Employee Awareness

This capability will focus on management of materials and tools associated to the process of providing awareness to ensure compliance with regulatory requriemetns, security policies, and risk managemet best practices that will ensure that the organization will have a secure, compliant, and safe working environment. Examples of this include Clean-Desk Policy, Disaster Recovery, On-Line training, PII/PHI information protection, among others.

Cloud Controls Matrix (CCM) Data

Array

IS-23 | Information Security | Incident Reporting

Control Specification +-

Contractors, employees and third party users shall be made aware of their responsibility to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a prompt and expedient manner in compliance with statutory, regulatory and contractual requirements.

Architectural Relevance +-

PhysicalNetworkComputeAppData
True True True True True

Corp Gov Relevance +-

Corp Gov Relevance
True

Cloud Service Delivery Model Applicability +-

SaaSPaaSIaaS
True True True

Supplier Relationship +-

Service ProviderTenant / Consumer
True True

Scope Applicability +-

COBIT 4.1HIPAA / HITECH ActISO/IEC 27001-2005

DS5.6

45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a)
16 CFR 318.5 (a)
45 CFR 160.410 (a)(1)

Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1

NIST SP800-53 R3FedRAMP (Final 2012) Low ImpactFedRAMP (Final 2012) Moderate ImpactPCI DSS v2.0

IR-2
IR-6
IR-7
SI-4
SI-5

NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5

NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-5

12.5.2
12.5.3

BITS Shared Assessments SIG v6.0BITS Shared Assessments SIG v5.0GAPP (Aug 2009)

J.1.1, E.4

J.1
E.1

1.2.7
1.2.10
7.1.2
7.2.2
7.2.4
10.2.4

Jericho ForumNERC CIP

Commandment #2
Commandment #6
Commandment #8

CIP-003-3 - R4.1
CIP-004-3 R3.3

Array

Information Security (IS) | ID #IS-23.1

Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting?

Compliance Mapping +-

COBITHIPAAISO27001SP800_53

COBIT 4.1 DS5.6

45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a) (New)
16 CFR 318.5 (a) (New)
45 CFR 160.410 (a)(1) (New)

Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1

NIST SP800-53 R3 IR-2
NIST SP800-53 R3 IR-6
NIST SP800-53 R3 IR-7
NIST SP800-53 R3 SI-4
NIST SP800-53 R3 SI-5

FedRAMPPCI_DSSBITSGAPP

PCI-DSS v2.0 12.5.2
PCI-DSS v2.0 12.5.3

AUP v5.0 J.1 AUP v5.0 E.1 SIG v6.0: J.1.1, E.4

GAPP Ref 1.2.7
GAPP Ref 1.2.10
GAPP Ref 7.1.2
GAPP Ref 7.2.2
GAPP Ref 7.2.4
GAPP Ref 10.2.4

Model Applicability +-

SaaSPaaSIaaS
True True True

Scope Applicability +-

SPCUST
True True

Information Security (IS) | ID #IS-23.2

Does your logging and monitoring framework allow isolation of an incident to specific tenants?

Compliance Mapping +-

COBITHIPAAISO27001SP800_53

COBIT 4.1 DS5.6

45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a) (New)
16 CFR 318.5 (a) (New)
45 CFR 160.410 (a)(1) (New)

Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1

NIST SP800-53 R3 IR-2
NIST SP800-53 R3 IR-6
NIST SP800-53 R3 IR-7
NIST SP800-53 R3 SI-4
NIST SP800-53 R3 SI-5

FedRAMPPCI_DSSBITSGAPP

PCI-DSS v2.0 12.5.2
PCI-DSS v2.0 12.5.3

AUP v5.0 J.1 AUP v5.0 E.1 SIG v6.0: J.1.1, E.4

GAPP Ref 1.2.7
GAPP Ref 1.2.10
GAPP Ref 7.1.2
GAPP Ref 7.2.2
GAPP Ref 7.2.4
GAPP Ref 10.2.4

Model Applicability +-

SaaSPaaSIaaS
True True True

Scope Applicability +-

SPCUST
True True