Spreadsheet: 806524d1669364990-searching-for-an-exact-numeric-match-with-a-formula-sample-data-search-and-reporting-1-ans
Sheet: Source

ID | mat-1 | mat-2 | mat-3 | mat-4 | mat-5 | mat-6 | scf
5.4 5.1 5.37 | - There is no evidence of a capability to facilitate the implementation of cybersecurity and privacy governance controls. | - Security and privacy governance is informally assigned as an additional duty to existing IT or cybersecurity personnel. - Governance focus is narrowly limited to certain compliance requirements. | - Compliance requirements for security and privacy are identified and documented. - Controls are assigned to sensitive assets to comply with specific compliance requirements. | - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Formal governance program exists for both security and privacy. - Governance function is formally assigned with defined roles and associated responsibilities. - Compliance requirements for security and privacy are identified and documented. - Controls are assigned to sensitive assets to adhere to specific compliance requirements. | - Metrics are used to evaluate the effectiveness of the governance program, based on historical trends. - Formal governance program exists for both security and privacy. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Governance function is formally assigned with defined roles and associated responsibilities. - Compliance requirements for security and privacy are identified and documented. - Controls are assigned to sensitive assets to adhere to specific compliance requirements. | See SP-CMM4. SP-CMM5 is N/A, since a continuously-improving process is not necessary to facilitate the implementation of cybersecurity and privacy governance controls. | GOV-01
5.1 5.37 | - There is no evidence of a capability to establish, maintain and disseminate cybersecurity and privacy policies, standards and procedures. | - Basic cybersecurity policies and standards are documented [not based on any industry framework] - Documentation is made available to internal personnel. - Basic procedures are established for important tasks, but are ad hoc and not formally documented. | - Cybersecurity policies and standards exist that are aligned with a leading cybersecurity framework (e.g., NIST 800-53, ISO 27002 or NIST Cybersecurity Framework). - Documentation is made available to internal personnel. - Procedures for important tasks are documented and assigned to individuals or teams. | - Formal governance program exists for both security and privacy. | - Metrics are used to evaluate the coverage of policies and standards against obligations. - Metrics are used to evaluate the execution of key procedures. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Cybersecurity policies and standards are verified to address all applicable statutory, regulatory and contractual requirements. - Documentation is made available to internal personnel and third-party stakeholders. - Procedures are standardized across the organization to ensure uniformity and consistent execution. | See SP-CMM4. SP-CMM5 is N/A, since a continuously-improving process is not necessary to establish, maintain and disseminate cybersecurity and privacy policies, standards and procedures. | GOV-02
5.37 5.1 | - There is no evidence of a capability to review the cybersecurity and privacy program, including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness. | - Unstructured review is performed on an annual basis. - Informal recommendations are made to update existing policies and standards. - Documentation change control processes do not exist or are not formal. - People affected by the changes are provided notification of the changes. | - Formal review process is performed on an annual basis. - Review process includes the scope of applicable statutory, regulatory and contractual obligations. - Recommendations for edits are submitted for review and are handled in accordance with documentation change control processes. - Updated version is published at least annually, based on the review process. - People affected by the changes are provided notification of the changes. | - Governance function is formally assigned with defined roles and associated responsibilities. | - Metrics are used to evaluate the number of violations or exceptions to policies and standards. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Formal review process is performed on an annual basis, as business conditions require a review, or as metrics indicate a review is necessary. - Review process includes the scope of both currently-applicable and pending statutory, regulatory and contractual obligations. - Recommendations for edits are submitted for review and are handled in accordance with documentation change control processes. - Stakeholders are involved in the review process for proposed changes. - Updated version is published at least annually, based on the review process. - People affected by the changes are provided notification of the changes. | See SP-CMM4. SP-CMM5 is N/A, since a continuously-improving process is not necessary to review the cybersecurity and privacy program, including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness. | GOV-03
5.10 | - There is no evidence of a capability to identify and document appropriate contacts within relevant law enforcement and regulatory bodies. | - Cybersecurity personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement. | - Incident response personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement. - Contact information is verified and updated on at least an annual basis. | - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - An Integrated Security Incident Response Team (ISIRT), or similar function, exists to form an on-demand, integrated team of formally-assigned cybersecurity, IT, privacy and business function representatives that can execute coordinated incident response operations. - Incident response personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement. - Designated incident response personnel sign up for membership in public/private information sharing organizations (e.g., InfraGard). - Contact information is verified during incident response exercises and is updated on at least an annual basis. | - Metrics are developed that provide management oversight to ensure the process is operating in an optimal capacity. - Metrics reporting includes this process so it can be quantitatively analyzed. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - An Integrated Security Incident Response Team (ISIRT), or similar function, exists to form an on-demand, integrated team of formally-assigned cybersecurity, IT, privacy and business function representatives that can execute coordinated incident response operations. - Incident response personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement. - Designated incident response personnel sign up for membership in public/private information sharing organizations (e.g., InfraGard). - Contact information is verified during incident response exercises and is updated on at least an annual basis. | - Predictive analysis (e.g., machine learning, AI, etc.) is used to identify and alert on trends to enable decision makers to make time-critical decisions at the speed of relevance to support operational efficiency. - Process exists to continuously analyze metrics. - Proactive adjustments are made to govern the process, based on metrics. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - An Integrated Security Incident Response Team (ISIRT), or similar function, exists to form an on-demand, integrated team of formally-assigned cybersecurity, IT, privacy and business function representatives that can execute coordinated incident response operations. - Incident response personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement. - Designated incident response personnel sign up for membership in public/private information sharing organizations (e.g., InfraGard). - Contact information is verified during incident response exercises and is updated on at least an annual basis. | GOV-06
15.1 | - There is no evidence of a capability to establish contact with selected groups and associations within the cybersecurity & privacy communities to:   ▪ Facilitate ongoing cybersecurity and privacy education and training for organizational personnel;  ▪ Maintain currency with recommended cybersecurity and privacy practices, techniques and technologies; and  ▪ Share current security-related information including threats, vulnerabilities and incidents. | - Cybersecurity and privacy personnel identify and maintain contact information for local, regional and national cybersecurity / privacy groups and associations. | - Cybersecurity and privacy personnel identify and maintain contact information for local, regional and national cybersecurity / privacy groups and associations. - Cybersecurity and privacy personnel in supervisory positions subscribe to news feeds from groups and associations to facilitate ongoing education and training. | - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Cybersecurity and privacy personnel identify and maintain contact information for local, regional and national cybersecurity / privacy groups and associations. - Cybersecurity and privacy personnel in supervisory positions subscribe to news feeds from groups and associations to facilitate ongoing education and training. - Cybersecurity and privacy personnel are encouraged to attend and be involved in local groups and associations. | - Metrics are developed that provide management oversight to ensure the process is operating in an optimal capacity. - Metrics reporting includes this process so it can be quantitatively analyzed. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Cybersecurity and privacy personnel identify and maintain contact information for local, regional and national cybersecurity / privacy groups and associations. - Cybersecurity and privacy personnel in supervisory positions subscribe to news feeds from groups and associations to facilitate ongoing education and training. - Cybersecurity and privacy personnel are encouraged to attend and be involved in local groups and associations. | - Predictive analysis (e.g., machine learning, AI, etc.) is used to identify and alert on trends to enable decision makers to make time-critical decisions at the speed of relevance to support operational efficiency. - Proactive adjustments are made to govern the process, based on metrics. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Cybersecurity and privacy personnel identify and maintain contact information for local, regional and national cybersecurity / privacy groups and associations. - Cybersecurity and privacy personnel in supervisory positions subscribe to news feeds from groups and associations to facilitate ongoing education and training. - Cybersecurity and privacy personnel are encouraged to attend and be involved in local groups and associations. | GOV-07
5.12 15.1 | - There is no evidence of a capability to establish control objectives as the basis for the selection, implementation and management of the organization’s internal control system. | SP-CMM1 is N/A, since a structured process is required to establish control objectives as the basis for the selection, implementation and management of the organization’s internal control system. | - The Chief Information Officer (CIO), or similar function, analyzes the organization’s business strategy and prioritizes the objectives of the security function, based on business requirements. - IT and/or cybersecurity personnel develop control objectives to implement and manage the organization’s internal control system. | - The Chief Information Security Officer (CISO), or similar function, analyzes the organization’s business strategy and prioritizes the objectives of the security function, based on business requirements. - The CISO, or similar function, develops a security-focused Concept of Operations (CONOPS) that documents management, operational and technical measures to apply defense-in-depth techniques across the organization. This CONOPS may be incorporated as part of a broader business plan for the cybersecurity and privacy program. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure engineering practices that protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - A GRC team, or similar function, establishes control objectives as the basis for the selection, implementation and management of the organization’s internal control system. | See SP-CMM3. SP-CMM4 is N/A, since a quantitatively-controlled process is not necessary to establish control objectives as the basis for the selection, implementation and management of the organization’s internal control system. | See SP-CMM4. SP-CMM5 is N/A, since a continuously-improving process is not necessary to establish control objectives as the basis for the selection, implementation and management of the organization’s internal control system. | GOV-09