# nc_ofi_data

control_id: 5.1
NC_Option1:
  Security policies are not regularly updated to reflect changes in organizational objectives or the external threat landscape, leading to outdated controls.

NC_Option2:
  Lack of detailed guidance within policies for specific scenarios, resulting in inconsistent application of security measures across departments.

NC_Option3:
  Security policies are not effectively communicated to all employees, leaving some personnel unaware of their responsibilities.

NC_Option4:
  Policies do not cover all areas of information security, such as mobile device management or remote working, leaving gaps in the security posture.

OFI_Option1:
  Enhance policies by incorporating feedback from all levels of the organization to ensure they are comprehensive and pragmatic.

OFI_Option2:
  Develop a formal process for the periodic review of policies to ensure they remain aligned with business objectives and emerging threats.

OFI_Option3:
  Implement a training program to improve awareness and understanding of security policies across the organization.

OFI_Option4:
  Integrate security policies with other management systems (e.g., quality, health, and safety) to foster a holistic approach to organizational risk management.


control_id: 5.2
NC_Option1:
  Roles and responsibilities related to information security are not clearly defined, leading to ambiguity and potential oversight.

NC_Option2:
  Lack of accountability mechanisms for ensuring compliance with information security responsibilities.

NC_Option3:
  Inadequate training and resources provided to individuals assigned security roles, impairing their ability to fulfill their duties effectively.

NC_Option4:
  Security responsibilities are not regularly reviewed or updated in line with organizational changes, leading to misalignments.

OFI_Option1:
  Clarify and document information security roles and responsibilities at all levels of the organization to ensure clear accountability.

OFI_Option2:
  Develop a training and competency framework tailored to specific security roles and responsibilities.

OFI_Option3:
  Establish regular reviews of roles and responsibilities to ensure they align with current organizational needs and security best practices.

OFI_Option4:
  Integrate information security roles and responsibilities into performance management processes to enhance accountability and performance.


control_id: 5.3
NC_Option1: Insufficient segregation of duties in key areas, increasing the risk of fraud or errors.
NC_Option3: Lack of automated monitoring tools to detect violations of segregation of duties principles.
OFI_Option1: Implement automated solutions to enforce and monitor segregation of duties effectively.
OFI_Option2: Regularly review and update the segregation of duties matrix to reflect organizational changes.
NC_Option2:
  Over-reliance on manual controls to enforce segregation of duties, leading to inconsistencies and inefficiencies.

NC_Option4:
  Inadequate documentation and review of segregation of duties, making it difficult to assess compliance and effectiveness.

OFI_Option3:
  Enhance training for employees and management on the importance of segregation of duties in preventing fraud and errors.

OFI_Option4:
  Develop a comprehensive risk assessment process to identify areas where segregation of duties is critical and adjust controls accordingly.


control_id: 5.4
NC_Option3: Insufficient allocation of resources by management to support information security initiatives.
OFI_Option3: Allocate dedicated resources for continuous information security education and awareness programs.
NC_Option1:
  Evidence of management's commitment to information security is sporadic and not consistently demonstrated across the organization.

NC_Option2:
  Management does not regularly review information security performance indicators, missing opportunities for improvement.

NC_Option4:
  Lack of clear communication from management regarding the importance of information security, leading to a lack of engagement at lower levels of the organization.

OFI_Option1:
  Enhance management involvement in setting and reviewing information security objectives to demonstrate commitment and provide clear direction.

OFI_Option2:
  Establish regular information security briefings for management to keep them informed and engaged with the security posture.

OFI_Option4:
  Encourage management to lead by example, such as participating in security training and awareness activities, to reinforce the culture of security.


control_id: 5.5
OFI_Option3: Integrate procedures for contacting authorities into the overall incident response plan.
NC_Option1:
  Procedures for contact with authorities are not clearly defined or documented, leading to confusion during security incidents.

NC_Option2:
  Lack of formal agreements or contacts with relevant authorities for reporting or coordinating in response to security incidents.

NC_Option3:
  Employees are not aware of or trained on the procedures for contacting authorities in the event of a security incident.

NC_Option4:
  No record-keeping or documentation practice in place for interactions with authorities, impacting accountability and follow-up.

OFI_Option1:
  Establish formal agreements and maintain a list of contacts with relevant authorities to streamline communication during incidents.

OFI_Option2:
  Develop and implement training programs to educate employees about when and how to contact authorities.

OFI_Option4:
  Implement a documentation process for all communications with authorities to ensure accountability and facilitate post-incident reviews.


control_id: 5.6
NC_Option3: Lack of a formal mechanism to track and implement changes resulting from policy reviews.
NC_Option1:
  Information security policies are not reviewed at planned intervals or in response to significant changes, leading to outdated policies.

NC_Option2:
  Reviews of policies do not include input from all relevant stakeholders, missing critical perspectives.

NC_Option4:
  Insufficient documentation of the review process, findings, and actions taken, complicating audit trails and accountability.

OFI_Option1:
  Establish a regular schedule for reviewing information security policies, including ad hoc reviews in response to significant changes.

OFI_Option2:
  Involve a wider range of stakeholders in the review process to ensure comprehensive coverage of all relevant areas and perspectives.

OFI_Option3:
  Develop a structured process for documenting, tracking, and implementing changes arising from policy reviews.

OFI_Option4:
  Utilize feedback mechanisms to continuously improve the policy review process based on lessons learned and evolving best practices.


control_id: 5.7
NC_Option1:
  Insufficient mechanisms in place for collecting, analyzing, and acting on threat intelligence, leading to reactive rather than proactive security measures.

NC_Option2:
  Lack of integration between threat intelligence and other security processes, such as incident response and risk management.

NC_Option3:
  The threat intelligence process is not regularly reviewed or updated, leading to stale or irrelevant intelligence.

NC_Option4:
  Limited sharing of threat intelligence within the organization and with external partners, reducing the potential benefits.

OFI_Option1:
  Implement a dedicated threat intelligence platform or service to enhance the collection, analysis, and dissemination of intelligence.

OFI_Option2:
  Integrate threat intelligence into strategic decision-making processes to align security measures with current threats.

OFI_Option3:
  Establish partnerships with external entities for sharing threat intelligence, enhancing the organization's threat landscape awareness.

OFI_Option4:
  Regularly review and update threat intelligence processes to incorporate new sources of intelligence and emerging best practices.


control_id: 5.8
NC_Option3: No formal process for assessing and mitigating security risks at different stages of a project.
OFI_Option3: Integrate security risk assessments as a standard part of the project planning and review phases.
NC_Option1:
  Information security considerations are not consistently integrated into all phases of project management, leading to potential vulnerabilities.

NC_Option2:
  Project managers and teams lack training in incorporating information security into project planning and execution.

NC_Option4:
  Insufficient documentation and tracking of security requirements and controls throughout the project lifecycle.

OFI_Option1:
  Develop and implement a guideline for integrating security considerations into project management methodologies.

OFI_Option2:
  Provide targeted training for project managers and teams on managing information security risks within projects.

OFI_Option4:
  Implement a system for documenting and tracking the fulfillment of security requirements throughout the project lifecycle.


control_id: 5.9
NC_Option1: The inventory of information assets is incomplete or outdated, leading to gaps in protection.
NC_Option2: Lack of ownership or accountability for maintaining the inventory, resulting in inaccuracies.
OFI_Option1: Establish clear responsibilities and processes for updating and maintaining the asset inventory.
NC_Option3:
  Insufficient integration of the asset inventory with other information security processes, such as risk assessment and access control.

NC_Option4:
  No regular review or verification process for the asset inventory to ensure it reflects current assets and their classification.

OFI_Option2:
  Integrate the asset inventory with other security management processes to enhance overall security posture.

OFI_Option3:
  Implement a regular review and verification process for the asset inventory to keep it current and accurate.

OFI_Option4:
  Utilize automated tools to assist in the discovery and classification of assets to improve the completeness and accuracy of the inventory.


control_id: 5.10
NC_Option2: Lack of monitoring and enforcement mechanisms to ensure compliance with the acceptable use policy.
NC_Option1:
  The policy on the acceptable use of information assets is not comprehensively communicated to all employees, leading to potential misuse.

NC_Option3:
  The acceptable use policy does not cover all types of assets or all potential use cases, leaving gaps in guidance.

NC_Option4:
  No regular review or update of the acceptable use policy to reflect changes in technology or business practices.

OFI_Option1:
  Enhance communication and training on the acceptable use policy to ensure widespread understanding and compliance.

OFI_Option2:
  Implement monitoring tools and procedures to detect and address violations of the acceptable use policy.

OFI_Option3:
  Expand the scope of the acceptable use policy to cover emerging technologies and new types of information assets.

OFI_Option4:
  Establish a regular review process for the acceptable use policy to ensure it remains relevant and effective.


control_id: 5.11
NC_Option4: Inadequate record-keeping of asset returns, hindering accountability and asset management.
OFI_Option1: Implement a comprehensive asset return process, including clear guidelines and responsibilities.
OFI_Option2: Develop secure and verifiable methods for the return of sensitive assets to ensure their integrity.
OFI_Option3: Enhance training for employees and managers on the importance and process of asset return.
NC_Option1:
  No formal process in place for tracking or ensuring the return of assets upon employee termination or role change, risking loss or misuse of assets.

NC_Option2:
  Insufficient clarity on the responsibilities for asset return, leading to inconsistencies in enforcement.

NC_Option3:
  Lack of secure procedures for the return of sensitive or high-value assets, potentially compromising information security.

OFI_Option4:
  Integrate asset return procedures with the organizationâ€™s asset management system for improved tracking and accountability.


control_id: 5.12
NC_Option2: Lack of awareness among employees about classification schemes and their importance.
NC_Option3: Inconsistent application of classification levels across different departments or units.
NC_Option1:
  Information is not consistently classified, leading to inappropriate handling and protection levels.

NC_Option4:
  No regular review or update of classification guidelines to reflect changes in information sensitivity or business requirements.

OFI_Option1:
  Standardize an information classification framework and ensure it is well communicated across the organization.

OFI_Option2:
  Conduct regular training sessions to enhance employee understanding and compliance with classification policies.

OFI_Option3:
  Implement a periodic review process for classification policies to ensure they remain relevant and effective.

OFI_Option4:
  Leverage technology to assist in the classification and protection of information based on its sensitivity.


control_id: 5.14
NC_Option1: Secure transfer protocols are not consistently applied, risking data breaches during transmission.
NC_Option2: Employees lack understanding of secure transfer methods for different types of information.
NC_Option3: Insufficient controls over external transfer points, such as third-party services or cloud storage.
NC_Option4: No formal process for reviewing and approving information transfers, especially for sensitive data.
OFI_Option1: Standardize secure transfer protocols and ensure they are integrated into daily operations.
OFI_Option2:
  Provide targeted training on secure information transfer practices, tailored to different roles and data types.

OFI_Option3:
  Establish and enforce policies for the use of external transfer services, including vetting and secure configuration.

OFI_Option4:
  Implement a formal approval process for sensitive information transfers, incorporating need-to-know and least privilege principles.


control_id: 5.15
NC_Option1: Access control measures are not consistently applied or monitored, leading to unauthorized access.
NC_Option2: Inadequate processes for updating access rights following role changes or terminations.
NC_Option4: Insufficient use of multi-factor authentication for accessing sensitive systems and data.
OFI_Option1: Strengthen access control policies and procedures, including regular reviews and updates.
NC_Option3:
  Lack of awareness among employees about secure access practices and the risks of sharing credentials.

OFI_Option2:
  Implement comprehensive training programs on secure access practices and the importance of maintaining strict access control.

OFI_Option3:
  Enhance monitoring and logging of access events to quickly identify and respond to unauthorized access attempts.

OFI_Option4:
  Expand the use of multi-factor authentication across all systems, especially those containing sensitive or critical information.


control_id: 5.16
NC_Option3: Insufficient verification processes for identity creation, modification, and deletion.
OFI_Option1: Implement a unified identity management system to streamline the administration of user identities.
OFI_Option2: Establish rigorous procedures for the lifecycle management of identities, including regular audits.
NC_Option1:
  Inconsistent application of identity management practices, leading to potential security vulnerabilities.

NC_Option2:
  Lack of a centralized system for managing user identities across different platforms and applications.

NC_Option4:
  Limited training on the importance of secure identity management and the potential risks of negligence.

OFI_Option3:
  Provide education and awareness programs focused on the significance of identity management and security.

OFI_Option4:
  Integrate advanced technologies, such as biometrics or AI, to enhance the security and efficiency of identity management processes.


control_id: 5.17
NC_Option2: Employees use weak or reused passwords due to lack of enforced password policies.
NC_Option3: Insufficient security measures for the storage and transmission of biometric data.
OFI_Option2: Enhance protection of biometric data with encryption and secure storage practices.
NC_Option1:
  Authentication information, such as passwords and biometric data, is not adequately protected, risking exposure and unauthorized access.

NC_Option4:
  Lack of regular updates or changes to authentication information, leaving systems vulnerable over time.

OFI_Option1:
  Implement and enforce strong password policies, including complexity requirements and regular changes.

OFI_Option3:
  Educate employees on the importance of securing authentication information and the potential risks of negligence.

OFI_Option4:
  Introduce multi-factor authentication to add an extra layer of security beyond just passwords or biometric data.


control_id: 5.18
NC_Option1:
  Access rights are not always granted based on the principle of least privilege, leading to excessive permissions.

NC_Option2:
  Inadequate review and revocation process for access rights, allowing former employees or those who have changed roles to retain unnecessary access.

NC_Option3:
  Lack of automated systems to manage access rights efficiently, leading to delays and potential errors.

NC_Option4:
  Insufficient monitoring and logging of access rights changes, hindering the ability to audit and review access controls effectively.

OFI_Option1:
  Implement a formalized process for granting, reviewing, and revoking access rights, ensuring alignment with the principle of least privilege.

OFI_Option2:
  Utilize automated identity and access management solutions to streamline access rights administration.

OFI_Option3:
  Conduct regular access rights audits to ensure compliance with policies and to identify any discrepancies.

OFI_Option4:
  Enhance awareness and training for managers and IT staff on the importance of diligent access rights management.


control_id: 5.19
NC_Option3: Insufficient monitoring of supplier compliance with information security agreements.
OFI_Option1: Develop and implement a comprehensive supplier security assessment and monitoring program.
OFI_Option2: Establish clear information security requirements and expectations for all suppliers.
NC_Option1:
  Supplier security policies and practices are not adequately assessed, leading to potential vulnerabilities in the supply chain.

NC_Option2:
  Lack of clear information security requirements for suppliers, resulting in inconsistent security postures.

NC_Option4:
  Inadequate incident response plans for security breaches involving suppliers, risking delayed or uncoordinated responses.

OFI_Option3:
  Regularly review and update security requirements in supplier agreements to reflect changing threats and business needs.

OFI_Option4:
  Collaborate with suppliers to develop joint incident response plans, ensuring prompt and effective action in the event of a breach.


control_id: 5.20
OFI_Option1: Specify detailed information security requirements and expectations in all supplier agreements.
NC_Option1:
  Information security clauses in supplier agreements are vague or insufficient, providing inadequate protection.

NC_Option2:
  Lack of regular reviews of supplier agreements to ensure ongoing compliance with information security requirements.

NC_Option3:
  Supplier agreements do not specify responsibilities or processes for breach notification and response.

NC_Option4:
  Insufficient due diligence in verifying supplier adherence to agreed information security standards and practices.

OFI_Option2:
  Include clauses in supplier agreements that define the process for breach notification, investigation, and response.

OFI_Option3:
  Conduct regular audits or assessments of suppliers to verify compliance with information security clauses.

OFI_Option4:
  Enhance supplier onboarding processes to include thorough information security evaluations and alignment discussions.


control_id: 5.21
NC_Option2: Lack of defined security requirements and controls for suppliers within the ICT supply chain.
NC_Option4: No formal process for managing and updating supplier security requirements as threats evolve.
NC_Option1:
  Inadequate assessment of ICT supply chain risks, leading to potential vulnerabilities from suppliers.

NC_Option3:
  Insufficient due diligence and monitoring of suppliers' compliance with information security standards.

OFI_Option1:
  Implement a comprehensive risk management process for the ICT supply chain to identify and mitigate potential threats.

OFI_Option2:
  Develop clear security requirements for ICT supply chain partners, including regular security assessments.

OFI_Option3:
  Establish ongoing monitoring and reporting mechanisms to ensure supplier compliance with security requirements.

OFI_Option4:
  Regularly review and adjust security requirements for suppliers to address new and emerging threats.


control_id: 5.22
NC_Option3: No clear criteria or processes for evaluating the security impact of changes in supplier services.
NC_Option1:
  Lack of systematic monitoring and review processes for supplier services, potentially missing non-compliance or security gaps.

NC_Option2:
  Ineffective change management processes with suppliers, risking unassessed security implications of service changes.

NC_Option4:
  Limited communication and coordination with suppliers regarding changes, leading to misunderstandings and potential security risks.

OFI_Option1:
  Establish robust monitoring and review processes to evaluate the security posture of supplier services continuously.

OFI_Option2:
  Develop a formal change management process that includes security impact assessments for any changes in supplier services.

OFI_Option3:
  Enhance collaboration with suppliers to ensure any changes are communicated and agreed upon, including security implications.

OFI_Option4:
  Implement a feedback mechanism with suppliers to continuously improve the security and resilience of supplied services.


control_id: 5.23
NC_Option1: Insufficient evaluation of cloud service providers' security measures before adoption.
NC_Option3: Inadequate controls and processes for securing data stored or processed in the cloud.
NC_Option4: No comprehensive incident response plan that includes cloud services.
OFI_Option1: Conduct thorough security assessments of potential cloud service providers before engagement.
OFI_Option2: Clearly define and document security responsibilities with cloud service providers.
OFI_Option3: Implement strong encryption and access controls for data stored or processed in the cloud.
NC_Option2:
  Lack of clarity in the division of security responsibilities between the organization and cloud service providers.

OFI_Option4:
  Develop and test an incident response plan that specifically addresses potential cloud service incidents.


control_id: 5.24
NC_Option1:
  Lack of a formal incident management plan, leaving the organization unprepared for information security incidents.

NC_Option2:
  Insufficient allocation of resources, including personnel and technology, for effective incident management.

NC_Option3:
  Incident response teams lack training or are unaware of their roles and responsibilities in an incident.

NC_Option4:
  No regular testing or updating of the incident management plan to reflect changes in the threat landscape or business operations.

OFI_Option1:
  Develop a comprehensive incident management plan that includes roles, responsibilities, and procedures.

OFI_Option2:
  Allocate appropriate resources for incident management, including establishing a dedicated response team.

OFI_Option3:
  Conduct regular training and exercises to ensure readiness and effectiveness of the incident response team.

OFI_Option4:
  Periodically review and update the incident management plan to ensure its effectiveness and relevance.


control_id: 5.25
NC_Option1: Events are not consistently assessed, leading to potential security incidents being overlooked.
NC_Option2: Lack of clear criteria or processes for the assessment and prioritization of security events.
NC_Option3: Delayed decision-making on security events due to unclear authority or responsibility.
OFI_Option2: Define clear roles and responsibilities for decision-making on security events.
NC_Option4:
  Inadequate documentation and tracking of security events and decisions made, affecting accountability and learning.

OFI_Option1:
  Implement standardized processes for the timely assessment and prioritization of information security events.

OFI_Option3:
  Establish a central logging and analysis capability for better tracking and understanding of security events.

OFI_Option4:
  Enhance communication and reporting mechanisms for security events to ensure timely and informed decisions.


control_id: 5.26
NC_Option2: Communication during incidents is uncoordinated, leading to confusion and inefficiencies.
OFI_Option2: Establish clear communication protocols and channels for use during incidents.
NC_Option1:
  Responses to security incidents are often delayed or ineffective due to a lack of predefined response strategies.

NC_Option3:
  Post-incident activities, such as root cause analysis and mitigation, are not consistently performed.

NC_Option4:
  Limited capability to scale incident response efforts in the face of major or simultaneous incidents.

OFI_Option1:
  Develop and document specific incident response strategies and procedures for different types of incidents.

OFI_Option3:
  Incorporate post-incident activities into the incident response plan to ensure continuous improvement.

OFI_Option4:
  Plan and prepare for scalability in incident response to manage major or concurrent incidents effectively.


control_id: 5.27
NC_Option2: Lack of a formal process for conducting post-incident reviews and implementing recommendations.
NC_Option3: Insufficient involvement of relevant stakeholders in the learning and improvement process.
OFI_Option3: Update policies, procedures, and controls regularly based on insights gained from incidents.
OFI_Option4: Promote a culture of continuous improvement and learning from incidents across the organization.
NC_Option1:
  Lessons learned from incidents are not systematically captured or shared, missing opportunities for improvement.

NC_Option4:
  No regular update of security policies, procedures, and controls based on lessons learned from incidents.

OFI_Option1:
  Implement a structured process for capturing, analyzing, and sharing lessons learned from security incidents.

OFI_Option2:
  Conduct thorough post-incident reviews with all relevant stakeholders to identify improvement opportunities.


control_id: 5.28
NC_Option2: Lack of clear procedures and trained personnel for evidence collection and handling.
NC_Option3: Inadequate storage and management of collected evidence, risking its loss or contamination.
OFI_Option2: Train designated personnel in proper evidence collection techniques and legal requirements.
OFI_Option3: Secure and manage evidence with strict access controls and documentation to maintain its integrity.
NC_Option1:
  Evidence related to security incidents is not collected in a manner that preserves its integrity and admissibility in legal proceedings.

NC_Option4:
  No formal process for documenting the chain of custody for evidence, complicating legal or disciplinary actions.

OFI_Option1:
  Develop and implement standardized procedures for the collection, handling, and storage of evidence.

OFI_Option4:
  Establish a clear and documented chain of custody for all collected evidence to support potential legal actions.


control_id: 5.29
NC_Option2: Lack of clarity on prioritizing information security activities during a disruption.
NC_Option4: No clear roles or responsibilities defined for information security management during disruptions.
OFI_Option2: Define and prioritize critical information security tasks to be maintained during disruptions.
NC_Option1:
  Inadequate planning and preparation for maintaining information security during disruptions, risking data breaches or loss.

NC_Option3:
  Insufficient testing of security measures under conditions of disruption, leading to potential vulnerabilities.

OFI_Option1:
  Integrate information security considerations into business continuity and disaster recovery planning.

OFI_Option3:
  Regularly test and update security measures and procedures to ensure their effectiveness during disruptions.

OFI_Option4:
  Assign and communicate roles and responsibilities for maintaining information security during periods of disruption.


control_id: 5.30
NC_Option2: Insufficient redundancy and failover capabilities for critical ICT systems and data.
NC_Option3: Lack of regular testing and updating of ICT components of business continuity plans.
OFI_Option1: Enhance business continuity plans to include specific strategies and procedures for ICT readiness.
NC_Option1:
  Business continuity plans do not adequately address ICT readiness, potentially leading to extended service outages.

NC_Option4:
  Inadequate training for ICT staff on their roles and responsibilities in business continuity scenarios.

OFI_Option2:
  Implement redundancy and failover mechanisms for all critical ICT systems to ensure continuity of service.

OFI_Option3:
  Conduct regular exercises to test the ICT components of business continuity plans, identifying areas for improvement.

OFI_Option4:
  Provide specialized training for ICT staff on business continuity practices and their specific responsibilities.


control_id: 5.31
OFI_Option3: Integrate compliance mechanisms into the ISMS, including regular audits and assessments.
NC_Option1:
  Insufficient awareness or understanding of applicable legal, statutory, regulatory, and contractual requirements among employees, leading to potential non-compliance.

NC_Option2:
  Lack of processes to regularly update and communicate changes in relevant laws and regulations to all affected parties.

NC_Option3:
  Inadequate assessment and integration of these requirements into the organization’s information security management system (ISMS).

NC_Option4:
  No formal mechanism for ensuring compliance with these requirements, risking legal and financial penalties.

OFI_Option1:
  Develop and implement training programs to increase awareness of relevant legal and regulatory requirements.

OFI_Option2:
  Establish a process for regularly reviewing and updating the organization's compliance with changing requirements.

OFI_Option4:
  Implement a compliance tracking and management tool to monitor adherence to legal and regulatory obligations.


control_id: 5.32
NC_Option3: Insufficient security controls to protect IPR from unauthorized access or theft.
NC_Option4: No formal process for responding to IPR violations or breaches.
OFI_Option1: Conduct an IPR audit to identify and classify intellectual property assets accurately.
OFI_Option2: Implement targeted training and awareness programs focused on IPR protection.
OFI_Option3: Strengthen security measures, including access controls and encryption, to safeguard IPR.
OFI_Option4: Develop a response plan for IPR violations, including legal actions and remediation measures.
NC_Option1:
  Inadequate identification and classification of intellectual property within the organization, risking unintended breaches.

NC_Option2:
  Lack of employee awareness regarding the importance of protecting IPR and the potential consequences of infringement.


control_id: 5.33
NC_Option2: Lack of a comprehensive records management policy that includes security considerations.
NC_Option4: No regular review or auditing of record protection measures to ensure their ongoing effectiveness.
OFI_Option1: Implement robust access control and encryption measures for sensitive records.
OFI_Option2: Develop and communicate a records management policy that incorporates security requirements.
OFI_Option3: Establish and test backup and recovery procedures for all critical records.
NC_Option1:
  Records are not adequately protected against unauthorized access, alteration, or destruction, compromising their integrity and confidentiality.

NC_Option3:
  Insufficient backup and recovery processes for critical records, risking loss in the event of disasters.

OFI_Option4:
  Conduct periodic audits of records protection measures to identify and address potential vulnerabilities.


control_id: 5.34
NC_Option2: Employees are not adequately trained on their responsibilities regarding the protection of PII.
NC_Option3: Insufficient technical controls to secure PII against unauthorized access or disclosure.
NC_Option4: No formal process for responding to privacy breaches or complaints.
OFI_Option1: Develop detailed privacy policies and procedures aligned with legal and regulatory requirements.
OFI_Option2: Conduct regular privacy awareness training for employees.
NC_Option1:
  Lack of comprehensive privacy policies and procedures for managing PII, leading to potential breaches of privacy laws.

OFI_Option3:
  Implement and regularly update technical measures, such as encryption and access controls, to protect PII.

OFI_Option4:
  Establish a privacy breach response protocol, including notification procedures and remediation measures.


control_id: 5.35
NC_Option2: Lack of a formal process for acting on recommendations from independent reviews.
NC_Option3: Independent reviews do not cover all aspects of the ISMS, leaving some areas unchecked.
OFI_Option1: Schedule regular independent reviews of the ISMS to identify and address potential gaps.
OFI_Option2: Develop a structured approach to implement recommendations from independent reviews.
OFI_Option3: Ensure comprehensive coverage of all ISMS components during independent reviews.
NC_Option1:
  Information security practices are not regularly reviewed by independent external parties, leading to potential oversight of weaknesses.

NC_Option4:
  Insufficient frequency of independent reviews to keep pace with changes in the threat landscape and business operations.

OFI_Option4:
  Adjust the frequency of independent reviews based on risk assessment and significant changes in the organization.


control_id: 5.36
NC_Option2: Inadequate monitoring and enforcement of compliance with these policies, rules, and standards.
OFI_Option2: Implement monitoring tools and procedures to ensure compliance with information security policies.
NC_Option1:
  Employees are not fully aware of or do not understand the organization’s information security policies, rules, and standards.

NC_Option3:
  No formal process for regularly reviewing and updating policies, rules, and standards to reflect changes in the security landscape or business needs.

NC_Option4:
  Lack of a mechanism for gathering and incorporating feedback on the effectiveness of existing policies, rules, and standards.

OFI_Option1:
  Enhance awareness and understanding of information security policies through regular training and communication.

OFI_Option3:
  Establish a regular review cycle for policies, rules, and standards to ensure they remain relevant and effective.

OFI_Option4:
  Create a feedback loop with stakeholders to continuously improve the organization’s information security practices.


control_id: 5.37
NC_Option2: Lack of employee awareness and understanding of documented operating procedures.
NC_Option3: Inadequate review and testing of operating procedures to ensure their effectiveness and relevance.
OFI_Option2: Conduct regular training sessions to familiarize employees with the operating procedures.
NC_Option1:
  Operating procedures are not fully documented or are outdated, leading to inconsistencies in operations and security practices.

NC_Option4:
  Operating procedures do not adequately address security considerations or are not aligned with best practices.

OFI_Option1:
  Ensure all operating procedures are thoroughly documented and regularly updated to reflect current practices and technologies.

OFI_Option3:
  Review and test operating procedures periodically to assess their effectiveness and compliance with security requirements.

OFI_Option4:
  Integrate security considerations into all aspects of operating procedures and align them with industry best practices.


control_id: 6.1
NC_Option3: Screening processes are not standardized or consistently applied across the organization.
NC_Option4: Insufficient documentation and record-keeping of screening processes and outcomes.
NC_Option1:
  Incomplete or inadequate screening processes for new hires, risking the employment of individuals with questionable backgrounds.

NC_Option2:
  Lack of periodic re-screening or assessment for existing employees, potentially overlooking changes that could impact security.

OFI_Option1:
  Implement comprehensive and standardized screening procedures for all new hires, including background checks where legally permitted.

OFI_Option2:
  Establish periodic re-screening or review processes for current employees, especially for those in sensitive positions.

OFI_Option3:
  Ensure consistency in the application of screening processes through training and documented procedures.

OFI_Option4:
  Maintain detailed records of all screening activities and outcomes, ensuring compliance with privacy laws.


control_id: 6.2
NC_Option4: Employment contracts do not include provisions for handling security breaches by employees.
OFI_Option4: Include clauses in employment contracts that specify consequences for security policy violations.
NC_Option1:
  Terms and conditions of employment do not clearly articulate information security expectations and responsibilities.

NC_Option2:
  Employees are not adequately informed or reminded of their security obligations as part of their employment terms.

NC_Option3:
  Lack of mechanisms to enforce or monitor compliance with the information security terms outlined in employment contracts.

OFI_Option1:
  Update terms and conditions of employment to include specific information security responsibilities and obligations.

OFI_Option2:
  Ensure that all employees are informed of their security responsibilities at the start of their employment and periodically thereafter.

OFI_Option3:
  Implement monitoring and enforcement mechanisms to ensure compliance with security-related terms and conditions.


control_id: 6.3
NC_Option2: Training content is not updated regularly to reflect the latest threats and security practices.
NC_Option4: Inadequate mechanisms to measure the effectiveness of security awareness and training programs.
OFI_Option2: Regularly review and update training materials to ensure relevance and effectiveness.
NC_Option1:
  Lack of a formal information security awareness program, leading to employees being unaware of security policies and procedures.

NC_Option3:
  Training and awareness activities do not cover all employee groups, leaving some without essential knowledge.

OFI_Option1:
  Develop and implement a comprehensive information security awareness and training program for all employees.

OFI_Option3:
  Ensure that security awareness and training programs are inclusive, covering all parts of the organization.

OFI_Option4:
  Introduce metrics and feedback mechanisms to assess and continuously improve the effectiveness of awareness and training activities.


control_id: 6.4
OFI_Option2: Train managers and HR staff on applying disciplinary measures fairly and consistently.
NC_Option1:
  The disciplinary process for security violations is not clearly defined or communicated to employees.

NC_Option2:
  Inconsistent application of disciplinary measures for security breaches, leading to perceptions of unfairness.

NC_Option3:
  Lack of transparency in the disciplinary process, contributing to employee apprehension and potential non-reporting of incidents.

NC_Option4:
  Disciplinary processes do not include provisions for learning and improvement following security incidents.

OFI_Option1:
  Clearly define and communicate the disciplinary process for security violations, ensuring it is applied consistently.

OFI_Option3:
  Make the disciplinary process transparent, ensuring employees understand the steps and rationale behind disciplinary actions.

OFI_Option4:
  Incorporate a review stage in the disciplinary process to identify lessons learned and opportunities for improvement.


control_id: 6.5
NC_Option2: Employees leaving the organization are not reminded of their ongoing confidentiality obligations.
NC_Option3: No formal exit interviews or procedures to capture feedback and insights from departing employees.
OFI_Option2: Remind departing employees of their confidentiality and non-disclosure obligations post-employment.
NC_Option1:
  Inadequate processes to revoke access rights or retrieve company assets upon termination or role change, risking unauthorized access.

NC_Option4:
  Insufficient communication with new employers regarding an employee's confidentiality obligations, where applicable.

OFI_Option1:
  Implement strict procedures for access revocation and asset retrieval immediately upon termination or employment change.

OFI_Option3:
  Conduct exit interviews to capture valuable feedback and reinforce security awareness and obligations.

OFI_Option4:
  Where legally permissible, communicate with new employers about any ongoing confidentiality obligations of the employee.


control_id: 6.6
NC_Option2: Employees and contractors are not adequately informed about the implications of these agreements.
NC_Option3: Lack of processes to ensure that confidentiality agreements are signed and updated regularly.
NC_Option4: Inadequate enforcement or follow-up on breaches of confidentiality agreements.
OFI_Option4: Implement a mechanism for monitoring compliance with and enforcing confidentiality agreements.
NC_Option1:
  Use of generic or outdated confidentiality or non-disclosure agreements that do not reflect current legal or business needs.

OFI_Option1:
  Review and update confidentiality and non-disclosure agreements to ensure they are comprehensive and up-to-date.

OFI_Option2:
  Provide training and guidance to employees and contractors on the importance and implications of these agreements.

OFI_Option3:
  Establish a management process to ensure all relevant parties have current and signed agreements on file.


control_id: 6.7
NC_Option2: Lack of training for employees on secure remote working practices.
NC_Option3: Remote access solutions do not meet current security standards, risking unauthorized access.
NC_Option4: Inadequate monitoring of remote work activities to detect and respond to security incidents.
NC_Option1:
  Insufficient security controls and guidelines for remote working environments, leading to increased risk of data breaches.

OFI_Option1:
  Develop and communicate comprehensive remote working policies and guidelines, including secure use of personal devices.

OFI_Option2:
  Provide targeted security training for remote workers, focusing on best practices and threat awareness.

OFI_Option3:
  Implement secure remote access solutions, such as VPNs with strong encryption and multi-factor authentication.

OFI_Option4:
  Enhance monitoring and incident response capabilities for remote working activities to quickly identify and mitigate risks.


control_id: 6.8
NC_Option2: Employees are not aware of what constitutes a security event and the importance of reporting.
NC_Option1:
  Lack of a clear and easily accessible mechanism for reporting information security events, leading to underreporting.

NC_Option3:
  No feedback or follow-up provided to individuals reporting security events, leading to a lack of engagement.

NC_Option4:
  Insufficient analysis and aggregation of security event data to identify trends and areas for improvement.

OFI_Option1:
  Implement an intuitive and accessible reporting mechanism for security events, ensuring it is widely communicated.

OFI_Option2:
  Conduct regular awareness campaigns to educate employees on identifying and reporting security events.

OFI_Option3:
  Provide timely feedback to individuals who report security events, encouraging continued engagement.

OFI_Option4:
  Analyze reported security event data systematically to identify patterns and implement preventive measures.


control_id: 7.1
NC_Option1: Inadequate definition and security of physical perimeters, leading to unauthorized access risks.
NC_Option2: Lack of physical barriers and entry controls to secure sensitive areas.
NC_Option4: No regular review or testing of physical perimeter defenses to ensure their effectiveness.
OFI_Option1: Establish clearly defined physical security perimeters with appropriate barriers and controls.
OFI_Option2: Implement access control systems and surveillance to monitor and protect the perimeter.
OFI_Option3: Conduct regular security assessments and drills to test the effectiveness of physical perimeters.
NC_Option3:
  Insufficient monitoring of physical perimeter security, including surveillance and detection systems.

OFI_Option4:
  Upgrade physical security measures based on the latest risk assessments and technological advancements.


control_id: 7.2
NC_Option2: Insufficient control over physical access to sensitive rooms and facilities.
NC_Option3: Lack of security awareness among staff regarding securing offices and facilities.
NC_Option4: Inadequate procedures for responding to physical security breaches.
OFI_Option1: Implement physical security measures (e.g., locks, access control systems) for sensitive areas.
OFI_Option2: Establish strict access policies and procedures for secure areas.
OFI_Option3: Conduct security awareness training focused on physical security responsibilities.
NC_Option1:
  Weak or inconsistent access control measures for entry to secure areas, enabling potential unauthorized access.

OFI_Option4:
  Develop and practice incident response plans for physical security incidents. Physical Security Monitoring


control_id: 7.3
NC_Option1:
  Sensitive information and assets are exposed due to inadequate physical security in offices and facilities.


control_id: 7.5
NC_Option2: Lack of redundancy and resilience in physical infrastructure to withstand environmental threats.
NC_Option3: Inadequate detection and alarm systems for environmental hazards (e.g., fire, flooding).
OFI_Option2: Design and maintain facilities with resilience and redundancy to withstand environmental threats.
OFI_Option3: Install advanced detection and alarm systems for timely warning of environmental hazards.
OFI_Option4: Conduct regular environmental risk assessments to update protection measures as needed.
NC_Option1:
  Insufficient protection measures against natural disasters, leading to potential damage to facilities and data loss.

NC_Option4:
  Poorly designed or maintained facilities that do not account for environmental and physical threats.

OFI_Option1:
  Implement comprehensive environmental threat protection measures, including fire suppression and flood defenses.


control_id: 7.6
NC_Option1: Policies and procedures for working in secure areas are not clearly defined or communicated.
NC_Option2: Insufficient controls to prevent unauthorized access or activities within secure areas.
NC_Option4: Inadequate awareness among staff of the specific requirements for working in secure areas.
OFI_Option1: Clearly define and communicate policies for working in secure areas.
OFI_Option2: Enforce strict access controls and behavior protocols within secure areas.
OFI_Option3: Implement continuous monitoring and surveillance mechanisms in secure areas.
OFI_Option4: Provide targeted security awareness training for staff working in or responsible for secure areas.
NC_Option3:
  Lack of monitoring and surveillance within secure areas to detect and respond to security incidents.


control_id: 7.7
NC_Option2: Lack of awareness among employees about the importance of maintaining a clear desk and screen.
NC_Option3: No regular audits or checks to ensure compliance with clear desk and screen policies.
NC_Option4: Absence of guidelines or tools to facilitate adherence to clear desk and clear screen practices.
OFI_Option1: Strengthen and consistently enforce clear desk and clear screen policies.
OFI_Option2: Conduct awareness campaigns and training on the importance of these policies.
OFI_Option3: Perform regular compliance checks and audits to enforce policy adherence.
NC_Option1:
  Inconsistent enforcement of clear desk and clear screen policies, risking exposure of sensitive information.

OFI_Option4:
  Provide employees with tools and solutions (e.g., automatic screen locks, secure storage) to support compliance.


control_id: 7.8
NC_Option2: Poorly chosen locations for critical equipment, increasing the risk of compromise or damage.
NC_Option3: Lack of physical security measures (e.g., cages, locks) for critical equipment.
OFI_Option1: Implement robust physical security measures for critical equipment.
OFI_Option2: Carefully plan and review the siting of equipment to minimize risk.
OFI_Option3: Use environmental controls (e.g., HVAC, dehumidifiers) to protect equipment.
NC_Option1:
  Inadequate security controls for protecting equipment from unauthorized access or environmental hazards.

NC_Option4:
  Insufficient consideration of environmental factors (e.g., heat, moisture) in the siting of equipment.

OFI_Option4:
  Conduct regular reviews and risk assessments to optimize equipment siting and protection strategies.


control_id: 7.11
NC_Option2: Lack of regular testing or maintenance of backup utilities and systems (e.g., generators, UPS).
NC_Option4: No contingency plans for utility failures, risking operational downtime.
OFI_Option1: Implement redundancy and diversify utility supplies to mitigate single points of failure.
OFI_Option2: Schedule regular maintenance and testing of backup utilities to ensure their reliability.
NC_Option1:
  Dependency on single points of failure in utility supplies (e.g., electricity, water) without adequate redundancy.

NC_Option3:
  Insufficient protection of utility supply points and infrastructure from physical and environmental threats.

OFI_Option3:
  Secure and protect utility supply points and infrastructure against physical and environmental threats.

OFI_Option4:
  Develop and practice contingency plans for handling utility failures to minimize operational impact.


control_id: 7.12
NC_Option1: Exposed or unprotected cabling, risking damage, interception, or unauthorized access.
NC_Option3: Inadequate segregation of sensitive or critical cabling from standard infrastructure.
OFI_Option1: Protect and secure cabling from physical damage and unauthorized access.
OFI_Option2: Document and map all cabling infrastructure for efficient management and response to incidents.
OFI_Option3: Segregate critical and sensitive cables from general infrastructure to enhance security.
OFI_Option4: Implement a regular inspection and maintenance program for all cabling systems.
NC_Option2:
  Lack of documentation or mapping of network and power cabling, complicating maintenance and threat response.

NC_Option4:
  No regular inspections or maintenance of cabling infrastructure, leading to potential vulnerabilities.


control_id: 7.13
NC_Option3: Lack of security controls to protect equipment and data during maintenance activities.
NC_Option4: Insufficient inventory and tracking of maintenance activities and history.
OFI_Option1: Establish a schedule for regular maintenance activities and document all actions taken.
OFI_Option2: Vet and authorize all third-party service providers before allowing access to equipment.
OFI_Option3: Implement security measures to protect equipment and data during maintenance.
OFI_Option4: Maintain a comprehensive inventory and log of maintenance activities for all equipment.
NC_Option1:
  Maintenance activities not performed regularly or documented, risking equipment failure or security vulnerabilities.

NC_Option2:
  Use of unauthorized or unvetted third-party service providers for maintenance, risking data breaches.


control_id: 7.14
NC_Option2: Lack of standardized processes for the secure disposal or repurposing of equipment.
NC_Option3: Insufficient verification of the removal of sensitive data prior to equipment disposal.
NC_Option4: Inadequate awareness among employees regarding secure disposal and re-use practices.
OFI_Option1: Implement and enforce data sanitization and disposal policies for all equipment.
OFI_Option4: Provide training for employees on secure disposal and data sanitization practices.
NC_Option1:
  Sensitive data not adequately erased from equipment before disposal or re-use, risking data breaches.

OFI_Option2:
  Develop standardized processes for secure disposal or re-use, including third-party disposal services vetting.

OFI_Option3:
  Conduct verification checks to ensure data has been securely removed from equipment before disposal.


control_id: 8.1
NC_Option1: Inadequate security controls on user endpoint devices, leading to potential exploitation.
NC_Option2: Lack of consistent policies for the management and security of endpoint devices.
NC_Option4: Poor monitoring and detection of security incidents on endpoint devices.
OFI_Option2: Develop and enforce policies for the use and security of endpoint devices.
OFI_Option3: Provide regular training for users on securing their devices and recognizing potential threats.
OFI_Option4: Enhance monitoring and incident response capabilities for endpoint devices.
NC_Option3:
  Insufficient training for users on the security risks and best practices associated with their devices.

OFI_Option1:
  Implement comprehensive security measures, including encryption and anti-malware protection, on all user endpoint devices.


control_id: 8.2
NC_Option1: Privileged access rights are not tightly controlled, leading to unnecessary risk exposure.
NC_Option2: Lack of regular reviews or audits of privileged access rights to ensure they are still necessary.
NC_Option3: Insufficient separation of duties, allowing for potential misuse of privileged access.
NC_Option4: Inadequate logging and monitoring of actions taken using privileged access.
OFI_Option1: Implement strict controls and approval processes for granting privileged access rights.
OFI_Option3: Enforce separation of duties to minimize risks associated with privileged access.
OFI_Option4: Ensure comprehensive logging and monitoring of privileged access activities.
OFI_Option2:
  Conduct regular reviews and audits of privileged access rights to ensure they are appropriate and necessary.


control_id: 8.3
OFI_Option2: Implement robust access control mechanisms and ensure they are properly configured.
OFI_Option3: Regularly review and adjust access rights to reflect changes in roles or responsibilities.
OFI_Option4: Conduct awareness and training sessions on the importance of information access restrictions.
NC_Option1:
  Access to sensitive information is not adequately restricted, leading to potential unauthorized access.

NC_Option2:
  Ineffective implementation of access control mechanisms, allowing for broader access than necessary.

NC_Option3:
  Lack of regular review of access rights to ensure they align with current roles and responsibilities.

NC_Option4:
  Insufficient user awareness regarding the importance of access restrictions and compliance with policies.

OFI_Option1:
  Tighten access controls to ensure that access to sensitive information is based on the need-to-know principle.


control_id: 8.4
NC_Option2: Lack of segmentation or compartmentalization of access to source code based on project or role.
NC_Option3: Insufficient auditing and logging of access to and modifications of source code.
NC_Option4: Poor implementation of secure repositories or version control systems for source code management.
OFI_Option1: Implement strict access control policies and procedures for source code access.
OFI_Option2: Use segmentation or compartmentalization techniques to limit access based on necessity.
OFI_Option3: Enhance auditing and logging capabilities to track access and changes to source code.
NC_Option1:
  Inadequate control over access to source code, risking intellectual property theft or unauthorized modifications.

OFI_Option4:
  Utilize secure, managed repositories and version control systems for source code storage and tracking.


control_id: 8.5
NC_Option1: Weak authentication mechanisms, leading to potential unauthorized access.
NC_Option2: Lack of multi-factor authentication (MFA) for accessing sensitive systems and data.
NC_Option3: Insufficient user education on creating and managing strong, secure authentication credentials.
OFI_Option1: Strengthen authentication mechanisms across all systems, especially for sensitive data and systems.
OFI_Option2: Implement MFA wherever possible to add an additional layer of security.
OFI_Option3: Provide training and resources to help users create and manage secure authentication credentials.
OFI_Option4: Establish policies for the regular rotation and management of authentication credentials.
NC_Option4:
  Poor management and rotation of authentication credentials, leading to stale or compromised credentials remaining active.


control_id: 8.6
NC_Option1: Inadequate capacity planning, leading to system overloads and potential service disruptions.
NC_Option2: Lack of proactive monitoring and management of system capacity and performance.
NC_Option3: Insufficient scalability planning for future growth, risking performance degradation.
OFI_Option2: Utilize monitoring tools to proactively manage and adjust system capacity as needed.
OFI_Option3: Plan for scalability in system architecture to accommodate future growth.
NC_Option4:
  Poor alignment of capacity management practices with business continuity and disaster recovery planning.

OFI_Option1:
  Implement comprehensive capacity planning and management processes to ensure systems can handle current and projected loads.

OFI_Option4:
  Integrate capacity management with business continuity and disaster recovery planning to ensure resilience.


control_id: 8.7
NC_Option2: Lack of user training on recognizing and avoiding malware threats.
NC_Option3: Inadequate procedures for updating and maintaining anti-malware tools and definitions.
NC_Option4: Poor incident response planning for malware detections and outbreaks.
OFI_Option1: Strengthen anti-malware defenses with comprehensive solutions and regular updates.
OFI_Option2: Conduct regular malware awareness training for all users.
OFI_Option3: Implement robust processes for the regular updating and maintenance of anti-malware solutions.
OFI_Option4: Develop and test incident response plans specifically for managing malware incidents.
NC_Option1:
  Insufficient anti-malware protections across endpoints and networks, leading to vulnerability to infections.


control_id: 8.8
NC_Option1: Lack of a formal process for identifying, assessing, and mitigating technical vulnerabilities.
NC_Option2: Insufficient monitoring for new vulnerabilities affecting systems and software.
NC_Option3: Delayed patching and remediation of identified vulnerabilities.
NC_Option4: Inadequate risk assessment associated with vulnerabilities to prioritize remediation efforts.
OFI_Option2: Implement continuous monitoring for new vulnerabilities and threats.
OFI_Option3: Prioritize and expedite the patching and remediation of critical vulnerabilities.
OFI_Option4: Conduct thorough risk assessments for vulnerabilities to guide remediation priorities.
OFI_Option1:
  Establish a structured vulnerability management program that includes identification, assessment, and mitigation processes.


control_id: 8.11
NC_Option2: Lack of standardized processes for implementing data masking across systems and applications.
NC_Option3: Inadequate understanding among development and testing teams of the importance of data masking.
NC_Option4: Poor management and oversight of data masking practices and tools.
OFI_Option1: Implement data masking in all non-production environments where sensitive data is used.
OFI_Option2: Standardize data masking processes and ensure they are applied consistently.
OFI_Option4: Regularly review and update data masking practices and tools to ensure effectiveness.
NC_Option1:
  Insufficient use of data masking techniques, exposing sensitive information in non-production environments.

OFI_Option3:
  Provide training on data masking techniques and their importance for protecting sensitive information.


control_id: 8.12
NC_Option2: Insufficient monitoring and control of data transfer channels (e.g., email, cloud services).
NC_Option3: Users unaware of data handling policies and the risks of data leakage.
NC_Option4: Inadequate response protocols for detected data leakage incidents.
OFI_Option1: Implement a robust DLP solution to monitor and control sensitive data movements.
OFI_Option2: Monitor and restrict data transfer channels to prevent unauthorized data leakage.
OFI_Option3: Conduct regular data handling and security awareness training for all employees.
OFI_Option4: Develop and test incident response plans for handling data leakage incidents.
NC_Option1:
  Lack of comprehensive data leakage prevention (DLP) strategies and tools, leading to potential data exfiltration.


control_id: 8.13
NC_Option2: Lack of secure and redundant backup storage locations, compromising data recoverability.
NC_Option3: Insufficient testing of backup and restoration processes, leading to potential recovery failures.
NC_Option4: Poor documentation and management of backup schedules and policies.
OFI_Option1: Ensure regular, comprehensive backups of all critical data.
OFI_Option2: Implement secure, geographically redundant storage solutions for backups.
OFI_Option3: Regularly test backup and restoration processes to ensure data recoverability.
OFI_Option4: Maintain detailed documentation of backup schedules, policies, and test results.
NC_Option1:
  Incomplete or infrequent backups, risking data loss in the event of system failures or cyber incidents.


control_id: 8.14
NC_Option2: Insufficient planning for scalable and redundant system architecture.
NC_Option3: Inadequate testing of redundancy measures to ensure their effectiveness in failover scenarios.
NC_Option4: Poor integration of redundancy planning with business continuity and disaster recovery strategies.
OFI_Option2: Ensure scalability in the planning of redundant systems to accommodate future growth.
OFI_Option4: Closely align redundancy planning with overall business continuity and disaster recovery planning.
NC_Option1:
  Lack of redundancy for critical information processing facilities, leading to potential single points of failure.

OFI_Option1:
  Design and implement redundant systems and architectures for critical information processing facilities.

OFI_Option3:
  Regularly test redundancy and failover mechanisms to ensure seamless operation during system failures.


control_id: 8.15
NC_Option2: Logs are not securely stored or protected, risking tampering or unauthorized access.
NC_Option3: Lack of regular review and analysis of logs to detect and respond to security incidents.
OFI_Option1: Implement comprehensive logging of all security-relevant events across systems and networks.
OFI_Option2: Securely store and protect logs to ensure their integrity and confidentiality.
OFI_Option3: Regularly review and analyze logs to quickly detect and respond to potential security incidents.
OFI_Option4: Establish appropriate log retention policies in line with regulatory and business requirements.
NC_Option1:
  Inadequate logging of security-relevant events, limiting visibility into potential security incidents.

NC_Option4:
  Insufficient retention policies for logs, potentially compromising investigation and compliance efforts.


control_id: 8.16
NC_Option2: Insufficient correlation and analysis of monitoring data to identify potential security incidents.
NC_Option4: Poor integration of monitoring tools and processes with other security systems.
OFI_Option1: Implement continuous monitoring of all critical network and system activities.
OFI_Option2: Utilize advanced correlation and analysis techniques to enhance detection of security incidents.
OFI_Option3: Develop and test incident response protocols to ensure swift action on monitoring alerts.
OFI_Option4: Integrate monitoring systems with other security tools for a unified security posture.
NC_Option1:
  Lack of comprehensive monitoring of network and system activities, leaving gaps in security coverage.

NC_Option3:
  Inadequate response capabilities to monitoring alerts, leading to delayed or ineffective incident response.


control_id: 8.17
NC_Option2: Lack of secure and reliable time synchronization sources.
NC_Option3: Insufficient accuracy of system clocks, affecting timestamp reliability for security events.
NC_Option4: Poor management and monitoring of clock synchronization status across the infrastructure.
OFI_Option1: Standardize on secure and reliable time sources for all systems and networks.
OFI_Option2: Implement protocols (e.g., NTP) to ensure accurate and synchronized system clocks.
OFI_Option3: Regularly monitor and adjust clock synchronization to maintain accuracy.
OFI_Option4: Develop management processes to ensure consistent clock synchronization status across all assets.
NC_Option1:
  Inconsistent time sources across systems, leading to potential issues in log correlation and incident investigation.


control_id: 8.18
NC_Option2: Lack of auditing and monitoring for activities involving privileged utilities.
NC_Option3: Inadequate training for users on the risks and proper use of privileged utility programs.
NC_Option4: Absence of policies defining acceptable use and management of privileged utilities.
OFI_Option1: Implement strict access controls and usage policies for privileged utility programs.
OFI_Option2: Enable detailed logging and real-time monitoring of privileged utility usage.
OFI_Option3: Provide specialized training for authorized users on the secure use of privileged utilities.
NC_Option1:
  Insufficient controls over the use of privileged utility programs, risking misuse or unauthorized access.

OFI_Option4:
  Regularly review and update policies and controls related to privileged utilities to adapt to new threats.


control_id: 8.19
NC_Option2: Insufficient testing of new software before installation on operational systems.
NC_Option3: No clear inventory or documentation of installed software, complicating management and security.
NC_Option4: Inadequate rollback procedures for unauthorized or problematic software installations.
OFI_Option1: Establish formal procedures for software installation approvals and documentation.
OFI_Option2: Implement pre-installation testing processes to ensure compatibility and security.
OFI_Option3: Maintain an up-to-date inventory of all installed software and associated security configurations.
OFI_Option4: Develop and test rollback procedures for reversing unauthorized or faulty installations.
NC_Option1:
  Lack of formal processes for approving and managing software installations, leading to potential vulnerabilities.


control_id: 8.20
NC_Option2: Insufficient encryption of sensitive data in transit across networks.
NC_Option3: Lack of continuous monitoring and detection of suspicious network activities.
NC_Option4: Outdated or unpatched network devices exposing known vulnerabilities.
OFI_Option2: Enforce strong encryption standards for data in transit across the network.
OFI_Option3: Utilize advanced network monitoring and anomaly detection tools to identify and respond to threats.
OFI_Option4: Establish a regular patch management process for network devices and infrastructure.
NC_Option1:
  Inadequate segmentation and control of network traffic, leading to potential lateral movement by attackers.

OFI_Option1:
  Implement network segmentation and traffic control mechanisms to isolate sensitive systems and data.


control_id: 8.21
NC_Option2: Lack of authentication and access controls for critical network services.
NC_Option3: Inadequate monitoring of network services for unauthorized access attempts or abuse.
OFI_Option1: Harden network services by disabling unnecessary features and securing configurations.
OFI_Option2: Implement robust authentication and access control mechanisms for network services.
OFI_Option3: Enhance monitoring and alerting for suspicious activities related to network services.
OFI_Option4: Maintain comprehensive documentation and management practices for all network services.
NC_Option1:
  Network services exposed to unnecessary risks due to default configurations or unnecessary services running.

NC_Option4:
  Poor documentation and management of network services, leading to inconsistencies in security enforcement.


control_id: 8.22
NC_Option2: Lack of dedicated network segments for sensitive operations or data, compromising data security.
NC_Option3: Ineffective implementation of network segmentation controls, leading to potential bypass.
NC_Option4: Absence of regular reviews or updates to network segregation practices to address evolving threats.
OFI_Option1: Establish strict network segmentation policies to isolate sensitive data and systems.
OFI_Option2: Implement physical or virtual network segregation controls to enhance security.
OFI_Option3: Regularly test and validate the effectiveness of network segregation measures.
NC_Option1:
  Insufficient segregation between internal networks, risking the spread of malware or unauthorized access.

OFI_Option4:
  Continuously review and adapt network segmentation strategies in line with current threats and business needs.


control_id: 8.23
NC_Option1: Inadequate web filtering controls, allowing access to malicious or inappropriate websites.
NC_Option2: Lack of customization or updating of web filtering rules to address emerging threats.
NC_Option3: Insufficient user awareness on the purpose and practices of web filtering.
NC_Option4: No regular review or audit of web filtering logs and effectiveness.
OFI_Option1: Implement dynamic web filtering technologies with real-time threat intelligence.
OFI_Option3: Conduct user training and awareness programs on web security and filtering policies.
OFI_Option2:
  Regularly update and customize web filtering rules based on the evolving threat landscape and business requirements.

OFI_Option4:
  Periodically review and assess the effectiveness of web filtering strategies and adjust as necessary.


control_id: 8.24
NC_Option1: Inconsistent or improper use of cryptographic controls, leading to potential data exposure.
NC_Option2: Use of outdated or weak cryptographic algorithms, compromising data confidentiality and integrity.
NC_Option3: Lack of management and protection of cryptographic keys, risking key exposure or loss.
NC_Option4: Insufficient policies governing the use and management of cryptographic solutions.
OFI_Option1: Standardize the use of strong, industry-accepted cryptographic algorithms and protocols.
OFI_Option3: Develop comprehensive policies and procedures for the use and management of cryptography.
OFI_Option2:
  Implement robust key management practices, including secure storage, rotation, and recovery of cryptographic keys.

OFI_Option4:
  Regularly review and update cryptographic practices to ensure compliance with current standards and threats.


control_id: 8.25
NC_Option1: Lack of integration of security practices throughout the software development life cycle (SDLC).
NC_Option2: Insufficient training for development teams on secure coding practices and threat awareness.
NC_Option3: Inadequate security testing and review processes within the SDLC.
NC_Option4: Poor management of third-party components, leading to embedded vulnerabilities.
OFI_Option2: Provide regular secure coding training and resources to development teams.
OFI_Option3: Implement rigorous security testing and review processes at multiple stages of the SDLC.
OFI_Option1:
  Incorporate security as a fundamental component of the SDLC, from requirements to deployment and maintenance.

OFI_Option4:
  Establish strict policies for the use and management of third-party components, including security vetting.


control_id: 8.26
NC_Option1: Incomplete or unclear security requirements for applications, leading to vulnerabilities.
NC_Option2: Lack of stakeholder involvement in defining application security requirements.
NC_Option4: No regular review or update of security requirements to address new threats or changes.
OFI_Option1: Develop comprehensive and clear security requirements for each application project.
NC_Option3:
  Insufficient documentation and tracking of security requirements throughout the development process.

OFI_Option2:
  Ensure active involvement of all relevant stakeholders in defining and reviewing security requirements.

OFI_Option3:
  Maintain detailed documentation of security requirements and their implementation status throughout the development lifecycle.

OFI_Option4:
  Regularly review and update application security requirements to reflect evolving threats and business needs.


control_id: 8.27
NC_Option1: Systems designed without considering security principles, leading to inherent vulnerabilities.
NC_Option2: Lack of adherence to secure architecture and engineering standards.
NC_Option3: Insufficient review or assessment of architecture from a security perspective.
NC_Option4: Poor documentation and communication of secure architecture principles and standards.
OFI_Option1: Embed security considerations in the initial phases of system architecture and design.
OFI_Option2: Develop and enforce standards for secure system architecture and engineering practices.
OFI_Option3:
  Conduct security assessments of system architectures to identify and mitigate potential vulnerabilities.

OFI_Option4:
  Maintain comprehensive documentation of secure architecture principles and ensure they are communicated effectively to all relevant parties.


control_id: 8.29
NC_Option1: Security testing not integrated into the development and acceptance processes.
NC_Option2: Inadequate coverage or depth of security testing, missing critical vulnerabilities.
NC_Option3: Lack of specialized security testing skills within the development or QA teams.
NC_Option4: Insufficient tracking and remediation of identified security issues during testing phases.
OFI_Option1: Integrate comprehensive security testing into all stages of development and acceptance testing.
OFI_Option3: Develop or acquire specialized security testing expertise within the team or through partnerships.
OFI_Option2:
  Enhance the scope and depth of security testing to cover all critical areas and potential threat vectors.

OFI_Option4:
  Establish a robust process for tracking, prioritizing, and remediating security issues identified during testing.


control_id: 8.30
NC_Option1: Inadequate oversight and management of security practices in outsourced development projects.
NC_Option2: Outsourced development not held to the same security standards as in-house development.
NC_Option3: Lack of clarity and enforcement of security requirements in contracts with outsourcing partners.
NC_Option4: Insufficient verification of the security of deliverables from outsourced development projects.
OFI_Option1: Implement strict security standards and oversight mechanisms for outsourced development projects.
OFI_Option3: Conduct regular security assessments and audits of outsourcing partners and their deliverables.
OFI_Option2:
  Ensure that security requirements are clearly defined and integrated into contracts with outsourcing partners.

OFI_Option4:
  Develop a process for the thorough verification of security in deliverables from outsourced projects.


control_id: 8.31
NC_Option2: Use of production data in development or test environments without proper sanitization.
NC_Option3: Lack of controls to prevent untested or unauthorized code from being deployed to production.
NC_Option4: Inadequate access controls and monitoring across different environments.
OFI_Option2: Implement data masking or sanitization practices for using production data in lower environments.
NC_Option1:
  Insufficient separation between development, test, and production environments, risking accidental or unauthorized access.

OFI_Option1:
  Enforce strict separation and access controls between development, test, and production environments.

OFI_Option3:
  Establish rigorous deployment procedures to ensure only approved, tested code is moved to production.

OFI_Option4:
  Enhance monitoring and logging across all environments to detect and respond to unauthorized activities.


control_id: 8.33
NC_Option1: Use of sensitive or real user data in test environments without adequate protection.
NC_Option2: Insufficient cleanup of test data, risking data leakage or unauthorized access.
NC_Option3: Lack of policies governing the creation, use, and disposal of test data.
NC_Option4: Poor segregation of test information from production systems and data.
OFI_Option2: Ensure secure storage and regular cleanup of test data to prevent leakage.
OFI_Option4: Regularly audit and monitor the use of test data to ensure compliance with security policies.
OFI_Option1:
  Implement policies and procedures for managing test data, including the use of anonymized or synthetic data where possible.

OFI_Option3:
  Establish clear guidelines for the segregation and protection of test information from production environments.


control_id: 8.34
NC_Option1: Audit testing activities potentially impacting system stability or security.
NC_Option3: Insufficient guidelines on conducting audit tests without compromising system security.
NC_Option4: Lack of post-audit reviews to assess the impact of testing activities on system security.
OFI_Option3: Provide guidelines and training for auditors on secure testing practices.
NC_Option2:
  Lack of coordination between auditors and IT teams, leading to potential disruptions or overlooked vulnerabilities.

OFI_Option1:
  Develop and implement protocols for conducting audit tests that minimize impact on system security and operations.

OFI_Option2:
  Enhance coordination and communication between auditors and IT teams to ensure smooth audit processes.

OFI_Option4:
  Conduct thorough post-audit reviews to evaluate the impact of testing activities and to reinforce system security.


# users

username: yigal@titans2.com
role: Admin
created_at: 2024-02-13 20:31:57
first_name: Yigal
last_name: Akerman
last_login: 2024-05-19 13:56:49.263609
customer_id: 4
Status: Active
password_change: FALSE
password:
  scrypt:32768:8:1$4xcR5YLHPEXYdDcE$792bb0a208236ca1cb8c14e703ecf2596889e71d51f58a0715f733a88a2eda54813c85af5665a70bb1e258152346b3a578712a879721e3bd8f6ec904499be02a


username: user@user.com
role: Customer
created_at: 2024-04-23 13:27:42
first_name: Thomas
last_name: Shelby
last_login: 2024-05-23 17:07:04.986497
Status: Disabled
password_change: FALSE
password:
  scrypt:32768:8:1$yPxqPhBPS9TD1tNU$8e48042b656526b4296fa2a0e73e67e8248f704b2c42d013b4b3667e32ee80a22810f596462bdcd9565db25c5dfec4ae79abf9c98a4385dcc71429b289d13165


username: sapir@titans2.com
role: Consultant
created_at: 2024-04-23 17:22:47
first_name: Sapir
last_name: Lif
last_login: 2024-05-23 16:14:44.132600
Status: Active
password_change: FALSE
password:
  scrypt:32768:8:1$Yl7kW7jAg7yI0FZW$b43584104521e1d94b5baa01df08ee9f1d888d9ecc3149f1681361784dfc359c171dc835d5e7281a2db732959d8138deca0466cf9fb9405f963a3633a45591f5


username: dev.stallyons@gmail.com
role: Admin
created_at: 2024-04-29 19:29:04
first_name: dev
last_name: sty
last_login: 2024-05-30 14:11:03.837207
Status: Active
password_change: 0
password:
  scrypt:32768:8:1$Rh4iwyasmuvYB6Cz$5aef61c603eacc5bb0fc635e478b7bf38408cf9c7b766f9c61838bf992a6f4020f7bc3da9f2b31368a036e0ff4407cb54f98fe442f4122a4d1c3fa84856ffd0a


username: thefaizan@gmail.com
role: User
created_at: 2024-05-09 11:07:04
first_name: Faizan
last_name: sty
last_login: 2024-05-20 06:12:33.482052
Status: Active
password_change: FALSE
password:
  scrypt:32768:8:1$oEmBK96USO6vg65u$d3660b3b073f12f28540ec65d997e3c26515ea3bb1d0eaf2c29cb8c58f0fc4f0e0debb0b63c9c2090dba76c3fd12a2578e6904b76da54beb84ce245c05038869


username: moiz@gmail.com
role: User
created_at: 2024-05-23 14:45:44
first_name: moiz
last_name: sty
Status: Disabled
password_change: FALSE
password:
  scrypt:32768:8:1$wIXYECVyEYf4wZqE$fc78b4a52bc2e78a21f071b49edbb818787236a4529c874d5290fdfa1fbb1e3a499b500697435b605379a83282743ce0f334c873188c8ca7a911279040556ab9


username: Stallyons Tester
role: Admin
created_at: 2024-05-28 14:12:55
last_login: 2024-05-30 07:26:23.753793
Status: Active
password_change: FALSE
google_id: google-oauth2|117466191894778200464
password:
  scrypt:32768:8:1$bBUPyLC10lXUBiwb$7ee8a47b96607314b6cf4287811a209250120794268f83840d9e6aaa3122bce527fb461dd3fca2edf9a996cc3e2e09f22f6ebd4f4d31bee9957cb981ad41b105


username: Anas Mushtaq
role: Admin
created_at: 2024-05-28 14:16:39
last_login: 2024-05-30 06:41:53.730657
Status: Active
password_change: FALSE
microsoft_id: windowslive|690b8a42eebdfc19
password:
  scrypt:32768:8:1$Ttiu33wmiJcFsd7A$90b953da221c9944cb080f41119d6726c91af9e51258b31b11522ad6bc4ae0987bb22272fb3d1e775460c86c236b1046f10d2943d17b7652dd884eea62a31031


# goals

security_goal: Develop Security Awareness Program
baseline: 0
target: 100.00%
due_date: Q4-2024
internal_time: 10 hours
owner: CISO + IT Manager
description:
  Develop a full awareness program for all company's employees according to the relevant target audience.


security_goal: Implement, review, update and enforce Information Security and Procedures
baseline: 0
target: 40.00%
due_date: Q4-2024
internal_time: Consistent
owner: CISO + IT Manager
description:
  Implement, review, update and enforce Information Security and Procedures to match the company activities


security_goal: Data Classification Policy Implementation and Enforcement
baseline: 0
target: 20.00%
due_date: Q4-2024
internal_time: Consistent
owner: IT Manager
description:
  Make sure that the Classification Policy is well implemented and enforced for the following departments (HR, Finance)


# kpis

audit_mechanisms: On-Site Audit / Remotely
periodical_review: Annually
target: 70.00%
future_target: 85.00%
owner: CISO
due_date: Q1 2025
results: 70.00%
objective:
  Measure the percentage of employees that passed an effectiveness testing for the security awareness training


# ISO27001

part: Annex A
chapter_name: Organizational Controls
control_id: 5.4
control_text: Management responsibilities
requirements: Documentation of management roles, responsibilities, and authorities.
explanation:
  Ensure management actively supports and guides security efforts in compliance with business and legal standards.


part: Annex A
chapter_name: Organizational Controls
control_id: 5.21
control_text: Managing information security in the information and communication technology (ICT) supply chain
requirements: Procedures for managing ICT supply chain risks, including assessments and audits.
explanation:
  Secure ICT products and services during the lifecycle by checking risks, setting security rules, and monitoring suppliers.


part: Annex A
chapter_name: Organizational Controls
control_id: 5.29
control_text: Information security during disruption
requirements: Plans and procedures to ensure information security during disruptions.
explanation:
  Maintain the integrity, availability, and confidentiality of information during unexpected or planned disruptions to normal operations.


part: ISMS
chapter_name: Context of the Organization
control_id: 4.1
control_text: Understanding the organization and its context
requirements: Documented analysis of internal and external issues affecting the ISMS.
explanation:
  Enables the organization to align its ISMS with strategic objectives by understanding internal and external factors.


part: ISMS
chapter_name: Context of the Organization
control_id: 4.4
control_text: Information security management system (ISMS)
requirements: Documentation of the ISMS, including policies, objectives, and processes.
explanation:
  Provides a comprehensive framework for managing and protecting organizational information through policy, objectives, and procedures.


part: ISMS
chapter_name: Leadership
control_id: 5.1
control_text: Leadership and commitment
explanation: Demonstrates top management’s commitment to the ISMS, fostering a security-conscious culture.
requirements:
  Evidence of leadership involvement, such as meeting minutes and policies endorsed by top management.


part: ISMS
chapter_name: Leadership
control_id: 5.2
control_text: Information security policy
requirements: A documented information security policy that is approved by management and communicated.
explanation:
  Establishes the direction and support for information security in accordance with business requirements and relevant laws.


part: ISMS
chapter_name: Leadership
control_id: 5.3
control_text: Organizational roles, responsibilities, and authorities
requirements: Documentation defining roles, responsibilities, and authorities for information security.
explanation:
  Clarifies information security responsibilities within the organization to ensure accountability and effective management of security tasks.


part: ISMS
chapter_name: Planning
control_id: 6.1
control_text: Actions to address risks and opportunities
requirements: Risk assessments, risk treatment plans, and records of risk treatment actions taken.
explanation:
  Identifies and addresses risks and opportunities, enhancing the ISMS’s ability to achieve intended outcomes.


part: ISMS
chapter_name: Planning
control_id: 6.2
control_text: Information security objectives and planning to achieve them
requirements: Documented information security objectives at relevant functions and levels.
explanation:
  Sets measurable information security objectives to drive continual improvement and compliance with business, legal, and regulatory requirements.


part: ISMS
chapter_name: Support
control_id: 7.1
control_text: Resources
requirements:
  Records of resources allocated to the ISMS, including human, technological, and financial resources.

explanation:
  Ensures adequate resources are dedicated to information security, enabling the organization to meet its security objectives.


part: ISMS
chapter_name: Support
control_id: 7.2
control_text: Competence
requirements: Records of skills and qualifications of personnel, training programs, and competence assessments.
explanation:
  Assures personnel managing ISMS processes are competent, contributing to the effectiveness of the ISMS.


part: ISMS
chapter_name: Support
control_id: 7.3
control_text: Awareness
requirements: Evidence of awareness programs and communications about information security policies and roles.
explanation:
  Promotes information security awareness throughout the organization to protect information assets effectively.


part: ISMS
chapter_name: Support
control_id: 7.4
control_text: Communication
requirements: Documentation of internal and external communication related to the ISMS.
explanation:
  Facilitates effective communication strategies for information security, ensuring all personnel are informed of their roles and responsibilities.


part: ISMS
chapter_name: Support
control_id: 7.5
control_text: Documented information
requirements: Records of the creation, updating, and control of documented information required by the ISMS.
explanation:
  Ensures the integrity and availability of documentation for the ISMS, supporting operational effectiveness and compliance.


part: ISMS
chapter_name: Operation
control_id: 8.1
control_text: Operational planning and control
requirements:
  Operational plans integrating information security requirements and records of operational controls.

explanation:
  Integrates information security into operational processes, ensuring secure operations through planned actions and controls.


part: ISMS
chapter_name: Operation
control_id: 8.2
control_text: Information security risk assessment
requirements: Detailed risk assessment reports, including methodologies, risk criteria, and results.
explanation:
  Identifies information security risks, allowing the organization to prioritize and manage them effectively.


part: ISMS
chapter_name: Operation
control_id: 8.3
control_text: Information security risk treatment
requirements: Risk treatment plans, including chosen controls and evidence of control implementation.
explanation:
  Demonstrates the organization's approach to mitigating or accepting identified risks, ensuring effective risk management.


part: ISMS
chapter_name: Performance Evaluation
control_id: 9.1
control_text: Monitoring, measurement, analysis, and evaluation
requirements:
  Records of monitoring and measurement of information security performance and evaluation of controls.

explanation:
  Enables ongoing review and measurement of the ISMS’s performance to ensure security objectives are being met.


part: ISMS
chapter_name: Performance Evaluation
control_id: 9.2
control_text: Internal audit
requirements: Internal audit program and reports, including evidence of follow-up actions.
explanation:
  Provides an independent assessment of the ISMS to determine conformity with organizational and regulatory requirements.


part: ISMS
chapter_name: Performance Evaluation
control_id: 9.3
control_text: Management review
requirements: Records of management reviews of the ISMS, including decisions made and actions taken.
explanation:
  Ensures top management reviews the ISMS regularly, ensuring its continuing suitability, adequacy, and effectiveness.


part: ISMS
chapter_name: Improvement
control_id: 10.1
control_text: Nonconformity and corrective action
requirements: Records of identified nonconformities, actions taken, and results of corrective actions.
explanation:
  Facilitates the identification and correction of nonconformities, enhancing the ISMS's effectiveness and integrity.


# soa_default

control_id: 5.7
control_text: Threat intelligence
current_control: Threat Intelligence Program
accountability: CISO
remarks_implementation:
  A system for gathering and analyzing threat intelligence is active and integrated with incident response.


control_id: 5.31
control_text: Legal, statutory, regulatory and contractual requirements
current_control: Compliance Management Process
accountability: CISO
remarks_implementation:
  Process in place for ensuring compliance with legal, statutory, regulatory, and contractual requirements.


control_id: 6.1
control_text: Screening
current_control: Pre-employment Screening Policy
accountability: HR Manager
remarks_implementation:
  Screening procedures in place as per HR policy, including background checks and reference verification.


control_id: 6.8
control_text: Information security event reporting
current_control: Information Security Event Reporting
accountability: CISO
remarks_implementation:
  Established process for reporting information security events, with clear channels and responsibilities.


control_id: 7.1
control_text: Physical security perimeters
current_control: Physical Security Perimeter
accountability: CISO
remarks_implementation:
  Physical security perimeters established and maintained around sensitive areas, with entry controls.


control_id: 7.7
control_text: Clear desk and clear screen
current_control: Public Access, Delivery, and Loading Areas
accountability: CISO
remarks_implementation:
  Acceptable Use Policy; In addition, the Clear Desk Policy is communicated in the quarterly security awareness presentation and IS monthly tips.


control_id: 7.8
control_text: Equipment siting and protection
current_control: Equipment Siting and Protection
accountability: CISO
remarks_implementation:
  Equipment is positioned and protected to reduce risks from environmental hazards and unauthorized access.


control_id: 8.1
control_text: User end point devices
current_control: Endpoint Security Policy
accountability: IT Manager
remarks_implementation:
  Policy and measures in place for securing user end-point devices including anti-malware and patch management.


control_id: 8.3
control_text: Information access restriction
current_control: Information Access Restriction
accountability: IT Manager
remarks_implementation:
  Access to information is restricted based on user roles and responsibilities, enforced through access control systems.


control_id: 8.4
control_text: Access to source code
current_control: Source Code Access Control
accountability: Director R&D
remarks_implementation:
  Access to source code is strictly controlled and monitored according to the source code security policy.


control_id: 8.5
control_text: Secure authentication
current_control: Authentication Mechanisms
accountability: IT Manager
remarks_implementation:
  Secure authentication mechanisms, including multi-factor authentication, are in place and mandatory for system access.


control_id: 8.8
control_text: Management of technical vulnerabilities
current_control: Technical Vulnerability Management
accountability: CISO , IT Manager , Director of R&D
remarks_implementation:
  Process for timely identification, assessment, and remediation of technical vulnerabilities is established.


control_id: 8.10
control_text: Information deletion
current_control: Information Deletion
accountability: DPO
remarks_implementation:
  Procedures for secure deletion of information are documented and executed in compliance with data retention policies.


control_id: 8.11
control_text: Data masking
current_control: Data Masking
accountability: DPO
remarks_implementation:
  Data masking techniques are applied to protect sensitive information in non-production environments.


control_id: 8.12
control_text: Data leakage prevention
current_control: Data Leakage Prevention
accountability: IT Manager , CISO
remarks_implementation:
  Data leakage prevention mechanisms are not in place to monitor and protect against unauthorized data transfer.


control_id: 8.13
control_text: Information backup
current_control: Backup
accountability: IT Manager
remarks_implementation:
  Backup policies are enforced with regular testing of restore procedures to ensure data recoverability.


control_id: 8.16
control_text: Monitoring activities
current_control: Clock Synchronization
accountability: IT Manager
remarks_implementation:
  Systems are synchronized with a standardized time-source to ensure accurate timestamping of logs and events.


control_id: 8.18
control_text: Use of privileged utility programs
current_control: Network Security
accountability: IT Manager
remarks_implementation:
  Comprehensive network security controls including firewalls, intrusion detection/prevention systems, and secure network architectures.


control_id: 8.19
control_text: Installation of software on operational systems
current_control: Security of Network Services
accountability: IT Manager
remarks_implementation:
  Security mechanisms, service levels, and management requirements of network services are regularly monitored and reviewed.


control_id: 8.22
control_text: Segregation of networks
current_control: Use of Cryptography
accountability: IT Manager
remarks_implementation:
  Cryptographic controls are in place for protection of information, in line with a defined policy and key management practices.


control_id: 8.26
control_text: Application security requirements
current_control: Secure System Architecture and Engineering Principles
accountability: Director of R&D
remarks_implementation:
  Secure design principles are embedded in the development process, with architecture reviews and threat modeling.


control_id: 8.27
control_text: Secure system architecture and engineering principles
current_control: Secure Development Lifecycle (SDLC) Policy
accountability: Director of R&D
remarks_implementation:
  SDLC policy integrates security at every phase of software development. Compliance with the policy is mandatory for all projects.


control_id: 8.28
control_text: Secure coding
current_control: Secure Coding Guidelines
accountability: Director of R&D
remarks_implementation:
  Developers follow secure coding standards that are verified through code reviews and static code analysis.


control_id: 8.29
control_text: Security testing in development and acceptance
current_control: Security Testing in Development and Acceptance
accountability: Director of R&D
remarks_implementation:
  Security testing, including penetration testing and vulnerability scanning, is integral to the development lifecycle.


control_id: 8.31
control_text: Separation of development, test and production environments
current_control: Separation of Development, Test, and Production Environments
accountability: IT Manager , Director of R&D , CISO
remarks_implementation:
  Environments are segregated to prevent unauthorized access and data leakage. Access controls are in place and audited regularly.


control_id: 8.32
control_text: Change management
current_control: Change Management Policy
accountability: IT Manager , Director of R&D , CISO
remarks_implementation:
  Formal change management process ensures that all changes to IT systems are reviewed, tested, and approved before implementation.


control_id: 8.33
control_text: Test information
current_control: Test Information Policy
accountability: Director of R&D
remarks_implementation:
  Policies ensure that test data is anonymized and protected, reflecting the controls applied to live data.


control_id: 8.34
control_text: Protection of information systems during audit testing
current_control: Protection of Information Systems during Audit Testing
accountability: Director of R&D
remarks_implementation:
  Procedures are in place to ensure that audit activities do not affect the operational integrity of systems.


