26 Establish an identity management framework and supporting systems to include physical access and electronic access controls across major enterprise systems. Rather than focusing primarily on separate access controls for individual systems, integrate the organization’s approach to establishing and maintaining identities, striving for as much automated integration among systems as possible to reduce errors and delays. 27 Enforce “least privilege” access to cyber assets and periodically review access privileges. Ensure that employees have only the privileges they need to perform their jobs. 28 Establish an information-sharing program for departments or functions within the organization and designate personnel to be responsible for the key roles. Include training on what types of information need to be shared, with whom, and at which frequency. Ensure that the organization as a is aware of the security-related activities of other departments or functions. Encourage frank discussions about cyber security within the organization and foster a team-based approach, rather than each department relying on its own resources. 29 Categorize identity management according to organizational risk criteria so that stricter access controls are required for more sensitive systems. Systems that access or store sensitive data should be protected by multiple authentication factors. The organization’s identity management system should be flexible enough to allow multi-factor authentication. 30 Ensure that the employee evaluation process includes responsibilities related to security, that these responsibilities are updated regularly, and they are managed to ensure they continue to address the organization’s cyber security needs. Ensure that job descriptions formally include security responsibilities and that employee performance in this area is monitored and rewarded. 31 Ensure that training and recruiting efforts are focused on cyber security. Allow the organization to attract and retain top cyber security talent.
44 Vulnerability assessments are performed by independent third parties at regular intervals, covering all of the organization’s key systems, based on its threat model. Have independent experts review critical systems for known vulnerabilities to reduce likelihood of internal or external compromise. 45 Vulnerability and threat data are tracked via a formal risk register, and the organization tracks and manages its response to published vulnerabilities. Activities related to vulnerability and threat management are formally and tracked across the organization. 46 The logging and monitoring functions are used to specifically understand the organization’s cyber security posture and operations in near real time, including information from external sources. Enhance the situational awareness specific to cyber security, enabling effective security countermeasures if required. 47 Escalations of cyber security events are used to support near real-time situational awareness and analyze / correlate to provide insight over time. Leverage escalations to further enhance the situational awareness of the organization’s current cyber security posture. 25 Cyber security incidents are handled in coordination with external parties when appropriate, such as law enforcement and government agencies. Ensure proper of serious incidents and preserve evidence. The table below outlines the activities and controls that are currently missing from the operational risk plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance. Activity / Security Control Existing Guideline Deviation Accept or Mitigate Risk Responsible Party Estimated Completion Date Mitigation Strategy
65 Ask questions during the request for proposal (RFP) process to understand the security posture and practices of the partner organization, and whether its offerings meet security requirements. Compare the security policies and procedures of a third party against your organization’s own security policy to ensure compliance. Ensure that the security practices of the vendor / partner organization comply with those of your own organization. Ensure that the purchased product / service meets your organization’s security requirements. 66 Identify and prioritize external dependencies, both upstream (the organization depends on whom?) and downstream (who depends on the organization?). The organization should pay special attention to critical dependencies; for example, relying on a single external for a key function / service with no secondary party readily available as backup. Having an understanding of the dependency chain is critical in managing risk introduced by third-party dependencies, in addition to highlighting areas where additional contingency planning may be required in case a third party becomes unavailable. 67 Review the hiring practices and personnel background checks of your vendors and partners to ensure that they comply with your organization’s policies. Make sure that your vendor / partner organization’s background checks during the hiring process are consistent with your own. Security issues at vendors translate into security issues in their products. 68 Ensure that service-level agreements (SLAs) and other contractual tools are properly leveraged so that vendors and partners live up to their obligations. For instance, if a breach occurs at a partner organization, there needs to be a provision to have your organization notified of the full extent of the breach as soon as the information is available. A contractual obligation will help your organization transfer some of the security risks.
In the platform risks section, the discussion focused mainly on operating systems and other software making up the software stack on top of which the organization’s custom applications run. If the organization develops or purchases custom software, it is important that the software is developed with security in mind from the get-go to help ensure that it does not contain any software security weaknesses that may be exploited by adversaries to compromise the system. To accomplish this, the organization needs to makes its software development process security aware. The SDLC activities for doing so are documented in the “Insecure Software Development Life Cycle (SDLC) Risks” section under Addressing Process Risks earlier in this document. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan. ID Activity / Security Control Rationale Associated Documentation 119 Implement security activities and gates into your organization’s SDLC (please refer to the checklist in the “Insecure Software Development Life Cycle (SDLC) Risks” section for additional details). Your organization develops software that does not have security weaknesses. 120 Request independent-party software security assessments of the applications being purchased to gauge the security posture of the software being purchased. Gain confidence that the software your organization purchases does not have security weaknesses. The table below outlines the activities and controls that are currently missing from the application security plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
183 Ensure that the software controlling distribution feeders is free of security weaknesses. Prevent unauthorized control of distribution feeders. 184 Implement physical security controls and detection mechanisms when tampering occurs. Prevent unauthorized control of distribution feeders. 185 Perform sufficient authentication and validation of all control data bound for distribution feeders. Prevent unauthorized control of distribution feeders. 186 Design automatic control systems to operate with a human “in the loop” when time permits. Prevent unauthorized control of distribution feeders. The table below outlines the activities and controls that are currently missing from the advanced volt/VAR control plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance. Activity / Security Control Existing Guideline Deviation Accept or Mitigate Risk Responsible Party Estimated Completion Date Mitigation Strategy