1 | P a g e

Copyright © A24 Limited LONDON \ NEW YORK \ LOS ANGELES \ SYDNEY \ TOKYO

A24 Limited

Release 1

A24 Limited

Project Team

Shane Tully – Global Chief Information Security Officer

Szeern (Zee) Wong – Sales & Talent

May 2023
2 | P a g e

Copyright © A24 Limited LONDON \ NEW YORK \ LOS ANGELES \ SYDNEY \ TOKYO

Table of Contents 

1 A24 Recommendations for the NIST CSF Framework 2.0 Discussion Draft ........................................................................3

1.1 The Govern Function ...................................................................................................................................................3

1.2 The Identify Function...................................................................................................................................................3

1.3 The Protect Function ...................................................................................................................................................3

1.4 The Respond Function.................................................................................................................................................4

Appendix: Suggested Metrics Table...................................................................................................................................4
3 | P a g e

Copyright © A24 Limited LONDON \ NEW YORK \ LOS ANGELES \ SYDNEY \ TOKYO

1 A24 Recommendations for the NIST CSF Framework 2.0 

Discussion Draft 

A24 Limited is a global company that manages critical Payment Hardware Security (HSMs) for Banks and Credit Card Schemes and 

Payments companies, General Purpose HSMs and Data Protection systems in flight and at rest that rely on and use Cryptography.

Due to the nature and security around managing these systems for customers using Cloud Adjacent technologies between legacy 

systems and Cloud Providers, means that A24 is ensuring high security across private links and networks according to PCI, Critical 

National Infrastructure and NIST standards for Network Security, Access Controls and Monitoring.

A24 Limited would like to take advantage of the opportunity to provide input into the NIST Cyber Security Framework (CSF) v2.0

discussion draft. Many organisations that A24 Limited work with leverage the NIST CSF. The NIST CSF has become one of the more 

popular security frameworks, embraced by many industry sectors, and regulatory bodies as the primary method for applying 

controls and processes to deal with evolving cyber threats. 

A24 Limited is proposing addition of metrics (with corresponding notional examples) to the NIST CSF v2 related to four (4) specific 

functions outlined in the NIST CSF V2 Discussion Draft:

• Govern;

• Identify;

• Protect; &

• Respond

1.1 The Govern Function 

Metrics with various associated examples for the Govern function are proposed by A24 Limited for the following 

Category Identifiers:

• GV.PO

• GV.RM

• GV.RR

1.2 The Identify Function 

Metrics with various associated examples for the Identify function are proposed by A24 Limited for the following 

Category Identifiers:

• ID.SC

1.3 The Protect Function 

Metrics with various associated examples for the Protect function are proposed by A24 Limited for the following 

Category Identifiers:

• PR.AA

• PR.AT

• PR.PS



7 | P a g e

Copyright © A24 Limited LONDON \ NEW YORK \ LOS ANGELES \ SYDNEY \ TOKYO

common malpractices, such as password recycling and weak 

passwords?

Example 06: What is the process for monitoring user activity 

and access logs, and how are suspicious or anomalous 

behaviours detected and investigated?

Example 07: What controls are in place to protect privileged 

accounts?

Example 08: What are the procedures for granting temporary 

or emergency access to users, and how are these situations 

documented and reviewed?

Example 09: How is access to third-party applications and 

services managed, and what additional controls are in place 

to prevent unauthorized access or data leakage?

Example 10: How are access policies and procedures 

communicated to users, and what training or awareness 

programs are in place to promote secure access practices?

Example 11: How is access granted to new employees, and 

what is the process for removing access when an employee 

leaves the company?

Example 12: What is the process for managing access 

requests and approvals, and how are these requests 

documented and tracked?

Example 13: How is access control regularly audited and 

reviewed, and how often are access policies and procedures 

updated?

Example 14: What are the consequences for non-compliance 

with access policies, and how is compliance with access 

policies monitored?

Example 15: How is access to sensitive data and systems 

restricted, and how are those restrictions enforced?

Example 16: How is the principle of least privilege applied to 

limit user access and reduce the risk of privilege escalation 

attacks?

Example 17: What tools and processes are used to monitor 

user activity and detect potential insider threats?

PR.AT-01 Measurements or 

methods are in place for 

security awareness and 

training.

Example 01: How are employees of the organization and, 

where relevant, contractors and third-party users made 

aware of organizational policies and procedures for cyber 

security, as relevant for their job function?

Example 02: How is security training provided to ensure 

employees, contractors and third-party users are trained in 

cyber security, relevant to their job function.

PR.PS-01 Measurements or 

methods are in place to 

detect intrusion attempts.

Example 01: How many intrusion attempts have been 

detected and blocked by your intrusion detection system?

Example 02: What is the average time it takes to investigate 

and respond to detected intrusion attempts?

Example 03: What is the process for reporting intrusion 

attempts to relevant stakeholders, including management, 

legal, and law enforcement?

Example 04: How many unauthorized access attempts have 

been detected and blocked by your firewall?
8 | P a g e

Copyright © A24 Limited LONDON \ NEW YORK \ LOS ANGELES \ SYDNEY \ TOKYO

Example 05: What is the process for investigating and 

responding to detected intrusion attempts, and how are 

those findings communicated?

Example 06: How are logs and other security event data 

collected and analysed, and what tools and processes are 

used for this purpose?

Example 07: How are security incidents classified and 

prioritized, and what response procedures are in place for 

each classification?

Example 08: How frequently are security logs reviewed, and 

what is the process for reviewing them?

Example 09: How are security events and incidents correlated 

and analysed to identify potential threats and attacks?

Example 10: What measures are in place to prevent false 

positives and false negatives in intrusion detection systems?

Example 11: How are network traffic patterns and anomalies 

monitored to detect potential intrusions?

Example 12: How are incident response plans updated and 

tested in response to new intrusion attempts and attack 

trends?

Example 13: How are security controls adjusted and finetuned based on the results of intrusion detection and 

response efforts?

PR.PS-02 Measurements or 

methods are in place to 

demonstrate patching 

effectiveness.

Example 01: How frequently are security patches and 

updates released by software vendors, and how quickly are 

they implemented?

Example 02: How are high-risk vulnerabilities prioritized for 

patching, and what is the process for testing and validating 

patches before implementation?

Example 03: How are legacy systems and software that are 

no longer supported by vendors patched, and what measures 

are in place to mitigate their security risks?

Example 04: How are patches and updates distributed and 

installed across different devices and systems, and how is this 

process managed and monitored?

Example 05: What is the average time it takes to apply 

patches once they are released, and what is the maximum 

acceptable patching window for high-risk vulnerabilities?

Example 06: What metrics are used to track patching 

effectiveness and compliance, and how are these metrics 

used to drive improvements in the patching process?

Example 07: How are patches validated to ensure they do not 

cause any conflicts or disruptions in the systems they are 

being applied to?

Example 08: How are legacy systems and applications that 

are no longer supported with security patches being handled? 

Is there a plan in place for dealing with these systems?

Example 09: Are there any exceptions to the patching 

process, such as certain systems or applications that cannot 

be patched for operational or other reasons? How are these 

exceptions managed and mitigated?

10 | P a g e

Copyright © A24 Limited LONDON \ NEW YORK \ LOS ANGELES \ SYDNEY \ TOKYO

security incident, including costs for incident response, 

remediation, and reputational damage?

Example 09: How is user behaviour monitored to identify 

potential security incidents or insider threats?

Example 10: How is threat intelligence gathered and used to 

proactively detect and prevent security incidents?

Example 11: What is the process for reporting security 

incidents to regulatory authorities, customers, and other 

stakeholders?

Example 12: How is the organization's incident response plan 

updated and tested to ensure it remains effective and 

relevant?

End of Document