. These logs can be downloaded to customers' environments, if they need to be retained for longer than 30 days. The event logs on the other hand are less granular; they will include the creation of an incident, or deletion of problem, or any one of the 250 standard events. They may also contain customer created events. There are a number of security events as well, including successful login, failed login, security privilege escalation, and viewing of a table. These events can either be monitored manually, generate an Incident based on a parameter or when metric is reached; such as failed logins per minute. The final aspect of logging is the audit history. Audit history may be turned on for any particular table or field. The audit log table then maintains a record of who made changes when to a table or field and what they changed. For audit logs that are generated and monitored by the customer for activities within their instance - It is customer's responsibility to ensure access controls are applied to such logs. Internally, ACME Corporation utilizes Splunk to centralize audit logs and to support the audit review process. As part of the purpose and design for this system, audit reviews occur daily for events that are considered lower risk. High risk issues, such as intrusion detection events trigger real-time alerts which are emailed to the Security Incident Response Team. ACME Corporation has established a Scheduled Security Operations Checklist which includes procedures for performing daily reviews of Linux, Windows, Network Device, IDS, and identified issue logs. Please refer to the following link for details on how to view and download various types of log files: https://docs.ACME Corporation.com/bundle/jakarta-platform-administration/page/administer/system-logs/concept/system-logs.html **Regarding archives: ACME Corporation does not archive or require customers to delete data. It is up to the customer to determine the data retention period for data stored within their instance.

Identity & Access Management Credential Lifecycle / Provision Management

IAM-02

User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: • Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business relationships, or other third-party business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant)) • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multi-factor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions • Adherence to applicable legal, statutory, or regulatory compliance requirements

S3.2.0

B.1

B.1.8, B.1.21, B.1.28, E.6.2, H.1.1, K.1.4.5,

8 (B) 40 (B) 41 (B) 42 (B) 43 (B) 44 (C+)

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4

IS-07

DS 5.4

APO01.02 APO01.03 APO01.08 APO13.01 APO13.02 DSS05.04 DSS05.05 DSS05.06 DSS06.03 DSS06.06

312.8 and 312.10

SRM > Policies and Standards >

shared

Domain 2

6.01. (b) 6.01. (d) 6.02. (e) 6.03. (b) 6.03.04. (b) 6.03.04. (c) 6.03.05. (b) 6.03.05. (d) 6.03.06. (b) 6.04.01. (c) 6.04.01. (f) 6.04.02. (a) 6.04.02. (b) 6.04.02. (c) 6.04.03. (b) 6.04.06. (a) 6.04.08. (a) 6.04.08. (b) 6.04.08. (c) 6.04.08.03. (a) 6.04.08.03. (b)

Article 17

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-7 NIST SP 800-53 R3 AC-14 NIST SP 800-53 R3 IA-1

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-7 NIST SP 800-53 R3 AC-10 NIST SP 800-53 R3 AC-14 NIST SP 800-53 R3 IA-1

8.1.0

45 CFR 164.308 (a)(3)(i) 45 CFR 164.312 (a)(1) 45 CFR 164.312 (a)(2)(ii) 45 CFR 164.308(a)(4)(ii)(B) 45 CFR 164.308(a)(4)(ii)(c )

A.11.1.1 A.11.2.1 A.11.2.4 A.11.4.1 A.11.5.2 A.11.6.1

A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.5 A.9.1.2 A.9.4.1

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #6 Commandment #7 Commandment #8

CIP-007-3 - R5.1 - R5.1.2

AC-1 IA-1

15.1 15.2

3.5.1 8.5.1 12.5.4

3.5.1, 7.0 8.0 12.5.4

Compliant

ACME Corporation has formal HR and IT Off-boarding SOPs which govern granting, termination and transfer of access. The HR Onboarding/Offboarding SOPs and IT Support onboarding/Offboarding SOPs can be viewed on the ACME Corporation CORE here: HR Onbaording: https://community.ACME.com/community?id=community_article&sys_id=3e1d62e5dbd0dbc01dcaf3231f9619a1 HR Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=4dcc2265dbd0dbc01dcaf3231f961909 IT Onboarding: https://community.ACME.com/community?id=community_article&sys_id=6efc66a5dbd0dbc01dcaf3231f961957 IT Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=6c4c6e61dbd0dbc01dcaf3231f961948 Management of access to the customer's instance is the responsibility of the customer administration team. Access that is no longer needed is removed within 24 hours. Access removal is documented in ACME Corporation's internal ACME Corporation instance.

Identity & Access Management Diagnostic / Configuration Ports Access

IAM-03

User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

S3.2.g

(S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1

H1.1, H1.2, G.9.15

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-30

DS5.7

APO13.01 DSS05.02 DSS05.03 DSS05.05 DSS06.06

312.8 and 312.10

SRM > Privilege Management Infrastructure > Privilege Usage Management - Resource Protection

provider

Domain 2

NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-5

NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1) NIST SP 800-53 R3 MA-3 NIST SP 800-53 R3 MA-3 (1) NIST SP 800-53 R3 MA-3 (2) NIST SP 800-53 R3 MA-3 (3) NIST SP 800-53 R3 MA-4 NIST SP 800-53 R3 MA-4 (1) NIST SP 800-53 R3 MA-4 (2) NIST SP 800-53 R3 MA-5

A.10.6.1 A.11.1.1 A.11.4.4 A.11.5.4

A.13.1.1 A.9.1.1 A.9.4.4

Commandment #3 Commandment #4 Commandment #5 Commandment #6 Commandment #7 Commandment #8

CIP-007-3 - R2

CM-7 MA-3 MA-4 MA-5

15.4

9.1.2

1.2.2 7.1 7.1.2 7.1.3 7.2 7.2.3 9.1.2 9.1.3

Compliant

ACME Corporation architected its managed network as such, externally facing firewall controls limit the ports/services allowed into the ACME Corporation network. From the external firewall, network traffic is routed into the managed network that includes an IDS. Traffic then goes back through the firewall and to the load balancers, which move network traffic from port 443 to the port appropriate for the inbound request. Network traffic then passes back through the firewall and into the application server network. All requests to access data are then mediated through the application servers. Requests for data are then passed through a further router with ACLs that only allow MySQL traffic into the database network.

Identity & Access Management Policies and Procedures

IAM-04

Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.

APO01.03 APO01.08 APO13.01 APO13.02 DSS05.02 DSS05.04 DSS06.06

SRM > Policies and Standards > Information Security Policies

Domain 12

Annex A.9.2 A.9.2.1 A.9.2.2 A.9.2.3, A.9.2.4, A.9.2.5, A.9.2.6

7.3 8.8 9.10

Compliant

Access to Customer data is controlled by the Customer. ACME Corporation has a formal Information security policy and standards (ISP/ISS)., which require that strong password requirements are implemented, which include LDAP account password enforcement of, but not limited to, minimum password length, inactive lock out, unsuccessful login lockout, password complexity, and unique user IDs. ACME Corporation implements logical security by managing access to its key systems and authentication systems. The ISPS covers password management and authentication. ACME Corporation uses an identity and access management tool to manage the provisioning of user accounts based on role. The Information Security Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 The Information Security Standards can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5

Identity & Access Management Segregation of Duties

IAM-05

User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

S3.2.a

(S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1

G.2.13. G.3, G.20.1, G.20.2, G.20.5

Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3(b)

IS-15

DS 5.4

APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03

312.8 and 312.10

ITOS > Resource Management > Seggregation of Duties

shared

Domain 2

6.04.01. (d) 6.04.08.02. (a)

Article 17

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-6

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-2 (1) NIST SP 800-53 R3 AC-2 (2) NIST SP 800-53 R3 AC-2 (3) NIST SP 800-53 R3 AC-2 (4) NIST SP 800-53 R3 AC-2 (7) NIST SP 800-53 R3 AC-5 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1) NIST SP 800-53 R3 AC-6 (2) NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-6 (1) NIST SP 800-53 R3 AU-6 (3) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6)

99.31(a)(1)(ii)

8.2.2

45 CFR 164.308 (a)(1)(ii)(D) 45 CFR 164.308 (a)(3)(ii)(A) 45 CFR 164.308(a)(4)(ii)(A) 45 CFR 164.308 (a)(5)(ii)(C) 45 CFR 164.312 (b)

A.10.1.3

A.6.1.2

Commandment #6 Commandment #7 Commandment #8 Commandment #10

CIP-007-3 R5.1.1

AC-1 AC-2 AC-5 AC-6 AU-1 AU-6 SI-1 SI-4

3.0 3.1 3.2 3.3 3.4 3.5

PA24

6.4.2

6.4.2, 7.3 8.8 9.10

Compliant

Roles and responsibilities are formally documented in the Information Security Policy and Information Security Standards documents. Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 Please refer to the Information Security Standards here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5

Identity & Access Management Source Code Access Restriction

IAM-06

Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

S3.13.0

(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4

I.2.7.2, I.2.9, I.2.10, I.2.15

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-33

APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03

ITOS > Service Support > Release Management - Source Code Management

shared

Domain 2

Article 17

NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1) NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1

Clause 4.3.3 A.12.4.3 A.15.1.3

Clause 5.2(c) 5.3(a), 5.3(b), 7.5.3(b) 7.5.3(d) 8.1, 8.3 9.2(g) A.9.4.5 A.18.1.3

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #6 Commandment #7 Commandment #9 Commandment #10

CM-5 CM-6

9.4 14.1 14.2 19.1

6.4.1 6.4.2

6.4.1 6.4.2, 7.1 7.1.1 7.1.2 7.1.3 7.1.4 7.2 7.2.2 7.3

Compliant

See IAM-04.

Identity & Access Management Third Party Access

IAM-07

The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

S3.1 x3.1.0

CC3.1

B.1 H.2

B.1.1, B.1.2, D.1.1, E.1, F.1.1, H.1.1, K.1.1, E.6.2, E.6.3

Schedule 1 (Section 5), 4.7 - Safeguards

RI-05

DS 2.3

APO01.03 APO01.08 APO07.06 APO10.04 APO13.02 DSS05.04 DSS05.07 DSS06.03 DSS06.06

312.8 and 312.10

SRM > Governance Risk & Compliance > Vendor Management

shared

Domain 2, 4

6.02. (a) 6.02. (b) 6.03. (a)

Article 17 (1), (2)

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1 NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CP-1 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 MA-1 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 PE-1 NIST SP 800-53 R3 PL-1 NIST SP 800-53 R3 PS-1 NIST SP 800-53 R3 RA-1 NIST SP 800-53 R3 SA-1 NIST SP 800-53 R3 SC-1 NIST SP 800-53 R3 SI-1

7.1.1 7.1.2 7.2.1 7.2.2 7.2.3 7.2.4

A.6.2.1 A.8.3.3 A.11.1.1 A.11.2.1 A.11.2.4

A.9.2.6 A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.5

CA-3 MA-4 RA-3

"FTC Fair Information Principles Integrity/Security Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm". UL-2 INFORMATION SHARING WITH THIRD PARTIES

2.2 4.3

12.8.1 12.8.2 12.8.3 12.8.4

12.8 12.2

Compliant

Identity & Access Management Trusted Sources

IAM-08

Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

S3.2.0 S4.3.0

(S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters: c. Registration and authorization of new users. d. The process to make changes to user profiles. g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). (S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality, processing integrity and security is assessed on a timely basis; policies are updated for that assessment.

CC3.3

IS-08 IS-12

APO01.03 APO01.08 APO10.04 APO13.02 DSS05.04 DSS06.03 DSS06.06

312.8 and 312.10

Information Services > User Directory Services > Active Directory Services, LDAP Repositories, X.500 Repositories, DBMS Repositories, Meta Directory Services, Virtual Directory Services

shared

Domain 12

Annex A.9.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.5, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.5

3.2 9.2 15.2

7.1 7.1.1 7.1.2 7.1.3 7.1.4 7.2

Compliant

See IAM-04.

Identity & Access Management User Access Authorization

IAM-09

Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.2.0

H.2.4, H.2.5,

35 (B) 40 (B) 41 (B) 42 (B) 44 (C+)

Schedule 1 (Section 5) Safeguards, Subs. 4.7.2 and 4.7.3

IS-08

DS5.4

APO01.03 APO01.08 APO07.06 APO10.04 APO13.02 DSS05.04 DSS06.03 DSS06.06

312.8 and 312.10

SRM > Privilege Management Infrastructure > Identity Management - Identity Provisioning

shared

Domain 2

6.03.04. (b) 6.03.04. (c) 6.03.05. (d) 6.03.06. (a) 6.03.06. (b) 6.04.01. (a) 6.04.01. (b) 6.04.01. (d) 6.04.01. (e) 6.04.01. (g) 6.04.03. (c) 6.04.08.02. (a)

Article 17

NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 MA-5 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-7

NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 AC-3 (3) NIST SP 800-53 R3 AC-5 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1) NIST SP 800-53 R3 AC-6 (2) NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-2 (2) NIST SP 800-53 R3 IA-2 (3) NIST SP 800-53 R3 IA-2 (8) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-4 (4) NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 MA-5 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SI-9

8.2.2

45 CFR 164.308 (a)(3)(i) 45 CFR 164.308 (a)(3)(ii)(A) 45 CFR 164.308 (a)(4)(i) 45 CFR 164.308 (a)(4)(ii)(B) 45 CFR 164.308 (a)(4)(ii)(C) 45 CFR 164.312 (a)(1)

A.11.2.1 A.11.2.2 A.11.4.1 A 11.4.2 A.11.6.1

A.9.2.1, A.9.2.2 A.9.2.3 A.9.1.2 A.9.4.1

Commandment #6 Commandment #7 Commandment #8 Commandment #9 Commandment #10

CIP-003-3 - R5.1.1 - R5.3 CIP-004-3 R2.3 CIP-007-3 R5.1 - R5.1.2

AC-3 AC-5 AC-6 IA-2 IA-4 IA-5 IA-8 MA-5 PS-6 SA-7 SI-9

9.2 15.2

PA24

7.1 7.1.1 7.1.2 7.1.3 7.2.1 7.2.2 8.5.1 12.5.4

7.1 7.1.1 7.1.2 7.1.3 7.1.4 12.5.4

Compliant

ACME Corporation does not access any data stored by customers beyond what is required to provide services to its customer, except with customer's permission. ACME Corporation provides at no additional cost a plugin called the 'SNC Access Control Plugin'. Customers may use this plugin to restrict instance level access to named ACME Corporation support personal and can specify who from ACME Corporation can access the instance and when. This can also be configured to prevent any ACME Corporation support access to the instance unless this is explicitly updated to allow access. ACME Corporation enforces least privileged access concepts when granting user access rights and a small subset of users have the ability to access customer data. ACME Corporation has formal HR and IT On-boarding and Off-boarding SOP's which governs granting, termination and transfer of access. These can be viewed on the ACME Corporation CORE here: All provisioning and de-provisioning of employees is initiated via HR. HR sends notification to IT Support who executes the On-boarding or Off-boarding process for users accounts and resources, contacting other departments as necessary. ACME Corporation employees responsible for the management and support of both customer and internal ACME Corporation instances may require access to the instances. The HOP functionality provides an employee with the ability to access and make changes to data within any instance without having a pre-defined and approved account on that instance. When hopping into a customer instance, the ACME Corporation employee must document the justification for hopping, for example, by including explicit comments in the INT/CHG work notes.

Identity & Access Management User Access Reviews

IAM-10

User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

S3.2.0

(S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters: d. The process to make changes to user profiles. g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2.6, H.2.7, H.2.9,

41 (B)

Schedule 1 (Section 5), 4.7 - Safeguards

IS-10

DS5.3 DS5.4

APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 DSS06.06 MEA01.03

312.8 and 312.10

SRM > Privilege Management Infrastructure > Authorization Services - Entitlement Review

shared

Domain 2

Article 17

NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7

NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-2 (1) NIST SP 800-53 R3 AC-2 (2) NIST SP 800-53 R3 AC-2 (3) NIST SP 800-53 R3 AC-2 (4) NIST SP 800-53 R3 AC-2 (7) NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-6 (1) NIST SP 800-53 R3 AU-6 (3) NIST SP 800-53 R3 PS-6 NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii)

8.2.1 8.2.7

45 CFR 164.308 (a)(3)(ii)(B) 45 CFR 164.308 (a)(4)(ii)(C)

A.11.2.4

A.9.2.5

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #6 Commandment #7 Commandment #8 Commandment #10

CIP-004-3 R2.2.2 CIP-007-3 - R5 - R.1.3

AC-2 AU-6 PM-10 PS-6 PS-7

9.2

8.1.4

Compliant

ACME Corporation performs account and privilege access entitlement review on a quarterly basis. The Entitlement Review SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=ce1d22e5dbd0dbc01dcaf3231f961997 Inappropriate entitlements are documented in a ticket and removed per the ACME Corporation observation process, which is detailed in the Observation SOP on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=d18ca6e1dbd0dbc01dcaf3231f9619ea

Identity & Access Management User Access Revocation

IAM-11

Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.2.0

H.2

E.6.2, E.6.3

Schedule 1 (Section 5), 4.7 - Safeguards

IS-09

DS 5.4

APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 DSS06.06 MEA01.03

312.8 and 312.10

SRM > Privilege Management Infrastructure > Identity Management - Identity Provisioning

shared

Domain 2

6.03.04. (b) 6.03.04. (c) 6.03.05. (d) 6.03.06. (a) 6.04.02. (b)

Article 17

NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-5

NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-2 (1) NIST SP 800-53 R3 AC-2 (2) NIST SP 800-53 R3 AC-2 (3) NIST SP 800-53 R3 AC-2 (4) NIST SP 800-53 R3 AC-2 (7) NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-5 NIST SP 800-53 R3 SC-30

99.31(a)(1)(ii)

8.2.1

45 CFR 164.308(a)(3)(ii)(C)

ISO/IEC 27001:2005 A.8.3.3 A.11.1.1 A.11.2.1 A.11.2.2

Annex A A.9.2.6 A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.3

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #6 Commandment #7 Commandment #8

CIP-004-3 R2.2.3 CIP-007-3 - R5.1.3 -R5.2.1 - R5.2.3

AC-2 PS-4 PS-5

9.2

8.5.4 8.5.5

8.1.3 8.1.4 8.1.5, 12.5.4

Compliant

Identity & Access Management User ID Credentials

IAM-12

Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures: • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets)

S3.2.b

(S3.2.b) b. Identification and authentication of users.

CC5.3

B.1 H.5

E.6.2, E.6.3, H.1.1, H.1.2, H.2, H.3.2, H.4, H.4.1, H.4.5, H.4.8

6 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-02

DS5.3 DS5.4

APO01.03 APO01.08 APO13.02 DSS05.04 DSS06.03 DSS06.06 MEA01.03

312.8 and 312.10

SRM > Policies and Standards > Technical Securitry Standards

shared

Domain 10

6.03.04. (b) 6.03.04. (c) 6.03.05. (d) 6.04.05. (b)

Article 17 (1), (2)

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-6 NIST SP 800-53 R3 IA-8

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-2 NIST SP 800-53 R3 AC-3 NIST SP 800-53 R3 AC-11 NIST SP 800-53 R3 AC-11 (1) NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-2 (3) NIST SP 800-53 R3 AU-2 (4) NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 IA-1 NIST SP 800-53 R3 IA-2 NIST SP 800-53 R3 IA-2 (1) NIST SP 800-53 R3 IA-2 (2) NIST SP 800-53 R3 IA-2 (3) NIST SP 800-53 R3 IA-2 (8) NIST SP 800-53 R3 IA-5 NIST SP 800-53 R3 IA-5 (1) NIST SP 800-53 R3 IA-5 (2) NIST SP 800-53 R3 IA-5 (3) NIST SP 800-53 R3 IA-5 (6) NIST SP 800-53 R3 IA-5 (7) NIST SP 800-53 R3 IA-6 NIST SP 800-53 R3 IA-8 NIST SP 800-53 R3 SC-10

99.3 99.31(a)(1)(ii)

45 CFR 164.308(a)(5)(ii)(c) 45 CFR 164.308 (a)(5)(ii)(D) 45 CFR 164.312 (a)(2)(i) 45 CFR 164.312 (a)(2)(iii) 45 CFR 164.312 (d)

A.8.3.3 A.11.1.1 A.11.2.1 A.11.2.3 A.11.2.4 A.11.5.5

A.9.2.6 A.9.1.1 A.9.2.1, A.9.2.2 A.9.2.4 A.9.2.5 A.9.4.2

Commandment #6 Commandment #7 Commandment #8 Commandment #9

CIP-004-3 R2.2.3 CIP-007-3 - R5.2 - R5.3.1 - R5.3.2 - R5.3.3

AC-1 AC-2 AC-3 AC-11 AU-2 AU-11 IA-1 IA-2 IA-5 IA-6 IA-8 SC-10

15.1 15.2

PA9 PA6 PA24 PA22

BSGP BSGP P GP

8.1 8.2, 8.3 8.4 8.5 10.1, 12.2, 12.3.8

8.0 10.1, 12.3

Compliant

ACME Corporation does not manage customer instance accounts and authentication. This is the responsibility of the customer. Currently, ACME Corporation default deployment model supports only local login to the instance with single-factor authentication; however, customers can choose to customize their authentication mechanism after the initial deployment with SSO integration to support multi-factor authentication for details refer to: https://docs.ACME Corporation.com/bundle/geneva-ACME Corporation-platform/page/integrate/single_sign_on/concept/c_Authentication.html

Identity & Access Management Utility Programs Access

IAM-13

Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

S3.2.g

(S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1

H.2.16

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-34

DS5.7

APO13.01 APO13.02 DSS05.05

312.8 and 312.10

SRM > Privilege Management Infrastructure > Privilege Usage Management - Resource Protection

shared

Domain 2

NIST SP 800-53 R3 CM-7

NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1) NIST SP 800-53 R3 AC-6 (2) NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1)

A.11.4.1 A 11.4.4 A.11.5.4

A.9.1.2 Deleted A.9.4.4

Commandment #1 Commandment #5 Commandment #6 Commandment #7

CIP-007-3 - R2.1 - R2.2 - R2.3

AC-5 AC-6 CM-7 SC-3 SC-19

12.2 14.2

7.1.2

5.0 7.1 7.1.2 7.2

N/A

Virtual infrastructure is not used in the customer environment. Further, utility programs are restricted in use and scope.

Infrastructure & Virtualization Security Audit Logging / Intrusion Detection

IVS-01

Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.

S3.7

(S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2

G.7 G.8 G.9 J.1 L.2

G.14.7, G.14.8, G.14.9, G.14.10,G.14.11, G.14.12, G.15.5, G.15.7, G.15.8, G.16.8, G.16.9, G.16.10, G.15.9, G.17.5, G.17.7, G.17.8, G.17.6, G.17.9, G.18.2, G.18.3, G.18.5, G.18.6, G.19.2.6, G.19.3.1, G.9.6.2, G.9.6.3, G.9.6.4, G.9.19, H.2.16, H.3.3, J.1, J.2, L.5, L.9, L.10

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-14

DS5.5 DS5.6 DS9.2

APO13.01 APO13.02 BAI10.01 BAI10.02 BAI10.03 DSS01.03 DSS02.01 DSS05.07 DSS06.05

312.3, 312.8 and 312.10

BOSS > Security Monitoring Services > SIEM

shared

Domain 10

6.03. (i) 6.03. (j) 6.03.03. (a) 6.03.03. (d) 6.03.04. (e) 6.04.07. (a) 6.07.01. (a) 6.07.01. (c)

Article 17

NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-3 NIST SP 800-53 R3 AU-4 NIST SP 800-53 R3 AU-5 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 AU-12 NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3

NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-2 NIST SP 800-53 R3 AU-2 (3) NIST SP 800-53 R3 AU-2 (4) NIST SP 800-53 R3 AU-3 NIST SP 800-53 R3 AU-3 (1) NIST SP 800-53 R3 AU-4 NIST SP 800-53 R3 AU-5 NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-6 (1) NIST SP 800-53 R3 AU-6 (3) NIST SP 800-53 R3 AU-7 NIST SP 800-53 R3 AU-7 (1) NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 AU-12 NIST SP 800-53 R3 PE-2 NIST SP 800-53 R3 PE-3 NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 SC-18

8.2.1 8.2.2

A.10.10.1 A.10.10.2 A.10.10.3 A.10.10.4 A.10.10.5 A.11.2.2 A.11.5.4 A.11.6.1 A.13.1.1 A.13.2.3 A.15.2.2 A.15.1.3

A.12.4.1 A.12.4.1 A.12.4.2, A.12.4.3 A.12.4.3 A.12.4.1 A.9.2.3 A.9.4.4 A.9.4.1 A.16.1.2 A.16.1.7 A.18.2.3 A.18.1.3

Commandment #6 Commandment #7 Commandment #11

CIP-007-3 - R6.5

AU-1 AU-2 AU-3 AU-4 AU-5 AU-6 AU-7 AU-9 AU-11 AU-12 AU-14 SI-4

17.6

PA11 PA12 PA13 PA24

BSGP SGP SGP P

10.1 10.2 10.3 10.5 10.6 10.7 11.4 12.5.2 12.9.5

10.1 10.2 10.3 10.4 10.5 10.6 10.7, 10.8 11.4, 11.5, 11.6 12.5.2

Compliant

ACME Corporation has a dedicated Security Operations team. ACME Corporation utilizes Splunk to centralize audit logs and to support the audit review process. As part of the purpose and design for this system, audit reviews occur daily for events that are considered lower risk. High-risk issues, such as intrusion detection events trigger real-time alerts that are emailed to the Security Incident Response Team. ACME Corporation has established a Scheduled Security Operations Checklist that includes procedures for performing daily reviews of Linux, Windows, Network Device, file integrity monitoring, privilege account usage, IDS, and identified issue logs. ACME Corporation does not deploy HIDS, but does have dedicated IDS on the network. ACME Corporation leverages an enterprise grade IDS to monitor the datacenter environment at real-time. Sensors in our data centers detect malicious traffic (Denial of Service, vulnerability exploits, internet worms). The IDS solution is centrally managed to ensure consistent policies and signature updates. The Security Operations Checklist can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=ca0deaa5dbd0dbc01dcaf3231f961949 There are only a very limited number of personnel have access to the logs. ACME Corporation uses role-based entitlements and grants entitlements only to roles with explicit need for the level of access. ACME Corporation performs account and privilege access Entitlement review on a quarterly basis. The Entitlement SOP can be viewed on the ACME Corporation CORE here: The Log Management SOP can also be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=e9ec2e65dbd0dbc01dcaf3231f9619ca ACME Corporation has a dedicated team to manage and drive compliance efforts, including commercial and Federal certifications, regulatory compliance, and legal compliance. Governance, Risk and Compliance (GRC) define policies, and requirements for standards, processes, procedures, baselines, guidelines and risk assessments, monitor compliance with Information Security policies through internal and external audit, ensure compliance with government, regulatory and contractual information system security related requirements, coordinate customer audits, audit response, and audit mitigation, perform internal and external audits and report results to Security Management Council, perform risk assessments in support of identifying and managing risks related to the operation of the ISMS.

Infrastructure & Virtualization Security Change Detection

IVS-02

The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).

APO08.04 APO13.01 BAI06.01 BAI06.02 BAI10.03 BAI10.04

SRM > Privilege Management Infrastructure > Privileged Usage Management -> Hypervisor Governance and Compliance

Annex A.12.1.2 A.12.4, A.12.4.1, A.12.4.2, A.12.4.3, A.12.6.1, A.12.6.2, A.16.1.1, A.16.1.2, A.16.1.3, A.16.1.4, A.16.1.5, A.16.1.6, A.16.1.7

PA35

10.5.5, 12.10.5

N/A

This is not applicable as ACME Corporation does not use virtual machines in its customer environment.

Infrastructure & Virtualization Security Clock Synchronization

IVS-03

A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

S3.7

(S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2

G.7 G.8

G.13, G.14.8, G.15.5, G.16.8, G.17.6, G.18.3, G.19.2.6, G.19.3.1

20 (B) 28 (B) 30 (B) 35 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-12

DS5.7

APO01.08 APO13.01 APO13.02 BAI03.05 DSS01.01

312.8 and 312.10

Infra Services > Network Services > Authoritative Time Source

provider

Domain 10

6.03. (k)

NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-8

NIST SP 800-53 R3 AU-1 NIST SP 800-53 R3 AU-8 NIST SP 800-53 R3 AU-8 (1)

A.10.10.1 A.10.10.6

A.12.4.1 A.12.4.4

AU-1 AU-8

10.4

Compliant

ACME Corporation leverages NTP through DHCP for time synchronization. NTP is monitored and enforced through Puppet, which ACME Corporation uses as its standard configuration tool. If the server doesn't have a standard configuration, the tool overwrites the system with the standard configuration.

Infrastructure & Virtualization Security Information System Documentation

IVS-04

The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.

A3.2.0 A4.1.0

A1.1 A1.2 CC4.1

G.5

OP-03

DS 3

APO01.03 APO01.08 BAI04.01 BAI04.04 BAI04.05 BAI10.01 BAI10.02

312.8 and 312.10

ITOS > Service Delivery > Information Technology Resiliency - Capacity Planning

provider

Domain 7, 8

6.03.07. (a) 6.03.07. (b) 6.03.07. (c) 6.03.07. (d)

Article 17 (1)

NIST SP 800-53 R3 SA-4

NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1) NIST SP 800-53 R3 SA-4 (4) NIST SP 800-53 R3 SA-4 (7)

1.2.4

A.10.3.1

A.12.1.3

Commandment #1 Commandment #2 Commandment #3

SA-4

3.3

PA16

SGP

Compliant

ACME Corporation uses third party and homegrown tools to monitor and alert on performance and availability events. ACME Corporation provides extensive system metrics from within their ACME Corporation instance such as memory utilization, CPU load, and transaction throughput. These are available from the System Diagnostics and System Performance dashboards. ACME Corporation does not use virtual infrastructure in its customer environment.

Infrastructure & Virtualization Security Management - Vulnerability Management

IVS-05

Implementers shall ensure that the security vulnerability assessment tools or services accommodate the virtualization technologies used (e.g. virtualization aware).

APO01.08 APO04.02 APO04.03 APO04.04 DSS05.03 DSS06.06

SRM > Threat and Vulnerability Management > Vulnerability Management

provider

Domain 1, 13

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f)

PA36

6.1

N/A

This is not applicable as ACME Corporation does not use virtualization in its customer environment.

Infrastructure & Virtualization Security Network Security

IVS-06

Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and by compensating controls.

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

G.2 G.4 G.15 G.16 G.17 G.18 I.3

G.9.17, G.9.7, G.10, G.9.11, G.14.1, G.15.1, G.9.2, G.9.3, G.9.13

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-08

APO03.01 APO03.02 APO13.01 APO13.02 BAI02.01 BAI03.02 BAI03.03 BAI03.04 BAI03.05 DSS05.02 DSS06.06

312.8 and 312.10

SRM > Infrastructure Protection Services > Network

provider

Domain 10

6.03.03. (a) 6.03.03. (d) 6.03.04. (d) 6.04.07. (a) 6.07.01. (c)

Article 17

NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-20 (1)

NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 CM-7 (1) NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18) NIST SP 800-53 R3 SC-20 (1) NIST SP 800-53 R3 SC-21 NIST SP 800-53 R3 SC-22 NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SC-32

8.2.5

A.10.6.1 A.10.6.2 A.10.9.1 A.10.10.2 A.11.4.1 A.11.4.5 A.11.4.6 A.11.4.7 A.15.1.4

A.13.1.1 A.13.1.2 A.14.1.2 A.12.4.1 A.9.1.2 A.13.1.3 A.18.1.4

Commandment #1 Commandment #2 Commandment #3 Commandment #9 Commandment #10 Commandment #11

CIP-004-3 R2.2.4

SC-7

17.1 17.2

PA3 PA5 PA16 PA19 PA18

BSGP BSGP SGP GP SGP

1.1 1.1.2 1.1.3 1.1.5 1.1.6 1.2 1.2.1 2.2.2 2.2.3

1.1 1.1.2 1.1.3 1.1.5 1.1.6 1.2 1.2.1 1.2.2 1.2.3 1.3 2.2.2 2.2.3 2.2.4 2.5 4.1

Compliant

Infrastructure & Virtualization Security OS Hardening and Base Conrols

IVS-07

Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

APO13.01 APO13.02 BAI02.01 BAI03.02 BAI03.03 BAI03.04 BAI03.05 DSS05.01 DSS05.03 DSS06.06

SRM > Policies and Standards > Operational Security Baselines

shared

Domain 1, 13

Annex A.12.1.4 A.12.2.1 A.12.4.1 A.12.6.1

2.1 2.2 2.5 5.1

Compliant

The ACME Corporation server hardening checklist describes the approved ACME Corporation server configuration. The configuration is based on industry standards, including, but not limited to select content from the following sources for consistency and audit/scoring purposes: • The US National Security Agency (NSA) Guide to Secure Configuration of RHEL Linux 5: • The US Government Configuration Baseline (USGCB) [NIST/DoD/RHEL]: • CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0 • The Center for Internet Security (CIS) MySQL Benchmark Please refer to the System Configuration Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=483c2661dbd0dbc01dcaf3231f9619dd

Infrastructure & Virtualization Security Production / Non-Production Environments

IVS-08

Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

B.1

I.2.7.1, I.2.20, I.2.17, I.2.22.2, I.2.22.4, I.2.22.10-14, H.1.1

22 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-06

DS5.7

APO03.01 APO03.02 APO13.01 APO13.02 DSS05.02 DSS05.05 DSS06.06

312.8 and 312.10

Information Services > Data Governance > Data Segregation

shared

Domain 10

6.03. (d)

NIST SP 800-53 R3 SC-2

1.2.6

A.10.1.4 A.10.3.2 A.11.1.1 A.12.5.1 A.12.5.2 A.12.5.3

A.12.1.4 A.14.2.9 A.9.1.1 8.1,partial, A.14.2.2 8.1,partial, A.14.2.3 8.1,partial, A.14.2.4

Commandment #1 Commandment #10 Commandment #11

SC-2

14.5

PA3

BSGP

6.4.1 6.4.2

Compliant

ACME Corporation is a logically single-tenant environment. Customers share a hardware platform (no hypervisor virtualization), but access entirely separate individual instances of the ACME Corporation platform. Each individual instance connects to a database and database service only accessible by that specific instance. Customers are provided with at least one production and one UAT environment though more are supplied for larger contracts or can be separately acquired. Production and non-production instances have separate databases instances and thus are logically segregated, but may be hosted on the same physical server. ACME Corporation offers its customers the option to purchase dedicated hardware for their instances if physical segregation is required.

Infrastructure & Virtualization Security Segmentation

IVS-09

Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations: • Established policies and procedures • Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance • Compliance with legal, statutory and regulatory compliance obligations

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

G.17

G.9.2, G.9.3, G.9.13

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-09

DS5.10

APO03.01 APO03.02 APO13.01 APO13.02 DSS05.02 DSS05.05 DSS06.06

312.8 and 312.10

SRM > Infrastructure Protection Services > Network - Firewall

provider

Domain 10

6.03.03. (b) 6.03.05. (a) 6.03.05. (b) 6.04.01. (a) 6.04.01. (g) 6.04.03. (c) 6.04.08.02. (a) 6.04.08.02. (b) 6.05. (c)

Article 17

NIST SP 800-53 R3 SC-7

NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18)

45 CFR 164.308 (a)(4)(ii)(A)

A.11.4.5 A.11.6.1 A.11.6.2 A.15.1.4

A.13.1.3 A.9.4.1 A.18.1.4

Commandment #1 Commandment #2 Commandment #3 Commandment #9 Commandment #10 Commandment #11

CIP-004-3 R3

AC-4 SC-2 SC-3 SC-7

17.6 18.1 18.4

PA3 PA5 PA16 PA20

BSGP BSGP SGP GP

1.1 1.2 1.2.1 1.3 1.4

1.1 1.2 1.2.1 1.2.3 1.3 1.4 2.1.1 2.2.3 2.2.4 2.3

Compliant

The ACME Corporation architecture is designed with a boundary between the externally facing customer infrastructure and the internal infrastructure. The external components of the Production network consist of redundant border routers at network entry points, firewalls, load balancers, and intrusion detection devices. ACME Corporation's inbound circuits are restricted using an edge router configuration which restricts access to the inner network. ACLs are applied to each managed interface. Inbound network connections come into ACME Corporation's environment via the redundant external network facing firewall which is configured to deny all - allow by exception ACME Corporation's architecture diagram can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=938c6ae1dbd0dbc01dcaf3231f961937

Infrastructure & Virtualization Security VM Security - vMotion Data Protection

IVS-10

Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.

APO03.01 APO03.02 APO03.04 APO13.01 APO13.02 DSS05.02 DSS05.05 DSS06.06

SRM > Cryptographic Services > Data-in-transit Encryption

provider

Domain 1, 13

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

4.1

N/A

This is not applicable as ACME Corporation does not use hypervisors or virtual servers in the customer environment.

Infrastructure & Virtualization Security VMM Security - Hypervisor Hardening

IVS-11

Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).

APO13.01 APO13.02 DSS05.02 DSS05.04 DSS06.03 DSS06.06

SRM > Privilege Mangement Infrastructure > Privilege Use Management - Hypervisor Governance and Compliance

provider

Domain 1, 13

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

3.5.1, 3.6.6

N/A

This is not applicable as ACME Corporation does not use hypervisors or virtual servers in the customer environment.

Infrastructure & Virtualization Security Wireless Security

IVS-12

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following: • Perimeter firewalls implemented and configured to restrict unauthorized traffic • Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings) • User access to wireless network devices restricted to authorized personnel • The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network

S3.4

(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6

D.1 B.3 F.1 G.4 G.15 G.17 G.18

E.3.1, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 G.9.17, G.9.7, G.10, G.9.11, G.14.1, G.15.1, G.9.2, G.9.3, G.9.13

40 (B) 44 (C+)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

SA-10

DS5.5 DS5.7 DS5.8 DS5.10

APO01.08 APO13.01 APO13.02 DSS02.02 DSS05.02 DSS05.03 DSS05.04 DSS05.05 DSS05.07 DSS06.03 DSS06.06

312.8 and 312.10

SRM > Infrastructure Protection Services > Network - Wireless Protection

provider

Domain 10

Article 17

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 SC-7

NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AC-18 NIST SP 800-53 R3 AC-18 (1) NIST SP 800-53 R3 AC-18 (2) NIST SP 800-53 R3 CM-6 NIST SP 800-53 R3 CM-6 (1) NIST SP 800-53 R3 CM-6 (3) NIST SP 800-53 R3 PE-4 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18)

8.2.5

45 CFR 164.312 (e)(1)(2)(ii) 45 CFR 164.308(a)(5)(ii)(D) 45 CFR 164.312(e)(1) 45 CFR 164.312(e)(2)(ii)

A.7.1.1 A.7.1.2 A.7.1.3 A.9.2.1 A.9.2.4 A.10.6.1 A.10.6.2 A.10.8.1 A.10.8.3 A.10.8.5 A.10.10.2 A.11.2.1 A.11.4.3 A.11.4.5 A.11.4.6 A.11.4.7 A.12.3.1 A.12.3.2

A.8.1.1 A.8.1.2 A.8.1.3 A.11.2.1 A.11.2.4 A.13.1.1 A.13.1.2 A.13.2.1 A.8.3.3 A.12.4.1 A.9.2.1, A.9.2.2 A.13.1.3 A.10.1.1 A.10.1.2

Commandment #1 Commandment #2 Commandment #3 Commandment #4 Commandment #5 Commandment #9 Commandment #10 Commandment #11

CIP-004-3 R3 CIP-007-3 - R6.1

AC-1 AC-18 CM-6 PE-4 SC-3 SC-7

11.1 17.3

PA3 PA6 PA16 PA20 PA25 PA32 PA33

BSGP BSGP SGP GP P BSGP SGP

1.2.3 2.1.1 4.1 4.1.1 11.1 9.1.3

1.2.3 2.1.1 4.1 4.1.1 11.1, 11.1.a, 11.1.b, 11.1.c, 11.1.d, 11.1.1, 11.1.2 9.1.3

Compliant

Infrastructure & Virtualization Security Network Architecture

IVS-13

Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Compliant

Interoperability & Portability APIs

IPY-01

The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.

BAI02.04 BAI03.01 BAI03.02 BAI03.03 BAI03.04 BAI03.05

Application Services > Programming Interfaces >

provider

Domain 6

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

Compliant

ACME Corporation integrates with many third party applications and data sources. The most common integrations are with CMDB, Incident Management, Problem Management, Change Management, User Administration, and Single Sign-on. A variety of techniques can be used, most notably Web Services, JDBC, LDAP, Excel, CSV, and Email, as well as any industry standard technologies that use SOAP, REST, or WSDL. Additionally, API and command-line integrations can be done using a MID Server. These can be viewed on the ACME Corporation Docs site here: https://docs.ACME Corporation.com/bundle/geneva-ACME Corporation-platform/page/integrate/inbound_web_services/concept/c_InboundWebServices.html

Interoperability & Portability Data Request

IPY-02

All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files)

APO01.03 APO01.06 APO03.01 APO08.01 APO09.03 DSS04.07

Information Services > Reporting Services >

provider

Domain 6

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

Compliant

Contractually ACME Corporation allows for a 45-day grace period from when a customer terminates their contract and ACME Corporation coordinates the encryption and transport requirements for return of data to the customer. The process for the return of data is: 1) ACME Corporation exports the entire database in a MySQL format 2) ACME Corporation provides the customer a set of instructions on how to import the data on the customer side 3) The customer can FTPs the files from ACME Corporation to their site.

Interoperability & Portability Policy & Legal

IPY-03

Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.

APO01.08 APO02.05 APO03.01 APO03.02 APO04.02 BAI02.01 BAI02.04 APO09.03

Information Technology Operation Services > Service Delivery > Service Level Management - External SLA's

provider

Domain 3

6.04.03. (b) 6.04.08. (a) 6.04.08. (b) 6.06. (a) 6.06. (b) 6.06. (c) 6.06. (d) 6.06. (e) 6.06. (f)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

Compliant

ACME Corporation integrates with many third party applications and data sources. The most common integrations are with CMDB, Incident Management, Problem Management, Change Management, User Administration, and Single Sign-on. A variety of techniques can be used, most notably Web Services, JDBC, LDAP, Excel, CSV, and Email, as well as any industry standard technologies that use SOAP, REST, or WSDL. Additionally, API and command-line integrations can be done using a MID Server. See the ACME Corporation Docs page for details of the various type of APIs: https://docs.ACME Corporation.com/bundle/helsinki-ACME Corporation-platform/page/integrate/web-services/reference/r_AvailableWebServices.html

Interoperability & Portability Standardized Network Protocols

IPY-04

The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

APO01.08 APO02.05 APO03.01 APO03.02 APO04.02 BAI02.01 BAI02.04 APO09.03

SRM > Data Protection > Cryptographic Services - Data-In-Transit Encryption

provider

Domain 6

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

4.1

Compliant

ACME Corporation customers access their instances over the Internet using forced Transport Layer Security (TLS) encryption (AES128/256) for all user access. The level of encryption is based on the browser and must be configured by the customer as ACME Corporation does not modify any browser settings. All attempts to access ACME Corporation over HTTP are redirected to HTTPS. ACME Corporation administrators connect to the production network using an IPSEC VPN tunnel. For integrations such as LDAP and Web Services, ACME Corporation provides customers with the ability to encrypt traffic. LDAP can be configured to run over SSL; this requires customers to provide a certificate for the specific LDAP server. Certificates may also be stored within an instance to allow encrypted transmission for Web Services integrations. FTPS and SCP can be used as file transfer methods to securely transfer files to ACME Corporation.

Interoperability & Portability Virtualization

IPY-05

The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solution-specific virtualization hooks available for customer review.

APO01.08 APO02.05 APO03.01 APO03.02 APO04.02 BAI02.01 BAI02.04 APO09.03

Infrastructure Services > Virtual Infrastructure > Server Virtualization

provider

Domain 6

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

Not applicable, as ACME Corporation does not use virtualization in the customer environment.

Mobile Security Anti-Malware

MOS-01

Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

APO01.03 APO13.01 APO07.03 APO07.06 APO09.03 APO10.04

SRM > Governance Risk & Compliance > Technical Awareness and Training

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation employees do not support or access customer environments via their mobile devices. Mobile devices are only used for email. Specific Malware training for mobile devices is not provided. Phishing awareness is part of the Security Awareness training provided to users. However, BYO device configurations must prevent malicious software execution. The Mobile and BYO Device Access SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Application Stores

MOS-02

A documented list of approved application stores has been defined as acceptable for mobile devices accessing or storing provider managed data.

APO01.04 APO01.08 APO04.02 APO13.01 APO13.02 APO13.03

SRM > Policies and Standards > Technical Securitry Standards

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

4.1.1

N/A

ACME Corporation does not provide a list of mobile stores since customer data is not stored on mobile devices. ACME Corporation employees do not support or access customer environments via their mobile devices. Mobile devices are only used for email. Acceptable Use policies denote acceptable user practices. Any mobile device has encryption enabled along with password controls.

Mobile Security Approved Applications

MOS-03

The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

APO01.03 APO01.08 APO13.01 APO13.02 APO13.03

ITOS > Service Support > Configuration Management - Software Management

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation support employees are not able to access support infrastructure via mobile devices. Mobile device use is limited to corporate email, and access is managed by ACME Corporation's MDM solution.

Mobile Security Approved Software for BYOD

MOS-04

The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

APO01.03 APO01.08 APO13.01 APO13.02 APO13.03

SRM > Policies and Standards > Technical Securitry Standards

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation's Acceptable Use Policy provides guidance on what should and should not be installed onto mobile devices. The Acceptable Use Policy can be viewed on the ACME Corporation CORE here:https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967 The Mobile and BYO Device Access SOP can also be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Awareness and Training

MOS-05

The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

APO01.03 APO01.08 APO13.01 APO13.02 APO13.03

SRM > Policies and Standards > Technical Securitry Standards

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

4.3

N/A

ACME Corporation has a formally documented Mobile and BYO Device access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME Corporation resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems containing or interacting with ACME Corporation data or operating within the ACME Corporation secured network. ACME Corporation support employees are not able to access support infrastructure via mobile devices. The Mobile and BYO Device Access SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad ACME Corporation's Acceptable Use Policy provides guidance on acceptable usage and requirements on mobile devices. The Acceptable Use Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967

Mobile Security Cloud Based Services

MOS-06

All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

APO01.03 APO01.08 APO13.01 APO13.02 APO13.03

SRM > Governance Risk & Compliance > Vendor Management

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation has a formally documented Mobile and BYO Device access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME Corporation resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems containing or interacting with ACME Corporation data or operating within the ACME Corporation secured network. As BYODs are only used for access to corporate email, ACME Corporation support employees are not able to access support infrastructure via mobile devices. The Mobile and BYO Device Access SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad ACME Corporation's Acceptable Use Policy provides guidance on acceptable usage and requirements on mobile devices. The Acceptable Use Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967

Mobile Security Compatibility

MOS-07

The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

APO01.03 APO01.08 APO13.01 APO13.02 BAI03.07 BAI03.08

ITOS > Service Support > Configuration Management - Software Management

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

Mobile Security Device Eligibility

MOS-08

The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

APO01.03 APO01.08 APO13.01 APO13.02 BAI02.01 BAI02.04

SRM > Policies and Standards > Information Security Policies

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

Mobile Security Device Inventory

MOS-09

An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)) will be included for each device in the inventory.

BAI06.01 BAI06.02 BAI06.04 BAI10.01 BAI10.02 BAI10.03

SRM > Infrastructure Protection Services > End Point - Inventory Control

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked.

Mobile Security Device Management

MOS-10

A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

APO03.01 APO03.02 APO04.02 APO13.01 APO13.02 BAI02.01 BAI03.03 BAI03.04 BAI03.10

Presentation Servies > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked.

Mobile Security Encryption

MOS-11

The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

APO01.03 APO13.01 APO13.02 DSS05.03 DSS05.05 DSS06.06

SRM > Data Protection > Cryptographic Services - Data-At-Rest Encryption

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

PA32

BSGP

4.1

N/A

Mobile Devices are required to have full disk encryption implemented. Mobile devices are not required to be encrypted, however, ACME Corporation support employees are not able to access support infrastructure via mobile devices.

Mobile Security Jailbreaking and Rooting

MOS-12

The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and shall enforce the prohibition through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management).

APO01.03 APO13.01 APO13.02 DSS05.03

Presentation Servies > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management

provider

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation's Acceptable Use Policy prohibits this type of behavior. The Acceptable Use Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967 ACME Corporation only leverages BYO Devices for access to corporate email only. There is no access to the cloud environment or customer data. ACME Corporation only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked. Bitglass enforces security controls on mobile devices. ACME Corporation has a formally documented Mobile and BYO Device Access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME Corporation resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems. ACME Corporation support employees are not able to access support infrastructure via mobile devices. Mobile devices can only be used to access corporate email. Please refer to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Legal

MOS-13

The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations regarding the loss of non-company data in the case a wipe of the device is required.

APO01.03 APO13.01 APO13.02

SRM > Policies and Standards > Information Security Services

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

As MOS-05 above: ACME Corporation has a formally documented Mobile and BYO Device access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME Corporation resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems containing or interacting with ACME Corporation data or operating within the ACME Corporation secured network. ACME Corporation support employees are not able to access support infrastructure via mobile devices. The Mobile and BYO Device Access SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad ACME Corporation's Acceptable Use Policy provides guidance on acceptable usage and requirements on mobile devices. The Acceptable Use Policy can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967 As MOS-12.2 above: ACME Corporation only leverages BYO Devices for access to corporate email only. There is no access to the cloud environment or customer data. ACME Corporation only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked. Bitglass enforces security controls on mobile devices. ACME Corporation has a formally documented Mobile and BYO Device Access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME Corporation resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems. ACME Corporation support employees are not able to access support infrastructure via mobile devices. Mobile devices can only be used to access corporate email. Please refer to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Lockout Screen

MOS-14

BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

DSS05.03 DSS05.05

Presentation Servies > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

As MOS-12.2 above: ACME Corporation only leverages BYO Devices for access to corporate email only. There is no access to the cloud environment or customer data. ACME Corporation only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked. Bitglass enforces security controls on mobile devices. ACME Corporation has a formally documented Mobile and BYO Device Access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME Corporation resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems. ACME Corporation support employees are not able to access support infrastructure via mobile devices. Mobile devices can only be used to access corporate email. Please refer to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Operating Systems

MOS-15

Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

APO01.03 APO13.01 APO13.02 BAI06

ITOS > Service Support -Change Management > Planned Changes

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

Mobile Security Passwords

MOS-16

Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

APO01.03 APO13.01 APO13.02 DSS05.03

Presentation Servies > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

All mobile devices must have a personal identification number (PIN) or passcode. Enterprise issued laptops are subject to the password policy detailed in the Information Security Standards, which can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5 As MOS-15 above: ACME Corporation only leverages BYO Devices for access to corporate email only. There is no access to the cloud environment or customer data. ACME Corporation only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked. Bitglass enforces security controls on mobile devices. ACME Corporation has a formally documented Mobile and BYO Device Access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME Corporation resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems. ACME Corporation support employees are not able to access support infrastructure via mobile devices. Mobile devices can only be used to access corporate email. Please refer to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad ACME Corporation has formal Information Security Policy and a formal Information Security Standards (ISP/ISS), that require strong password requirements are implemented, which includes LDAP account password enforcement of, but not limited to, minimum password length, inactive lock out, unsuccessful login lockout, password complexity, password reuse and unique user IDs. Users who do not change passwords in LDAP every 90 days are locked out. For systems (VPN, network devices, etc.) that use RSA for two-factor authentication (PIN & token), users are required to change their PIN every 90 days. Finally access to workstations is governed by active directory, which forces users to change their password every 90 days. Password policies detailed in the Information Security Standards are enforced via Bitglass, ACME Corporation's MDM solution. Please refer to the Information Security Standards here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5 Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 The Mobile and BYO Device Access SOP can be viewed on the ACME Corporation CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Policy

MOS-17

The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

APO01.03 APO13.01 APO13.02 DSS05.01 DSS05.03

SRM > Policies and Standards > Technical Securitry Standards

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

ACME Corporation users cannot connect to the customer network via BYOD. All access is required to come through a security corporate VPN using two-factor authentication via an RSA token. As MOS-02 above: Mobile devices are only used for email, and as such do not have a requirement for backup, as email is backed up to the email service. Acceptable Use policies denote acceptable user practices. Any mobile device has encryption enabled along with password controls. The Mobile and BYO Device Access SOP requires that a BYO device configuration includes virus protection as appropriate for the device. Please refer to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Remote Wipe

MOS-18

All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

APO01.03 APO13.01 APO13.02 DSS05.03 DSS05.05 DSS05.06

BOSS > Data Governance > Secure Disposal of Data

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

PA34

SGP

N/A

All cellphones that have access to corporate emails, must be encrypted, with remote wipe capability; laptops and workstations are required to have full disk encryption implemented. Please refer to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad

Mobile Security Security Patches

MOS-19

Mobile devices connecting to corporate networks, or storing and accessing company information, shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

APO01.03 APO13.01 APO13.02 DSS05.03 DSS05.05 DSS05.06

SRM > Infrastructure Protection Services->Network > Link Layer Network Security

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

There is no technical enforcement of this. Laptops and workstations allow for remote validation to download the latest security patches by company IT personnel, however, mobile devices do not. Mobile and bring your own devices are only used to access corporate email.

Mobile Security Users

MOS-20

The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

APO01.03 APO13.01 APO13.02

SRM > Policies and Standards > Technical Security Standards

shared

None (Mobile Guidance)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

N/A

As MOS-03 above: ACME Corporation support employees are not able to access support infrastructure via mobile devices. Mobile device use is limited to corporate email, and access is managed by ACME Corporation's MDM solution. ACME Corporation does not allow customer data to be put on BYOD.

Security Incident Management, E-Discovery & Cloud Forensics Contact / Authority Maintenance

SEF-01

Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

S4.3.0 x4.4.0

(S4.3.0) Environmental, regulatory, and technological changes are monitored and their effect on system security is assessed on a timely basis and policies are updated for that assessment. (x4.4.0) Environmental, regulatory, and technological changes are monitored, and their impact on system [availability, processing integrity, confidentiality] and security is assessed on a timely basis. System [availability, processing integrity, confidentiality] policies and procedures are updated for such changes as required.

CC3.3

CO-04

ME 3.1

APO01.01 APO01.02 APO01.03 APO01.08 MEA03.01 MEA03.02 MEA03.03

312.4

BOSS > Compliance > Contact/Authority Maintenance

shared

Domain 2, 4

NIST SP 800-53 R3 IR-6 NIST SP 800-53 R3 SI-5

NIST SP 800-53 R3 IR-6 NIST SP 800-53 R3 IR-6 (1) NIST SP 800-53 R3 SI-5

1.2.7 10.1.1 10.2.4

A.6.1.6 A.6.1.7

A.6.1.3 A.6.1.4

Commandment #1 Commandment #2 Commandment #3

Chapter VI, Article 44. Chatper II, Article 16, part I

CIP-001-1a R3 - R4

AT-5 IR-6 SI-5

3.2

11.1.e 12.5.3 12.9

12.5.3 12.10.1

Compliant

For the purpose of Computer Emergency Readiness, ACME Corporation maintains contact with FBI, Infragard, DHS, IC3, US-CERT, CERT-EU, CERT Australia, NCSC (aka CERT-UK), in-house counsel as well as outside counsel, district attorney of the county of Santa Clara ( Headquarters) , regional police departments. In addition, ACME Corporation also has an external breach response firm at call, to handle large scale incidents that may require external help. The Legal team maintains these contacts in conjunction with the Threat Intelegence and Global Incident Response (TIGIR) Team.

Security Incident Management, E-Discovery & Cloud Forensics Incident Management

SEF-02

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

IS3.7.0 S3.9.0

(IS3.7.0) Procedures exist to identify, report, and act upon system security breaches and other incidents. (S3.9.0) Procedures exist to provide that issues of noncompliance with system availability, confidentiality of data, processing integrity and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC5.5 CC6.2

J.1

J.1.1, J.1.2

46 (B)

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.8 Openness, Subs. 4.8.2

IS-22

DS5.6

APO01.03 APO13.01 APO13.02 DSS01.03 DSS02.01 DSS02.02 DSS02.04 DSS02.05 DSS02.06

312.8 and 312.10

ITOS > Service Support > Security Incident Management

shared

Domain 2

6.04.07. (b) 6.07.01. (a) 6.07.01. (d) 6.07.01. (e) 6.07.01. (f) 6.07.01. (g) 6.07.01. (h)

Article 17

NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-4 NIST SP 800-53 R3 IR-5 NIST SP 800-53 R3 IR-6 NIST SP 800-53 R3 IR-7

NIST SP 800-53 R3 IR-1 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-3 NIST SP 800-53 R3 IR-4 NIST SP 800-53 R3 IR-4 (1) NIST SP 800-53 R3 IR-5 NIST SP 800-53 R3 IR-7 NIST SP 800-53 R3 IR-7 (1) NIST SP 800-53 R3 IR-7 (2) NIST SP 800-53 R3 IR-8

1.2.4 1.2.7 7.1.2 7.2.2 7.2.4 10.2.1 10.2.4

45 CFR 164.308 (a)(1)(i) 45 CFR 164.308 (a)(6)(i)

Clause 4.3.3 A.13.1.1 A.13.2.1

Clause 5.3 (a), 5.3 (b), 7.5.3(b), 5.2 (c), 7.5.3(d), 8.1, 8.3, 9.2(g), Annex A.16.1.1 A.16.1.2

ITAR 22 CFR § 127.12

Commandment #2 Commandment #6 Commandment #8

Chapter II, Article 20

CIP-007-3 - R6.1 CIP-008-3 - R1

IR-1 IR-2 IR-3 IR-4 IR-5 IR-7 IR-8

IP-4 COMPLAINT MANAGEMENT. SE-2 PRIVACY INCIDENT RESPONSE

4.1 4.2 4.6 7.1

PA8 PA11

BSGP

12.9 12.9.1 12.9.2 12.9.3 12.9.4 12.9.5 12.9.6

12.1

Compliant

Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 ACME Corporation has a formal documented Security Incident Response policy, process and workflow. Our Incident Response process includes documented event discovery, triage, escalation, notification (including customer notification) remediation, and post-mortem review. ACME Corporation reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA. The Security Incident Response Plan is tested annually. Customers may generate their own alerts in their ACME Corporation instance, or export their application logs to their own SIEM solution or build/implement an integration for alert generation. However, we do not integrate customer requirements into our plans.

Security Incident Management, E-Discovery & Cloud Forensics Incident Reporting

SEF-03

Workforce personnel and external business relationships shall be informed of their responsibilities and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

A2.3.0 C2.3.0 I2.3.0 S2.3.0 S2.4 C3.6.0

(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. (S2.4) The process for informing the entity about breaches of the system security and for submitting complaints is communicated to authorized users. (C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.3 CC2.5 C1.4 C1.5

J.1 E.1

J.1.1, E.4

5 (B) 46 (B) 48 (A+) 49 (B) 50 (B)

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3

IS-23

DS5.6

APO01.03 APO07.06 APO07.03 APO13.01 APO13.02 DSS02.01

312.3, 312.8 and 312.10

BOSS > Human Resources Security > Employee Awareness

shared

Domain 2

6.07.01. (a)

Article 17

NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6 NIST SP 800-53 R3 IR-7 NIST SP 800-53 R3 SI-5

NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6 NIST SP 800-53 R3 IR-6 (1) NIST SP 800-53 R3 IR-7 NIST SP 800-53 R3 IR-7 (1) NIST SP 800-53 R3 IR-7 (2) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-4 (2) NIST SP 800-53 R3 SI-4 (4) NIST SP 800-53 R3 SI-4 (5) NIST SP 800-53 R3 SI-4 (6) NIST SP 800-53 R3 SI-5

99.31(a)(1)(i) 34 CFR 99.32(a)

1.2.7 1.2.10 7.1.2 7.2.2 7.2.4 10.2.4

45 CFR 164.312 (a)(6)(ii) 16 CFR 318.3 (a) 16 CFR 318.5 (a) 45 CFR 160.410 (a)(1)

Clause 4.3.3 Clause 5.2.2 A.6.1.3 A.8.2.1 A.8.2.2 A.13.1.1 A.13.1.2 A.13.2.1

Clause 5.2 (c), 5.3 (a), 5.3 (b), 7.2(a), 7.2(b), 7.2(c), 7.2(d), 7.3(b), 7.3(c) 7.5.3(b), 7.5.3(d), 8.1, 8.3, 9.2(g) Annex A.6.1.1 A.7.2.1, A.7.2.2, A.16.1.2, A.16.1.3, A.16.1.1

ITAR 22 CFR § 127.12

Commandment #2 Commandment #6 Commandment #8

Chapter II, Article 20

CIP-003-3 - R4.1 CIP-004-3 R3.3

IR-2 IR-6 IR-7 SI-4 SI-5

IP-4 COMPLAINT MANAGEMENT. SE-2 PRIVACY INCIDENT RESPONSE

7.2

PA8

BSGP

12.5.2 12.5.3

12.10.1

Compliant

ACME Corporation reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA. Please refer to the Incident Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=331c6e21dbd0dbc01dcaf3231f96191f Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958

Security Incident Management, E-Discovery & Cloud Forensics Incident Response Legal Preparation

SEF-04

Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

S2.4.0 C3.15.0

(S2.4.0) The process for informing the entity about system availability issues, confidentiality issues, processing integrity issues, security issues and breaches of the system security and for submitting complaints is communicated to authorized users. (C3.15.0) Procedures exist to provide that issues of noncompliance with defined confidentiality and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC2.5 CC6.2

J.1 E.1

J.1.1, J.1.2, E.4

IS-24

DS5.6

APO01.03 APO13.01 APO13.02 DSS01.03 DSS02.01 DSS02.02 DSS02.04 DSS02.05 DSS02.06

312.8 and 312.10

BOSS > Legal Services > Incident Response Legal Preparation

shared

Domain 2

6.04.07. (b) 6.07.01. (f) 6.07.01. (h)

NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 IR-5 NIST SP 800-53 R3 IR-7 NIST SP 800-53 R3 IR-8

NIST SP 800-53 R3 AU-6 NIST SP 800-53 R3 AU-6 (1) NIST SP 800-53 R3 AU-6 (3) NIST SP 800-53 R3 AU-7 NIST SP 800-53 R3 AU-7 (1) NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-9 (2) NIST SP 800-53 R3 AU-10 NIST SP 800-53 R3 AU-10 (5) NIST SP 800-53 R3 AU-11 NIST SP 800-53 R3 IR-5 NIST SP 800-53 R3 IR-7 NIST SP 800-53 R3 IR-7 (1) NIST SP 800-53 R3 IR-7 (2) NIST SP 800-53 R3 IR-8 NIST SP 800-53 R3 MP-5 NIST SP 800-53 R3 MP-5 (2) NIST SP 800-53 R3 MP-5 (4)

1.2.7

45 CFR 164.308 (a)(6)(ii)

Clause 4.3.3 Clause 5.2.2 A.8.2.2 A.8.2.3 A.13.2.3 A.15.1.3

Clause 5.2 (c), 5.3 (a), 5.3 (b), 7.2(a), 7.2(b), 7.2(c), 7.2(d), 7.3(b), 7.3(c) 7.5.3(b), 7.5.3(d), 8.1, 8.3, 9.2(g) Annex A.7.2.2, A.7.2.3, A.16.1.7, A.18.1.3

CIP-004-3 R3.3

AU-6 AU-7 AU-9 AU-11 IR-5 IR-7 IR-8

7.3

PA11

BSGP

Compliant

ACME Corporation has a formal documented Security Incident Response policy, process and workflow. Our Incident Response process includes documented event discovery, triage, escalation, notification (including customer notification) remediation, and post-mortem review. ACME Corporation reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA. Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 ACME Corporation maintains relationship with two vendors to provide forensic services with chain of custody in the event that forensic investigation is required. Further, ACME Corporation is capable of cloning a customer instance for evidence preservation.

Security Incident Management, E-Discovery & Cloud Forensics Incident Response Metrics

SEF-05

Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

S3.9.0 C4.1.0

(S3.9.0) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis. (C4.1.0) The entity’s system security, availability, system integrity, and confidentiality is periodically reviewed and compared with the defined system security, availability, system integrity, and confidentiality policies.

CC6.2 CC4.1

J.1.2

47 (B)

IS-25

DS 4.9

DSS04.07

312.8 and 312.10

BOSS > Operational Risk Management > Key Risk Indicators

shared

Domain 2

6.07.01. (a) 6.07.01. (i)

NIST SP 800-53 R3 IR-4 NIST SP 800-53 R3 IR-5 NIST SP 800-53 R3 IR-8

NIST SP 800-53 R3 IR-4 NIST SP 800-53 R3 IR-4 (1) NIST SP 800-53 R3 IR-5 NIST SP 800-53 R3 IR-8

1.2.7 1.2.10

45 CFR 164.308 (a)(1)(ii)(D)

A.13.2.2

A.16.1.6

CIP-008-3 - R1.1

IR-4 IR-5 IR-8

7.2 7.3

PA11

BSGP

12.9.6

Compliant

ACME Corporation reports incidents in accordance with the Incident Response Plan. The document identifies the types of security incidents that should be reported, reporting timeframes, and specific processes for reporting and handling incidents involving customer data. Internally, ACME Corporation utilizes Splunk to centralize audit logs and to support the audit review process. As part of the purpose and design for this system, audit reviews occur daily for events that are considered lower risk. High risk issues, such as intrusion detection events trigger real-time alerts which are emailed to the Security Incident Response Team. ACME Corporation has established a Scheduled Security Operations Checklist which includes procedures for performing daily reviews of Linux, Windows, Network Device, IDS, and identified issue logs. Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958

Supply Chain Management, Transparency and Accountability Data Quality and Integrity

STA-01

Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain.

APO10 APO11 DSS05.04 DSS06.03 DSS06.06

SRM > Governance Risk & Compliance > Vendor Management

provider

Domain 2

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

Compliant

All equipment in the secure data center customer network is owned, operated and managed by ACME Corporation. Third party vendors do not have access to the data at any time. ACME Corporation uses role-based entitlements and grant entitlements only to roles with explicit need for the level of access based strictly on a 'least privilege' principle for the cloud infrastructure. ACME Corporation utilizes RSA SecurID for multi-factor authentication for network access to privileged (including administrative access) accounts for production. For the application, the customer will assume this responsibility as they manage authorization in their application instance and can configure the appropriate access control list. Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 Please refer to the Information Security Standards here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5

Supply Chain Management, Transparency and Accountability Incident Reporting

STA-02

The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).

APO09.03 APO09.04 APO10.04 APO10.05 DSS02.07

ITOS > Service Support -> Incident Management > Cross Cloud Incident Response

provider

Domain 2

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f)

Compliant

Supply Chain Management, Transparency and Accountability Network / Infrastructure Services

STA-03

Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

C2.2.0

(C2.2.0) The system security, availability, system integrity, and confidentiality and related security obligations of users and the entity’s system security, availability, system integrity, and confidentiality and related security commitments to users are communicated to authorized users.

CC2.2 CC2.3

C.2

C.2.6, G.9.9

45 (B) 74 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-31

DS5.10

APO01.03 APO03.01 APO03.02 APO09.03 BAI02.01 BAI02.04 BAI07.05

312.8 and 312.10

ITOS > Service Delivery > Service Level Management

provider

Domain 2

6.02. (c) 6.03.07. (a) 6.03.07. (b) 6.03.07. (c) 6.03.07. (d)

Article 17

NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 SA-9

NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 CP-6 NIST SP 800-53 R3 CP-6 (1) NIST SP 800-53 R3 CP-6 (3) NIST SP 800-53 R3 CP-7 NIST SP 800-53 R3 CP-7 (1) NIST SP 800-53 R3 CP-7 (2) NIST SP 800-53 R3 CP-7 (3) NIST SP 800-53 R3 CP-7 (5) NIST SP 800-53 R3 CP-8 NIST SP 800-53 R3 CP-8 (1) NIST SP 800-53 R3 CP-8 (2) NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SA-9 (1) NIST SP 800-53 R3 SC-30

8.2.2 8.2.5

A.6.2.3 A.10.6.2

A.15.1.2 A.13.1.2

Commandment #6 Commandment #7 Commandment #8

SC-20 SC-21 SC-22 SC-23 SC-24

17.1

PA3 PA8 PA16

BSGP BSGP SGP

Compliant

ACME Corporation’s Change Management SOP is leveraged for managing changes to the infrastructure environment. Infrastructure changes go through the Change Management process. Changes with a significant impact need to be tested and peer reviewed by Cloud Operations staff prior to being taken to the CAB for approval. Additionally, ACME Corporation has a physically and logically separate TEST and DEV environment to test selected infrastructure changes before deployment. ACME Corporation's patch deployment process is closely integrated to the Change Management process; patches are deployed after testing and with Change Approval Board (CAB) approvals. Please refer to the Change Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=140d2aa5dbd0dbc01dcaf3231f961900 ACME Corporation has a documented capacity planning model which is used to determine sizing requirements and scaling options. As a SaaS provider, the need to address capacity and horizontal system scaling is in the background, transparent to our customers. Please refer to Capacity Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=707c22e1dbd0dbc01dcaf3231f96196c

Supply Chain Management, Transparency and Accountability Provider Internal Assessments

STA-04

The provider shall perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.

MEA01 MEA02

SRM > Governance Risk & Compliance > Vendor Management

provider

Domain 2

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f) A.14.2.3 A.12.6.1 A.18.1.1 A.18.2.2 A.18.2.3

12.1.1

Compliant

ACME Corporation has a dedicated Governance, Risk and Compliance (GRC) team. Internal audits are perfomed periodically throughout the year. In addition to the internal audit, and continuous monitoring programs, ACME Corporation also hosts multiple customer audits covering all relevant areas throughout the year. Please refer to the Internal Compliance Audit SOP here: https://community.ACME.com/community?id=community_article&sys_id=2e7ca2e1dbd0dbc01dcaf3231f9619c5 ACME Corporation is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE18 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME Corporation undergoes multiple internal audits and customer audits each year. Please refer to the CORE for copies of ACME Corporation's Third Party Attestations here: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924

Supply Chain Management, Transparency and Accountability Supply Chain Agreements

STA-05

Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms: • Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations) • Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships • Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain) • Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed • Expiration of the business relationship and treatment of customer (tenant) data impacted • Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence

S2.2.0 A3.6.0 C3.6.0

(S2.2.0) The availability, confidentiality of data, processing integrity, system security and related security obligations of users and the entity’s availability and related security commitments to users are communicated to authorized users. (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2 CC2.3 CC5.5 C1.4 C1.5

C.2

C.2.4, C.2.6, G.4.1, G.16.3

74 (B) 75 (C+, A+) 45 (B) 75 (C+, A+) 79 (B) 4 (C+, A+)

Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3

LG-02

DS5.11

APO09.03 APO09.05

312.3, 312.8 and 312.10

BOSS > Legal Services > Contracts

shared

Domain 3

6.02. (e) 6.10. (h) 6.10. (i)

Article 17 (3)

NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 PS-7 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SA-9

NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 MP-5 NIST SP 800-53 R3 MP-5 (2) NIST SP 800-53 R3 MP-5 (4) NIST SP 800-53 R3 PS-7 NIST SP 800-53 R3 SA-6 NIST SP 800-53 R3 SA-7 NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SA-9 (1)

1.2.5

45 CFR 164.308 (a)(4)(ii)(A) 45 CFR 164.308 (b)(1) 45 CFR 164.308 (b)(2)(i) 45 CFR 164.308 (b)(2)(ii) 45 CFR 164.308 (b)(2)(iii) 45 CFR 164.308 (b)(3) 45 CFR 164.308 (b)(4) 45 CFR 164.312(e)(2)(i) 45 CFR 164.312 (c)(1) 45 CFR 164.312(e)(2)(ii) 45 CFR 164.314 (a)(1)(i) 45 CFR 164.314 (a)(1)(ii)(A) 45 CFR 164.314 (a)(2)(i) 45 CFR 164.314 (a)(2)(i)(A) 45 CFR 164.314 (a)(2)(i)(B) 45 CFR 164.314 (a)(2)(i)(C) 45 CFR 164.314 (a)(2)(i)(D) 45 CFR 164.314 (a)(2)(ii)(A) 45 CFR 164.314 (a)(2)(ii)(A)(1) 45 CFR 164.314 (a)(2)(ii)(A)(2) 45 CFR 164.314 (a)(2)(ii)(B) 45 CFR 164.314 (a)(2)(ii)(C) 45 CFR 164.314 (b)(1) 45 CFR 164.314 (b)(2) 45 CFR 164.314 (b)(2)(i) 45 CFR 164.314 (b)(2)(ii) 45 CFR 164.314 (b)(2)(iii) 45 CFR 164.314 (b)(2)(iv)

A.6.2.3 A10.2.1 A.10.8.2 A.11.4.6 A.11.6.1 A.12.3.1 A.12.5.4

A.15.1.2, 8.1* partial, A.13.2.2, A.9.4.1 A.10.1.1

ITAR 22 CFR § 120.17 EAR 15 CFR §736.2 (b)

Commandment #1 Commandment #4 Commandment #5 Commandment #6 Commandment #7 Commandment #8

Chapter II Article 14.

CA-3 MP-5 PS-7 SA-6 SA-7 SA-9

5.2 2.2

2.4 12.8.2

Compliant

ACME Corporation does not make use of outsourced providers for the processing and storage of data. ACME Corporation's only major outsource providers are its data centers however they only provide physical security, power, air-conditioning and network access. They play no role in the storage or processing of data. ACME Corporation's legal team will review all contracts including those from vendors. Internal audit and compliance group is responsible for reviewing ACME Corporation procedures for compliance as part of the 3rd party vendor management program. ACME Corporation uses third party datacenter vendors to host its services to customers. ACME Corporation uses the 3rd party datacenter for environmental and physical security controls. ACME Corporation equipment is stored in bio-metrically locked cages within these datacenters, that only ACME Corporation employees have access to, except for the co-location provider for emergency purposes. ACME Corporation does not allow the storing of customer data on unapproved systems and access to customer is limited to those with a business need. The customer is responsible for the management of their customer data within their customer instance. ACME Corporation's customers would not typically inform us of the location that data originated, and have no need to do so. Please refer to the Data Center Third Party Attestations here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb ACME Corporation does not provide this information to its customers as no sub-processors are used to support the customer environment. However, ACME Corporation performs annual tests over high risk vendors such as co-location datacenters to ensure service level agreements are being met.

Supply Chain Management, Transparency and Accountability Supply Chain Governance Reviews

STA-06

Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

APO10.04 APO10.05 MEA01

SRM > Governance Risk & Compliance > Vendor Management

provider

Domain 2

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f)

12.8.4

Compliant

ACME Corporation's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME Corporation, and to customers of ACME Corporation. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, active existing vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed. ACME Corporation does not enforce its internal security policies and procedures on its third party vendors; where appropriate, ACME Corporation reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively. Please refer to the VSRA SOP here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993

Supply Chain Management, Transparency and Accountability Supply Chain Metrics

STA-07

Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream). Reviews shall performed at least annually and identity non-conformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships.

51 (B)

APO01.03 APO09.03 APO09.04 APO09.05 APO10.01 APO10.03 APO10.04

ITOS > Service Delivery > Service Level Management - Vendor Management

provider

Domain 3

6.02. (c) 6.02. (d) 6.07.01. (k)

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f)

Compliant

There are no direct connections between ACME Corporation's customers and its providers that would be relevant to the SLAs that ACME Corporation provides. As STA-06 above: ACME Corporation's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME Corporation, and to customers of ACME Corporation. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, critical/Tier 1 vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed. Non-critical vendors are reviewed every 2 years. ACME Corporation does not enforce its internal security policies and procedures on its third party vendors; where appropriate, ACME Corporation reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively. Please refer to the VSRA SOP here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993 ACME Corporation has process and procedures in places to handle and maintenance procedures activities within our data centers. ACME Corporation works with our suppliers to have replacement parts ready if needed based on contractual SLAs.

Supply Chain Management, Transparency and Accountability Third Party Assessment

STA-08

Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party-providers upon which their information supply chain depends on.

APO09.03 MEA01 MEA02

SRM > Governance Risk & Compliance > Vendor Management

provider

Domain 2

Clause 6.1.1, 6.1.1(e)(2) 6.1.2 6.1.2(a)(1) 6.1.2(a)(2), 6.1.2(b) 6.1.2 (c) 6.1.2(c)(1), 6.1.2(c)(2) 6.1.2(d) 6.1.2(d)(1) 6.1.2(d)(2) 6.1.2(d)(3) 6.1.2(e) 6.1.2(e)(1) 6.1.2(e)(2) 6.1.3, 6.1.3(a) 6.1.3(b) 8.1 8.3 9.3(a), 9.3(b) 9.3(b)(f) 9.3(c) 9.3(c)(1) 9.3(c)(2) 9.3(c)(3) 9.3(d) 9.3(e) 9.3(f)

Compliant

ACME Corporation's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME Corporation, and to customers of ACME Corporation. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, active existing vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed. ACME Corporation does not enforce its internal security policies and procedures on its third party vendors; where appropriate, ACME Corporation reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively. Please refer to the VSRA SOP here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993

Supply Chain Management, Transparency and Accountability Third Party Audits

STA-09

Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

S2.2.0 C2.2.0 C3.6

Note: third party service providers are addressed under either the carve-out method or the inclusive method as it relates to the assessment of controls. (S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (C2.2.0) The system confidentiality and related security obligations of users and the entity’s confidentiality and related security commitments to users are communicated to authorized users before the confidential information is provided. This communication includes, but is not limited to, the following matters: (see sub-criteria on TSPC tab) (C3.6) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2 CC2.3 C1.4 C1.5

C.2

C.2.4,C.2.6, G.4.1, G.4.2, L.2, L.4, L.7, L.11

60 (B) 62 (C+, A+) 83 (B) 84 (B) 85 (B)

CO-03

ME 2.6 DS 2.1 DS 2.4

APO01.08 APO10.05 MEA02.01

312.2(a) and 312.3 (Prohibition on Disclosure)

BOSS > Compliance > Third-Party Audits

shared

Domain 2, 4

6.02. (b) 6.02. (d)

Article 17(2)

NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SC-7

NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 SA-9 NIST SP 800-53 R3 SA-9 (1) NIST SP 800-53 R3 SA-12 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 SC-7 (1) NIST SP 800-53 R3 SC-7 (2) NIST SP 800-53 R3 SC-7 (3) NIST SP 800-53 R3 SC-7 (4) NIST SP 800-53 R3 SC-7 (5) NIST SP 800-53 R3 SC-7 (7) NIST SP 800-53 R3 SC-7 (8) NIST SP 800-53 R3 SC-7 (12) NIST SP 800-53 R3 SC-7 (13) NIST SP 800-53 R3 SC-7 (18)

1.2.11 4.2.3 7.2.4 10.2.3 10.2.4

45 CFR 164.308(b)(1) 45 CFR 164.308 (b)(4)

A.6.2.3 A.10.2.1 A.10.2.2 A.10.6.2

A.15.1.2 8.1* partial, 8.1* partial, A.15.2.1 A.13.1.2

Commandment #1 Commandment #2 Commandment #3

Chapter II Article 14, 21 Chapter III Article 25 Chapter V Article 36

CA-3 SA-9 SA-12 SC-7

5.4

2.4 12.8.2 12.8.3 12.8.4 Appendix A

Compliant

ACME Corporation's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME Corporation, and to customers of ACME Corporation. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, active existing vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed. ACME Corporation does not enforce its internal security policies and procedures on its third party vendors; where appropriate, ACME Corporation reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively. Please refer to the VSRA SOP here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993

Threat and Vulnerability Management Anti-Virus / Malicious Software

TVM-01

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.5.0

(S3.5.0) Procedures exist to protect against infection by computer viruses, malicious codes, and unauthorized software.

CC5.8

G.7

17 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-21

DS5.9

APO01.03 APO13.01 APO13.02 DSS05.01

312.8 and 312.10

SRM > Infrastructure Protection Services > Anti-Virus

shared

Domain 2

6.03. (f)

Article 17

NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SI-3 NIST SP 800-53 R3 SI-5

NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SI-3 NIST SP 800-53 R3 SI-3 (1) NIST SP 800-53 R3 SI-3 (2) NIST SP 800-53 R3 SI-3 (3) NIST SP 800-53 R3 SI-5 NIST SP 800-53 R3 SI-7 NIST SP 800-53 R3 SI-7 (1) NIST SP 800-53 R3 SI-8

8.2.2

45 CFR 164.308 (a)(5)(ii)(B)

A.10.4.1

A.12.2.1

Commandment #4 Commandment #5

CIP-007-3 - R4 - R4.1 - R4.2

SA-7 SC-5 SI-3 SI-5 SI-7 SI-8

14.1 17.6

PA1

BSGP

5.1 5.1.1 5.2

1.4, 5.0

Compliant

ACME Corporation incorporates approved antivirus and anti-malware software on workstations and servers. It is deployed and configured for central policy control by IT operations. Antivirus and anti-malware signatures are updated at least daily. For production servers located at the secured data center, ACME Corporation uses a host-based antivirus solution to prevent virus and malware infections. It is deployed and configured for central policy control by Cloud Operations. The antivirus client is configured to perform weekly antivirus scans and detection of malicious code, authorize white/black listings of files and directories. The Antivirus event logs are imported in to Splunk for further analysis. The antivirus solution takes remediation actions to quarantine or eradicate malicious code (i.e., virus, worms, and Trojan horses) in response to malicious code detection. ACME Corporation does not monitor its customer's instances for malware, as ACME Corporation maintains a data agnostic stance and neither views its customers data transactions nor attempts to determine legitimate information. As stated, ACME Corporation's production servers use an antivirus tool to monitor the servers for malware. ACME Corporation neither monitors for malware within the customer instance's contents nor specifically prevents the customer for transmitting malware to/from their instance.

Threat and Vulnerability Management Vulnerability / Patch Management

TVM-02

Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identfied weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.10.0

CC7.1

I.4

G.15.2, I.3

32 (B) 33 (B)

Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3

IS-20

AI6.1 AI3.3 DS5.9

APO01.03 APO13.01 APO13.02 BAI06.01 BAI06.02 BAI06.03 BAI06.04 DSS01.01 DSS01.02 DSS01.03 DSS03.05 DSS05.01 DSS05.03 DSS05.07

312.8 and 312.10

SRM > Threat and Vulnerability Management > Vulnerability Management

shared

Domain 2

6.03.02. (a) 6.03.02. (b) 6.03.05. (c) 6.07.01. (o)

Article 17

NIST SP 800-53 R3 CM-4 NIST SP 800-53 R3 RA-5 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-5

NIST SP 800-53 R3 CM-3 NIST SP 800-53 R3 CM-3 (2) NIST SP 800-53 R3 CM-4 NIST SP 800-53 R3 RA-5 NIST SP 800-53 R3 RA-5 (1) NIST SP 800-53 R3 RA-5 (2) NIST SP 800-53 R3 RA-5 (3) NIST SP 800-53 R3 RA-5 (6) NIST SP 800-53 R3 RA-5 (9) NIST SP 800-53 R3 SC-30 NIST SP 800-53 R3 SI-1 NIST SP 800-53 R3 SI-2 NIST SP 800-53 R3 SI-2 (2) NIST SP 800-53 R3 SI-4 NIST SP 800-53 R3 SI-5

1.2.6 8.2.7

45 CFR 164.308 (a)(1)(i)(ii)(A) 45 CFR 164.308 (a)(1)(i)(ii)(B) 45 CFR 164.308 (a)(5)(i)(ii)(B)

A.12.5.1 A.12.5.2 A.12.6.1

8.1*partial, A.14.2.2, 8.1*partial, A.14.2.3 A.12.6.1

Commandment #4 Commandment #5

CIP-004-3 R4 - 4.1 - 4.2 CIP-005-3a - R1 - R1.1 CIP-007-3 - R3 - R3.1 - R8.4

CM-3 CM-4 CP-10 RA-5 SA-7 SI-1 SI-2 SI-5

12.4 14.1

PA2 PA8

BSGP

2.2 6.1 6.2 6.3.2 6.4.5 6.5 6.6 11.2 11.2.1 11.2.2 11.2.3

Compliant

As STA-09.1 above: ACME Corporation performs internal network security scans on a weekly basis and external scans on a daily basis. ACME Corporation also contracts a third party vendor to perform an annual comprehensive penetration test on the platform and environment to identify risks and remediation that help increase the security posture. The last 3rd party review was performed in Feb 2014. ACME Corporation for security reasons does not share any findings or results to our customers. Customer can request a one-penetration test a year. Please refer to HI KB0538598 for more information. Please refer to the Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918 ACME Corporation's application penetration testing program has four aspects: 1) ACME Corporation conducts 3rd party, continuous loop testing on a ACME Corporation instance where developers check in their code as it is completed. 2) ACME Corporation uses commercially available penetration-testing tool to conduct both formal and informal penetration testing during the SDLC. 3) The third and most intensive phase is its major release penetration testing. A third party organization is given an extended period of time and access to the resources necessary to test ACME Corporation's security and occurs in two rounds. At the end of the first round of testing any issues discovered are entered into ACME Corporation problem resolution process with issues categorized as High or Critical requiring attention. At the end of the development and remediation cycle, a second round of testing is conducted again to confirm the remediation or mitigation of the discovered issues. 4) The final and most important aspect of ACME Corporation's penetration testing regime is its customer penetration-testing program. Existing customers, through a documented approval process, are permitted to perform an annual application level penetration test. The testing must be approved and conducted at a time that is agreed upon by ACME Corporation to allow ACME Corporation to continue to conduct its monitoring activities and be able to determine potential real attacks from authorized customer activities. Customers must upgrade their instances to the latest release and follow ACME Corporation's hardening guide before conducting any penetration testing to avoid large scale reporting of previously fixed issues. The customer must share all results with ACME Corporation's Application Security team. Please refer to the Application Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=3ebc6e25dbd0dbc01dcaf3231f961902 ACME Corporation performs internal network security scans on a weekly basis and external scans on a daily basis. ACME Corporation leverages the scanning tool Qualys to perform internal network security scans on a weekly basis and external scans on a daily basis. The Security Engineering team reviews and triages identified vulnerabilities based on their associated risks to the environment. Vulnerabilities are assigned with priorities and sent to the respective Engineering teams for remediation. Please refer to the Cloud Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918 ACME Corporation executes a network penetration test at least once per year. ACME Corporation provides executive summaries of its third party pen tests here: https://community.ACME.com/community?id=community_topic&sys_id=ec499e2ddbd897c068c1fb651f96192c ACME Corporation Application/Platform Patches: ACME Corporation allows customers to chose patches and upgrades from a list of available patches and upgrade. In addition, ACME Corporation runs a Quarterly Patching Process to insure that customers are on the latest general customer-facing patch of their release family. Infrastructure Patches: ACME Corporation’s Infrastructure stack is customized at each layer to specifically support the ACME Corporation product, which is the only product residing in the ACME Corporation private cloud. With the small footprint of technology required and the limited ports and services enabled, many system and security patches published do not apply to ACME Corporation’s cloud. With each published patch, ACME Corporation follows a risk-based approach to determine if the patch is to be deployed. Once it is determined that a patch needs to be deployed, the process then follows the Change Management process to identify the assets, the risk and potential impact to the environment, the testing process as well as the timeline for deployment. ACME Corporation leverages the Advanced High Availability architecture to transfer customers’ production instances to the other data center when performing maintenance such as patching, thereby minimizing the impact to availability. Please refer to the Patching Program SOP here: https://community.ACME.com/community?id=community_article&sys_id=009caae1dbd0dbc01dcaf3231f9619e5

Threat and Vulnerbility Management Mobile Code

TVM-03

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.4.0 S3.10.0

(S3.4.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software. (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

CC5.6 CC7.1

G.20.12, I.2.5

SA-15

APO01.03 APO13.01 APO13.02 DSS05.01 DSS05.02 DSS05.03 DSS05.04

312.8 and 312.10

SRM > Infrastructure Protection Services > End Point - White Listing

shared

Domain 10

6.03. (g)

Article 17

A.10.4.2 A.12.2.2

A.12.2.1

Commandment #1 Commandment #2 Commandment #3 Commandment #5 Commandment #11

SC-18

3 3.1 3.2 3.3 3.4 3.5

Compliant

The ACME Corporation platform uses both client and server side JavaScript. ACME Corporation has coding standards for its developers on the creation of mobile code and the organization trains its developers in the use of the proper coding standards. ACME Corporation, builds into its platform the technologies to prevent cross - site script forgery and malicious code injection. Code reviews are performed to monitor assess and detect vulnerable code during development. The use of mobile code can be disabled on client browsers. Additionally, mobile code can be disabled on client browsers. Please refer to Product Documentation here: http://www.docs.ACME Corporation.com

© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Cloud Controls Matrix (CCM) Version 3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Cloud Controls Matrix v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Cloud Controls Matrix v3.0.1 may not be modified or altered in any way; (c) the Cloud Controls Matrix v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Cloud Controls Matrix v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Controls Matrix Version 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].