{"text_format":"1","workbook":"xlsx","n_sheets":22,"sheets":["Instructions","Organization Profile","Interview Process"," I- Mgmt","I - Bus. Ops","I - Sec. Ops","I - Assett Mgmt.","I. Access Control  & HR","I - DR & IR","I - Comms","I - Physical","Summary - Identify","Summary - Protect","Summary - Detect","Summary - Respond","Summary - Recover","Current Profile Summary","Threat Assessment","Risk Assessment","Target Profile and Action Plan","Gap Assessment","Dropdown data"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":6,"comments":1,"pivot_tables":8},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Instructions","index":0,"n_rows":25,"n_cols":1,"rows_kept":25,"cut":false,"hidden":false,"merged":[[20,0,20,13],[21,0,21,13],[23,0,23,13],[24,0,24,13],[15,0,15,13],[19,0,19,13],[22,0,22,13],[13,0,13,13],[14,0,14,13],[17,0,17,13],[16,0,16,13],[18,0,18,13],[0,0,6,13],[7,0,7,13],[12,0,12,13],[8,0,8,13],[9,0,9,13],[10,0,10,13],[11,0,11,13]]}
["Welcome to the NIST Self-Assessment tool created by Trent University! \nPlease review all instructions on this page to ensure that the tool is filled out correctly. \nThe tab layout of this tool is sequential and is designed to step you through the process of completing the self-assessment. Click each tab and fill out the information needed.\n\nA note about functionality - This tool uses Pivot Tables and Macros to function. Please make sure you're using a computer that supports both."]
[]
[]
[]
[]
[]
[]
["Tab colors "]
["Tabs highlighted in Blue should be reviewed, but do not contain information to be filled out"]
["Tabs highlighted in Green contain information to be entered"]
["Tabs highlighted in Tan contain mostly summary information, but have some inputs"]
["Tabs highlighted in Red contain background data and should not be accessed"]
["Cell Colors"]
["Cells highlighted in Blue should be reviewed but do not contain information to be filled out"]
["Tabs highlighted in Green should have data entered in them"]
["Process"]
["1) Enter the organizational profile and complete all the information regarding roles, critical systems and demographic information"]
["2) Review the interview process tab, and schedule interviews."]
["3) Proceed through each of the interview tabs and respond to the questions and objectives posed.  Enter an question score out of 1 for how closely your institution meets the objective and responds to the question. 0.25, 0.50 and 0.75 can also be used."]
["4) Review each of the summary sheets, note how the ranking is automatically determined from the interview score. Adjust the ranking if needed"]
["5) Proceed to the Current Profile Summary Sheet, and refresh the table. This page shows NIST categories that are not at the fully achieved level"]
["6) Enter the threat assessment sheet - Review your institutional threat landscape and enter the threats relative to the critical infrastructure you identified in the organizational profile. "]
["7) Enter the risk assessment sheet - Review each of the NIST control subcategories and determine the impact of not having the control in place, relative to your threat landscape. For reference this data is also summarized on this sheet"]
["8) Enter the target profile sheet, refresh the table and complete the desired state information for each of the NIST sub-categories listed"]
["9) Review the resulting gap assessment. Sub categories with a high delta should be considered as priorities. "]

{"sheet":"Organization Profile","index":1,"n_rows":35,"n_cols":5,"rows_kept":35,"cut":false,"hidden":false,"merged":[[19,4,19,5],[0,0,0,1],[11,0,13,1],[10,0,10,1],[0,4,0,5],[1,4,3,5],[5,4,5,5]]}
["Organization Information",null,null,null,"Roles"]
["Organization Name",null,null,null,"The following roles have been defined by relevant standards. Enter in the space provided the name of the person who best fits that role in your organization. "]
["Organization Address"]
[]
["Assessment Executive Sponsor"]
["Assessment Technical Leader",null,null,null,"Leadership / Executive / Management "]
[null,null,null,null,"Project Sponsor / Owner"]
["Assessment Date",null,null,null,"Chief Information Officer "]
[null,null,null,null,"Chief Information Security Officer"]
[null,null,null,null,"Human Resources Manager"]
["Assessment Scope",null,null,null,"Facilities Manager"]
[null,null,null,null,"Physical Security Manager"]
[null,null,null,null,"IT Manager - Networking"]
[null,null,null,null,"IT Manager - Client Services"]
[null,null,null,null,"IT Manager - Information Systems"]
["System Name","System Priority \n1 = Not Critical\n5 = Critical",null,null,"IT Manager - Project Management"]
["ERP - Student Information System",5,null,null,"Legal Department"]
[null,null,null,null,"Risk and Compliance Officer"]
[null,null,null,null,"Finance Manager - Audit and Controls"]
[null,null,null,null,"Technical / Functional"]
[null,null,null,null,"Information Security Officer"]
[null,null,null,null,"Security Analyst "]
[null,null,null,null,"System Administrator / Architect"]
[null,null,null,null,"System Administrator / Architect"]
[null,null,null,null,"System Administrator / Architect"]
[null,null,null,null,"System Administrator / Architect"]
[null,null,null,null,"System Administrator / Architect"]
[null,null,null,null,"System Administrator / Architect"]
[null,null,null,null,"Network Architect "]
[null,null,null,null,"Service Desk Analyst "]
[null,null,null,null,"Service Desk Analyst "]
[null,null,null,null,"Service Desk Analyst "]
[null,null,null,null,"Service Desk Analyst "]
[null,null,null,null,"Programmer "]
[null,null,null,null,"Programmer "]

{"sheet":"Interview Process","index":2,"n_rows":66,"n_cols":5,"rows_kept":66,"cut":false,"hidden":false,"merged":[[43,2,50,2],[51,2,56,2],[57,2,65,2],[1,2,7,2],[1,4,7,10],[8,2,17,2],[18,2,23,2],[24,2,32,2],[33,2,42,2],[43,0,50,0],[51,0,56,0],[57,0,65,0],[1,0,7,0],[8,0,17,0],[18,0,23,0],[24,0,32,0],[33,0,42,0]]}
["Interview","Roles","Suggested Interview Time"]
["Management Processes, Governence and Compliance",null,"1 Hour",null,"Notes - The roles outlined here are suggestions only, CIO and CISO as well as project sponsor should attend any interviews they feel are appropriate"]
[null,"Chief Information Officer "]
[null,"Chief Information Security Officer"]
[null,"Legal Department"]
[null,"Risk and Compliance Officer"]
[null,"Finance Manager - Audit and Controls"]
[null,"Information Security Officer"]
["Business Operations and Business Processes",null,"1 Hour"]
[null,"IT Manager - Client Services"]
[null,"IT Manager - Information Systems"]
[null,"IT Manager - Project Management"]
[null,"Risk and Compliance Officer"]
[null,"Finance Manager - Audit and Controls"]
[null,"Information Security Officer"]
[null,"Security Analyst "]
[null,"Programmer "]
[null,"Programmer "]
["Security Operations",null,"1 Hour"]
[null,"Chief Information Security Officer"]
[null,"IT Manager - Networking"]
[null,"Information Security Officer"]
[null,"Security Analyst "]
[null,"Service Desk Analyst "]
["Assett Management",null,"1 Hour"]
[null,"Chief Information Security Officer"]
[null,"IT Manager - Networking"]
[null,"IT Manager - Client Services"]
[null,"Information Security Officer"]
[null,"Security Analyst "]
[null,"System Administrator / Architect"]
[null,"Service Desk Analyst "]
[null,"Enterprise Workstation Specialist"]
["Access Control and HR",null,"1 Hour"]
[null,"Chief Information Security Officer"]
[null,"Human Resources Manager"]
[null,"Physical Security Manager"]
[null,"IT Manager - Networking"]
[null,"IT Manager - Client Services"]
[null,"Information Security Officer"]
[null,"Security Analyst "]
[null,"System Administrator / Architect"]
[null,"Service Desk Analyst "]
["Disaster Recovery and Incident Response",null,"1 Hour"]
[null,"Chief Information Security Officer"]
[null,"IT Manager - Networking"]
[null,"IT Manager - Client Services"]
[null,"Legal Department"]
[null,"Risk and Compliance Officer"]
[null,"Information Security Officer"]
[null,"Security Analyst "]
["Communcations Security",null,"30 Mins"]
[null,"Chief Information Security Officer"]
[null,"Information Security Officer"]
[null,"Security Analyst "]
[null,"System Administrator / Architect"]
[null,"Network Architect "]
["Physical Security",null,"30 Mins"]
[null,"Chief Information Security Officer"]
[null,"Information Security Officer"]
[null,"Security Analyst "]
[null,"Facilities Manager"]
[null,"Physical Security Manager"]
[null,"IT Manager - Networking"]
[null,"System Administrator / Architect"]
[null,"Network Architect "]

{"sheet":" I- Mgmt","index":3,"n_rows":22,"n_cols":7,"rows_kept":22,"cut":false,"hidden":false,"merged":[[18,2,19,2],[3,0,6,0],[3,1,6,1],[3,5,6,5],[3,6,6,6]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score /100"]
["ID.GV-1: Organizational information security policy is established","A clearly defined and executive supported information security policy","Does you organization have an information security policy or policies that are supported by senior management? ",null,null,1,{"$f":"D2*100","v":0}]
["ID.GV-2: Information security roles & responsibilities are coordinated and aligned with internal roles and external partners","Clearly defined accountability, roles and responsibilities for cyber-security focused individuals","Do job descriptions and management portfolios contain clear responsibility and accountability for information and cybersecurity?",null,null,1,{"$f":"D3*100","v":0}]
["ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed","The organization is in compliance with relevant legal and regulatory regulations. Regulations that are relevant to the organization are widely understood and processes are in place to manage compliance ","Does your organization comply with relevant legal and regulatory standards (PCI-DSS, PIPEDA, etc..)",null,null,4,{"$f":"(SUM(D4:D7)/4)*100","v":0}]
[null,null,"Do cyber security policies present in your organization map to relevant legal and regulatory standards?"]
[null,null,"Do you regularly perform audits do ensure your compliance with legal and regulatory standards?"]
[null,null,"Do you have a formal policy in place to monitor and review changes to relevant legal and regulatory standards?"]
["ID.GV-4: Governance and risk management processes address cybersecurity risks","The risk management process in place has a focus on cybersecurity risk and provisions for addressing cybersecurity risks","Does your enterprise risk management process provide for the inclusion and priority of cybersecurity risks? ",null,null,1,{"$f":"D8*100","v":0}]
["ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders","Risk assessment plan and framework for establishing plan is established by senior management and other stakeholders","Does your enterprise have an overall risk management process that is established and supported by stakeholders? ",null,null,1,{"$f":"D9*100","v":0}]
["ID.RM-2: Organizational risk tolerance is determined and clearly expressed","Senior management and other stakeholders have clearly articulated organizational risk tolerance","Through an overall risk management framework, has your senior management clearly defined organizational risk tolerance?",null,null,1,0]
["ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis","Risk tolerance level is relative to organizational importance in the industry community","Do you feel that your current risk tolerance reflects organizational importance in the industry? ",null,null,1,0]
["DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability","Security personnel have clearly defined roles and responsibilities, accountability for cybersecurity is clearly defined","Do job descriptions and management portfolios contain clear responsibility and accountability for information and cybersecurity?",{"$f":"D2","v":0},null,1,0]
["PR.AT-4: Senior executives understand roles & responsibilities ","Training and awareness seminars that are specifically targeted to senior management and are routinely delivered","Do job descriptions and management portfolios contain clear responsibility and accountability for information and cybersecurity?",{"$f":"D2","v":0},null,1,0]
["PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met","A controlled environment for the operation of critical business assets is provided and regulated by policy or other agreements","Does your organization have a facilities management policy that makes reference to technical assets and provisions arrangements for data centers, closets and server rooms? ",null,null,1,0]
["PR.IP-6: Data is destroyed according to policy","Records are destroyed in accordance with a organizational policy that clearly outlines retention times for each information asset","Does your organization have a records management policy that clearly defines retention times and data destruction methods for sensitive data? ",null,null,1,0]
["PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties","The organization reports the results of security assessments to appropriate stakeholders","Does your organization communicate the effectiveness of security measures to interested parties in board or stakeholder reports? ",null,null,1,0]
["PR.IP-12: A vulnerability management plan is developed and implemented","Management has approved a vulnerability management plan that is accessible to relevant stakeholders","Does your organization have a management approved policy that details the management of new vulnerabilities and threats? ",null,null,1,0]
["PR.PT-2: Removable media is protected and its use restricted according to policy","The organization is protected from the use of removable media (except in authorized instances) and use of removable media is regulated by policy","Does your organization have a policy that details the acceptable and unacceptable uses of removable media? ",null,null,1,0]
["RS.CO-3: Information is shared consistent with response plans","Sharing of information with stakeholders and external parties is outlined in response plans and well understood by key personnel ","As part of your incident response plan, is your organization required by policy to communicate with other stakeholders? ",null,null,1,0]
["RC.CO-3: Recovery activities are communicated to internal stakeholders and executive and management teams","A functional incident response team with senior management representation is established and recovery efforts are communicated by response personnel. ",null,{"$f":"D19","v":0},null,1,0]
["DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events","Hosting companies and cloud providers are regularly assessed and the SLA in place with the hosting provider establishes provisions of notification for cyber-security events","Are external service providers monitored to ensure they are in compliance with established SLAs?",null,null,1,0]
["DE.DP-2: Detection activities comply with all applicable requirements","Detection and user monitoring is performed in accordance with relevant legal and regulatory requirements","If user monitoring is used, is there an established policy that outlines the scope of user monitoring?  ",null,null,1,0]

{"sheet":"I - Bus. Ops","index":4,"n_rows":19,"n_cols":7,"rows_kept":19,"cut":false,"hidden":false,"merged":[[2,0,3,0],[2,1,3,1],[2,5,3,5],[2,6,3,6],[5,0,6,0],[5,1,6,1],[5,5,6,5],[5,6,6,6],[17,0,18,0],[17,1,18,1],[17,5,18,5],[17,6,18,6],[8,0,9,0],[8,1,9,1],[8,5,9,5],[8,6,9,6],[14,0,16,0],[14,1,16,1],[14,5,16,5],[14,6,16,6]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score"]
["ID.AM-3: Organizational communication and data flows are mapped","Communication and data workflows between systems and people are clearly documented and well understood","Do you have documented copies of flow diagrams, logical network diagrams and organization data flow diagrams? ",null,null,1,{"$f":"D2*100","v":0}]
["ID.BE-1: The organization’s role in the supply chain is identified and communicated","Staff in the organization clearly understand the role they have in delivering \"product\" of the institution","Do you have a documented business continuity plan?",null,null,2,{"$f":"(SUM(D3:D4)/2)*100","v":0}]
[null,null,"Does your organization have an up-to-date cyber communications strategy? "]
["ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated","A clear understanding in the institution as to how the organization works to deliver critical business functions ","Does your organization have an up-to-date strategic plan and mission statement that clearly articulates its role in the institution? ",null,null,1,{"$f":"D5*100","v":0}]
["ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated","A clear communication plan from management where organization goals, objectives and projects are established and communicated. ","Does your strategic plan define organizational goals? ",null,null,2,{"$f":"(SUM(D6:D7)/2)*100","v":0}]
[null,null,"Is your strategic plan and organizational goals mapped to enterprise goals?"]
["ID.BE-4: Dependencies and critical functions for delivery of critical services are established","A document that clearly outlines critical business functions and their dependencies ","Does your business continuity plan clearly identify dependencies for critical systems? ",null,null,1,{"$f":"D8*100","v":0}]
["PR.AT-1: All users are informed and trained ","Extensive and continuing user awareness training that informs all users of cybersecurity risks","Do you have a user training program that informs users about relevant cybersecurity threats? ",null,null,2,{"$f":"(SUM(D9:D10)/2)*100","v":0}]
[null,null,"Does your training program provide for assessment or verification of understanding?"]
["PR.AT-2: Privileged users understand roles & responsibilities ","Additional training for users with privileged accounts such as formal training to the Security+ standard. ","Do users who have privileged accounts receive additional or advanced security training?",null,null,1,{"$f":"D11*100","v":0}]
["PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities ","Policies and training for external users with accounts that clearly articulate their responsibilities for the confidentiality, integrity and availability of resources they have access too. ","Are relationship agreements with third parties documented to include cybersecurity responsibilities and roles internal and external to the organization? ",null,null,1,{"$f":"D12*100","v":0}]
["PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity","Controls are in place to ensure the integrity of organizational data (e.g. Financial, grades)","Do you have internal audits and controls to establish that sensitive and critical corporate data maintains integrity? ",null,null,1,0]
["PR.DS-7: The development and testing environment(s) are separate from the production environment","Each critical system has a dedicated development environment that is separate from production environments","Do you have isolation between development environments and production environments? ",null,null,1,0]
["PR.IP-2: A System Development Life Cycle to manage systems is implemented","A documented system life cycle is implemented in the development process","Do you have a documented systems development lifecycle or programming practice that is monitored? ",null,null,3,{"$f":"(SUM(D15:D17)/2)*100","v":0}]
[null,null,"Does your code review process include security audits?"]
[null,null,"Does your development lifecycle include formal acceptance testing and handoff supervised by management? "]
["PR.IP-3: Configuration change control processes are in place","A formal change management process that includes leadership sign-off and dual person controls are present","Does your code review process include security audits?",{"$f":"D16","v":0},null,2,{"$f":"(SUM(D18:D19)/2)*100","v":0}]
[null,null,"Does your development lifecycle include formal acceptance testing and handoff supervised by management? ",{"$f":"D17","v":0}]

{"sheet":"I - Sec. Ops","index":5,"n_rows":39,"n_cols":7,"rows_kept":39,"cut":false,"hidden":false,"merged":[[13,0,15,0],[13,1,15,1],[1,0,2,0],[1,1,2,1],[3,1,4,1],[3,0,4,0],[11,0,12,0],[11,1,12,1],[18,0,20,0],[18,1,20,1],[23,0,24,0],[23,1,24,1],[25,0,26,0],[25,1,26,1],[27,0,28,0],[27,1,28,1],[31,0,32,0],[31,1,32,1],[33,0,34,0],[33,1,34,1],[1,5,2,5],[1,6,2,6],[3,5,4,5],[3,6,4,6],[11,5,12,5],[11,6,12,6],[13,5,15,5],[13,6,15,6],[18,5,20,5],[18,6,20,6],[23,5,24,5],[23,6,24,6],[37,2,38,2],[33,5,34,5],[33,6,34,6],[25,5,26,5],[25,6,26,6],[27,6,28,6],[31,5,32,5],[27,5,28,5],[31,6,32,6]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score"]
["ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established","Clearly defined accountability, roles and responsibilities for cyber-security focused individuals","Do job descriptions clearly identify roles, responsibilities and accountability for cybersecurity for all related employees?",null,null,2,{"$f":"(SUM(D2:D3)/2)*100","v":0}]
[null,null,"Do supplier, third party and partner agreements clearly establish roles and responsibilities for cybersecurity?"]
["ID.RA-2: Threat and vulnerability information is received from information sharing forums and sources","Threat information is derived from professional organizations and a variety of other sources (REN-ISEC, Communities of practice, vendor) ","Does your organization subscribe to professional threat intelligence services?",null,null,2,{"$f":"(SUM(D4:D5)/2)*100","v":0}]
[null,null,"Does your organization contribute to communities of practice that share threat intelligence data among similar organizations? "]
["ID.RA-3: Threats, both internal and external, are identified and documented","Common internal and external threats are well documented ","Are common internal and external threats documented in a risk assessment? ",null,null,1,{"$f":"D6*100","v":0}]
["ID.RA-4: Potential business impacts and likelihoods are identified","Risk assessment plan includes impacts (relative to likelihood) for critical systems and business processes","For common threats, are business impacts as well as likelihood of a threat being exploited identified?",null,null,1,{"$f":"D7*100","v":0}]
["ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk","Risk assessment plan uses a number of quantifiable methods to determine priority, impact and likelihood","When completing a risk assessment for upcoming vulnerabilities and common issues, is risk quantified with measures such as likelihood and impact on a structured scale? ",null,null,1,0]
["ID.RA-6: Risk responses are identified and prioritized","Risk assessment plan includes response plans which are prioritized relative to business need. ","When completing overall risk analysis for common problems, does the risk assessment take priority of business systems into account when quantifying impact? ",null,null,1,0]
["ID.BE-5: Resilience requirements to support delivery of critical services are established","A document that outlines the fault tolerance and resilience of critical services (including load testing outlines and results) ","When completing projects that involve the contraction of critical systems, is a fault tolerance and resilience document included as part of the project?",null,null,1,0]
["DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed","A system is established that maps baseline and expected traffic on the network and monitors in real time inputs and outputs from critical systems","Do you maintain a documented baseline of expected and normal traffic for each critical system on your network?",null,null,1,0]
["DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors","A SIEM system is used to gather security data from a number of independent sources","Is event and log data correlated in a centralized place so that it can be analyzed?",null,null,2,{"$f":"(SUM(D12:D13)/2)*100","v":0}]
[null,null,"Are multiple detection sensors used to identify potential issues in critical systems? "]
["DE.AE-5: Incident alert thresholds are established","Automated systems have established alert properties that automatically alert personnel as an event happens","Does your monitoring system have established thresholds for warnings, problems and critical problems?",null,null,3,{"$f":"(SUM(D14:D16)/2)*100","v":0}]
[null,null,"Are monitoring system thresholds documented in a standard operating procedure? "]
[null,null,"Are escalation points and critical events defined for staff responding to monitoring system alerts?"]
["DE.CM-1: The network is monitored to detect potential cybersecurity events","Personnel routinely monitor the network to detect issues and cyber security attacks","Do security staff monitor the network, SIEM and monitoring systems to detect potential cyber security events? ",null,null,1,{"$f":"D17*100","v":0}]
["DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","User monitoring is present that can detect malicious events in user behavior ","Is user activity monitored to detect malicious behavior? ",null,null,1,{"$f":"D18*100","v":0}]
["DE.CM-4: Malicious code is detected","Endpoints are controlled to prevent malicious software from being used / installed","Do you maintain an endpoint protection software? ",null,null,3,{"$f":"(SUM(D19:D21)/2)*100","v":0}]
[null,null,"Do you maintain a network access control system? "]
[null,null,"Is endpoint protection tied to a central console for monitoring?"]
["DE.CM-5: Unauthorized mobile code is detected","Mobile devices are controlled as endpoints to prevent malicious software from running on them.","Do you maintain endpoint protection software for mobile devices? ",null,null,1,{"$f":"D22*100","v":0}]
["DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed","Security personnel monitor network connections and devices to prevent and detect unauthorized access","Is user activity monitored to detect malicious behavior? ",{"$f":"D18","v":0},null,1,{"$f":"D23*100","v":0}]
["DE.CM-8: Vulnerability scans are performed","Network systems are routinely pen-tested and scanned","Do you conduct routine penetration tests on critical systems and infrastructure? ",null,null,2,{"$f":"(SUM(D24:D25)/2)*100","v":0}]
[null,null,"do you have a documented process for conducting penetration testing and vulnerability testing on critical systems?"]
["DE.DP-3: Detection processes are tested","Endpoint and sensor systems are routinely fed with known alert data to test detection methods","Are protection systems and monitoring systems tested with known positives to evaluate response? ",null,null,2,{"$f":"(SUM(D26:D27)/2)*100","v":0}]
[null,null,"Is a testing process for detection methods outlined in a process document? "]
["DE.DP-4: Event detection information is communicated to appropriate parties","A clearly defined communication and escalation plan is in place for automated and human discovered cybersecurity incidents","Do you have a clearly documented response plan for incidents discovered by security personnel? ",null,null,2,{"$f":"(SUM(D28:D29)/2)*100","v":0}]
[null,null,"Are escalation points and critical events defined for staff responding to monitoring system alerts?",{"$f":"D16","v":0}]
["DE.DP-5: Detection processes are continuously improved","The above processes are routinely revised to insure they are up to date and relevant. ","Are detection processes routinely reviewed to ensure they are up to date and reflect current industry trends? ",null,null,1,{"$f":"D30*100","v":0}]
["PR.DS-1: Data-at-rest is protected","Data at rest is encrypted and stored in a redundant manor","Is critical data (as defined in the organizational profile) encrypted when at rest? ",null,null,1,{"$f":"D31*100","v":0}]
["PR.DS-4: Adequate capacity to ensure availability is maintained","Critical infrastructure is subjected to stress testing to ensure adequate capacity remains in the event of a disaster","Are critical systems routinely evaluated to ensure they have adequate capacity?",null,null,2,{"$f":"(SUM(D32:D33)/2)*100","v":0}]
[null,null,"Does the organization have an overall capacity plan for managed infrastructure that includes room for expected growth? "]
["PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy","A detailed audit log and log retention policy is established in the organization and regularly reviewed","Does the organization have a detailed audit and log retention policy that defines logs that are critical to security analysis?",null,null,2,{"$f":"(SUM(D34:D35)/2)*100","v":0}]
[null,null,"Does a policy exist for the retention of logs?"]
["RS.CO-2: Events are reported consistent with established criteria","Events that are reported by personnel and automated systems have been established to avoid false positives and negatives","Have logging systems been reviewed and tuned to eliminate false positives from being reported to system administrators?",null,null,1,{"$f":"D36*100","v":0}]
["RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","Patch management processes are clearly documented with established processes (relative to specific systems) for the mitigation of vulnerabilities","Does your organization have a clearly defined patching process for critical infrastructure that identifies the risks of patching and delaying patching? ",null,null,1,{"$f":"D37*100","v":0}]
["DE.AE-2: Detected events are analyzed to understand attack targets and methods","When an event occurs on a critical system staff undertake a review process to understand the methods used in the attack","Does your organization perform a through analysis or post-mortem on events to determine attack methods and targets? ",null,null,null,{"$f":"D38*100","v":0}]
["DE.AE-4: Impact of events is determined","Security personnel identify the impact of various events",null,null,null,null,{"$f":"D39*100","v":0}]

{"sheet":"I - Assett Mgmt.","index":6,"n_rows":22,"n_cols":7,"rows_kept":22,"cut":false,"hidden":false,"merged":[[1,0,2,0],[1,1,2,1],[3,0,5,0],[3,1,5,1],[6,0,8,0],[6,1,8,1],[9,0,10,0],[9,1,10,1],[11,0,12,0],[11,1,12,1],[13,0,14,0],[13,1,14,1],[15,0,17,0],[15,1,17,1],[18,0,19,0],[18,1,19,1],[20,1,21,1],[20,0,21,0],[1,6,2,6],[1,5,2,5],[3,5,5,5],[3,6,5,6],[6,5,8,5],[6,6,8,6],[9,5,10,5],[9,6,10,6],[11,5,12,5],[11,6,12,6],[13,5,14,5],[13,6,14,6],[15,5,17,5],[15,6,17,6],[18,5,19,5],[18,6,19,6],[20,6,21,6],[20,5,21,5]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score"]
["ID.AM-1: Physical devices and systems within the organization are inventoried","An inventory control system where physical devices are cataloged and tracked throughout the lifecycle of the device","Do you have an inventory control system in place that tracks the location of an asset throughout its lifecycle",null,null,2,{"$f":"(SUM(D2:D3)/2)*100","v":0}]
[null,null,"Does your inventory control system contain up-to-date information on all assets that are connected to the corporate network?"]
["ID.AM-2: Software platforms and applications within the organization are inventoried","A systems management software that identifies and catalogs all software installed on organizational assets. ","Do you have an automated systems management software that inventories software installed on endpoints connected to the corporate network? ",null,null,3,{"$f":"(SUM(D4:D6)/2)*100","v":0}]
[null,null,"Does your systems management software track license data relative to software installed on endpoints? "]
[null,null,"Does your systems management software have the ability to track rogue applications installed on corporate endpoints? "]
["ID.AM-4: External information systems are catalogued","A detailed inventory of hosted system that identifies all relevant information and critical contacts","Do you have a documented knowledgebase of hosted systems?",null,null,3,{"$f":"(SUM(D7:D9)/2)*100","v":0}]
[null,null,"Does the inventory of hosted systems include relevant information regarding integrations and connection points? "]
[null,null,"Does the inventory of hosted systems include contact information for the company hosting the application? "]
["ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value ","An assessment of physical assets that includes priority relative to criticality and business value for all high-level critical systems","Are the physical assets of critical systems identified and inventoried? ",null,null,2,{"$f":"(SUM(D10:D11)/2)*100","v":0}]
[null,null,"Do you have documentation that outlines the priority of physical assets that support critical systems (relative to the importance of the system itself)?"]
["ID.RA-1: Asset vulnerabilities are identified and documented","Assets are regularly subjected to vulnerability identification and vulnerabilities are well documented","Do you have a documented process that inventories vulnerabilities and threats for critical assets (that support critical systems)? ",null,null,2,{"$f":"(SUM(D12:D13)/2)*100","v":0}]
[null,null,"Is a documented process in place for cataloging and inventorying new vulnerabilities for critical assets?"]
["PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition","Assets that contain data are tracked through their lifecycle and a clearly defined process is established for the secure destruction of data before an asset is disposed of. ","Do you have a formal process for the secure disposal of assets after their lifecycle has ended? ",null,null,2,{"$f":"(SUM(D14:D15)/2)*100","v":0}]
[null,null,"Do you use a secure destruction method for the removal of critical data from assets after their lifecycle has ended?"]
["PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained","Baseline configurations that are hardened and security tested are used for workstation and server deployments","Are new servers and critical infrastructure provisioned according to a formalized hardened baseline?",null,null,3,{"$f":"(SUM(D16:D18)/2)*100","v":0}]
[null,null,"Are endpoint images subjected to baseline configuration testing?"]
[null,null,"Is a documented process in place to update baselines regularly? "]
["PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools","Assets that contain data are repaired in accordance with best practices, tool access is controlled and all maintenance activities are logged","Is maintenance of organizational assets tracked in a ticketing system?",null,null,2,{"$f":"(SUM(D19:D20)/2)*100","v":0}]
[null,null,"Are controls in place to prevent the introduction of third-party repair tools into the environment? "]
["PR.IP-7: Protection processes are continuously improved","Security processes for critical assets are routinely reviewed and updated to account for new vulnerabilities","Is a formalized patching process in place for critical infrastructure? ",null,null,2,{"$f":"(SUM(D21:D22)/2)*100","v":0}]
[null,null,"Is a review process in place for asset protection policies and procedures?"]

{"sheet":"I. Access Control  & HR","index":7,"n_rows":19,"n_cols":7,"rows_kept":19,"cut":false,"hidden":false,"merged":[[16,1,18,1],[16,0,18,0],[16,5,18,5],[16,6,18,6],[11,1,13,1],[11,0,13,0],[11,5,13,5],[11,6,13,6],[14,1,15,1],[14,0,15,0],[14,5,15,5],[14,6,15,6],[1,5,3,5],[1,6,3,6],[4,5,6,5],[4,6,6,6],[7,5,9,5],[7,6,9,6],[4,1,6,1],[1,1,3,1],[1,0,3,0],[4,0,6,0],[7,1,9,1],[7,0,9,0]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score"]
["PR.AC-1: Identities and credentials are managed for authorized devices and users","An identity management system that interfaces with critical business software and manages the lifecycle of the user","Does your organization have an identity management system? ",null,null,3,{"$f":"(SUM(D2:D4)/3)*100","v":0}]
[null,null,"Do you use SSO technology to have one login for all corporate systems? "]
[null,null,"Does your identity management system interface with the HRIS to automatically provision and de-provision users and roles?"]
["PR.AC-3: Remote access is managed","Access remotely via a secured VPN, control of which users are able to access systems remotely","Does your organization have a policy or procedure for remotely accessing systems? ",null,null,3,{"$f":"(SUM(D5:D7)/3)*100","v":0}]
[null,null,"Do you employ 2FA for critical systems? "]
[null,null,"Are your employees required to use a VPN for remotely accessing critical systems? "]
["PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties","Users are assigned the least amount of privileges required to accomplish job functions. \nSeparation of duties is present in organizational workflows when dealing with sensitive data and functions","Are permission changes managed automatically when an employee moves roles? ",null,null,3,{"$f":"(SUM(D8:D10)/3)*100","v":0}]
[null,null,"Are role based security permissions documented for each role in the organization?"]
[null,null,"Are critical business functions that deal with sensitive data isolated with separation of responsibility and two-person controls?  "]
["PR.DS-5: Protections against data leaks are implemented",null,"Are there currently protections in place to prevent or detect the unauthorized transmission of critical data? ",null,null,1,{"$f":"(D11/F11)*100","v":0}]
["PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access","Remote maintenance is approved by management, logged and monitored to prevent third parties from accessing additional systems (beyond the scope of the maintenance) ","Are vendor activities documented and logged in a ticketing system? ",null,null,3,{"$f":"(SUM(D12:D14)/3)*100","v":0}]
[null,null,"Is a policy in place for management to approve remove access by vendors? "]
[null,null,"Do vendors or remote support entitles have the ability to access a system without first contacting "]
["PR.PT-3: Access to systems and assets is controlled, incorporating the principle of least functionality","Users are assigned the least amount of privileges required to accomplish job functions. ","Are role based security permissions documented for each role in the organization?",{"$f":"D9","v":0},null,2,{"$f":"(SUM(D15:D16)/3)*100","v":0}]
[null,null,"Are role based permissions reviewed periodically to ensure the principal of least privilege is followed? "]
["PR.IP-11: Cybersecurity is included in human resources practices (e.g., de-provisioning, personnel screening)","Information security is embedded into all relevant business processes including HR and financial controls","Are applications credentials, employment history and criminal history verified by HR during the hiring process",null,null,3,{"$f":"(SUM(D17:D19)/3)*100","v":0}]
[null,null,"Is termination of access automated in HR systems? "]
[null,null,"Are employees required to sign a confidentiality agreement when dealing with sensitive data? "]

{"sheet":"I - DR & IR","index":8,"n_rows":25,"n_cols":7,"rows_kept":25,"cut":false,"hidden":false,"merged":[[19,2,20,2],[4,5,5,5],[4,6,5,6],[9,0,10,0],[9,1,10,1],[9,5,10,5],[9,6,10,6],[14,2,15,2],[16,2,17,2],[1,1,2,1],[1,0,2,0],[1,5,2,5],[1,6,2,6],[4,1,5,1],[4,0,5,0]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score"]
["PR.IP-4: Backups of information are conducted, maintained, and tested periodically","A formal backup process is in place that identifies frequency and priority of backups. Backups are monitored and restore process is regularly tested","Is a formal backup and recovery plan in existence? ",null,null,2,{"$f":"(SUM(D2:D3)/2)*100","v":0}]
[null,null,"Are backups periodically tested and verified? "]
["PR.IP-10: Response and recovery plans are tested","Disaster response and other response plans are regularly tested ","Do you regularly test your disaster recovery plans? ",null,null,1,{"$f":"(D4/F4)*100","v":0}]
["RS.RP-1: Response plan is executed during or after an event","A detailed response plan is available to staff responding to an event that is used when an event takes place","Do you have an approved incident response plan?",null,null,2,{"$f":"(SUM(D5:D6)/2)*100","v":0}]
[null,null,"Do you have an approved business continuity plan? "]
["RS.CO-1: Personnel know their roles and order of operations when a response is needed","Incident response is rehearsed and all personnel know the roles they play in a disaster response. ","Does your incident response plan define roles and responsibilities? ",null,null,1,{"$f":"(D7/F7)*100","v":0}]
["RS.CO-4: Coordination with stakeholders occurs consistent with response plans","Sharing of information with stakeholders and external parties is outlined in response plans and well understood by key personnel ","Does your incident response plan define communication with external and external stakeholders?",null,null,1,{"$f":"(D8/F8)*100","v":0}]
["RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness ","Security breaches are reported to various government and law enforcement sources, pertinent details are shared with communities of practice where possible","In the event of a security breach, does your organization contribute important information to communities of practice (if they are able to)? ",null,null,1,0]
["RS.AN-1: Notifications from detection systems are investigated ","Security personnel review alerts from detection sensors as a matter of practice. ","Are notifications from monitoring systems tracked in a ticketing system?",null,null,2,{"$f":"(SUM(D10:D11)/2)*100","v":0}]
[null,null,"Are notifications from monitoring systems investigated to determine if a risk to the organization is present? "]
["RS.AN-2: The impact of the incident is understood","Key personnel provide guidance to stakeholders so the impact of the incident is understood","Does your incident response plan categorize and classify incidents related to organizational impact? ",null,null,1,{"$f":"(D12/F12)*100","v":0}]
["RS.AN-3: Forensics are performed","When necessary, computer forensics is performed to establish important data relevant to the incident ","When required, does the institution maintain ties with forensic organizations? ",null,null,1,{"$f":"(D13/F13)*100","v":0}]
["RS.AN-4: Incidents are categorized consistent with response plans","Policy and incident response plans outline categories for incidents. Incidents are reported based on category","Does your incident response plan categorize and classify incidents related to organizational impact? ",{"$f":"D12","v":0},null,1,0]
["RS.MI-1: Incidents are contained","Key personnel work quickly to contain the incident from spreading to other key systems in the organization","Is there a formal process to respond to and mitigate common forms of disaster (data loss, Ddos, Malware)",null,null,1,0]
["RS.MI-2: Incidents are mitigated","Key personnel work quickly to mitigate incidents and return the business to functionality as a top priority",null,{"$f":"D15","v":0},null,1,0]
["RS.IM-1: Response plans incorporate lessons learned","Near miss and security events are reviewed to incorporate continuous improvements","Does the organization conduct near miss and post-event reviews to review performance, update processes and fine-tune responses? ",null,null,1,0]
["RS.IM-2: Response strategies are updated","Incident response plans are updated routinely and incorporate technological updates",null,{"$f":"D17","v":0},null,1,0]
["RC.RP-1: Recovery plan is executed during or after an event","A well documented incident response plan is in place to restore critical operations as soon as possible","Does the organization have a business continuity plan that assists with the restoration of services during an event? ",null,null,1,0]
["RC.IM-1: Recovery plans incorporate lessons learned","Near miss and security events are reviewed to incorporate continuous improvements","Does the organization conduct near miss and post-event reviews to review performance, update processes and fine-tune responses? ",{"$f":"D17","v":0},null,1,0]
["RC.IM-2: Recovery strategies are updated","Incident response and recovery plans are routinely updated to incorporate technological and process change",null,{"$f":"D17","v":0},null,1,0]
["RC.CO-1: Public relations are managed","Communications and external relations personnel are involved in security incidents and have adequate training to understand cybersecurity events, in order to communicate effectively to the public","Does your organization have communications a plan in place to insure that information regarding incidents or events is communicated effectively and in a way that preserves institutional marketability? ",null,null,1,0]
["RC.CO-2: Reputation after an event is repaired","Communications and external relations personnel are involved in security incidents and have adequate training to understand cybersecurity events, in order to communicate effectively to the public","Does your incident response team contain representation from your marketing, communications or public relations team? ",null,null,1,0]
["PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed","The organization has clearly defined response plans available in a number of formats that are accessible by relevant stakeholders","Is your incident response plan reviewed continually by relevant stakeholders? ",null,null,1,0]
["DE.AE-4: Impact of events is determined","Security personnel identify the impact of various events","When responding to disasters do security personnel perform an initial impact of events in order to accurately respond (relative to established procedures)? ",null,null,1,0]

{"sheet":"I - Comms","index":9,"n_rows":10,"n_cols":7,"rows_kept":10,"cut":false,"hidden":false,"merged":[[1,6,4,6],[5,6,7,6],[8,6,9,6],[1,1,4,1],[1,0,4,0],[5,1,7,1],[5,0,7,0],[8,1,9,1],[8,0,9,0],[1,5,4,5],[5,5,7,5],[8,5,9,5]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score"]
["PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate","VLAN and network segregation that isolates management consoles, wireless networks, guest networks and various departments","Do you use VLANs to isolate different segments of your network? ",null,null,4,{"$f":"(SUM(D2:D5)/4)*100","v":0}]
[null,null,"Do you isolate access to management interfaces on your network? "]
[null,null,"Are DMZs used in your network for high risk systems? "]
[null,null,"Is there a process to approve additions to firewall rules or new communications between systems? "]
["PR.DS-2: Data-in-transit is protected","Encryption is used for data in transit","Is strong encryption used when data is transmitted over the internet? ",null,null,3,{"$f":"(SUM(D6:D8)/3)*100","v":0}]
[null,null,"Is a policy in place to prevent the sending of confidential material over email? "]
[null,null,"Do third parties transmit data over the internet without using strong encryption? "]
["PR.PT-4: Communications and control networks are protected","Network communications equipment is protected","Do you have a firewall in place? ",null,null,2,{"$f":"(SUM(D9:D10)/2)*100","v":0}]
[null,null,"Do you have a functional intrusion detection system? "]

{"sheet":"I - Physical","index":10,"n_rows":11,"n_cols":7,"rows_kept":11,"cut":false,"hidden":false,"merged":[[1,5,5,5],[6,5,8,5],[9,5,10,5],[1,6,5,6],[6,6,8,6],[9,6,10,6],[1,1,5,1],[1,0,5,0],[6,1,8,1],[9,1,10,1],[6,0,8,0],[9,0,10,0]]}
["Subcategory","Objectives","Question / Evidence","Score /1","Comments","Points Possible","Subcategory Score"]
["PR.AC-2: Physical access to assets is managed and protected","Physical security controls on server rooms and other assets to prevent theft and unauthorized physical access","Are server rooms and network closets locked? ",null,null,5,{"$f":"(SUM(D2:D6)/5)*100","v":0}]
[null,null,"Is there surveillance in place for server rooms and network closets? "]
[null,null,"Do you have a log of physical activity inside of server rooms? "]
[null,null,"Are visitors and external vendors escorted when entering server rooms? "]
[null,null,"Is physical access to server rooms terminated when an employee leaves? "]
["PR.AT-5: Physical and information security personnel understand roles & responsibilities ","Physical security and information security personnel understand their roles, limitations and how they interface with each other. ","Are physical security employees trained to understand roles related to cybersecurity? ",null,null,3,{"$f":"(SUM(D7:D9)/3)*100","v":0}]
[null,null,"is a method is in place to measure physical security personnel's cybersecurity knowledge and understanding against organization requirements?"]
[null,null,"Are knowledge and skills required defined for physical security personnel? "]
["DE.CM-2: The physical environment is monitored to detect potential cybersecurity events","Connection points (jacks, switches) are audited and monitored to prevent unauthorized connections","Do you have an inventory of critical facilities (data centers, network closets, control rooms)? ",null,null,2,{"$f":"(SUM(D10:D11)/2)*100","v":0}]
[null,null,"Are the locations mentioned above monitored for physical security (door locks, sign in/out, cameras) "]

{"sheet":"Summary - Identify","index":11,"n_rows":25,"n_cols":6,"rows_kept":25,"cut":false,"hidden":false,"merged":[[1,0,6,0],[7,0,11,0],[12,0,15,0],[16,0,21,0],[22,0,24,0]]}
["Category","Subcategory","NIST Testing Steps","Interview Score /100","Score","Relevant COBIT Practices"]
["Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization’s risk strategy.","ID.AM-1: Physical devices and systems within the organization are inventoried","1. Obtain a copy of physical devices and systems inventory. Review the inventory considering the following:\na. Scope of physical devices and systems is based on the organization's risk appetite (e.g., systems that contain sensitive information, allow access to the network, or are critical to business objectives)\nb. Completeness of inventory (e.g., location, asset number, owner)\nc. Inventory collection process ensures new devices are collected accurately and in a timely manner (e.g., automated software to detect and/or store the inventory)\nd. Frequency of inventory reviews",{"$f":"'I - Assett Mgmt.'!G2:G3","v":0},"N: Not Achieved (0 to 15%)","BAI09.01, BAI09.02"]
[null,"ID.AM-2: Software platforms and applications within the organization are inventoried","1. Obtain a copy of software inventory. Review the inventory considering the following:\na. Scope of software inventory is based on the organization's risk appetite (e.g., software that processes, stores or accesses sensitive information or is critical to business objectives)\nb. Completeness of inventory (e.g., version, system, vendor, owner)\nc. Inventory collection process ensures new software is collected accurately and in a timely manner (e.g., automated software to detect and/or store the inventory)\nd. Frequency of inventory reviews",{"$f":"'I - Assett Mgmt.'!G4","v":0},{"$f":"IF(D3<=15,\"N: Not Achieved (0 to 15%)\",IF(D3<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D3<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D3>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"},"BAI09.01, BAI09.02, BAI09.05"]
[null,"ID.AM-3: Organizational communication and data flows are mapped","1. Ensure the organization maintains accurate and current copies of data flow diagram(s) (DFD), logical network diagram(s) (LND), and/or other diagrams to show organizational communication and data flow. ",{"$f":"'I - Bus. Ops'!G3","v":0},"N: Not Achieved (0 to 15%)","DSS05.02"]
[null,"ID.AM-4: External information systems are catalogued","1. If the organization relies on information systems hosted by third parties, obtain a copy of the external systems inventory.  Review the third-party inventory considering the following:\na. Scope of external systems is based on the organization's risk appetite (e.g., systems that store, process or access sensitive information or are critical to business objectives).\nb. Completeness of inventory (e.g., location, third party, owner, etc.)\nc. Inventory collection process ensures new systems are collected accurately and in a timely manner (e.g,. automated software to detect and/or store the inventory)\nd. Frequency of inventory reviews\n",{"$f":"'I - Assett Mgmt.'!G7","v":0},"N: Not Achieved (0 to 15%)","APO02.02"]
[null,"ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value ","1. Obtain a copy of the organization's data classification program (classification may also be identified in the risk assessment or business impact analysis).\n2. Review the program to determine if key resources (e.g., hardware, devices, data, software) are classified and prioritized based on criticality and business value.",{"$f":"'I - Assett Mgmt.'!G10","v":0},"N: Not Achieved (0 to 15%)","APO03.03, APO03.04, BAI09.02"]
[null,"ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established","1. Review cybersecurity policies, information security policies, job descriptions, agreements, RACI charts, service level agreements (SLAs) and/or contracts to determine if they include cybersecurity roles and responsibilities.\n",{"$f":"'I - Sec. Ops'!G2","v":0},"N: Not Achieved (0 to 15%)","APO01.02, DSS06.03"]
["Business Environment (ID.BE): The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions.","ID.BE-1: The organization’s role in the supply chain is identified and communicated","1. Obtain documentation or evidence (e.g., cybersecurity strategy, business continuity plan, information system acquisition procedures, business impact analysis, acquisition/procurement process, key supplier reviews, supplier relationship management, supplier due diligence reports) to determine whether the organization has clearly defined and understands its role in the supply chain. ",{"$f":"'I - Bus. Ops'!G3","v":0},"N: Not Achieved (0 to 15%)","APO08.04, APO08.05, APO10.03, APO10.04, APO10.05"]
[null,"ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated","1. Obtain documentation or evidence (e.g., mission statement, business continuity policy, strategic plan) that the organization has clearly defined and understands its role in its industry sector and its role within national critical infrastructure, as defined by the Department of Homeland Security (https://www.dhs.gov/what-critical-infrastructure). ",{"$f":"'I - Bus. Ops'!G5","v":0},"N: Not Achieved (0 to 15%)","APO02.06, APO03.01"]
[null,"ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated","1. Determine if the organization has a strategic plan defining enterprise goals. Ensure enterprise goals are aligned with stakeholder interests.\n2. Determine if the organization's mission statement and objectives are clearly published in a way employees can easily see or access them.\n3. Determine if an IT strategic plan is documented, defines goals and is mapped to enterprise goals.\n4. Determine if employees are educated on the organization's mission and objectives.",{"$f":"'I - Bus. Ops'!G6","v":0},"N: Not Achieved (0 to 15%)","APO02.01, APO02.06, APO03.01"]
[null,"ID.BE-4: Dependencies and critical functions for delivery of critical services are established","1. Obtain the organization's business continuity plan, disaster recovery plan, business impact analysis and risk assessments and review for the following:\na. Information systems and software supporting critical business functions are identified and prioritized based on maximum allowable downtime.\nb. Third parties who support critical business functions and information systems/software are identified and prioritized.",{"$f":"'I - Bus. Ops'!G8","v":0},"N: Not Achieved (0 to 15%)"]
[null,"ID.BE-5: Resilience requirements to support delivery of critical services are established","1. Determine if the organization's business continuity and disaster recovery plans (including business impact analysis) support resilience of critical services.\n2. Determine if appropriate due diligence (e.g., business continuity plans (BCP), service level agreements (SLA), Service Organization Control (SOC) reports) information is in place and reviewed to ensure resilience requirements of the organization can be met by critical third-party services.",{"$f":"'I - Sec. Ops'!G10","v":0},"N: Not Achieved (0 to 15%)","DSS04.02"]
["Governance (ID.GV): The policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements are understood and inform the management of cybersecurity risk.","ID.GV-1: Organizational information security policy is established","1. Obtain a copy of the information security policy.\n2. Determine if the policy is complete and has been approved by a governance structure within the organization.\n3. Determine if the policy is communicated to employees.",{"$f":"' I- Mgmt'!G2","v":0},"N: Not Achieved (0 to 15%)","APO01.03, EDM01.01, EDM01.02"]
[null,"ID.GV-2: Information security roles & responsibilities are coordinated and aligned with internal roles and external partners","1. Determine if information security roles and responsibilities are defined.  Roles and responsibilities may be defined in policies, job descriptions, agreements, RACI charts, hierarchy charts and/or contracts.\n2. Determine if there is sufficient independence within the information security roles in order to provide adequate separation of duties for critical functions.\n3. Review contracts, nondisclosure agreements (NDAs) and service level agreements (SLAs) with critical vendors to determine if cybersecurity controls and incident notification are addressed appropriately.",{"$f":"' I- Mgmt'!G3","v":0},"N: Not Achieved (0 to 15%)","APO13.12"]
[null,"ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed","1. Obtain a list of all relevant legal and regulatory requirements for the organization.\n2. Determine if the cybersecurity program is mapped to legal and regulatory requirements.\n3. Review any recent regulatory cybersecurity exams or audits.  If any exceptions were noted in audits, determine how the organization responded to exceptions.  \n4. Determine if critical third-party contracts are reviewed by legal counsel prior to execution.\n5. Determine if there is a formalized process in place to monitor and review changes in cybersecurity laws and regulations.",{"$f":"' I- Mgmt'!G4","v":0},"N: Not Achieved (0 to 15%)","MEA03.01, MEA03.04"]
[null,"ID.GV-4: Governance and risk management processes address cybersecurity risks","1. Determine the adequacy of executive or board oversight and understanding of cybersecurity.  Consider the following:\na. Risk Management\nb. Governance Structures\nc. Security Oversight\nd. Training\ne. Accountability\nf. Reporting",{"$f":"' I- Mgmt'!G8","v":0},"N: Not Achieved (0 to 15%)","DSS04.02"]
["Risk Assessment (ID.RA): The organization understands the cybersecurity risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.","ID.RA-1: Asset vulnerabilities are identified and documented","1. Determine if vulnerability testing is conducted and analyzed on critical organizational assets (e.g., assets important to business objectives and the organization's risk strategy).",{"$f":"'I - Assett Mgmt.'!G12","v":0},"N: Not Achieved (0 to 15%)","APO12.01, APO12.02, APO12.03, APO12.04"]
[null,"ID.RA-2: Threat and vulnerability information is received from information sharing forums and sources","1. Determine if the organization is a member of or subscribes to a threat and vulnerability information sharing organization (e.g,. United States Computer Emergency Readiness Team [US-CERT]).\n2. Determine if the organization has a formal process in place for disseminating threat and vulnerability information to individuals with the expertise to review the information and the authority to mitigate risk posed to the organization.",{"$f":"'I - Sec. Ops'!G4","v":0},"N: Not Achieved (0 to 15%)"]
[null,"ID.RA-3: Threats, both internal and external, are identified and documented","1. Review risk assessments to determine if internal and external threats are identified and documented.\n2. Determine if the organization has developed processes to actively monitor and report potential threats.",{"$f":"'I - Sec. Ops'!G6","v":0},"N: Not Achieved (0 to 15%)","APO12.01, APO12.02, APO12.03, APO12.04"]
[null,"ID.RA-4: Potential business impacts and likelihoods are identified","1. Review risk assessments and business impact analysis to determine if likelihood and potential impacts are identified and analyzed for threats.",{"$f":"'I - Sec. Ops'!G7","v":0},"N: Not Achieved (0 to 15%)","DSS04.02"]
[null,"ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk","1. Determine if the risk assessment process identifies reasonably foreseeable internal and external threats and vulnerabilities, the likelihood and potential damage of those threats, and the sufficiency of controls to mitigate the risk associated with those threats.",{"$f":"'I - Sec. Ops'!G8","v":0},"N: Not Achieved (0 to 15%)","APO12.02"]
[null,"ID.RA-6: Risk responses are identified and prioritized","1. Obtain the organization's risk management plan and/or other documentation showing the organization's response to risk levels identified in the risk assessment. Determine if the risk management plan is designed to accept or reduce risk level in accordance with the organization's risk appetite.\n2. Obtain copies of management responses to recent cybersecurity-related audits and assessments to determine if exceptions noted in audits or assessments are identified and prioritized.",{"$f":"'I - Sec. Ops'!G9","v":0},"N: Not Achieved (0 to 15%)","APO12.05, APO13.02"]
["Risk Management Strategy (ID.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.","ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders","1. Evaluate the framework or process used for risk management.  Consider the following:\na. Is the process formally documented?\nb. Is the process regularly updated?\nb. Is the process repeatable and measurable?\nc. Does the process have an owner?\nd. Are stakeholders involved or informed of the process?",{"$f":"' I- Mgmt'!G9","v":0},"N: Not Achieved (0 to 15%)","APO12.04, APO12.05, APO13.02, BAI02.03, BAI04.02 "]
[null,"ID.RM-2: Organizational risk tolerance is determined and clearly expressed","1. Determine if the organization has defined and approved a cyberrisk appetite statement.",{"$f":"' I- Mgmt'!G10","v":0},"N: Not Achieved (0 to 15%)","APO12.06"]
[null,"ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis","1. Obtain a copy of the organization's risk management strategy and risk appetite statement to determine if these align with its role in critical infrastructure (as defined by national infrastructure protection plan [NIPP] and sector-specific plans).\n",{"$f":"' I- Mgmt'!G11","v":0},"N: Not Achieved (0 to 15%)"]

{"sheet":"Summary - Protect","index":12,"n_rows":36,"n_cols":6,"rows_kept":36,"cut":false,"hidden":false,"merged":[[30,0,31,0],[32,0,35,0],[1,0,5,0],[6,0,10,0],[11,0,17,0],[18,0,29,0]]}
["Category","Subcategory","NIST Testing Steps","Interview Score /100","Score","Relevant COBIT Practices"]
["Access Control (PR.AC): Access to assets and associated facilities is limited to authorized users, processes, or devices, and to authorized activities and transactions.","PR.AC-1: Identities and credentials are managed for authorized devices and users","1. Determine whether access to network devices (e.g., servers, workstations, mobile devices, firewalls) are restricted by:\na. Unique user logon IDs\nb. Complex passwords\nc. Multifactor authentication\nd. Automatic timeout if left unattended\ne. Automatic lockout after repeated failed access attempts\nd. Changing default administrative account names and passwords\n2. Determine whether password parameters comply with organization policy and/or applicable industry requirements. Consider the following:\na. Length, complexity, change requirements, history\nb. Are passwords suppressed from all output?\nc. Are password files encrypted and restricted?\n3. Review termination procedures to ensure credentials are revoked or changed when an employee leaves.\na. Spot-check accounts to ensure user access is revoked following termination and accounts are deleted according to policy.",{"$f":"'I. Access Control  & HR'!G2:G4","v":0},{"$f":"IF(D2<=15,\"N: Not Achieved (0 to 15%)\",IF(D2<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D2<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D2>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"},"DSS05.04, DSS06.03"]
[null,"PR.AC-2: Physical access to assets is managed and protected","1. Determine whether physical access to key assets (e.g., server rooms, network closets, zones) are physically restricted:\na. Locked doors\nb. Surveillance\nc. Fences or walls\nd. Logs\ne. Visitor escorts\n2. Determine whether policies and procedures allow only authorized personnel access to sensitive areas.\n3. Review termination procedures to ensure physical access is removed once an employee leaves.",{"$f":"'I - Physical'!G2:G6","v":0},{"$f":"IF(D3<=15,\"N: Not Achieved (0 to 15%)\",IF(D3<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D3<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D3>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"},"DSS01.04, DSS05.05"]
[null,"PR.AC-3: Remote access is managed","1. Determine whether policies and procedures related to remote users' access capabilities are formalized. Consider the following:\na. Remote users (e.g., employees, contractors, third parties) with access to critical systems are approved and documented.\nb. Remote connections are only opened as required.\nc. Remote connections are logged and monitored.\nd. Remote connections are encrypted.\ne. Strong authentication is in place (e.g., multifactor, strong password parameters).\nf. The ability to wipe data remotely on mobile devices when data are missing or stolen is enabled.\ng. Institution security controls (e.g., antivirus, patch management) are required on remote devices connecting to the network.",{"$f":"'I. Access Control  & HR'!G5","v":0},"N: Not Achieved (0 to 15%)","APO13.01, DSS01.04, DSS05.03"]
[null,"PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties","1. Review access rights and permissions for the network and any critical applications.\n2. Determine if user access profiles are consistent with their job functions (based on least privilege). Compare a sample of users' access authority with their assigned duties and responsibilities.\n3. Determine if access is granted for mission critical functions and information system support functions in order to reduce the risk of malevolent activity without collusion (e.g., critical processes require two people to perform the function).\n4. Determine if users with local administrative privilege on workstations require this level of access.\n5. Review how the organization restricts and/or monitors access to sensitive data by users with elevated network privilege.\n6. Determine if role-based access controls are implemented (e.g., roles vs. users are assigned access rights).\n7. Determine if there are regular reviews of access.",{"$f":"'I. Access Control  & HR'!G8","v":0},"N: Not Achieved (0 to 15%)"]
[null,"PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate","1. Review network diagrams and data flow diagrams. \n2. Determine if high-value/critical systems are separated from high-risk systems (e.g., VLAN, DMZ, hard backups, air-gapping) where possible.\n3. Determine if the organization has a formal process to approve data flows and/or connections between networks and/or systems.",{"$f":"'I. Access Control  & HR'!G11","v":0},"N: Not Achieved (0 to 15%)"]
["Awareness and Training (PR.AT): The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.","PR.AT-1: All users are informed and trained ","1. Review acceptable use policy and/or training materials to ensure content is adequate.\n2. Review user training reports and/or documentation to ensure users are trained in accordance with applicable policy, guidance, and/or requirement (e.g., annual cybersecurity training of all employees).\n3. Determine whether training materials are updated based on changes in cyberthreat environment.",{"$f":"'I - Bus. Ops'!G9","v":0},"N: Not Achieved (0 to 15%)","APO07.03, BAI05.07"]
[null,"PR.AT-2: Privileged users understand roles & responsibilities ","1. Determine if the organization has a process to identify privileged users.\n2. Determine if privileged users' roles are well defined and if privileged users are trained based on their responsibilities.\n3. Review training material and/or user agreements to ensure users with elevated privileges are taught security roles and responsibilities associated with elevated privileges.",{"$f":"'I - Bus. Ops'!G11","v":0},"N: Not Achieved (0 to 15%)","APO07.02, DSS06.03"]
[null,"PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities ","1. Review applicable third-party contracts, customer agreements, and partner agreements to ensure security roles and responsibilities are clearly defined.\n2. Review the organization's vendor management program to ensure third parties are complying with cybersecurity responsibilities defined in contracts and agreements.",{"$f":"'I - Bus. Ops'!G12","v":0},"N: Not Achieved (0 to 15%)","APO07.03, APO10.04, APO10.05"]
[null,"PR.AT-4: Senior executives understand roles & responsibilities ","1. Review training and continuing education programs for senior executives.  Consider the following:\na. Cybersecurity knowledge and skill levels needed to perform their duties are defined.\nb. Specific role-based training is assigned based on cybersecurity roles and responsibilities. \nc. A method is in place to measure senior executives' cybersecurity knowledge and understanding against organization requirements.\nd. Training and education materials are updated to reflect changes in the threat environment.",{"$f":"' I- Mgmt'!G13","v":0},"N: Not Achieved (0 to 15%)","APO07.03"]
[null,"PR.AT-5: Physical and information security personnel understand roles & responsibilities ","1. Review training and continuing education programs for physical and information security personnel. Consider the following:\na. Knowledge and skill levels needed to perform physical and information security duties are defined.\nb. Specific role-based training is assigned based on physical and information security roles and responsibilities. \nc. A method is in place to measure physical and information security personnel's cybersecurity knowledge and understanding against organization requirements.\nd. Training and education materials are updated to reflect changes in the threat environment.\n",{"$f":"'I - Physical'!G7","v":0},"N: Not Achieved (0 to 15%)","APO07.03"]
["Data Security (PR.DS): Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.","PR.DS-1: Data-at-rest is protected","1. Determine if confidential or sensitive data is identified on the organization's network (e.g., data classification, risk assessment).\n2. Determine if confidential data is secured (e.g., strong encryption as defined by industry best practices) at rest.\n3. Determine if mobile devices (e.g., laptops, tablets, removable media) that are used to store confidential data are encrypted.\n4. Review contracts with third parties storing confidential data to ensure appropriate security controls are in place for sensitive data at rest.",{"$f":"'I - Sec. Ops'!G31","v":0},"N: Not Achieved (0 to 15%)","APO01.06, BAI02.01, BAI06.01, DSS06.06"]
[null,"PR.DS-2: Data-in-transit is protected","1. Determine if sensitive information is secured (e.g., strong encryption as defined by industry best practices) when transmitted across publicly-accessible networks.\n2. Determine if adequate policies are in place regarding transmission of confidential or sensitive information via email.\n3. Review training materials and/or acceptable use policy to determine whether employees are instructed on organization policy regarding data transmission.\n4. Review contracts with third parties transmitting confidential data to ensure appropriate security controls are in place for transmission of sensitive data.",{"$f":"'I - Comms'!G6","v":0},"N: Not Achieved (0 to 15%)","APO01.06, DSS06.06"]
[null,"PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition","1. Review asset inventory policies and procedures.  Consider the following:\na. Formalized processes in place \nb. Accuracy of asset tracking\nc. Secure removal or destruction of confidential information from decommissioned assets",{"$f":"'I - Assett Mgmt.'!G14:G15","v":0},"N: Not Achieved (0 to 15%)","BAI09.03"]
[null,"PR.DS-4: Adequate capacity to ensure availability is maintained","1. Review sample of capacity management monitoring reports used to monitor critical resources such as network bandwidth, CPU, disk utilization, etc.\n2. Determine if resources have adequate capacity (e.g., disk space, CPU). \n3. Determine if the risk of distributed denial-of-service (DDoS) has been addressed and is in line with the organization's risk appetite. ",{"$f":"'I - Sec. Ops'!G32","v":0},"N: Not Achieved (0 to 15%)","APO13.01"]
[null,"PR.DS-5: Protections against data leaks are implemented","1. Review risk assessments, information security meeting minutes and information security strategies to determine if the risk of data loss prevention or exfiltration of confidential data is being considered.\n2. Ensure controls or tools (e.g., data loss prevention) are in place to detect or block potential unauthorized or unintentional transmission or removal of confidential data (e.g., email, FTP, USB devices, Telnet)   ",{"$f":"'I. Access Control  & HR'!G11","v":0},"N: Not Achieved (0 to 15%)","APO01.06"]
[null,"PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity","1. Determine if the organization employs integrity verification tools (e.g., parity checks, cyclical redundancy checks, cryptographic hashes) to detect unauthorized changes to software (e.g., middleware, applications and operating systems with key internal components such as kernels, drivers), firmware (e.g., Basic Input Output System [BIOS]), and information (e.g., metadata such as security attributes associated with information).  ",{"$f":"'I - Bus. Ops'!G13","v":0},"N: Not Achieved (0 to 15%)"]
[null,"PR.DS-7: The development and testing environment(s) are separate from the production environment","1. If the organization maintains a software development or testing environment, review network diagrams, database connections and applicable firewall/router configurations to determine sufficiency of separation between these environments and the production network.",{"$f":"'I - Bus. Ops'!G14","v":0},"N: Not Achieved (0 to 15%)","BAI07.04"]
["Information Protection Processes and Procedures (PR.IP): Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.","PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained","1. Determine if the organization has created or adopted baseline configurations (e.g., Center for Internet Security [CIS] benchmarks, Security Technical Implementation Guides [STIG]) for systems (e.g., servers, desktops, routers).\n2. Sample systems against the organization's baseline configurations to ensure standards are followed and enforced.",{"$f":"'I - Assett Mgmt.'!G16","v":0},"N: Not Achieved (0 to 15%)","BAI10.01, BAI10.02, BAI10.03, BAI10.05"]
[null,"PR.IP-2: A System Development Life Cycle to manage systems is implemented","1. Obtain and review a copy of the organization's system development life cycle.\n2. Obtain samples of rollout documentation and rollout schedule to ensure compliance with policy.",{"$f":"'I - Bus. Ops'!G15","v":0},"N: Not Achieved (0 to 15%)","APO13.01"]
[null,"PR.IP-3: Configuration change control processes are in place","1. Determine if configuration change control processes for information systems are in place.  Consider the following:\na. Proposed changes are documented and approved.\nb. Changes are prohibited until designated approvals are received.\nc. Changes are tested and validated before implementation.\nd. Changes are documented and reported upon completion.\n",{"$f":"'I - Bus. Ops'!G18","v":0},"N: Not Achieved (0 to 15%)","BAI06.01, BAI01.06"]
[null,"PR.IP-4: Backups of information are conducted, maintained, and tested periodically","1. Determine if a formal backup and recovery plan exists.\n2. Review backup procedures. Ensure periodic backup testing is performed to verify data are accessible and readable.",{"$f":"'I - DR & IR'!G2","v":0},"N: Not Achieved (0 to 15%)","APO13.01 "]
[null,"PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met","1. Review physical security operating environment policies, procedures and plans. Ensure the following are addressed:\na. Emergency shutoff\nb. Emergency lighting\nc. Emergency power\nd. Fire protection\ne. Temperature and humidity control\nf. Water damage protection\ng. Location of information system components (to minimize damage)",{"$f":"' I- Mgmt'!G14","v":0},"N: Not Achieved (0 to 15%)","DSS01.04, DSS05.05"]
[null,"PR.IP-6: Data is destroyed according to policy","1. Review media sanitization (data destruction) policies.\n2. Ensure sanitization techniques and procedures are commensurate with the security category or classification of the information or asset and in accordance with applicable federal and organizational standards and policies.\n3. Spot-check trash cans, dumpsters, shred bin and/or shredders to ensure compliance with policy.\n4. Obtain proof (e.g., destruction certificates) that media sanitization is occurring according to policy.",{"$f":"' I- Mgmt'!G15","v":0},"N: Not Achieved (0 to 15%)","BAI09.03"]
[null,"PR.IP-7: Protection processes are continuously improved","1. Review the organization's policies and procedures related to continually improving protection processes. Consider the following:\na. Ongoing audits, assessments and vulnerability scanning are conducted, reviewed and responded to.\nb. Plans, processes and policies are updated based on lessons learned from tests (e.g., business continuity, disaster recovery, incident response).\nc. Designated position and/or committee responsible for continuous evaluation of the organization's information security needs and posture\nd. Threat information gathering and responses to changes in the threat environment",{"$f":"'I - Assett Mgmt.'!G21","v":0},"N: Not Achieved (0 to 15%)","APO11.06, DSS04.05"]
[null,"PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties","1. Determine if the organization participates in information sharing and analysis groups.\n2. Determine if the organization facilitates information sharing by enabling authorized users to share authorized information to sharing partners.",{"$f":"' I- Mgmt'!G16","v":0},"N: Not Achieved (0 to 15%)"]
[null,"PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed","1. Review incident response and business continuity plans to determine if the institution has documented how it will respond to a cyberincident.\n2. Evaluate plans to determine how frequently they are updated and approved.",{"$f":"'I - DR & IR'!G24","v":0},"N: Not Achieved (0 to 15%)","DSS04.03"]
[null,"PR.IP-10: Response and recovery plans are tested","1. Determine whether business continuity and incident response tests are performed according to policy and any applicable guidance.",{"$f":"'I - DR & IR'!G4","v":0},"N: Not Achieved (0 to 15%)"]
[null,"PR.IP-11: Cybersecurity is included in human resources practices (e.g., de-provisioning, personnel screening)","1. Review hiring procedures to determine whether background checks/screenings are performed for all employees.\n2. Review hiring procedures for positions with access to sensitive information to determine if they are commensurate with a higher level of risk.\n3. Review termination procedures to determine whether accounts/access are disabled in a timely manner.",{"$f":"'I. Access Control  & HR'!G17","v":0},"N: Not Achieved (0 to 15%)","APO07.01, APO07.02, APO07.03, APO07.04, APO07.05"]
[null,"PR.IP-12: A vulnerability management plan is developed and implemented","1. Obtain the organization's vulnerability management plan and ensure it includes the following:\na. Frequency of vulnerability scanning\nb. Method for measuring the impact of vulnerabilities identified (e.g., Common Vulnerability Scoring System [CVSS])\nc. Incorporation of vulnerabilities identified in other security control assessments (e.g., external audits, penetration tests)\nd. Procedures for developing remediation of identified vulnerabilities\n2. Obtain a copy of the organization's risk assessment to ensure vulnerabilities identified during the vulnerability management process are included.",{"$f":"' I- Mgmt'!G17","v":0},"N: Not Achieved (0 to 15%)"]
["Maintenance (PR.MA): Maintenance and repairs of industrial control and information system components is performed consistent with policies and procedures.","PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools","1. Review controlled maintenance processes. Consider the following:\na. Maintenance activities are approved, scheduled and documented (e.g., date and time, name of individual(s) performing maintenance, description of maintenance performed, systems removed/replaced)\nb. Maintenance staff or vendors are approved, authorized and supervised (if required).\nc. Maintenance tools and media are approved and inspected for improper or unauthorized modifications prior to use.",{"$f":"'I - Assett Mgmt.'!G19","v":0},"N: Not Achieved (0 to 15%)","BAI09.03"]
[null,"PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access","1. Determine whether remote maintenance on servers, workstations and other systems is performed. Consider the following:\na. Who is allowed to connect to systems (e.g. internal employees, third parties)\nb. What software/version or service is used to connect\nc. Whether end users have to take some action prior to allowing remote control of their workstation and/or whether access is logged and monitored\nd. Adequacy of authentication requirements (e.g., multifactor authentication)",{"$f":"'I. Access Control  & HR'!G12","v":0},"N: Not Achieved (0 to 15%)","DSS05.04"]
["Protective Technology (PR.PT): Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.","PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy","1. Determine if audit logs (e.g., security, activity) are maintained and reviewed in a timely manner. Verify the adequacy of the logs to monitor and evaluate IT activities and security events. Consider the following:\na. Audit records contain appropriate content (e.g., type of event, when the event occurred, where the event occurred, source of the event, outcome of the event, identity of any individuals or subjects associated with the event).\nb. Log files are sized such that logs are not deleted prior to review and/or being backed up.\nc. Audit logs and tools are protected from unauthorized access, modification and deletion.\n2. Determine if logs for the following parts of the network are monitored and reviewed:\na. Network perimeter (e.g., intrusion dectection systems [IDS], firewalls)\nb. Microsoft systems (e.g., Windows event logs)\nc. Non-Microsoft systems (e.g., syslog files for Unix/Linux servers, routers, switches)",{"$f":"'I - Sec. Ops'!G34","v":0},"N: Not Achieved (0 to 15%)","APO11.04"]
[null,"PR.PT-2: Removable media is protected and its use restricted according to policy","1. Obtain a copy of the removable media policy. Review controls defined in the policy. Controls may include:\na. User training\nb. Encryption of removable media\nc. Restricted access to removable media (e.g., USB restrictions)\nd. Sanitization procedures for decommissioned media\n2. Perform spot-checks on systems with removable media restrictions to ensure restrictions are working as expected and comply with the organization's policy.",{"$f":"' I- Mgmt'!G18","v":0},"N: Not Achieved (0 to 15%)","DSS05.02, APO13.01"]
[null,"PR.PT-3: Access to systems and assets is controlled, incorporating the principle of least functionality","1. Review information systems to determine if unnecessary and/or non-secure functions, ports, protocols and services are disabled.\n2. Where feasible, the organization limits component functionality to a single function per device (e.g., dedicated email server).\n3. Determine if the organization reviews functions and services provided by information systems or individual components of information systems to determine which functions and services are candidates for elimination.",{"$f":"'I. Access Control  & HR'!G15","v":0},"N: Not Achieved (0 to 15%)","DSS05.02"]
[null,"PR.PT-4: Communications and control networks are protected","1. Evaluate controls related to communications to ensure the network is secure. Consider:\na. Network perimeter defenses are in place (e.g., border router, firewall).\nb. Physical security controls are used to prevent unauthorized access to telecommunication systems, etc.\nc. Logical network access controls (e.g., VLAN) and technical controls (e.g., encrypting traffic) are in place to protect and/or segregate communications networks (e.g., wireless, WAN, LAN, VoIP).",{"$f":"'I - Comms'!G9","v":0},"N: Not Achieved (0 to 15%)","DSS05.02, APO13.01"]

{"sheet":"Summary - Detect","index":13,"n_rows":19,"n_cols":6,"rows_kept":19,"cut":false,"hidden":false,"merged":[[1,0,5,0],[6,0,13,0],[14,0,18,0]]}
["Category","Subcategory","NIST Testing Steps","Interview Score /100","Score","Relevant COBIT Practices"]
["Anomalies and Events (DE.AE): Anomalous activity is detected in a timely manner and the potential impact of events is understood.","DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed","1. Obtain a copy of the organization's logical network diagram (LND), data flow diagrams, and other network and communications diagrams.\n2. Review the diagrams for the following:\na. Frequency of updates to diagrams\nb. Accuracy and completeness of diagrams\nc. Scope of diagrams is adequate to identify both domains of different risk and control levels (i.e., high-risk, publicly-accessible portions of a network vs. high-value, restricted access portions of the network) and the control points (e.g., firewalls, routers, intrusion detection/prevention systems) between them.\n2. Determine if tools (e.g., security event and information management systems [SIEMs]) are used to establish typical (baseline) traffic so abnormal traffic can be detected.",{"$f":"'I - Sec. Ops'!G11","v":0},"N: Not Achieved (0 to 15%)","DSS03.01"]
[null,"DE.AE-2: Detected events are analyzed to understand attack targets and methods","1. Obtain a copy of policies and procedures regarding system and network monitoring.\na. Determine if policies and procedures require monitoring for anomalous activity at identified control points.\n2. Obtain a copy of detected events (e.g., alerts from IDS) and the organization's response to them. Review the events and responses to ensure thorough analysis of detected events is performed.",{"$f":"'I - Sec. Ops'!G38","v":0},{"$f":"IF(D3<=15,\"N: Not Achieved (0 to 15%)\",IF(D3<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D3<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D3>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"}]
[null,"DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors","1. Obtain a listing of event aggregation and monitoring systems in use at the organization (e.g., SIEMs, event log correlation systems).\n2. Obtain a list of sources that provide data to each event aggregation and monitoring system (e.g., firewalls, routers, servers).\n3. Compare the sources to identified control points between domains of different risk and control levels and determine if they provide adequate monitoring coverage of the organization's environment.",{"$f":"'I - Sec. Ops'!G12","v":0},"N: Not Achieved (0 to 15%)"]
[null,"DE.AE-4: Impact of events is determined","1. Obtain a copy of detected events and the organization's responses to them.\n2. Review the events, tickets and responses in order to ensure the organization is documenting the impact of anomalous activity using metrics that are applicable to the organization (e.g., compliance impact, operational impact, accurate reporting impact). ",{"$f":"'I - Sec. Ops'!G39","v":0},"N: Not Achieved (0 to 15%)","APO12.06"]
[null,"DE.AE-5: Incident alert thresholds are established","1. Obtain a copy of alert messages, meeting minutes, reports and other documentation where detected events were escalated.\n2. Review the documentation and determine the following:\na. Detected events are reported in a timely manner to someone with the knowledge and expertise to resolve or escalate the event.\nb. Escalated events are reported to individuals or groups with the appropriate authority to make decisions about the organization's response.\nc. Thresholds are defined such that an event triggers the appropriate response (e.g., business continuity response, disaster recovery response, incident response, legal response).",{"$f":"'I - Sec. Ops'!G14","v":0},"N: Not Achieved (0 to 15%)","APO12.06"]
["Security Continuous Monitoring (DE.CM): The information system and assets are monitored at discrete intervals to identify cybersecurity events and verify the effectiveness of protective measures.","DE.CM-1: The network is monitored to detect potential cybersecurity events","1. Obtain a list of the monitoring control implemented by the organization at the following levels:\na. Network (e.g., firewall, router, switch)\nb. Operating system (e.g., server platforms, workstation platforms, appliances)\nc. Application (e.g., account management, file and database access).\n2. Determine if monitoring at each level includes detection of cybersecurity events (e.g., denial-of-service [DoS] attacks, unauthorized account access, unauthorized file/system access, privilege escalation attacks, SQL injection attacks).",{"$f":"'I - Sec. Ops'!G17","v":0},"N: Not Achieved (0 to 15%)","DSS05.07"]
[null,"DE.CM-2: The physical environment is monitored to detect potential cybersecurity events","1. Obtain an inventory of critical facilities (e.g., data centers, network closets, operations centers, critical control centers).\n2. Determine if physical security monitoring controls are implemented and appropriate to detect potential cybersecurity events (e.g., sign in/out logs, motion detectors, security cameras, security lighting, security guards, door/window locks, automatic system lock when idle, restricted physical access to servers, workstations, network devices, network ports).",{"$f":"'I - Physical'!G10","v":0},"N: Not Achieved (0 to 15%)"]
[null,"DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","1. Obtain a list of the monitoring controls implemented by the organization at the application/user account level (e.g., account management, user access roles, user activity monitoring, file and database access).\n2. Determine if monitoring includes detection and alerting of cybersecurity events (e.g., unauthorized account access, unauthorized file/system access, access out of hours, access to sensitive data, unusual access, unauthorized physical access, privilege escalation attacks).",{"$f":"'I - Sec. Ops'!G18","v":0},"N: Not Achieved (0 to 15%)"]
[null,"DE.CM-4: Malicious code is detected","1. Obtain a copy of processes and procedures used to detect malicious code on the network and servers/workstations (e.g., anti-malware software on servers and workstations, phishing filters on email systems, intrusion prevention/detection systems on the network [IDS/IPS], endpoint security products on workstations and/or servers).\n2. Determine if malicious code controls are:\na. Installed on all applicable systems and network control points\nb. Updated on a regular basis\nc. Configured to perform real-time scanning or periodic scans at regular intervals\n3. Spot-check workstations and other user endpoint devices to verify the following:\na. Malicious code controls are installed.\nb. Malicious code controls are updated.\nc. Malicious code controls are capable of detecting test code (e.g., the EICAR test virus).",{"$f":"'I - Sec. Ops'!G19","v":0},"N: Not Achieved (0 to 15%)","DSS05.01"]
[null,"DE.CM-5: Unauthorized mobile code is detected","1. Obtain documented processes and procedures used to detect unauthorized mobile code (e.g., Java, JavaScript, ActiveX, Flash, VBScript) that is run on the organization's servers, workstations and devices.\n2. Determine if detective mobile code controls block unauthorized mobile code when detected (e.g., quarantine, execution blocking, download blocking). \n\n*Examples of mobile code controls include:\na. Detecting and blocking mobile code attachments in emails (e.g., .exe files, .js files)\nb. Detecting and blocking mobile code portions of websites\nc. Removing the ability to run mobile code on systems that do not require this functionality (e.g., uninstalling Java from workstations without a need for it)\nd. Configuring systems to generate alerts and block execution when mobile code that is not signed with an approved code-signing certificate attempts to execute",{"$f":"'I - Sec. Ops'!G22","v":0},"N: Not Achieved (0 to 15%)"]
[null,"DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events","1. Obtain and review contracts executed with external service providers.\n2. Determine if external service provider contracts require the service providers to:\na. Notify the organization as soon as possible of any known or suspected cybersecurity event.\nb. Notify the organization as soon as possible of termination of any employee who possesses credentials to access the organization's systems or facilities.\nc. Implement security controls equivalent to or exceeding the level of security required of the organization.\n3. Obtain a copy of the organization's logical network diagram (LND) to determine how external service provider networks are connected to the organization's network to determine if monitoring controls (e.g.. firewalls, routers, intrusion detection/prevention systems) are implemented at these connection points.\n4. Obtain and analyze a copy of system configurations for monitoring controls used to detect cybersecurity events originating on external service providers' networks.",{"$f":"' I- Mgmt'!G21","v":0},"N: Not Achieved (0 to 15%)","APO07.06"]
[null,"DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed","1. Obtain a copy of processes and procedures designed to detect unauthorized access to the organization's facilities and systems (e.g., sign-in/out logs, video surveillance, break-in alarms, network port blocking, USB device restrictions on workstations and user devices, monitoring of excessive failed logins indicating a password-guessing attack).\n2. Spot-check unauthorized access controls by accessing facilities and systems with permission to test, but not standard authorization. Request the organization provide the alert notifications generated by the simulated unauthorized access.",{"$f":"'I - Sec. Ops'!G23","v":0},"N: Not Achieved (0 to 15%)"]
[null,"DE.CM-8: Vulnerability scans are performed","1. Obtain a copy of the organization's schedule for performing internal and external vulnerability scans and the results of the most recent internal and external vulnerability scans.\n2. Review the schedule and results for the following:\na. Frequency\nb. Successful completion\nc. Documented resolution or mitigation of identified vulnerabilities\nd. Scope of testing includes all critical systems\n3. Determine whether vulnerability scan results were reported to individuals or teams with appropriate authority to ensure resolution.",{"$f":"'I - Sec. Ops'!G24","v":0},"N: Not Achieved (0 to 15%)","BAI03.10"]
["Detection Processes (DE.DP): Detection processes and procedures are maintained and tested to ensure timely and adequate awareness of anomalous events.","DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability","1. Obtain a copy of processes and procedures for monitoring physical and electronic anomalous events.\n2. Determine if the organization's processes and procedures assign key responsibilities to specific individuals or positions. ",{"$f":"' I- Mgmt'!G12","v":0},"N: Not Achieved (0 to 15%)","DSS05.01"]
[null,"DE.DP-2: Detection activities comply with all applicable requirements","1. Obtain a copy of laws and regulations (e.g., federal, state, local), industry standards, internal security requirements and risk appetite applicable to the organization.\n2. Determine if the organization is performing audits/testing to ensure their detection activities comply with these requirements.",{"$f":"' I- Mgmt'!G22","v":0},"N: Not Achieved (0 to 15%)"]
[null,"DE.DP-3: Detection processes are tested","1. Obtain a copy of the organization's schedule of incident response tests, the results of recent incident response tests, and documented processes and procedures requiring tests of anomalous activity controls (e.g., periodic tests of intrusion detection/prevention systems, endpoint anti-malware software).\n2. Review the documentation for the following:\na. Completeness in testing implemented anomalous activity detection controls\nb. Frequency of testing\nc. Documented resolution or mitigation of negative testing results",{"$f":"'I - Sec. Ops'!G26","v":0},"N: Not Achieved (0 to 15%)","APO13.02"]
[null,"DE.DP-4: Event detection information is communicated to appropriate parties","1. Obtain a copy of meeting minutes where physical and electronic anomalous activity is reported (e.g., information security committee meetings, board/management meetings, risk management meetings).\n2. Obtain a copy of documented responses to recent physical and electronic anomalous activity incidents.\n3. Compare meeting minutes to documented incidents and determine if detected events are consistently reported and appropriately handled.",{"$f":"'I - Sec. Ops'!G28","v":0},"N: Not Achieved (0 to 15%)","APO12.06"]
[null,"DE.DP-5: Detection processes are continuously improved","1. Obtain a copy of documented responses to recent physical and electronic anomalous activity incidents. Determine if responses include the following:\na. Lessons learned and analysis of failed or missing controls\nb. Action items to detect/prevent similar incidents in the future",{"$f":"'I - Sec. Ops'!G30","v":0},"N: Not Achieved (0 to 15%)","APO11.06, DSS04.05"]

{"sheet":"Summary - Respond","index":14,"n_rows":16,"n_cols":6,"rows_kept":16,"cut":false,"hidden":false,"merged":[[2,0,6,0],[7,0,10,0],[11,0,13,0],[14,0,15,0]]}
["Category","Subcategory","NIST Testing Steps","Interview Score /100","Score","Relevant COBIT Practices"]
["Response Planning (RS.RP): Response processes and procedures are executed and maintained, to ensure timely response to detected cybersecurity events.","RS.RP-1: Response plan is executed during or after an event","1. Determine if the organization has approved incident response and business continuity plans.\n2. Obtain copies of reports from recent incidents to validate the plans are executed.",{"$f":"'I - DR & IR'!G5","v":0},{"$f":"IF(D2<=15,\"N: Not Achieved (0 to 15%)\",IF(D2<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D2<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D2>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"},"BAI01.10"]
["Communications (RS.CO): Response activities are coordinated with internal and external stakeholders, as appropriate, to include external support from law enforcement agencies.","RS.CO-1: Personnel know their roles and order of operations when a response is needed","1. Review the incident response plan to determine if roles and responsibilities are defined for employees.\n2. Interview employees to determine if employees know their roles and responsibilities as defined by the plan.\n3. Review any incident response tests or training provided to employees to determine if they support educating employees on their roles and responsibilities.",{"$f":"'I - DR & IR'!G7","v":0},{"$f":"IF(D3<=15,\"N: Not Achieved (0 to 15%)\",IF(D3<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D3<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D3>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"}]
[null,"RS.CO-2: Events are reported consistent with established criteria","1. Review the incident response plan to determine if reporting structure and communication channels are clearly defined.\n2. Determine if employees are trained to report suspected security incidents.\n3. Obtain copies of reports from recent incidents to validate reporting is consistent and follows the plan.",{"$f":"'I - Sec. Ops'!G36","v":0},"N: Not Achieved (0 to 15%)"]
[null,"RS.CO-3: Information is shared consistent with response plans","1. Review the incident response plan to determine if information sharing is clearly defined as it relates to the following (if applicable):\na. Customers\nb. Law enforcement\nc. Regulators\nd. Media\ne. Information sharing organizations\n2. Obtain copies of reports from recent incidents to validate sharing is consistent and follows the plan.",{"$f":"' I- Mgmt'!G19","v":0},"N: Not Achieved (0 to 15%)"]
[null,"RS.CO-4: Coordination with stakeholders occurs consistent with response plans","1. Review the incident response plan to determine if a process is in place to communicate with internal and external stakeholders during and/or following an incident.\n2. Obtain copies of reports from recent incidents to validate reporting is consistent and follows the plan.",{"$f":"'I - DR & IR'!G8","v":0},"N: Not Achieved (0 to 15%)"]
[null,"RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness ","1. Review the incident response plan to determine if a process is in place to communicate with external stakeholders (e.g., end users, suppliers, third parties, customers) following an incident.",{"$f":"'I - DR & IR'!G9","v":0},"N: Not Achieved (0 to 15%)"]
["Analysis (RS.AN): Analysis is conducted to ensure adequate response and support recovery activities.","RS.AN-1: Notifications from detection systems are investigated ","1. Obtain evidence of event notifications (e.g., detection alerts, reports) from information systems (e.g., account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools, physical access, temperature and humidity, anomalous activity, use of mobile code).\n2. Determine who receives alerts or reports from detection systems and what actions are taken once reports are received.\n3. Review the incident response plan to determine if actions taken follow the plan.",{"$f":"'I - DR & IR'!G10","v":0},"N: Not Achieved (0 to 15%)","DSS02.07"]
[null,"RS.AN-2: The impact of the incident is understood","1. Review the incident response plan to determine if there is a process to formally analyze and classify incidents based on their potential impact.\n2. Review resume and education of incident response team members responsible for determining incident impact to determine if they have the knowledge and experience to adequately understand potential impact.",{"$f":"'I - DR & IR'!G12","v":0},"N: Not Achieved (0 to 15%)"]
[null,"RS.AN-3: Forensics are performed","1. Review the incident response plan as it relates to forensics.  Consider the following:\na. There is a process in place to ensure forensics will be performed when needed.\nb. Determine if security investigations and forensic analysis are performed by qualified staff or third parties.\nc. Review forensics procedures to ensure they include controls, such as chain of custody, to support potential legal action. ",{"$f":"'I - DR & IR'!G13","v":0},"N: Not Achieved (0 to 15%)"]
[null,"RS.AN-4: Incidents are categorized consistent with response plans","1. Review the incident response plan to determine if it is designed to prioritize incidents, enabling a rapid response for significant incidents or vulnerabilities.\n2. Obtain copies of reports from recent incidents to validate reporting is consistent and follows the plan.",{"$f":"'I - DR & IR'!G14","v":0},"N: Not Achieved (0 to 15%)"]
["Mitigation (RS.MI): Activities are performed to prevent expansion of an event, mitigate its effects, and eradicate the incident.","RS.MI-1: Incidents are contained","1. Review the incident response plan to determine if appropriate steps are in place to contain an incident.  Consider the following:\na. Steps to contain and control the incident to prevent further harm\nb. Procedures to notify potentially impacted third parties \nc. Strategies to control different types of incidents (e.g., distributed denial-of-service [DDoS], malware, etc.)",{"$f":"'I - DR & IR'!G15","v":0},"N: Not Achieved (0 to 15%)"]
[null,"RS.MI-2: Incidents are mitigated","1. Review the incident response plan to determine if appropriate steps are in place to mitigate the impact of an incident. Consider the following:\na. Steps to mitigate the incident to prevent further harm\nb. Procedures to notify potentially impacted third parties\nc. Strategies to mitigate impact different types of incidents (e.g., distributed denial-of-service [DDoS], malware, etc.)\n2. Review any documented incidents to determine whether mitigation efforts were implemented and effective.",{"$f":"'I - DR & IR'!G16","v":0},"N: Not Achieved (0 to 15%)"]
[null,"RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","1. Determine if the organization's continuous monitoring programs (e.g., risk assessments, vulnerability scanning) facilitate ongoing awareness of threats, vulnerabilities and information security to support organizational risk management decisions.  Consider the following:\na. Is the process continuous (at a frequency sufficient to support organizational risk-based decisions)\nb. Results generate appropriate risk response (e.g., mitigation strategy, acceptance) based on the organization's risk appetite",{"$f":"'I - Sec. Ops'!G37","v":0},"N: Not Achieved (0 to 15%)"]
["Improvements (RS.IM): Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.","RS.IM-1: Response plans incorporate lessons learned","1. Review the organization's incident handling reports and incident testing documentation for action items and lessons learned.\n2. Evaluate the incident response plan to determine if results (e.g., action items, lessons learned) from real-world incidents and incident testing have been used to update incident response procedures, training and testing.",{"$f":"'I - DR & IR'!G20","v":0},"N: Not Achieved (0 to 15%)","BAI01.13"]
[null,"RS.IM-2: Response strategies are updated","1. Review the organization's incident response and business continuity strategies and plans. Consider the following:\na. There is a mechanism in place to regularly review, improve, approve and communicate the plans.\nb. The organization's response capability is informed by actual incidents, tests and current threats.",{"$f":"'I - DR & IR'!G21","v":0},"N: Not Achieved (0 to 15%)"]

{"sheet":"Summary - Recover","index":15,"n_rows":7,"n_cols":6,"rows_kept":7,"cut":false,"hidden":false,"merged":[[2,0,3,0],[4,0,6,0]]}
["Category","Subcategory","NIST Testing Steps","Inverview Score /100","Score","Relevant COBIT Practices"]
["Recovery Planning (RC.RP): Recovery processes and procedures are executed and maintained to ensure timely restoration of systems or assets affected by cybersecurity events.","RC.RP-1: Recovery plan is executed during or after an event","1. Obtain a copy of the organization's recovery plans and procedures (e.g., business continuity plan, incident response plan, disaster recovery plan, cybersecurity incident plan) and the documented results of recent cybersecurity events or event tests.\n2. Evaluate documentation for the following:\na. Frequency of testing\nb. Coverage of critical pieces of the organization's recovery plans and procedures\nc. Documentation of incidents (e.g. power outages, communication failures, system outages, attempted and successful malicious or careless unauthorized access or disruption).",{"$f":"'I - DR & IR'!G19","v":0},{"$f":"IF(D2<=15,\"N: Not Achieved (0 to 15%)\",IF(D2<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D2<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D2>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"},"DSS02.05, DSS03.04"]
["Improvements (RC.IM): Recovery planning and processes are improved by incorporating lessons learned into future activities.","RC.IM-1: Recovery plans incorporate lessons learned","1. Obtain a copy of results of recent cybersecurity events or event tests.\n2. Evaluate documentation for the following:\na. Documented lessons learned and analysis of failed or missing controls\nb. Action items designed to improve recovery plans and procedures based on the lessons learned and analysis",{"$f":"'I - DR & IR'!G20","v":0},{"$f":"IF(D3<=15,\"N: Not Achieved (0 to 15%)\",IF(D3<=50,\"P: Partially Achieved (>15 – 50%)\",IF(D3<=85,\"L: Largely Achieved (>50 to 85%)\",IF(D3>85,\"F: Fully Achieved (>85%)\"))))","v":"N: Not Achieved (0 to 15%)"},"BAI05.07"]
[null,"RC.IM-2: Recovery strategies are updated","1. Obtain a copy of the organization's recovery plans and procedures (e.g., business continuity plan, incident response plan, disaster recovery plan, cybersecurity incident plan) and the documented results of recent cybersecurity events or event tests.\n2. Determine if recovery plans and procedures are reviewed, updated and approved on a regular basis or as changes are made to systems and controls.\n3. Review recovery plans and procedures to determine if action items resulting from lessons learned during cybersecurity events and event tests have been implemented.",{"$f":"'I - DR & IR'!G21","v":0},"N: Not Achieved (0 to 15%)","BAI07.08"]
["Communications (RC.CO): Restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacking systems, victims, other CSIRTs, and vendors.","RC.CO-1: Public relations are managed","1. Obtain a copy of the organization's recovery plans and procedures (e.g., business continuity plan, incident response plan, disaster recovery plan, cybersecurity incident plan).\n2. Determine if the plans and procedures include the following:\na. Designation of points of contact within the organization to communicate with customers, partners, media, regulators and law enforcement\nb. Training for employees regarding where to refer questions about cybersecurity incidents\nc. Order of succession of key positions responsible for managing the organization's reputation risk during cybersecurity incidents\nd. Timely and responsible notification of customers, partners, regulators and law enforcement of a cybersecurity incident",{"$f":"'I - DR & IR'!G22","v":0},"N: Not Achieved (0 to 15%)","EDM03.02"]
[null,"RC.CO-2: Reputation after an event is repaired","1. Obtain documented results of recent cybersecurity events. Determine whether the following are included:\na. Informing customers, partners, media, regulators and law enforcement, as applicable, of ongoing efforts to correct identified issues and final resolution\nb. Specific efforts or plans to address reputation repair ",{"$f":"'I - DR & IR'!G23","v":0},"N: Not Achieved (0 to 15%)","MEA03.02"]
[null,"RC.CO-3: Recovery activities are communicated to internal stakeholders and executive and management teams","1. Obtain a copy of meeting minutes where cybersecurity events are reported (e.g. Information Security Committee meetings, Board/management meetings, risk management meetings, Compliance Committee meetings).\n2. Obtain a copy of documented results of recent cybersecurity events.\n3. Compare meeting minutes to documented cybersecurity events and determine if recovery activities notified applicable stakeholders and management members (e.g. Board members, stockholders, C-level executives, risk management managers, affected department managers).",{"$f":"' I- Mgmt'!G20","v":0},"N: Not Achieved (0 to 15%)"]

{"sheet":"Current Profile Summary","index":16,"n_rows":108,"n_cols":4,"rows_kept":108,"cut":false,"hidden":false,"merged":[[0,0,0,2],[46,0,46,2],[83,0,83,2],[100,0,100,2],[3,3,11,5],[26,0,26,2]]}
["Identify"]
["Subcateogry","Score","Interview Score /100"]
["ID.AM-1: Physical devices and systems within the organization are inventoried","N: Not Achieved (0 to 15%)",0]
["ID.AM-2: Software platforms and applications within the organization are inventoried","N: Not Achieved (0 to 15%)",0,"Select each of the tables presented, and push Alt+F5 on your keyboard to refresh the data"]
["ID.AM-3: Organizational communication and data flows are mapped","N: Not Achieved (0 to 15%)",0]
["ID.AM-4: External information systems are catalogued","N: Not Achieved (0 to 15%)",0]
["ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value","N: Not Achieved (0 to 15%)",0]
["ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established","N: Not Achieved (0 to 15%)",0]
["ID.BE-1: The organization’s role in the supply chain is identified and communicated","N: Not Achieved (0 to 15%)",0]
["ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated","N: Not Achieved (0 to 15%)",0]
["ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated","N: Not Achieved (0 to 15%)",0]
["ID.BE-4: Dependencies and critical functions for delivery of critical services are established","N: Not Achieved (0 to 15%)",0]
["ID.BE-5: Resilience requirements to support delivery of critical services are established","N: Not Achieved (0 to 15%)",0]
["ID.GV-1: Organizational information security policy is established","N: Not Achieved (0 to 15%)",0]
["ID.GV-2: Information security roles & responsibilities are coordinated and aligned with internal roles and external partners","N: Not Achieved (0 to 15%)",0]
["ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed","N: Not Achieved (0 to 15%)",0]
["ID.GV-4: Governance and risk management processes address cybersecurity risks","N: Not Achieved (0 to 15%)",0]
["ID.RA-1: Asset vulnerabilities are identified and documented","N: Not Achieved (0 to 15%)",0]
["ID.RA-2: Threat and vulnerability information is received from information sharing forums and sources","N: Not Achieved (0 to 15%)",0]
["ID.RA-3: Threats, both internal and external, are identified and documented","N: Not Achieved (0 to 15%)",0]
["ID.RA-4: Potential business impacts and likelihoods are identified","N: Not Achieved (0 to 15%)",0]
["ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk","N: Not Achieved (0 to 15%)",0]
["ID.RA-6: Risk responses are identified and prioritized","N: Not Achieved (0 to 15%)",0]
["ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders","N: Not Achieved (0 to 15%)",0]
["ID.RM-2: Organizational risk tolerance is determined and clearly expressed","N: Not Achieved (0 to 15%)",0]
["ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis","N: Not Achieved (0 to 15%)",0]
["Detect"]
["Row Labels","Score","Interview Score /100"]
["DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed","N: Not Achieved (0 to 15%)",0]
["DE.AE-2: Detected events are analyzed to understand attack targets and methods","N: Not Achieved (0 to 15%)",0]
["DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors","N: Not Achieved (0 to 15%)",0]
["DE.AE-4: Impact of events is determined","N: Not Achieved (0 to 15%)",0]
["DE.AE-5: Incident alert thresholds are established","N: Not Achieved (0 to 15%)",0]
["DE.CM-1: The network is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)",0]
["DE.CM-2: The physical environment is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)",0]
["DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)",0]
["DE.CM-4: Malicious code is detected","N: Not Achieved (0 to 15%)",0]
["DE.CM-5: Unauthorized mobile code is detected","N: Not Achieved (0 to 15%)",0]
["DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)",0]
["DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed","N: Not Achieved (0 to 15%)",0]
["DE.CM-8: Vulnerability scans are performed","N: Not Achieved (0 to 15%)",0]
["DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability","N: Not Achieved (0 to 15%)",0]
["DE.DP-2: Detection activities comply with all applicable requirements","N: Not Achieved (0 to 15%)",0]
["DE.DP-3: Detection processes are tested","N: Not Achieved (0 to 15%)",0]
["DE.DP-4: Event detection information is communicated to appropriate parties","N: Not Achieved (0 to 15%)",0]
["DE.DP-5: Detection processes are continuously improved","N: Not Achieved (0 to 15%)",0]
["Protect"]
["Row Labels","Score","Interview Score /100"]
["PR.AC-1: Identities and credentials are managed for authorized devices and users","N: Not Achieved (0 to 15%)",0]
["PR.AC-2: Physical access to assets is managed and protected","N: Not Achieved (0 to 15%)",0]
["PR.AC-3: Remote access is managed","N: Not Achieved (0 to 15%)",0]
["PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties","N: Not Achieved (0 to 15%)",0]
["PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate","N: Not Achieved (0 to 15%)",0]
["PR.AT-1: All users are informed and trained ","N: Not Achieved (0 to 15%)",0]
["PR.AT-2: Privileged users understand roles & responsibilities ","N: Not Achieved (0 to 15%)",0]
["PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities ","N: Not Achieved (0 to 15%)",0]
["PR.AT-4: Senior executives understand roles & responsibilities ","N: Not Achieved (0 to 15%)",0]
["PR.AT-5: Physical and information security personnel understand roles & responsibilities ","N: Not Achieved (0 to 15%)",0]
["PR.DS-1: Data-at-rest is protected","N: Not Achieved (0 to 15%)",0]
["PR.DS-2: Data-in-transit is protected","N: Not Achieved (0 to 15%)",0]
["PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition","N: Not Achieved (0 to 15%)",0]
["PR.DS-4: Adequate capacity to ensure availability is maintained","N: Not Achieved (0 to 15%)",0]
["PR.DS-5: Protections against data leaks are implemented","N: Not Achieved (0 to 15%)",0]
["PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity","N: Not Achieved (0 to 15%)",0]
["PR.DS-7: The development and testing environment(s) are separate from the production environment","N: Not Achieved (0 to 15%)",0]
["PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained","N: Not Achieved (0 to 15%)",0]
["PR.IP-10: Response and recovery plans are tested","N: Not Achieved (0 to 15%)",0]
["PR.IP-11: Cybersecurity is included in human resources practices (e.g., de-provisioning, personnel screening)","N: Not Achieved (0 to 15%)",0]
["PR.IP-12: A vulnerability management plan is developed and implemented","N: Not Achieved (0 to 15%)",0]
["PR.IP-2: A System Development Life Cycle to manage systems is implemented","N: Not Achieved (0 to 15%)",0]
["PR.IP-3: Configuration change control processes are in place","N: Not Achieved (0 to 15%)",0]
["PR.IP-4: Backups of information are conducted, maintained, and tested periodically","N: Not Achieved (0 to 15%)",0]
["PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met","N: Not Achieved (0 to 15%)",0]
["PR.IP-6: Data is destroyed according to policy","N: Not Achieved (0 to 15%)",0]
["PR.IP-7: Protection processes are continuously improved","N: Not Achieved (0 to 15%)",0]
["PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties","N: Not Achieved (0 to 15%)",0]
["PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed","N: Not Achieved (0 to 15%)",0]
["PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools","N: Not Achieved (0 to 15%)",0]
["PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access","N: Not Achieved (0 to 15%)",0]
["PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy","N: Not Achieved (0 to 15%)",0]
["PR.PT-2: Removable media is protected and its use restricted according to policy","N: Not Achieved (0 to 15%)",0]
["PR.PT-3: Access to systems and assets is controlled, incorporating the principle of least functionality","N: Not Achieved (0 to 15%)",0]
["PR.PT-4: Communications and control networks are protected","N: Not Achieved (0 to 15%)",0]
["Respond"]
["Row Labels","Score","Interview Score /100"]
["RS.AN-1: Notifications from detection systems are investigated ","N: Not Achieved (0 to 15%)",0]
["RS.AN-2: The impact of the incident is understood","N: Not Achieved (0 to 15%)",0]
["RS.AN-3: Forensics are performed","N: Not Achieved (0 to 15%)",0]
["RS.AN-4: Incidents are categorized consistent with response plans","N: Not Achieved (0 to 15%)",0]
["RS.CO-1: Personnel know their roles and order of operations when a response is needed","N: Not Achieved (0 to 15%)",0]
["RS.CO-2: Events are reported consistent with established criteria","N: Not Achieved (0 to 15%)",0]
["RS.CO-3: Information is shared consistent with response plans","N: Not Achieved (0 to 15%)",0]
["RS.CO-4: Coordination with stakeholders occurs consistent with response plans","N: Not Achieved (0 to 15%)",0]
["RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness ","N: Not Achieved (0 to 15%)",0]
["RS.IM-1: Response plans incorporate lessons learned","N: Not Achieved (0 to 15%)",0]
["RS.IM-2: Response strategies are updated","N: Not Achieved (0 to 15%)",0]
["RS.MI-1: Incidents are contained","N: Not Achieved (0 to 15%)",0]
["RS.MI-2: Incidents are mitigated","N: Not Achieved (0 to 15%)",0]
["RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","N: Not Achieved (0 to 15%)",0]
["RS.RP-1: Response plan is executed during or after an event","N: Not Achieved (0 to 15%)",0]
["Recover"]
["Row Labels","Score","Inverview Score /100"]
["RC.CO-1: Public relations are managed","N: Not Achieved (0 to 15%)",0]
["RC.CO-2: Reputation after an event is repaired","N: Not Achieved (0 to 15%)",0]
["RC.CO-3: Recovery activities are communicated to internal stakeholders and executive and management teams","N: Not Achieved (0 to 15%)",0]
["RC.IM-1: Recovery plans incorporate lessons learned","N: Not Achieved (0 to 15%)",0]
["RC.IM-2: Recovery strategies are updated","N: Not Achieved (0 to 15%)",0]
["RC.RP-1: Recovery plan is executed during or after an event","N: Not Achieved (0 to 15%)",0]

{"sheet":"Threat Assessment","index":17,"n_rows":34,"n_cols":11,"rows_kept":34,"cut":false,"hidden":false,"merged":[[0,5,13,7],[21,9,34,11]]}
["Threat","Impact of Threat\n1 = Little Impact\n5 = High Impact","Liklihood of Threat\n1 = Not Likely\n5 = Very Likely","Risk Score","Risk Quotient","Examine the threat landscape your institution faces relative to the critical systems you identified earler. For each threat, extrapolate the Impact and Liklihood of the threat being exploited",null,null,null,"System Name","System Priority "]
["DDoS by Student",5,5,{"$f":"B2*C2","v":25},{"$f":"IF(D2>=18,\"High\",IF(D2<=10,\"Low\",\"Medium\"))","v":"High"},null,null,null,null,"ERP - Student Information System",5]
["DDoS by External Party ",null,null,{"$f":"B3*C3","v":0},{"$f":"IF(D3>=18,\"High\",IF(D3<=10,\"Low\",\"Medium\"))","v":"Low"}]
["Advanced Persistent Threat Attack",null,null,0,"Low"]
["Phishing Message Targeting Credentials",null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,{"$f":"IF(D9>=18,\"High\",IF(D9<=10,\"Low\",\"Medium\"))","v":"Low"}]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low",null,null,null,null,"Click System Name (Cell J1) and Press Alt + F5 to refresh the table"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]
[null,null,null,0,"Low"]

{"sheet":"Risk Assessment","index":18,"n_rows":109,"n_cols":12,"rows_kept":109,"cut":false,"hidden":false,"merged":[[0,6,8,8],[18,6,26,8],[9,6,17,8],[0,3,26,5]]}
["Identify","Current Profile Score"," Impact of not having control in place \n1 = Low Impact \n5 = High Impact","For each of the current profile items, evaluate the impact on your critical systems of not having this control in place. Consider this relative to the treat landscape displayed to the right ",null,null,"Click button to move data \nAfter paste is complete push Ctrl + Alt + L to refresh",null,null,null,"Threat","Risk Quotient"]
["ID.AM-1: Physical devices and systems within the organization are inventoried","N: Not Achieved (0 to 15%)",1,null,null,null,null,null,null,null,"Advanced Persistent Threat Attack","Low"]
["ID.AM-2: Software platforms and applications within the organization are inventoried","N: Not Achieved (0 to 15%)",1,null,null,null,null,null,null,null,"DDoS by External Party ","Low"]
["ID.AM-3: Organizational communication and data flows are mapped","N: Not Achieved (0 to 15%)",null,null,null,null,null,null,null,null,"DDoS by Student","Low"]
["ID.AM-4: External information systems are catalogued","N: Not Achieved (0 to 15%)",null,null,null,null,null,null,null,null,"Phishing Message Targeting Credentials","Low"]
["ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value","N: Not Achieved (0 to 15%)",null,null,null,null,null,null,null,null,"(blank)","Low"]
["ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established","N: Not Achieved (0 to 15%)"]
["ID.BE-1: The organization’s role in the supply chain is identified and communicated","N: Not Achieved (0 to 15%)"]
["ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated","N: Not Achieved (0 to 15%)"]
["ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated","N: Not Achieved (0 to 15%)"]
["ID.BE-4: Dependencies and critical functions for delivery of critical services are established","N: Not Achieved (0 to 15%)"]
["ID.BE-5: Resilience requirements to support delivery of critical services are established","N: Not Achieved (0 to 15%)"]
["ID.GV-1: Organizational information security policy is established","N: Not Achieved (0 to 15%)"]
["ID.GV-2: Information security roles & responsibilities are coordinated and aligned with internal roles and external partners","N: Not Achieved (0 to 15%)"]
["ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed","N: Not Achieved (0 to 15%)"]
["ID.GV-4: Governance and risk management processes address cybersecurity risks","N: Not Achieved (0 to 15%)"]
["ID.RA-1: Asset vulnerabilities are identified and documented","N: Not Achieved (0 to 15%)"]
["ID.RA-2: Threat and vulnerability information is received from information sharing forums and sources","N: Not Achieved (0 to 15%)"]
["ID.RA-3: Threats, both internal and external, are identified and documented","N: Not Achieved (0 to 15%)"]
["ID.RA-4: Potential business impacts and likelihoods are identified","N: Not Achieved (0 to 15%)"]
["ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk","N: Not Achieved (0 to 15%)"]
["ID.RA-6: Risk responses are identified and prioritized","N: Not Achieved (0 to 15%)"]
["ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders","N: Not Achieved (0 to 15%)"]
["ID.RM-2: Organizational risk tolerance is determined and clearly expressed","N: Not Achieved (0 to 15%)"]
["ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis","N: Not Achieved (0 to 15%)"]
[]
["Detect"]
["DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed","N: Not Achieved (0 to 15%)"]
["DE.AE-2: Detected events are analyzed to understand attack targets and methods","N: Not Achieved (0 to 15%)"]
["DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors","N: Not Achieved (0 to 15%)"]
["DE.AE-4: Impact of events is determined","N: Not Achieved (0 to 15%)"]
["DE.AE-5: Incident alert thresholds are established","N: Not Achieved (0 to 15%)"]
["DE.CM-1: The network is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)"]
["DE.CM-2: The physical environment is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)"]
["DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)"]
["DE.CM-4: Malicious code is detected","N: Not Achieved (0 to 15%)"]
["DE.CM-5: Unauthorized mobile code is detected","N: Not Achieved (0 to 15%)"]
["DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events","N: Not Achieved (0 to 15%)"]
["DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed","N: Not Achieved (0 to 15%)"]
["DE.CM-8: Vulnerability scans are performed","N: Not Achieved (0 to 15%)"]
["DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability","N: Not Achieved (0 to 15%)"]
["DE.DP-2: Detection activities comply with all applicable requirements","N: Not Achieved (0 to 15%)"]
["DE.DP-3: Detection processes are tested","N: Not Achieved (0 to 15%)"]
["DE.DP-4: Event detection information is communicated to appropriate parties","N: Not Achieved (0 to 15%)"]
["DE.DP-5: Detection processes are continuously improved","N: Not Achieved (0 to 15%)"]
[]
[]
["Protect"]
["PR.AC-1: Identities and credentials are managed for authorized devices and users","N: Not Achieved (0 to 15%)"]
["PR.AC-2: Physical access to assets is managed and protected","N: Not Achieved (0 to 15%)"]
["PR.AC-3: Remote access is managed","N: Not Achieved (0 to 15%)"]
["PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties","N: Not Achieved (0 to 15%)"]
["PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate","N: Not Achieved (0 to 15%)"]
["PR.AT-1: All users are informed and trained ","N: Not Achieved (0 to 15%)"]
["PR.AT-2: Privileged users understand roles & responsibilities ","N: Not Achieved (0 to 15%)"]
["PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities ","N: Not Achieved (0 to 15%)"]
["PR.AT-4: Senior executives understand roles & responsibilities ","N: Not Achieved (0 to 15%)"]
["PR.AT-5: Physical and information security personnel understand roles & responsibilities ","N: Not Achieved (0 to 15%)"]
["PR.DS-1: Data-at-rest is protected","N: Not Achieved (0 to 15%)"]
["PR.DS-2: Data-in-transit is protected","N: Not Achieved (0 to 15%)"]
["PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition","N: Not Achieved (0 to 15%)"]
["PR.DS-4: Adequate capacity to ensure availability is maintained","N: Not Achieved (0 to 15%)"]
["PR.DS-5: Protections against data leaks are implemented","N: Not Achieved (0 to 15%)"]
["PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity","N: Not Achieved (0 to 15%)"]
["PR.DS-7: The development and testing environment(s) are separate from the production environment","N: Not Achieved (0 to 15%)"]
["PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained","N: Not Achieved (0 to 15%)"]
["PR.IP-10: Response and recovery plans are tested","N: Not Achieved (0 to 15%)"]
["PR.IP-11: Cybersecurity is included in human resources practices (e.g., de-provisioning, personnel screening)","N: Not Achieved (0 to 15%)"]
["PR.IP-12: A vulnerability management plan is developed and implemented","N: Not Achieved (0 to 15%)"]
["PR.IP-2: A System Development Life Cycle to manage systems is implemented","N: Not Achieved (0 to 15%)"]
["PR.IP-3: Configuration change control processes are in place","N: Not Achieved (0 to 15%)"]
["PR.IP-4: Backups of information are conducted, maintained, and tested periodically","N: Not Achieved (0 to 15%)"]
["PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met","N: Not Achieved (0 to 15%)"]
["PR.IP-6: Data is destroyed according to policy","N: Not Achieved (0 to 15%)"]
["PR.IP-7: Protection processes are continuously improved","N: Not Achieved (0 to 15%)"]
["PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties","N: Not Achieved (0 to 15%)"]
["PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed","N: Not Achieved (0 to 15%)"]
["PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools","N: Not Achieved (0 to 15%)"]
["PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access","N: Not Achieved (0 to 15%)"]
["PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy","N: Not Achieved (0 to 15%)"]
["PR.PT-2: Removable media is protected and its use restricted according to policy","N: Not Achieved (0 to 15%)"]
["PR.PT-3: Access to systems and assets is controlled, incorporating the principle of least functionality","N: Not Achieved (0 to 15%)"]
["PR.PT-4: Communications and control networks are protected","N: Not Achieved (0 to 15%)"]
[]
[]
["Respond"]
["RS.AN-1: Notifications from detection systems are investigated ","N: Not Achieved (0 to 15%)"]
["RS.AN-2: The impact of the incident is understood","N: Not Achieved (0 to 15%)"]
["RS.AN-3: Forensics are performed","N: Not Achieved (0 to 15%)"]
["RS.AN-4: Incidents are categorized consistent with response plans","N: Not Achieved (0 to 15%)"]
["RS.CO-1: Personnel know their roles and order of operations when a response is needed","N: Not Achieved (0 to 15%)"]
["RS.CO-2: Events are reported consistent with established criteria","N: Not Achieved (0 to 15%)"]
["RS.CO-3: Information is shared consistent with response plans","N: Not Achieved (0 to 15%)"]
["RS.CO-4: Coordination with stakeholders occurs consistent with response plans","N: Not Achieved (0 to 15%)"]
["RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness ","N: Not Achieved (0 to 15%)"]
["RS.IM-1: Response plans incorporate lessons learned","N: Not Achieved (0 to 15%)"]
["RS.IM-2: Response strategies are updated","N: Not Achieved (0 to 15%)"]
["RS.MI-1: Incidents are contained","N: Not Achieved (0 to 15%)"]
["RS.MI-2: Incidents are mitigated","N: Not Achieved (0 to 15%)"]
["RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","N: Not Achieved (0 to 15%)"]
["RS.RP-1: Response plan is executed during or after an event","N: Not Achieved (0 to 15%)"]
[]
["Recover"]
["RC.CO-1: Public relations are managed","N: Not Achieved (0 to 15%)"]
["RC.CO-2: Reputation after an event is repaired","N: Not Achieved (0 to 15%)"]
["RC.CO-3: Recovery activities are communicated to internal stakeholders and executive and management teams","N: Not Achieved (0 to 15%)"]
["RC.IM-1: Recovery plans incorporate lessons learned","N: Not Achieved (0 to 15%)"]
["RC.IM-2: Recovery strategies are updated","N: Not Achieved (0 to 15%)"]
["RC.RP-1: Recovery plan is executed during or after an event","N: Not Achieved (0 to 15%)"]

{"sheet":"Target Profile and Action Plan","index":19,"n_rows":105,"n_cols":11,"rows_kept":105,"cut":false,"hidden":false,"merged":[[0,0,0,10]]}
["Push Atl + F5 to refresh sub categories listing"]
["Sub Category"," Impact of not having control in place \n1 = Low Impact\n5 = High Impact","Current Profile Score","Desired State (Target)","Current Practices","Comments","Improvement Actions","Resources Required ","Schedule / Milestones","Pre-requisites/Dependencies","Action Assignee"]
["DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed","(blank)","N: Not Achieved (0 to 15%)","F: Fully Achieved (>85%)"]
["DE.AE-2: Detected events are analyzed to understand attack targets and methods","(blank)","N: Not Achieved (0 to 15%)","F: Fully Achieved (>85%)"]
["DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors","(blank)","N: Not Achieved (0 to 15%)","No Change"]
["DE.AE-4: Impact of events is determined","(blank)","N: Not Achieved (0 to 15%)"]
["DE.AE-5: Incident alert thresholds are established","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-1: The network is monitored to detect potential cybersecurity events","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-2: The physical environment is monitored to detect potential cybersecurity events","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-4: Malicious code is detected","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-5: Unauthorized mobile code is detected","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed","(blank)","N: Not Achieved (0 to 15%)"]
["DE.CM-8: Vulnerability scans are performed","(blank)","N: Not Achieved (0 to 15%)"]
["DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability","(blank)","N: Not Achieved (0 to 15%)"]
["DE.DP-2: Detection activities comply with all applicable requirements","(blank)","N: Not Achieved (0 to 15%)"]
["DE.DP-3: Detection processes are tested","(blank)","N: Not Achieved (0 to 15%)"]
["DE.DP-4: Event detection information is communicated to appropriate parties","(blank)","N: Not Achieved (0 to 15%)"]
["DE.DP-5: Detection processes are continuously improved","(blank)","N: Not Achieved (0 to 15%)"]
["Detect","(blank)","(blank)"]
["ID.AM-1: Physical devices and systems within the organization are inventoried",1,"N: Not Achieved (0 to 15%)"]
["ID.AM-2: Software platforms and applications within the organization are inventoried",1,"N: Not Achieved (0 to 15%)"]
["ID.AM-3: Organizational communication and data flows are mapped","(blank)","N: Not Achieved (0 to 15%)"]
["ID.AM-4: External information systems are catalogued","(blank)","N: Not Achieved (0 to 15%)"]
["ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value","(blank)","N: Not Achieved (0 to 15%)"]
["ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established","(blank)","N: Not Achieved (0 to 15%)"]
["ID.BE-1: The organization’s role in the supply chain is identified and communicated","(blank)","N: Not Achieved (0 to 15%)"]
["ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated","(blank)","N: Not Achieved (0 to 15%)"]
["ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated","(blank)","N: Not Achieved (0 to 15%)"]
["ID.BE-4: Dependencies and critical functions for delivery of critical services are established","(blank)","N: Not Achieved (0 to 15%)"]
["ID.BE-5: Resilience requirements to support delivery of critical services are established","(blank)","N: Not Achieved (0 to 15%)"]
["ID.GV-1: Organizational information security policy is established","(blank)","N: Not Achieved (0 to 15%)"]
["ID.GV-2: Information security roles & responsibilities are coordinated and aligned with internal roles and external partners","(blank)","N: Not Achieved (0 to 15%)"]
["ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed","(blank)","N: Not Achieved (0 to 15%)"]
["ID.GV-4: Governance and risk management processes address cybersecurity risks","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RA-1: Asset vulnerabilities are identified and documented","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RA-2: Threat and vulnerability information is received from information sharing forums and sources","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RA-3: Threats, both internal and external, are identified and documented","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RA-4: Potential business impacts and likelihoods are identified","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RA-6: Risk responses are identified and prioritized","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RM-2: Organizational risk tolerance is determined and clearly expressed","(blank)","N: Not Achieved (0 to 15%)"]
["ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AC-1: Identities and credentials are managed for authorized devices and users","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AC-2: Physical access to assets is managed and protected","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AC-3: Remote access is managed","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AT-1: All users are informed and trained ","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AT-2: Privileged users understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AT-4: Senior executives understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)"]
["PR.AT-5: Physical and information security personnel understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)"]
["PR.DS-1: Data-at-rest is protected","(blank)","N: Not Achieved (0 to 15%)"]
["PR.DS-2: Data-in-transit is protected","(blank)","N: Not Achieved (0 to 15%)"]
["PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition","(blank)","N: Not Achieved (0 to 15%)"]
["PR.DS-4: Adequate capacity to ensure availability is maintained","(blank)","N: Not Achieved (0 to 15%)"]
["PR.DS-5: Protections against data leaks are implemented","(blank)","N: Not Achieved (0 to 15%)"]
["PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity","(blank)","N: Not Achieved (0 to 15%)"]
["PR.DS-7: The development and testing environment(s) are separate from the production environment","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-10: Response and recovery plans are tested","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-11: Cybersecurity is included in human resources practices (e.g., de-provisioning, personnel screening)","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-12: A vulnerability management plan is developed and implemented","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-2: A System Development Life Cycle to manage systems is implemented","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-3: Configuration change control processes are in place","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-4: Backups of information are conducted, maintained, and tested periodically","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-6: Data is destroyed according to policy","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-7: Protection processes are continuously improved","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties","(blank)","N: Not Achieved (0 to 15%)"]
["PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed","(blank)","N: Not Achieved (0 to 15%)"]
["PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools","(blank)","N: Not Achieved (0 to 15%)"]
["PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access","(blank)","N: Not Achieved (0 to 15%)"]
["PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy","(blank)","N: Not Achieved (0 to 15%)"]
["PR.PT-2: Removable media is protected and its use restricted according to policy","(blank)","N: Not Achieved (0 to 15%)"]
["PR.PT-3: Access to systems and assets is controlled, incorporating the principle of least functionality","(blank)","N: Not Achieved (0 to 15%)"]
["PR.PT-4: Communications and control networks are protected","(blank)","N: Not Achieved (0 to 15%)"]
["Protect","(blank)","(blank)"]
["RC.CO-1: Public relations are managed","(blank)","N: Not Achieved (0 to 15%)"]
["RC.CO-2: Reputation after an event is repaired","(blank)","N: Not Achieved (0 to 15%)"]
["RC.CO-3: Recovery activities are communicated to internal stakeholders and executive and management teams","(blank)","N: Not Achieved (0 to 15%)"]
["RC.IM-1: Recovery plans incorporate lessons learned","(blank)","N: Not Achieved (0 to 15%)"]
["RC.IM-2: Recovery strategies are updated","(blank)","N: Not Achieved (0 to 15%)"]
["RC.RP-1: Recovery plan is executed during or after an event","(blank)","N: Not Achieved (0 to 15%)"]
["Recover","(blank)","(blank)"]
["Respond","(blank)","(blank)"]
["RS.AN-1: Notifications from detection systems are investigated ","(blank)","N: Not Achieved (0 to 15%)"]
["RS.AN-2: The impact of the incident is understood","(blank)","N: Not Achieved (0 to 15%)"]
["RS.AN-3: Forensics are performed","(blank)","N: Not Achieved (0 to 15%)"]
["RS.AN-4: Incidents are categorized consistent with response plans","(blank)","N: Not Achieved (0 to 15%)"]
["RS.CO-1: Personnel know their roles and order of operations when a response is needed","(blank)","N: Not Achieved (0 to 15%)"]
["RS.CO-2: Events are reported consistent with established criteria","(blank)","N: Not Achieved (0 to 15%)"]
["RS.CO-3: Information is shared consistent with response plans","(blank)","N: Not Achieved (0 to 15%)"]
["RS.CO-4: Coordination with stakeholders occurs consistent with response plans","(blank)","N: Not Achieved (0 to 15%)"]
["RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness ","(blank)","N: Not Achieved (0 to 15%)"]
["RS.IM-1: Response plans incorporate lessons learned","(blank)","N: Not Achieved (0 to 15%)"]
["RS.IM-2: Response strategies are updated","(blank)","N: Not Achieved (0 to 15%)"]
["RS.MI-1: Incidents are contained","(blank)","N: Not Achieved (0 to 15%)"]
["RS.MI-2: Incidents are mitigated","(blank)","N: Not Achieved (0 to 15%)"]
["RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","(blank)","N: Not Achieved (0 to 15%)"]
["RS.RP-1: Response plan is executed during or after an event","(blank)","N: Not Achieved (0 to 15%)"]
["(blank)","(blank)","(blank)"]

{"sheet":"Gap Assessment","index":20,"n_rows":119,"n_cols":10,"rows_kept":119,"cut":false,"hidden":false,"merged":[[0,9,10,9],[11,9,16,9]]}
["Sub Category","Impact of not having control in place \n1 = Low Impact\n5 = High Impact","Current Status","Current Numb","Desired Status","Desired Numb","Delta of Change /3","Delta / 15 (Change * Impact)\n0 = Minimal Change Low Impact\n15 = High Change High Impact"]
["DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed",5,"N: Not Achieved (0 to 15%)",{"$f":"IF(C2=\"N: Not Achieved (0 to 15%)\",3,IF(C2=\"P: Partially Achieved (>15 – 50%)\",2, IF(C2=\"L: Largely Achieved (>50 to 85%)\", 1, IF(C2=\"F: Fully Achieved (>85%)\", 0, 0))))","v":3},"F: Fully Achieved (>85%)",{"$f":"IF(E2=\"N: Not Achieved (0 to 15%)\",3,IF(E2=\"P: Partially Achieved (>15 – 50%)\",2, IF(E2=\"L: Largely Achieved (>50 to 85%)\", 1, IF(E2=\"F: Fully Achieved (>85%)\", 0, 0))))","v":0},{"$f":"(D2-F2)","v":3},{"$f":"(D2-F2)*B2","v":15}]
["DE.AE-2: Detected events are analyzed to understand attack targets and methods",5,"N: Not Achieved (0 to 15%)",{"$f":"IF(C3=\"N: Not Achieved (0 to 15%)\",3,IF(C3=\"P: Partially Achieved (>15 – 50%)\",2, IF(C3=\"L: Largely Achieved (>50 to 85%)\", 1, IF(C3=\"F: Fully Achieved (>85%)\", 0, 0))))","v":3},"F: Fully Achieved (>85%)",{"$f":"IF(E3=\"N: Not Achieved (0 to 15%)\",3,IF(E3=\"P: Partially Achieved (>15 – 50%)\",2, IF(E3=\"L: Largely Achieved (>50 to 85%)\", 1, IF(E3=\"F: Fully Achieved (>85%)\", 0, 0))))","v":0},{"$f":"(D3-F3)","v":3},{"$f":"(D3-F3)*B3","v":15}]
["DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors",5,"N: Not Achieved (0 to 15%)",3,"F: Fully Achieved (>85%)",0,3,{"$f":"(D4-F4)*B4","v":15}]
["DE.AE-4: Impact of events is determined",3,"N: Not Achieved (0 to 15%)",3,"L: Largely Achieved (>50 to 85%)",1,2,{"$f":"(D5-F5)*B5","v":6}]
["DE.AE-5: Incident alert thresholds are established",5,"N: Not Achieved (0 to 15%)",3,"L: Largely Achieved (>50 to 85%)",1,2,10]
["DE.CM-1: The network is monitored to detect potential cybersecurity events",5,"N: Not Achieved (0 to 15%)",3,"F: Fully Achieved (>85%)",0,3,15]
["DE.CM-2: The physical environment is monitored to detect potential cybersecurity events",5,"N: Not Achieved (0 to 15%)",3,"F: Fully Achieved (>85%)",0,3,15]
["DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events",5,"N: Not Achieved (0 to 15%)",3,"F: Fully Achieved (>85%)",0,3,15]
["DE.CM-4: Malicious code is detected",5,"N: Not Achieved (0 to 15%)",3,"F: Fully Achieved (>85%)",0,3,15]
["DE.CM-5: Unauthorized mobile code is detected",5,"N: Not Achieved (0 to 15%)",3,"F: Fully Achieved (>85%)",0,3,15]
["DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events",5,"N: Not Achieved (0 to 15%)",3,"F: Fully Achieved (>85%)",0,3,15,null,"Click copy target profile data to populate the sheet."]
["DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["DE.CM-8: Vulnerability scans are performed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["DE.DP-2: Detection activities comply with all applicable requirements","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["DE.DP-3: Detection processes are tested","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["DE.DP-4: Event detection information is communicated to appropriate parties","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["DE.DP-5: Detection processes are continuously improved","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["Detect","(blank)","(blank)",0,null,0,0,{"$error":"#VALUE!"}]
["ID.AM-1: Physical devices and systems within the organization are inventoried",1,"N: Not Achieved (0 to 15%)",3,null,0,3,3]
["ID.AM-2: Software platforms and applications within the organization are inventoried",1,"N: Not Achieved (0 to 15%)",3,null,0,3,3]
["ID.AM-3: Organizational communication and data flows are mapped","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.AM-4: External information systems are catalogued","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.BE-1: The organization’s role in the supply chain is identified and communicated","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.BE-4: Dependencies and critical functions for delivery of critical services are established","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.BE-5: Resilience requirements to support delivery of critical services are established","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.GV-1: Organizational information security policy is established","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.GV-2: Information security roles & responsibilities are coordinated and aligned with internal roles and external partners","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.GV-4: Governance and risk management processes address cybersecurity risks","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RA-1: Asset vulnerabilities are identified and documented","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RA-2: Threat and vulnerability information is received from information sharing forums and sources","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RA-3: Threats, both internal and external, are identified and documented","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RA-4: Potential business impacts and likelihoods are identified","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RA-6: Risk responses are identified and prioritized","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RM-2: Organizational risk tolerance is determined and clearly expressed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AC-1: Identities and credentials are managed for authorized devices and users","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AC-2: Physical access to assets is managed and protected","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AC-3: Remote access is managed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AT-1: All users are informed and trained ","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AT-2: Privileged users understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AT-4: Senior executives understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.AT-5: Physical and information security personnel understand roles & responsibilities ","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.DS-1: Data-at-rest is protected","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.DS-2: Data-in-transit is protected","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.DS-4: Adequate capacity to ensure availability is maintained","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.DS-5: Protections against data leaks are implemented","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.DS-7: The development and testing environment(s) are separate from the production environment","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-10: Response and recovery plans are tested","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-11: Cybersecurity is included in human resources practices (e.g., de-provisioning, personnel screening)","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-12: A vulnerability management plan is developed and implemented","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-2: A System Development Life Cycle to manage systems is implemented","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-3: Configuration change control processes are in place","(blank)","N: Not Achieved (0 to 15%)",{"$f":"IF(C67=\"N: Not Achieved (0 to 15%)\",3,IF(C67=\"P: Partially Achieved (>15 – 50%)\",2, IF(C67=\"L: Largely Achieved (>50 to 85%)\", 1, IF(C67=\"F: Fully Achieved (>85%)\", 0, 0))))","v":3},null,{"$f":"IF(E67=\"N: Not Achieved (0 to 15%)\",3,IF(E67=\"P: Partially Achieved (>15 – 50%)\",2, IF(E67=\"L: Largely Achieved (>50 to 85%)\", 1, IF(E67=\"F: Fully Achieved (>85%)\", 0, 0))))","v":0},{"$f":"(D67-F67)","v":3},{"$f":"(D67-F67)*B67","v":{"$error":"#VALUE!"}}]
["PR.IP-4: Backups of information are conducted, maintained, and tested periodically","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-6: Data is destroyed according to policy","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-7: Protection processes are continuously improved","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.PT-2: Removable media is protected and its use restricted according to policy","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.PT-3: Access to systems and assets is controlled, incorporating the principle of least functionality","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["PR.PT-4: Communications and control networks are protected","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["Protect","(blank)","(blank)",0,null,0,0,{"$error":"#VALUE!"}]
["RC.CO-1: Public relations are managed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RC.CO-2: Reputation after an event is repaired","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RC.CO-3: Recovery activities are communicated to internal stakeholders and executive and management teams","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RC.IM-1: Recovery plans incorporate lessons learned","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RC.IM-2: Recovery strategies are updated","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RC.RP-1: Recovery plan is executed during or after an event","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["Recover","(blank)","(blank)",0,null,0,0,{"$error":"#VALUE!"}]
["Respond","(blank)","(blank)",0,null,0,0,{"$error":"#VALUE!"}]
["RS.AN-1: Notifications from detection systems are investigated ","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.AN-2: The impact of the incident is understood","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.AN-3: Forensics are performed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.AN-4: Incidents are categorized consistent with response plans","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.CO-1: Personnel know their roles and order of operations when a response is needed","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.CO-2: Events are reported consistent with established criteria","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.CO-3: Information is shared consistent with response plans","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.CO-4: Coordination with stakeholders occurs consistent with response plans","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness ","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.IM-1: Response plans incorporate lessons learned","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.IM-2: Response strategies are updated","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.MI-1: Incidents are contained","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.MI-2: Incidents are mitigated","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["RS.RP-1: Response plan is executed during or after an event","(blank)","N: Not Achieved (0 to 15%)",3,null,0,3,{"$error":"#VALUE!"}]
["(blank)","(blank)","(blank)",0,null,0,0,{"$error":"#VALUE!"}]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]
[null,null,null,0,null,0,0,0]

{"sheet":"Dropdown data","index":21,"n_rows":21,"n_cols":4,"rows_kept":21,"cut":false,"hidden":false,"merged":[]}
["N: Not Achieved (0 to 15%)",null,null,"Chief Information Officer "]
["P: Partially Achieved (>15 – 50%)",null,null,"Chief Information Security Officer"]
["L: Largely Achieved (>50 to 85%)",null,null,"Human Resources Manager"]
["F: Fully Achieved (>85%)",null,null,"Facilities Manager"]
[null,null,null,"Physical Security Manager"]
[null,null,null,"IT Manager - Networking"]
[1,null,null,"IT Manager - Client Services"]
[2,null,null,"IT Manager - Information Systems"]
[3,null,null,"IT Manager - Project Management"]
[4,null,null,"Legal Department"]
[5,null,null,"Risk and Compliance Officer"]
[null,null,null,"Finance Manager - Audit and Controls"]
[null,null,null,"Information Security Officer"]
[null,null,null,"Security Analyst "]
[null,null,null,"System Administrator / Architect"]
[null,null,null,"Network Architect "]
[null,null,null,"Service Desk Analyst "]
["N: Not Achieved (0 to 15%)",null,null,"Programmer "]
["P: Partially Achieved (>15 – 50%)"]
["L: Largely Achieved (>50 to 85%)"]
["F: Fully Achieved (>85%)"]