urn: urn:intuitem:risk:library:cisco-ccf-v3.0
locale: en
ref_id: cisco-ccf-v3.0
name: Cisco Cloud Controls Framework (CCF) v3.0
description: 'The Cisco CCF is the result of research to determine what is needed
  to certify and achieve compliance for multiple industry accepted security compliance
  standards SaaS products.

  The CCF is purely guidance, and each organization must review, evaluate, and tailor
  the control framework according to your needs and integrate into your own compliance
  regime.'
copyright: Cisco
version: 1
publication_date: 2025-06-05
provider: Cisco
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:cisco-ccf-v3.0
    ref_id: cisco-ccf-v3.0
    name: Cisco Cloud Controls Framework (CCF) v3.0
    description: 'The Cisco CCF is the result of research to determine what is needed
      to certify and achieve compliance for multiple industry accepted security compliance
      standards SaaS products.

      The CCF is purely guidance, and each organization must review, evaluate, and
      tailor the control framework according to your needs and integrate into your
      own compliance regime.'
    implementation_groups_definition:
    - ref_id: process
      name: Process
      description: null
    - ref_id: technology
      name: Technology
      description: null
    - ref_id: people
      name: People
      description: null
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:audit-compliance
      assessable: false
      depth: 1
      name: Audit Compliance
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:audit-compliance
      ref_id: CCF 1
      name: Control Self-Assessments
      description: Independent Control self-assessments are performed by independent
        auditors, at least annually, to gain reasonable assurance that controls are
        in place and operating effectively. Corrective actions are taken based on
        relevant findings and tracked to resolution.  Independent control self-assessments
        are reviewed by management and stored in a central repository and maintained.
      annotation: "1. Develop and document a procedure for performance of control\
        \ self-assessments against the CCF controls that have been implemented.\n\n\
        2. The self-assessment procedure should minimally include:\n\n\u2022 Tracking\
        \ of the self-assessment in a ticketing system such as Jira or ServiceNow\n\
        \u2022 Identification of the controls to be assessed (must include SOC 2(S/A/C)\
        \ and ISO 27001 relevant controls at a minimum)\n\u2022 Documentation gathering\
        \ as necessary for the identified controls\n\u2022 Evidence gathering in accordance\
        \ with the \u201CControl RFI\u201D requirements of each CCF control\n\u2022\
        \ Process review session(s) by the responsible management team\n\u2022 Review\
        \ and approval of the audit report by the responsible management\n\u2022 Identification\
        \ of shortcomings and creation of separate tickets for remediation (assigned\
        \ to responsible party)\n\u2022 Lessons learned meeting by the responsible\
        \ management teams with an output of updated policy and procedure to prevent\
        \ control shortcomings in the future\n\u2022 Store the documented procedure\
        \ in a backed-up, access-controlled location"
      typical_evidence: '1. Provide org chart to showcase independence of the audit
        team members

        2. Provide the list of controls/scope that were audited

        3. Provide the internal audit report showing the results (findings), date
        when control self-assessment was completed

        4. Provide evidence of review and approval by the management of the control
        self-assessment report

        5. Provide the internal audit report of a previous self-assessment, and resolution
        of previous findings

        6. Provide remediation tracking documents (e.g. Tickets) showing remediation
        actions, owner and closure date


        TX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-AAC-01.01:
        Review and update the current audit and accountability policy at least every
        three (3) years and following significant changes.


        Review and update the current audit and accountability procedures at least
        annually and following significant changes.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:audit-compliance
      ref_id: CCF 2
      name: Security Policy Audit
      description: "At least quarterly, organization reviews shall be performed with\
        \ approved documented specification to confirm personnel are following security\
        \ policies and operational procedures pertaining to: \n\u2022 log reviews\n\
        \u2022 firewall rule-set reviews\n\u2022 applying configuration standards\
        \ to new systems\n\u2022 responding to security alerts\n\u2022 change management\
        \ processes"
      annotation: '1. On a quarterly basis, there must be documentation documenting
        a review of logs, firewall rule-sets, configuration standards, security alert
        and incidents, and change management processes.

        2. Ensure review is performed at least on a quarterly basis'
      typical_evidence: "1. Provide following documentation\n\u2022 Log Management\n\
        \u2022 Firewall standard\n\u2022 Configuration standard\n\u2022 Incident management\n\
        \u2022 Monitoring procedure\n\u2022 Change management\n\n2. Provide reports\
        \ of reviews conducted every quarter"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:audit-compliance
      ref_id: CCF 3
      name: Customer Audits
      description: If applicable, corporate documented procedures regarding customer-requested
        audits shall be defined, documented and transparently communicated to the
        customer; and where applicable, the mandated auditor.
      annotation: '1. Obtain audit procedures and ensure the document covers procedure
        regarding customer-requested audits

        2. Ensure procedure regarding customer-requested audits are communicated to
        customers and where applicable, the mandated auditor'
      typical_evidence: "1. Provide audit procedure for customer requested audits\n\
        2. Provide sample communication shared with customers and where applicable,\
        \ the mandated auditor regarding customer requested audit procedure \n\nFedRAMP\
        \ Moderate & High - The following attribute should be validated for CCF-AAC-01.03:\
        \ The following events are included in audit logs - \nsuccessful and unsuccessful\
        \ account logon events, account management events, object access, policy change,\
        \ privilege functions, process tracking, and system events. For Web applications:\
        \ all administrator activity, authentication checks, authorization checks,\
        \ data deletions, data access, data changes, and permission changes"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:audit-compliance
      ref_id: CCF 4
      name: Audit Program
      description: A three-year audit program is in place which defines the scope
        and frequency of audits in accordance with change management, policies, and
        risk assessment results.
      annotation: '1. Obtain audit procedures and ensure that the audit procedure
        documentation covers scope and frequency for the three year period.

        2. Ensure audit program procedures are in accordance with change management,
        policies, and risk assessment results.'
      typical_evidence: '1. Provide audit procedure documentation for the three year
        period, including the scope and frequency of audits.

        2. Provide relevant corporate policies and risk assessment results.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:audit-compliance
      ref_id: CCF 5
      name: Review of Audit Plan
      description: Management performs a review of the audit plan on a quarterly basis.
      annotation: '1. Verify organization reviews and updates the audited events.

        2. Verify that over time, the events that the organization believe should
        be audited change.'
      typical_evidence: '1. Provide organization-defined frequency for management
        reviews of the audit plan.

        2. Provide test results of the audit performed basis of the audit plan.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:audit-compliance
      ref_id: CCF 6
      name: KPI Audit
      description: Key performance indicators (KPI's - OFI, Minor, Major, pass, low,
        or high) are included as part of independent control self assessment performed
        by independent auditors at least annualy.
      annotation: 1. Ensure key performance indicators (KPIs) are a component of the
        independent control self-assessment that independent auditors do at least
        annually. KPIs are OFI, Minor, Major, pass, low, or high.
      typical_evidence: '1. Provide the most recent audit report, including KPIs.

        2. Provide the previous review report with organization-defined frequency.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:application-security
      assessable: false
      depth: 1
      name: Application Security
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:application-security
      ref_id: CCF 7
      name: Interface Threat Assessment
      description: Threats to the applications and application programming interfaces
        and weaknesses with their design are identified and assessed at least monthly.
      annotation: "1. Perform application vulnerability scanning in accordance with\
        \ to identify threats and weaknesses continuously\n2. Remediate in accordance\
        \ with the defined vulnerability management procedure\_\n3. Configure quality\
        \ \"gate\" or \"gates\" within the CI/CD pipeline that require security assessments\
        \ to occur and any changes with vulnerabilities are reviewed and fixed before\
        \ any new or changed code can be pushed into production. Perform the following\
        \ assessments for new or changed code at a minimum:\n\n- Security Impact Analysis\n\
        - Manual Code Review\n- Static Code Scan\n- Container Image Scan (if applicable)\n\
        \n4. Remediation of identified weaknesses and threats must be completed prior\
        \ to proceeding through the pipeline.\n5. Document the assessments and approvals\
        \ with a ticket\n6. Review incident after action reports for application or\
        \ API related incidents on a regular basis to ensure that the incident response\
        \ remediation efforts were successful and identify recurring incidents\n7.\
        \ Configure a log query within the log management tool for log entries pertinent\
        \ to application and API threats and weaknesses. Configure a dashboard within\
        \ the log management tool to display the results of the log query. Review\
        \ the dashboard on a monthly basis\n8. Configure alerts in the log management\
        \ tool based upon the configured application log query to meet continuous\
        \ identification and assessment requirements\n9. Perform a security impact\
        \ analysis of the detected threats and weaknesses and remediate in accordance\
        \ with the defined vulnerability management procedure"
      typical_evidence: '1. Examine application threat and vulnerability scans

        2. Provide tickets related to identified application scan results

        3. Provide resolution to identified application vulnerabilities

        4. Provide log management tool dashboard details and show evidence that it
        is reviewed on a monthly basis'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:application-security
      ref_id: CCF 8
      name: Cybersecurity Legal and Regulatory Requirements
      description: Legal and regulatory requirements regarding cybersecurity, including
        privacy and civil liberties obligations, are documented and maintained by
        corporate legal department on an annual basis.
      annotation: "1. The corporate Legal department documents and maintains legal\
        \ and regulatory requirements. BU's must work with the Legal department to\
        \ understand the requirements that must be met to be onboarded into the corporate\
        \ and BU Legal process if not already completed. Implementation of the procedures,\
        \ architectures, technologies, and strategies that are necessary to meet the\
        \ requirements of the corporate legal and regulatory requirements are the\
        \ responsibility of the business unit. Such legal examples include regulation\
        \ such as GDPR, encryption requirements, and more. \n\n2. Each BU must complete\
        \ the CSDL Guidance Template as part of this control requirement as well."
      typical_evidence: '1. Provide the legal and regulatory documentations relating
        to BU obligations in different countries

        2. Provide the evidence or examples that legal and regulatory documents are
        updated annually

        3. Provide evidence the CSDL Guidance Template has been completed'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:application-security
      ref_id: CCF 9
      name: Spanish Security Requirements
      description: When applicable, systems, products or equipment will have their
        security functionalities evaluated in accordance with European or international
        standards, and whose certificates are recognized by the National Scheme for
        the Evaluation and Certification of Information Technology Security prior
        to being used.
      annotation: "1. Any Systems with services in the EU shall review and understand\
        \ European and/or international standards applicable in the EU. \n2. Documented\
        \ review and applicable standards shall be documented.\n3. Any security requirements\
        \ shall be adhered to and followed for security around the product.\n4. Any\
        \ security certificates provided to systems, products, or equipment must be\
        \ appropriate and recognized by the National Scheme for Evaluation and Certification\
        \ of Information Technology Security prior to being used."
      typical_evidence: '1. Obtain documentation of review of European and international
        standards that are applicable to the product.

        2. Validate all standards that are applicable are adhered to by the Systems.

        3. Validate any certificates used by the Systems around systems, products,
        equipment are certificates recognized by the National Scheme for the Evaluation
        and Certification of Information Technology Security. This can be certifications
        around encryption, equipment, security, etc.


        Spanish ENS High: This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      assessable: false
      depth: 1
      name: Business Continuity & Resilience
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 10
      name: Documented BC/DR
      description: A documented business continuity/disaster recovery (BC/DR) plan
        is in place and tested at least annually. Enterprise testing is done by the
        IT Risk Management Team. Offer teams perform testing for their given offers.
        Any exclusions are documented as part of the BC/DR plan. As part of the BC/DR
        plan, management identifies rooms for improvement and implements necessary
        actions to improve their business continuity plan as well.
      annotation: '1. Ensure Business continuity / disaster recovery planning is completed
        in coordination with the centralized BC / DR team

        2. Coordinate with the corporate BC / DR team to understand the requirements
        for developing a BC / DR plan for the products/services

        3. Contact the BC / DR team to jointly identify a BC / DR plan for the products/services
        that meets corporate standards

        4. Coordinate with the corporate BC / DR team to perform annual or semi-annual
        tests of the BC / DR plan. Review the results of the tests and update the
        operational continuity and business criticality of all assets within the required
        asset inventory

        5. Coordinate with the privacy office and refer to the corporate Data Privacy
        Policy to ensure that the backup and recovery plans impacting PII are developed
        in accordance with the corporate Data Privacy Policy and meet all legal obligations

        6. As part of the BC / DR testing, validate that information security can
        been maintained in the event of an adverse situation.

        7. Store the documentation in a corporate-approved, backed-up, access-controlled
        storage repository'
      typical_evidence: "1. Provide the BC / DR documentation\n2. Provide recent BC/\
        \ DR test documentation (tracking ticket)\n3. Provide remediation tickets\
        \ for issues identified as part of the BC/DR test\n4. Validate the BC/DR ticket\
        \ has details around lessons/learned as well.\n\nAgID (Critical) - The following\
        \ attribute should be validated for CCF-BCR-01.01: BC/DR plan is tested every\
        \ 6 months\n\nTX-RAMP Level 1 & 2 - The following attribute should be validated\
        \ for CCF-BCR-01.01: Test the contingency plan for the system at least every\
        \ 2 years with a tabletop simulation\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-BCR-01.01:\n  1. Identifies essential\
        \ missions and business functions and associated contingency requirements;\n\
        \   2. Provides recovery objectives, restoration priorities, and metrics;\n\
        \   3. Addresses contingency roles, responsibilities, assigned individuals\
        \ with contact information;\n   4. Addresses maintaining essential missions\
        \ and business functions despite an information system disruption, compromise,\
        \ or failure;\n   5. Addresses eventual, full information system restoration\
        \ without deterioration of the security safeguards originally planned and\
        \ implemented; and\n   6. Is reviewed and approved by [Assignment: organization-defined\
        \ personnel or roles];\n b. Distributes copies of the contingency plan to\
        \ [Assignment: organization-defined key contingency personnel (identified\
        \ by name and/or by role) and organizational elements];\n c. Coordinates contingency\
        \ planning activities with incident handling activities;\n d. Reviews the\
        \ contingency plan for the information system [Assignment: organization-defined\
        \ frequency];\n e. Updates the contingency plan to address changes to the\
        \ organization, information system, or environment of operation and problems\
        \ encountered during contingency plan implementation, execution, or testing;\n\
        \ f. Communicates contingency plan changes to [Assignment: organization-defined\
        \ key contingency personnel (identified by name and/or by role) and organizational\
        \ elements]; and\n g. Protects the contingency plan from unauthorized disclosure\
        \ and modification. \n\nFedRAMP Moderate & High - The following attribute\
        \ should be validated for CCF-BCR-01.01: \n- BU needs to call out specific\
        \ RTO and RPO timeliens for environment and essential functions of BU in case\
        \ of incident or outage as part of BCDR/CP plan.\n- alternate telemmunications\
        \ is included as part of this strategy.\n- system implements transaction recovery\
        \ for systems that are transaction based.\n\nFedRAMP High - The following\
        \ attribute should be validated for CCF-BCR-01.01: \n- BU needs to call out\
        \ specific RTO and RPO timelines for environment and essential functions of\
        \ BU in case of incident or outage as part of BCDR/CP plan. \n- obtain evidence\
        \ of contingency plans by telecommunications providers and testing/training\
        \ annually.\n\nPCI - The following attribute should be validated for CCF-BCR-01.01:\
        \ Review and test plan annually"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 11
      name: Legal & Regulatory Requirements for Continuity
      description: The organization maintains and documents a process to identify,
        have access to, and assess applicable legal and regulatory requirements relating
        to the continuity of its products and services, activities and resources.
        Such legal and regulatory requirements are reviewed at least annually to ensure
        the continuity of its products and services, activities and resources. Revision
        histories and review periods are defined within the documents themselves and
        the Organization Policy Governance Policy.
      annotation: '1. Obtain documented process to identify an assess applicable legal
        and regulatory requirements relating to the continuity of products and services.
        Legal and regulatory requirements include local laws and regulations of the
        country the service is provided

        2. Review and verify if documented legal and regulatory requirements for business
        continuity are reviewed at least annually to ensure local legal and regulatory
        requirements are kept up to date for continuity and storage of its services
        and data.

        3. Verify on an sample basis whether updates/ amendments to applicable legal
        or regulatory requirements have been assessed by the team and the continuity
        requirements have been addressed.


        Note: This is a corporate control unless BU is managing its own policy/management
        standard'
      typical_evidence: '1. Documented BCMS process with applicable business continuity
        related legal and regulatory requirements

        2. Show evidence of identified legal and regulatory requirements related to
        continuity of product and service

        3. Documented evidence showing legal and regulatory requirements are reviewed
        at least annually


        Note: This is a corporate control unless BU is managing its own policy/management
        standard'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 12
      name: Business Impact Assessment
      description: Business impact assessment (BIA) and continuity specific risk assessment
        are performed at least annually and when significant changes within the organization
        occur. Results of the assessments are used to establish the scope of the continuity
        plan, determine business continuity priorities, and the recovery strategies.
      annotation: "1. Identify and complete a business impact assessment that meets\
        \ corporate standards.\n2. Identify all critical assets, or any significant\
        \ changes that are planned.\n3. Perform a business impact analysis and continuity\
        \ specific risk assessment on an annual basis for all critical assets or when\
        \ significant changes to the infrastructure occur. Review the results of the\
        \ test and plan remediation or update system resources accordingly to ensure\
        \ continuity of services. \n4. Ensure business continuity plans are established\
        \ and followed in the case of an emergency. \n5. Store the documentation in\
        \ a corporate-approved, backed-up, access-controlled storage repository"
      typical_evidence: "1. Provide the Business Continuity Management documentation.\
        \ \n2. Provide recent BIA test documentation (tracking ticket) including all\
        \ services in scope and procedures tested.\n3. Provide remediation tickets\
        \ for issues identified as part of BIA test.\n4. Provide previous BIA test\
        \ for timeliness.\n5. Check for remediation tickets for issues identified\
        \ and observe that they are tracked to completion."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 13
      name: Business Contingency Roles & Responsibilities
      description: Business contingency roles and responsibilities are assigned to
        individuals and their contact information is communicated to authorized personnel.
      annotation: "1. Review BCMS document consisting of business contingency roles\
        \ and responsibilities. If needed, each BU/BE should identify business contingency\
        \ roles and responsibilities within their own team as well.\n2. Identify and\
        \ validate whether identified roles and responsibilities documented are adequate\
        \ an cover all necessary responsibilities before crisis, during crisis an\
        \ after crisis. \n3. Verify if key stakeholders/ individuals have been assigned\
        \ for each specified business contingency roles (e.g. Executive council, crisis\
        \ management team, product/ process owners recovery teams, BCMS Head ,Facility\
        \ manager, third party employees, CISO, security compliance officer etc.)\n\
        4. Define, validate, and obtain evidence for communication of BCMS roles and\
        \ responsibilities to individuals assigned with BCMS roles and responsibilities.\n\
        5. Obtain evidence to check whether contact details of all individuals assigned\
        \ with BCMS roles and responsibilities are communicated to all applicable\
        \ stakeholders/ audience"
      typical_evidence: "1. BCMS roles and responsibilities document\n2. Evidence\
        \ of individuals been assigned to defined roles in BCMS roles and responsibilities\n\
        3. Evidence of business contingency contact details communication to all applicable\
        \ stakeholders/ audience\n\nTX-RAMP Level 1 & 2 - The following attribute\
        \ should be validated for CCF-BCR-01.04: Provide contingency training to system\
        \ users within 14 days and anually thereafter\n\nFedRAMP Moderate & High -\
        \ The following attribute should be validated for CCF-BCR-01.04: The organization:\n\
        \ a. Employs [Assignment: organization-defined security controls] at alternate\
        \ work sites;\n b. Assesses as feasible, the effectiveness of security controls\
        \ at alternate work sites; and\n c. Provides a means for employees to communicate\
        \ with information security personnel in case of security incidents or problems.\n\
        \nSpanish ENS High - This control is deemed good to have for Spanish ENS High,\
        \ but not deemed mandatory if remaining ENS controls are effective. If any\
        \ remaining ENS controls are deficient, these controls maybe scoped in as\
        \ needed."
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 14
      name: Service Storage and Processing
      description: Systems used for service, storage, processing, monitoring of customer
        data, support, and disaster recovery centers must reside in KSA. All information
        stored cannot be stored outside of the KSA.
      annotation: 'For products pursuing Saudi CCC, The following must be met:


        1. Ensure systems used for storage, processing, monitoring, support, and disaster
        recovery centers reside in KSA only

        2. Verify whether all information stored is within KSA and ensure no information
        is stored outside KSA'
      typical_evidence: 1. Provide screenshot showing region/ location of data residency
        for services provided in KSA
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 15
      name: Service Storage and Processing
      description: Corporate evaluates the data localization laws and requests from
        EU. If requested, corporate systems that store EU Data must reside within
        the EU.
      annotation: "1. Any Systems providing services to the EU must evaluate data\
        \ localization laws and requests from any EU country. \n2. A review and documentation\
        \ shall be maintained confirming adherence to data localization laws and requests\
        \ from the EU.\n3. If a request from an EU country is made to provide services\
        \ that reside in the EU, the Systems must have systems and databases reside\
        \ in the EU.\n4. Data must not be transferred out of the EU unless specific\
        \ guidance and approval has been obtained."
      typical_evidence: '1. Validate the Systems maintains documentation around any
        data localization laws and/or requests from the EU/EU Countries.

        2. If there are data localization laws that have been requested, the Systems
        must have systems and databases that reside in the EU to host customer data.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 16
      name: Service Storage and Processing
      description: The organization evaluates the data localization laws and requests
        from Japan. If requested, corporate systems that store Japan Data must reside
        within Japan.
      annotation: "1. Any Systems providing services to Japan must evaluate data localization\
        \ laws and requests from Japan.\n2. A review and documentation shall be maintained\
        \ confirming adherence to data localization laws and requests from Japan.\n\
        3. If a request from Japan is made to provide services that reside in Japan,\
        \ the Systems must have systems and databases that reside in Japan. \n4. Japan\
        \ Data must not be transferred out of Japan, unless specific guidance and\
        \ approval has been obtained."
      typical_evidence: '1. Validate the Systems maintains documentation around any
        data localization laws and/or requests from Japan.

        2. If there are data localization laws that have been requested, the Systems
        must have systems and databases that reside in Japan to host customer data.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 17
      name: Backup Policy
      description: Management maintains a backup policy or standard that is reviewed
        on a periodic basis.
      annotation: '1. Ensure organization has documented backup policy in place.

        2. Verify the backup policy is reviewed annually.'
      typical_evidence: '1. Provide documented backup policy.

        2. Provide last review with approval dates with email communication.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 18
      name: Service Storage and Processing
      description: The organization evaluates the data localization laws and requests
        from USA. If requested, corporate systems that store and process USA Data
        must reside within USA.
      annotation: 'Organization:

        1. Keeps records of all the requests coming from USA with proper logging mechanisms.

        2. Keeps track of all the international data localization as per the geography
        of the customer/data

        3. Corporate systems that store and process USA Data have records of processing
        acivities (ROPA) to showcase the journey of custmer data

        4. Has an updated PIA inventrory of customer data particulary when the data
        is travelling in USA

        5. Is aware and keeps up to date with the data localization laws of of various
        geographies across the world'
      typical_evidence: "1. Provide evidence of records for handling requests coming\
        \ from USA \n2. Provide policy that covers data localization laws as per the\
        \ geography or region of the data\n3. Provide evidence of Privacy impact assessment\
        \ (PIA) of USA data residing in USA\n4. Provide evidence that corporate offerings\
        \ have evaluated geographies with legal and regulatory risks.\n5. Validate\
        \ that the offerings do not operate out of, or have administrators that reside\
        \ in such geographies like USA"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 19
      name: Multi-Location Strategy
      description: A multi-location or region strategy for production environments
        is employed to permit the resumption of operations at other Company facilities
        in the event of the loss of a facility.
      annotation: "1. For systems/solutions hosted on major CSP's like AWS or GCP\
        \ :\n\u2022 Deploy subnets in at least two availability zones. Mirror application\
        \ resources across the subnets to remove single points of failure.\n\u2022\
        \ Deploy elastic load balancing and configure health checks so that load balancing\
        \ directs traffic to resources in the functional AZ in the case of an AZ failure.\n\
        \u2022 Deploy at least two NAT Gateways in different AZ\u2019s in AWS\n\u2022\
        \ Deploy virtual machines that host or support the application redundantly\
        \ in at least two subnets. This includes virtual appliances like firewalls,\
        \ load balancers, proxies, etc.\n\u2022 Ensure that all managed services used\
        \ by the system or solution have been configured to have multi-AZ support\n\
        \u2022 Configure CSP managed data bases to replicate data across multiple\
        \ instances in at least two availability zones. Configure read replicas where\
        \ available\n\u2022 In AWS, configure a snapshot schedule for EBS volumes\
        \ and back up the snapshots to a regional S3 bucket. Backup all data to regional\
        \ S3 buckets\n\u2022 In GCP, configure regional persistent disks for GCP managed\
        \ AZ redundancy or configure a snapshot schedule for persistent disks and\
        \ back up the snapshots to a regional Cloud Storage bucket. Backup all data\
        \ to regional Cloud Storage buckets\n\n2. For other Cloud Providers:\n\u2022\
        \  Deploy storage and operating solutions for redundancy across geographical\
        \ locations\n\u2022  If a cloud provider is being used it is the responsibility\
        \ of BU to ensure redundancy has been identified and addressed for all services\
        \ in use\n\u2022  Deploy subnets or VLANs in at least two geographically separate\
        \ locations. Mirror application resources across the locations to remove single\
        \ points of failure. Deploy redundant load balancers and configure health\
        \ checks to direct traffic to functional resources\n\u2022  Deploy VMs or\
        \ servers that host or support the application redundantly in at least two\
        \ physically separate locations. This includes network appliances like firewalls,\
        \ load balancers, proxies, etc.\n\u2022 Configure CSP managed data bases to\
        \ replicate data across multiple instances in at least two availability zones.\
        \ Configure read replicas where available\n\nNote: Large scale Systems should\
        \ have this in effect. Smaller Systems that have budget constraints may not\
        \ necessarily have the resources to execute this. If a BU does not have a\
        \ multi-location strategy, they must adequatly have a documented process and\
        \ SLA to bring up production environments in the event of any outages or disruption.\
        \ This can be done via backup/recovery procedures, but it must be also tested.\n\
        \nNote: If no multi-location strategy for production environments can be used,\
        \ a business justification or risk acceptance/rationale is provided."
      typical_evidence: "1. Provide the network architecture diagram of the system\
        \ / solution\n2. Provide the screenshots of the deployment of the system /\
        \ solution across availability zones\n3. Validate the resumption of operations\
        \ at alternate facility is tested and doable.\n\nNote: Large scale systems\
        \ should have this in effect. Smaller systems that have budget constraints\
        \ may not necessarily have the resources to execute this. If a BU does not\
        \ have a multi-location strategy, they must adequatly have a documented process\
        \ and SLA to bring up production environments in the event of any outages\
        \ or disruption. This can be done via backup/recovery procedures, but it must\
        \ be also tested.\n\nTX-RAMP Level 2 - The following attribute should be validated\
        \ for CCF-BCR-06.01: include telecommunication redundencies or alternate telecom\
        \ capabilities \n\nCCCS medium cloud profile specific requirement:\nNote:\
        \ since everything is a cloud system and usually built on AWS infrastructure,\
        \ this will be inherited through their ATO. Unless the BU is maintaining hardware\
        \ and/or their own data centers, CP-6 + enhancements, CP-7 + enhancements\
        \ and CP-8 + enhancements will be inherited thru AWS."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 20
      name: Audit Record Capacity
      description: The organization allocates audit record storage capacity in accordance
        with logging storage and retention requirements; Audit logs are retained for
        at least one year with one year of data immediately available for analysis.
      annotation: "1. Obtain Log management policy/procedure \n2. Verify if document\
        \ includes legal, regulatory, contractual, leading practice an business requirements\
        \ to be considered for audit logging an retention. \n3. Verify if log management\
        \ procedure clearly specifies logging storage an retention requirements to\
        \ ensure logs are retained for at least one year with one year of data immediately\
        \ available for analysis. If certain regulations or contractual obligations\
        \ require longer retention periods, this needs to be considered as well. \n\
        4.Validate whether log management procedure clearly specifies controls to\
        \ be put in place to prevent exceeding the storage capacity of the logging\
        \ media. (i.e. log archival, backups], replication). \n5. Configure in-scope\
        \ tools an systems to ensure that logs are captured an retained for at least\
        \ one year\n6. On a sample basis, check for applicable systems/ applications\
        \ whether logs are collected and stored is as per documented log storage an\
        \ retention schedules\n7. Validate whether logs are retained for at least\
        \ one year with one year of data immediately available for analysis\n8. Audit\
        \ Log/Record Storage Capacity should be evaluated at a set cadence to ensure\
        \ sufficient capacity is available."
      typical_evidence: "1. Log management procedure/policy document\n2. Business\
        \ unit/ Product level log storage and retention schedules\n3. Sample audit\
        \ log snapshots for logs stored for a period of one year with one year of\
        \ data immediately available for analysis\n4. Configuration showing that logs\
        \ are stored for a period of one year\n5. Validate sufficient audit log storage\
        \ requirements are met (i.e. sufficient log storage should be kept to meet\
        \ legal and contractual obligations)\n\nTX-RAMP Level 1 & 2 - The following\
        \ attribute should be validated for CCF-BCR-06.02: Log all the following events:\
        \ Successful and unsuccessful account logon events, account management events,\
        \ object access, policy change, privilege functions, process tracking, and\
        \ system events. For Web applications: all administrator activity, authentication\
        \ checks, authorization checks, data deletions, data access, data changes,\
        \ and permission changes\n\nRetain audit records for at least 60 days\n\n\
        FedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-BCR-06.02: \n- The following events are included in audit logs - successful\
        \ and unsuccessful account logon events, account management events, object\
        \ access, policy change, privilege functions, process tracking, and system\
        \ events. For Web applications: all administrator activity, authentication\
        \ checks, authorization checks, data deletions, data access, data changes,\
        \ and permission changes\n- audit logs are revisited annually for review.\n\
        - audit logs are encrypted using FIPS 140-2\n\nFedRAMP High - The following\
        \ attribute should be validated for CCF-BCR-06.02: Audit log generates an\
        \ alert if capacity reached.\n\nPCI - The following attribute should be validated\
        \ for CCF-BCR-06.02: PCI requires minimum of 1 year audit trail retention.\
        \ With 3 months immediately availble for analysis.\n\nCCCS medium cloud profile\
        \ specific requirement:\nThe following events are included in audit logs -\
        \ \nsuccessful and unsuccessful account logon events, account management events,\
        \ object access, policy change, privilege functions, process tracking, and\
        \ system events. For Web applications: all administrator activity, authentication\
        \ checks, authorization checks, data deletions, data access, data changes,\
        \ and permission changes"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 21
      name: Audit Logging Alert
      description: An alert is sent to relevant staff when the audit logging process
        failed.  Failures are addressed to resume system logging.
      annotation: '1. Maintain a list of personnel authorized to receive audit logging
        failure alerts

        2. Ensure alert notifications are sent to relevant staff when the audit logging
        process fails

        3. Ensure the logging failures are addressed timely to resume system logging'
      typical_evidence: '1. Provide sample alerts sent to staff when the audit logging
        process failed

        2. Provide evidence of logging failures being addressed to resume system logging


        TX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-BCR-06.03:
        Need to add a time period for the alert being sent (organization determined)'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-22
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 22
      name: Customer Data Backup
      description: At least annually, full backups are configured for data stores
        housing sensitive customer data and personal information. Repeated Failed
        backups are investigated and resolved. Backups are periodically restored to
        validate the integrity of the backup. Details of the restoration test are
        logged and included over who performed the test, a description, and restored
        backup, as well as an integrity check of the restored backup.
      annotation: "1. Identify all production instances and assets that store customer\
        \ data and personal information.\n2. For AWS, configure the AWS Backup service\
        \ to centralize incremental backup management in AWS. Configure backup plans\
        \ to perform timely (daily, weekly) backups of application data stores such\
        \ as Amazon Elastic Block Store (Amazon EBS) snapshots, Amazon Relational\
        \ Database Service (Amazon RDS) snapshots, Amazon DynamoDB backups, and AWS\
        \ Storage Gateway. Additionally, use backup software such as Veeam to perform\
        \ weekly or daily full backups of data stores.\n3. For GCP, configure persistent\
        \ disk snapshots, cloud sql snapshots, managed database service backups, Cloud\
        \ File Storage Backups to perform daily, weekly incremental backups. Additionally,\
        \ use backup software such as Veeam to perform weekly or daily full backups\
        \ of data stores.\n4. All other types of cloud services that are in use, or\
        \ other assets that hold customer data and personal information must be configured\
        \ for weekly, daily backups for data stores. Use backup software such as Veeam\
        \ to perform weekly or daily full backups of data stores. \n5. Ensure each\
        \ backup is able to be used, in the case of an emergency.\n6. Review backups\
        \ for completion, and follow up/resolve any backups that fail. Create a ticket\
        \ for each backup that fails detailing the failure, and what resolution was\
        \ completed to resolve the failed backup. \n7. Weekly/Daily cadence of backups\
        \ do not need to be enforced, but full backups should occur at least monthly\
        \ to reasonably ensure up-to-date data.\n8. Backups are tested for restoration\
        \ at least annually to validate integrity of the data. The backup validation\
        \ can be completed as part of BCDR procedures if needed. \n\nNote: If backups\
        \ are not feasible, a team must be able to achieve CCF-BCR-08.02."
      typical_evidence: "1. Show the configuration of full backups for data stores\
        \ housing sensitive customer data and personal information, and validate full\
        \ backups occur at least monthly. \n2. Validate that the backup is complete\
        \ and accurate. \n3. Obtain a job history log of the backup, and identify\
        \ any failures that have occurred.\n4. Check for remediation tickets for backups\
        \ that have failed, and observe that they are tracked to completion and resolution.\
        \ \n5. Evidence that backup restoration tests have been performed to validate\
        \ backups can be restored, at least annually.\n\nNote: If backups are not\
        \ feasible, a team must be able to achieve CCF-BCR-08.02. \n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-BCR-08.01: Conduct\
        \ backups for of user-level information, and of system-level information as\
        \ such: daily incremental; weekly full\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-BCR-08.01: \n- backups are saved to\
        \ a physically different system or multiple location. Backups should occur\
        \ weekly\n- backups must be daily incremental, and weekly full. And at least\
        \ 3 backup copies are retained.\n- backups must be restore tested at least\
        \ monthly.\n\nCCCS medium cloud profile specific requirement:\nBackups are\
        \ saved to a physically different system or multiple location. Backups should\
        \ occur weekly"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-23
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 23
      name: Customer Data Replication
      description: Databases are replicated to a secondary data base or data center.
        Alerts are configured to notify administrators if replication fails.
      annotation: "BU's shall identify primary databases that support the application\
        \ and host customer data. This data shall be replicated to a secondary database\
        \ periodically (real-time if possible). Any databases that are not replicated\
        \ real-time shall have a documented rationale.\n\n1. For systems/solutions\
        \ hosted on AWS:\n\u2022 Configure database software hosted on EC2 instances\
        \ to (asynchronously or synchronously) replicate to a secondary instance in\
        \ another availability zone using OEM provided capabilities, cron jobs, or\
        \ scheduled tasks.\n\u2022 Enable read replicas for RDS databases\n\u2022\
        \ Fully managed database services such as DynamoDB can be leveraged to offload\
        \ synchronous replication responsibility to AWS\n\u2022 Configure log metric\
        \ filters in CloudWatch Logs or in the SIEM tool to identify replication failures.\
        \ Configure an alert in response to those logs that notifies administrators\
        \ of the replication failure that was logged. Failures must be followed up\
        \ and resolved.\n\u2022 Retain replicated databases\n\n2. For systems/solutions\
        \ hosted on GCP:\n\u2022 Configure database software hosted on Compute Engine\
        \ instances to (asynchronously or synchronously) replicate to a secondary\
        \ instance in another availability zone using OEM provided capabilities, cron\
        \ jobs, or scheduled tasks\n\u2022 Enable read replicas for Cloud SQL databases\n\
        \u2022 Fully managed database services such as Cloud Spanner can be leveraged\
        \ to offload synchronous replication responsibility to GCP\n\u2022 Configure\
        \ log metric filters in Stack driver or in the SIEM tool to identify replication\
        \ failures. Configure an alert in response to those logs that notifies administrators\
        \ of the replication failure that was logged. Failures must be followed up\
        \ and resolved.\n\u2022 Retain replicated databases\n\n3. For systems/solutions\
        \ hosted on other CSP's:\n\u2022 Configure database software hosted on servers\
        \ and virtual machines to (asynchronously or synchronously) replicate to a\
        \ secondary instance in another geographic location using OEM provided capabilities,\
        \ cron jobs, or scheduled tasks\n\u2022 Enable cloud native replication services\
        \ or use fully managed cloud databases where available\n\u2022 Configure log\
        \ filters in the SIEM tool to identify replication failures. Configure an\
        \ alert in response to those logs that notifies administrators of the replication\
        \ failure that was logged. Failures must be followed up and resolved.\n\u2022\
        \ Retain replicated databases \n\nNote: If replication is not feasible, a\
        \ team must be able to achieve CCF-BCR-08.01."
      typical_evidence: '1. Provide screenshots of database replication configurations
        to secondary data centers

        2. Provide screenshots of retention configurations

        3. Provide screenshots of notification configurations for failures

        4. Provide population of failures, and sample failures, and obtain resolution
        of failure. Population of failures shall include details around parameters/query
        used to generate failure listing as well (and includes date and timestamp).


        Note: If replication is not feasible, a team must be able to achieve CCF-BCR-08.01.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-24
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 24
      name: Customer Data Backup
      description: Organizatin provides the specifications of its backup capabilities
        to its cloud service customers. Where applicable, the specifications include
        scope and schedule of backups, backup methods and data formats, encryption
        of backup data, retention periods for backup data, integrity verification
        of backup data, procedures and timescale of data restore, and location of
        backup data.
      annotation: "1.Document backup capabilities that cloud service customers can\
        \ use as a guidance to configure their own backups (if applicable) \n2. Verify\
        \ if specifications of platform/product backup capabilities are provided to\
        \ the cloud service customers.\n\u2022 Verify if following specifications\
        \ are provided to the cloud service customer as applicable:\n- Scope and schedule\
        \ of backups\n- Backup methods and data formats\n- Encryption of backup data\n\
        - Retention periods for backup data\n- Integrity verification of backup data\n\
        - Procedures and timescale of data restore\n- Location of backup data.\n3.\
        \ Validate via. a test customer instance to verify how customers can view\
        \ information around backup capabilities and configure backups in their own\
        \ instance."
      typical_evidence: "1. Backup capabilities document with evidence of below specifications\
        \ provided to the cloud service customer as applicable:\n\u2022 Scope and\
        \ schedule of backups\n\u2022 Backup methods and data formats\n\u2022 Encryption\
        \ of backup data\n\u2022 Retention periods for backup data\n\u2022 Integrity\
        \ verification of backup data\n\u2022 Procedures and timescale of data restore\n\
        \u2022 Location of backup data.\n\n2. Demo of a test customer instance, if\
        \ possible, to show how customers can view information around backup capabilities\
        \ an configure their own instance.\n\nSpanish ENS High - This control is deemed\
        \ good to have for Spanish ENS High, but not deemed mandatory if remaining\
        \ ENS controls are effective. If any remaining ENS controls are deficient,\
        \ these controls maybe scoped in as needed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-25
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 25
      name: Backup Location
      description: The organization backups are securely stored in an alternate location
        from source data.
      annotation: 1. Ensure backups are securely stored in an alternate/secondary
        location from source data
      typical_evidence: '1. Provide backup management policy/procedures

        2. Provide evidence showing secondary/alternate location is used/implemented
        for storing backups'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-26
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 26
      name: Email Backup
      description: The organization periodically backs up emails. Repeated failed
        backups are investigated and reviewed.
      annotation: '1. Ensure emails are periodically backed up

        2. Ensure alerts are configured to notify administrators if backup/replication
        fails or in case if backups are performed manually, a similar process is in
        place

        3. Ensure repeated failed backups are investigated and reviewed'
      typical_evidence: '1. Provide backup management policy/procedure

        2. Provide relevant organizational email security policy

        3. On a sample basis, provide screenshot showing successful email backups
        taken

        4. Provide screenshots or evidences to showcase alerts are configured to notify
        administrators if backup/replication fails

        5. Provide evidence showing appropriate actions taken on repeated failed backups'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-27
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:business-continuity-&-resilience
      ref_id: CCF 27
      name: Backup Storage
      description: Backups are stored offline or in a non-writable manner and are
        stored at a multiple geographically-dispersed locations.
      annotation: 1. Verify organization has implemented cryptographic mechanisms
        to protect the confidentiality and integrity of information stored on digital
        media during transport outside of controlled areas.
      typical_evidence: '1. Provide organization-defined types of information system
        media.

        2. Provide evidence of organization-defined security safeguards for the information
        systems'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      assessable: false
      depth: 1
      name: Change & Configuration Management
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-28
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 28
      name: SDLC Methodology
      description: A formal systems development life cycle (SDLC) methodology is in
        place that governs the development, acquisition, implementation, changes (including
        emergency changes), and maintenance of information systems and related technology
        requirements.
      annotation: "Develop and document a formal SDLC methodology. The SDLC methodology\
        \ minimally includes the following phases (or similar):\n\n1. Initiation\n\
        \n- Establish the need for system development or for changes to an existing\
        \ system\n- Begin security planning by identifying security roles and evaluating\
        \ security requirements.\n- Identify privacy requirements\n- Create a ticket\
        \ for SDLC tracking\n\n2. Development / Acquisition\n\n- Design and build\
        \ (or procure) the system\n- Conduct a risk assessment\n- Threat modeling\
        \ and design review\n- Develop security plans to address security and compliance\
        \ obligations\n- Register and operate build environments according to Build\
        \ Environment Security Guidelines \n\n3. Implementation\n\n- Configure and\
        \ enable system security features\n- Test security and functionality of the\
        \ system\n- Obtain a formal authorization to operate the system\n- Deploy\
        \ the system or system change\n\n4. Maintenance\n\n- Perform continuous monitoring\
        \ of the system\n- Perform vulnerability management of the system\n- Perform\
        \ configuration management activities\n\n5. Disposal\n\n- Archive system or\
        \ version information that may be required\n- Ensure proper disposal of sensitive\
        \ information that is no longer required for the system or solution\n\nStore\
        \ the documentation of the SLDC methodology in a corporate-approved, backed-up,\
        \ access-controlled storage repository.\n\nReview and update the methodology\
        \ at least annually. Track review and updates within a ticket"
      typical_evidence: "1. Provide the SDLC methodology document\n2. Provide a sample\
        \ SDLC tracking ticket\n3. Provide a sample methodology update ticket (i.e.\
        \ annual review evidence)\n4. Provide change history and previous review date\
        \ for timeliness.\n\nNIST 800-53 (Moderate & High) - The following attribute\
        \ should be validated for CCF-CCC-01.01: Offering develops, documents, and\
        \ implements a configuration management plan for the respective product\n\n\
        FedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-CCC-01.01: \n- BU is signing code packages/verifying integrity prior\
        \ to deployment into prod.\n- Engineers must practice best pracitces for coding\
        \ practices, and in their SDLC process, that includes input validation. Corporate\
        \ engineers should only be allowed to code/input into fields what is expected\
        \ (inut validation), and test this.\n\nSOC 2 (A/C/S) 2022 - The following\
        \ attribute should be validated for CCF-CCC-01.01: \n- as part of the SDLC,\
        \ ongoing/continuous controls should be adjusted for changes. Could also be\
        \ decided via policy or attribute. \n- Process to review and approve system\
        \ architecture changes"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-29
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 29
      name: Cloud Provider Change Monitoring
      description: Cloud Service Customers review and monitor changes made by the
        cloud service provider for appropriateness and any potential impact to the
        customer's instance.
      annotation: "1. Identify any cloud service provider accounts (vendor accounts\
        \ i.e. AWS, GCP, etc.) that have direct access to the production instance.\
        \ Validate that this account belongs to the vendor and no corporate developers\
        \ have access. \n2. Should a direct cloud service provider account exist,\
        \ run an audit log of all changes made by the service account. \n3. Review\
        \ all changes made by the service account for appropriateness. \n4. Document\
        \ all details of the review in a ticket, at least quarterly, with appropriate\
        \ screenshots of the audit log history pull (i.e. period of audit log, any\
        \ exclusions used, filters, etc.)\n5. Alternatively, changes can be reviewed\
        \ on an ad-hoc basis by creating an alert configuration every time a change\
        \ is pushed by the cloud service provider. Each change is reviewed for appropriateness.\n\
        6. Any inappropriate changes identified are immediately followed up with the\
        \ service provider and remediated. \n7. If a service provider account does\
        \ not exist, validate that  the service provider is unable to make direct\
        \ changes to the production instance.\n8. Review the service providers' third\
        \ party assurance report (SOC report) to validate the provider did not have\
        \ any deviations that may affect the production instances."
      typical_evidence: "1. Provide the ticket reviewing any changes made by service\
        \ providers. \n2. Provide the notification settings of any changes made by\
        \ service providers. \n3. Identify any inappropriate changes that were identified\
        \ and validate they were tracked and followed up on. \n\nSpanish ENS High\
        \ - This control is deemed good to have for Spanish ENS High, but not deemed\
        \ mandatory if remaining ENS controls are effective. If any remaining ENS\
        \ controls are deficient, these controls maybe scoped in as needed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-30
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 30
      name: Change Approval and Testing Documentation
      description: Changes to service and supporting infrastructure components of
        the service are authorized, formally documented, tested, reviewed, and approved
        prior to being implemented in the production environment.
      annotation: "1. Obtain Change management policy\n2. Obtain asset register and\
        \ identify list of changes performed for service and supporting infrastructure\n\
        3. Ensure that changes to software components of the service are documented\
        \ and follow the SDLC methodology including mandatory testing and review.\n\
        4. Segment non-production environments from production environments.\nPrevent\
        \ access to make changes to the production environment in accordance with\
        \ CCF-IAM-01.01 and CCF-IAM-02.04\n5. Leverage the configuration management\
        \ and infrastructure as code tools required by CCF-CCC-02.11 for the deployment\
        \ of the system or solution to make the required updates to the system. Updates\
        \ should not be made outside of these tools used in the change management\
        \ process in order to limit configuration drift.\n6. For sample changes, validate\
        \ if:\n\u2022 Change tickets were created\n\u2022 Sample changes are tested\
        \ prior to deployment in production. Only successfully tested changes should\
        \ be pushed to production.\n\u2022 Roll back strategies for sample changes\
        \ were established\n\u2022 Security impact analysis is performed for sample\
        \ changes\n\u2022 Appropriate approvals were obtained for sample changes at\
        \ various stages of change management process\n\u2022 Change process based\
        \ SLAs were met for all sampled changes"
      typical_evidence: "1. Provide Change management policy\n2. Provide asset register/assets\
        \ in production\n3. Provide sample change tickets that were created changes\
        \ to service and supporting infrastructure\n4. Validate if security impact\
        \ analysis is performed for sample changes\n5. Validate if appropriate approvals\
        \ were obtained for sample changes at various stages of change management\
        \ process\n6. Validate appropriate testing was performed prior to the change\
        \ being pushed to production. No failed testing changes should be pushed to\
        \ production.\n7. Validate sufficient Segregation of duties is maintained.\
        \ I.e. if developers have access to production to make direct changes, how\
        \ will in appropriate changes be identified (i.e. review process, settings,\
        \ etc.)?\n\nNOTE - IF DEVELOPERS HAVE DIRECT ACCESS TO MAKE CHANGES, CCC-04.02\
        \ must be tested to validate there is a review process of all changes to make\
        \ sure no inapporpriate changes were made directly to production.\n\nFedRAMP\
        \ Moderate & High - The following attribute should be validated for CCF-CCC-02.08:\
        \ \n- there needs to be an official committee for change control activities.\
        \ Security team must be a part of change board.\n- as part of testing a security\
        \ impact report must be conducted prior to the move to prod.\n- requires changes\
        \ to have a: \n a. Create and implement a security assessment plan;\n b. Perform\
        \ [Selection (one or more): unit; integration; system; regression] testing/evaluation\
        \ at [Assignment: organization-defined depth and coverage];\n c. Produce evidence\
        \ of the execution of the security assessment plan and the results of the\
        \ security testing/evaluation;\n d. Implement a verifiable flaw remediation\
        \ process; and\n e. Correct flaws identified during security testing/evaluation.\n\
        \nFedRAMP High - The following attribute should be validated for CCF-CCC-02.08:\
        \ an information security rep needs to be part of change review process. \n\
        \nSOC 2 (A/C/S) 2022 - The following attribute should be validated for CCF-CCC-02.08:\
        \ Changes to architecture' needs to be distinctly identified and assessed\
        \ prior to implementation."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-31
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 31
      name: System Change Communication
      description: System changes are communicated to authorized internal users via
        a ticketing system.
      annotation: "1. Obtain Change management policy\n2. Obtain asset register and\
        \ identify list of changes performed for service and supporting infrastructure\n\
        3. Identify authorized internal users that would be notified of System Changes\n\
        4. Identify channel(s) of formal communication/notification of System Changes\
        \ to the authorized internal users. If changes are tracked through ServiceNow,\
        \ those part of the change should be notified when the change gets pushed\
        \ to production. \n5. Validate if change request tickets were created and\
        \ appropriate internal stakeholders/ users are notified.\n6. Any major changes\
        \ are communicated as needed to larger/broader relevant groups as well."
      typical_evidence: '1. Provide Change management policy

        2. Scope/list of authorized internal users

        3. Provide sample change request tickets

        4. For sample change tickets, provide evidence that system changes were communicated
        to identified authorized internal users via. a ticketing system or any other
        formal channel of communication (must be documented)'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-32
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 32
      name: Processing Change Notification
      description: Customers are notified of critical changes that may affect their
        processing.
      annotation: '1. Obtain communication policy that includes notifying changes
        to customers

        2. Obtain asset register and identify list of critical changes performed for
        service and supporting infrastructure that may impact customer processes.

        3. Identify customers who will be notified of critical changes that may affect
        their processing

        4. Identify channel(s) of formal communication/notification of critical changes
        to customers. Channel can be via email, or public facing page, or alternative
        communication page that notifies customers of any critical change such as
        patches, updates to service, changes in location, etc. Critical changes can
        be categorized as any change that may affect the security, availability, confidentiality,
        and processing of the service.

        5. Validate if change request tickets were created and customers were notified
        of critical changes

        6. For sample critical changes, verify if customers were formally notified
        (i.e. Notification platform, Change notification emails, providing customer
        with access change ticketing system) prior to implementing changes.'
      typical_evidence: "1. Provide evidence of defined communication policy, and\
        \ how customers are notified of critical changes.\n2. Provide sample change\
        \ request tickets for critical changes and how they are communicated to customers.\
        \ \n4. For sample change tickets, provide evidence that System changes were\
        \ communicated to identified authorized internal users via. a ticketing system\
        \ or any other formal channel of communication (must be documented). An alternative\
        \ notification channel would be a public facing availability page, or news\
        \ page that notifies customers of major changes such as patches, updates to\
        \ service, change in location, etc."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-33
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 33
      name: System Configuration Management
      description: A configuration management system is in place to ensure that system
        configurations are deployed consistently throughout the production environment.
      annotation: "1. Security hardening and Baseline configuration standards should\
        \ be established\n2. Configuration of systems (systems can include AWS, Azure,\
        \ GCP, and more) should be configured with the baseline configuration\n3.\
        \ Configure required permissions for the configuration management server.\
        \ \n4. Configuration of Security Groups, NACLs, and virtual firewall appliances\
        \ should be in place.\n5. Configuration of VPC Firewall Rules and virtual\
        \ firewall appliances to allow traffic from the configuration management server\
        \ to the other system servers\n6. All production systems should be able to\
        \ demonstrate consistent system configurations via version control #, last\
        \ update date, settings, or other."
      typical_evidence: "1. Provide and obtain the configuration management system\
        \ in place, and how it is configured to monitor system configurations.\n2.\
        \ Provide evidence that system configurations are deployed consistently throughout\
        \ the production environments, this can be done via version control #, last\
        \ update date, or more. \n3. Obtain population of instances where there were\
        \ deviations and obtain evidence that configuration deviation is tracked and\
        \ remediated to completion. \n\nAgID (Critical) - The following attribute\
        \ should be validated for CCF-CCC-02.11: Firewall software must be installed\
        \ on all devices\n\nTX-RAMP Level 1 & 2 - The following attribute should be\
        \ validated for CCF-CCC-02.11: Review and update the current configuration\
        \ management:\n- Policy at least every 3 years and following significant changes\
        \ nd\n- Procedures annually and following significant changes\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-CCC-02.11:\
        \ at a minimum CIS Level 1 benchmarks are a starting point for baseline configuration."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-34
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 34
      name: Environment Identification
      description: Infrastructure components clearly display the environment that
        is being accessed (i.e. dev, test, prod).
      annotation: '1. Obtain policy and procedure for the labelling/display of environments
        and verify the requirement that infrastructure components must clearly display
        the environment that is being accessed.

        2. Verify that that Infrastructure components clearly display the environment
        that is being accessed (i.e. dev, test, prod).'
      typical_evidence: '1. Provide policy and procedure for the labelling/display
        of environments.

        2. Provide evidence that Infrastructure components clearly display the environment
        that is being accessed (i.e. dev, test, prod).'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-35
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 35
      name: Build Tools
      description: Utilize, securely configure, and integrate build tools for the
        development environment to improve executable security, information security,
        and risk mitigation.
      annotation: '1. Obtain policy and procedure and verify policy is in place requiring
        the use of securely configured tools in the development environment to mitigate
        identified risks.

        2. Verify that tools are used in the development environment for development
        projects based upon risk assessment results and security concerns.'
      typical_evidence: '1. Provide policy and procedure for utilizing tools in the
        development environment, including the use of tools to mitigate risks identified
        in devleopment.

        2. Provide a sample inventory of tools used during development.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-36
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 36
      name: File Integrity Monitoring
      description: A file integrity monitoring (FIM) tool is used to notify system
        administrators of potential unauthorized changes to the production system.
      annotation: '1. Verify that the file integrity monitoring (FIM) tool is implemented.
        File integrity monitoring (FIM) refers to an IT security process and technology
        that tests and checks operating system (OS), database, and application software
        files to determine whether or not they have been tampered with or corrupted.

        2. Define baseline configurations within the FIM tool and configure the rule
        engine of the tool to identify the variances in the configurations

        3. These baseline configuration can be maintained in an internal wiki or an
        procedural document that matches the rules defined in the file integrity monitoring
        (FIM) tool

        4. Validate that FIM tool is configured to notify system administrators of
        any potential unauthorized changes to the production system

        5. Verify sample notifications received by system administrators from FIM
        tool for appropriateness and accuracy

        6. Follow up on any unauthorized changes, and validate if they were appropriate,
        and root cause of change, and revert change if needed.'
      typical_evidence: "1. Provide the walkthrough of file integrity monitoring (FIM)\
        \ tool\n2. Provide process/procedure documented for file integrity monitoring\
        \ tool (FIM)\n3. Provide configuration of FIM tool that evidently shows that\
        \ system administrators will get notifications of potential unauthorized changes\
        \ to the production system\nExample - if there is an rule engine built into\
        \ the FIM tool that captures deviation in the configuration, the system administrators\
        \ should be notified of such deviation in configurations\n4. Provide the sample\
        \ notifications sent from FIM tool to system administrators of potential unauthorized\
        \ changes made to the production system \n5. Provide list of system administrators\
        \ that should be notified about such unauthorized changes\n6. Identify if\
        \ any inappropriate changes were made, and if they were followed up and reversed.\n\
        \nFedRAMP High - The following attribute should be validated for CCF-CCC-04.01:\
        \ that alert is created and resolved timely.\n\nFedRAMP Moderate & High -\
        \ The following attribute should be validated for CCF-CCC-04.01: \n- details\
        \ what response is done when unauthorized change is detected.\n- for Fedramp\
        \ workstations and servers and their operating systems need to protect its\
        \ memory from unauthorized code execution as well, and any discrepancies are\
        \ followed up upon.\n\nSpanish ENS High - This control is deemed good to have\
        \ for Spanish ENS High, but not deemed mandatory if remaining ENS controls\
        \ are effective. If any remaining ENS controls are deficient, these controls\
        \ maybe scoped in as needed."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-37
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 37
      name: Change Migrations
      description: Access to migrate changes to production is restricted to authorized
        personnel. All change migrations are tracked and notifications are sent when
        changes are migrated to production.
      annotation: '1. Identify personnel that require authorization to make changes
        to production as a part of their job function

        2. Required authorized personnel can include quality assurance, system/solution
        owners, and security personnel.

        3. Prevent access by all other personnel using the IAM features of the component
        tools (code repositories, automation servers, container registries, etc.).
        Developers should not have direct access to production.

        4. Configure the CI/CD pipeline so that new or changed code cannot be pushed
        to production without review and approval by a minimum number of additional
        authorized personnel

        5. Use a ticketing system such as Jira or ServiceNow to track the change request
        and record approval or the requested changes'
      typical_evidence: '1. Provide a list of personnel authorized to migrate changes
        to production

        2. Provide the IAM configuration details permitting authorized personnel and
        preventing unauthorized personnel

        3. Provide the screenshots of permissions of authorized personnel

        4. Provide point in time review of appropriateness of users, and validating
        that no users are developers with direct access to migrate changes.

        5. Provide screenshots of notification for all changes when migrated to production.

        6. Any inappropriate changes are followed up upon and reviewed.


        SOC 2 (A/C/S) 2022 - The following attribute should be validated for CCF-CCC-04.02:
        test for SOD.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-38
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 38
      name: Workstation Privileged Access
      description: Policies governing the appropriate use and installation of software
        on Company workstations are communicated and reviewed periodically. Revision
        histories and review periods are defined within the policies themselves and
        the organization Policy Governance Policy.
      annotation: "1. Obtain and review the documented policies governing the appropriate\
        \ use an installation of software on Company workstations to verify the whitelisting\
        \ / blacklisting an approval requirements\n\u2022 Check if policies governing\
        \ the appropriate use an installation of software on Company workstations\
        \ are approved an reviewed annually\n\u2022 Check if policies governing the\
        \ appropriate use an installation of software on Company workstations are\
        \ communicated to relevant stakeholders\n\n2. Configure workstation logs to\
        \ be forwarded to the SIEM solution. Configure alerts in the SIEM to identify\
        \ unauthorized software install on workstations. Configure the SIEM to notify\
        \ admins when unauthorized software installs are detected.\n\n3. Blacklisted\
        \ applications should not be able to be downloaded to company workstations.\
        \ If they are, a notification should be kicked off, followed up upon, and\
        \ reserved if deemed necessary. \n\n4. As part of the Code of Conduct, all\
        \ employees should acknowledge the prevention of downloading malicious software."
      typical_evidence: "1. Provide documented policies governing the appropriate\
        \ use an installation of software Company workstations\n2. Provide evidence\
        \ of communication of policies governing the appropriate use an installation\
        \ of software on Company workstations\n3. Provide evidence of annual review\
        \ being done for policies governing the appropriate use an installation of\
        \ software on Company workstations\n4. Attempt to download blacklisted applications,\
        \ and validate such applications cannot be downloaded.\n5. Screenshot of system\
        \ alert\n6. Other considerations:\n\u2022 Who has access to install software\
        \ on workstations?\n\u2022 Who owns admin of workstations ?\n\u2022 How is\
        \ install of software prevented an detected ?\n\nTX-RAMP Level 2 - The following\
        \ attribute should be validated for CCF-CCC-04.03: Review and update the list\
        \ of authorized software programs at least annually or when there is a change"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-39
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 39
      name: Version Control
      description: Version control procedures are set up to track dependencies of
        individual changes and to restore affected system components back to their
        previous state as a result of errors or identified vulnerabilities.
      annotation: '1. All changes made to production must have version control procedures
        that allow for reversal of changes, or the ability to restore affected system
        components back to their previous state as a result of any errors or identified
        vulnerabilities.

        2. Check if production instances are version controlled and all changes to
        production instances are documented.

        3. Verify if roll-back/restoration functionality is in place to restore affected
        system components back to their previous state.'
      typical_evidence: "1. Obtain a sample of changes pushed to production.\n2. Demonstrate\
        \ that changes can be rolled-back if needed.\n3. Obtain screenshot showing\
        \ production instances have versioning enabled.\n4. Provide documented version\
        \ history with key updates/changes for each product, and validate that previous\
        \ versions can be restored if needed.\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-CCC-04.04: there should be at least\
        \ 3 previous versions to roll back to that were retained. \n\nFedRAMP High\
        \ - The following attribute should be validated for CCF-CCC-04.04: any config\
        \ changes are automatically reverted if not appropriate.\n\nCCCS medium cloud\
        \ profile specific requirement:\nThere should be at least 2 previous versions\
        \ to roll back to that were retained."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-40
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 40
      name: Customer Data direct change
      description: The organization uses mechanisms to detect direct changes to the
        integrity of customer data and personal information; The organization takes
        action to resolve confirmed unauthorized changes to data.
      annotation: '1. Ensure there are mechanisms in place to detect direct changes
        to the integrity of customer data and personal information

        2. Ensure appropriate actions are taken to resolve confirmed unauthorized
        changes to data'
      typical_evidence: '1. Provide walkthrough of mechanism used to detect direct
        changes to integrity of customer data and personal information

        2. Provide relevant process documentations

        3. Provide evidence showing actions taken to resolve confirmed unauthorized
        changes to data'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-41
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 41
      name: Payment Page Tamper-Detection
      description: A change and tamper-detection mechanism is deployed to alert personnel
        to unauthorized modification (including indicators of compromise, changes,
        additions, and deletions) to the HTTP headers and the contents of payment
        pages as received by the consumer browser. The change and tamper-detection
        mechanism functions are performed at least once every seven days.
      annotation: '1. Verify that a change- and tamper- detection mechanism is in
        place from system settings, monitored payment pages, and results from monitoring
        activities.

        2. Ensure configuration settings are in place in accordance with all elements
        specified in this requirement.'
      typical_evidence: '1. Examine system settings, monitored payment pages, and
        results from monitoring activities to verify the use of a change- and tamper-
        detection mechanism.

        2. Examine configuration settings to verify the mechanism is configured in
        accordance with all elements specified in this requirement.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-42
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 42
      name: Utility Program Control
      description: Cloud service provider identifies the requirements for any utility
        programs used within the cloud service. Any utility programs used must follow
        the standard change process, and cannot be used to override any system controls.
        Any necessary utility programs that can override system controls must have
        access limited to authorized personnel, and all activity are reviewed for
        appropriateness on a monthly basis.
      annotation: '1. All Systemss shall identify any utility programs used by the
        cloud service. This can be programs related to memory management, antivirus,
        package installer, etc. that help execute functions that are critical for
        running an operating system/cloud service.

        2. All utility program use is documented and changes to the program must follow
        the standard change process. Such utility programs should not have access
        to production unless deemed necessary.

        3. Any utility programs with privileged access to modify the production instance
        shall have its activity reviewed on a monthly basis for appropriateness.'
      typical_evidence: '1. Validate the use of any utility programs from the Systems.

        2. Validate changes to the utility programs follow a change process of having
        approval and testing prior to any changes.

        3. Validate if any utility programs have access to production.

        4. If a utility program has direct access to production to modify, validate
        on a monthly basis changes are reviewed for appropriateness.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-43
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 43
      name: Mobile Code
      description: The use of mobile code is prohibited.
      annotation: '1. Mobile code are basically software programs or parts of programs
        obtained from remote information systems, transmitted across a network, and
        executed on a local information system without explicit installation or execution
        by the recipient

        2. Some examples of software technologies that provide the mechanisms for
        the production and use of mobile code include Java, JavaScript, ActiveX, VBScript,
        etc.

        3. Ensure that the use of such mobile code is prohibited since these mobile
        code can cause significant damage to the systems if used maliciously'
      typical_evidence: "1. Provide Mobile code use guidelines (if applicable)\n2.\
        \ Provide evidence that mobile code usage is prohibited\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-CCC-05.02:\
        \  \na. Defines acceptable and unacceptable mobile code and mobile code technologies;\n\
        \ b. Establishes usage restrictions and implementation guidance for acceptable\
        \ mobile code and mobile code technologies; and\n c. Authorizes, monitors,\
        \ and controls the use of mobile code within the information system.\n\nCCCS\
        \ medium cloud profile specific requirement:\na. Defines acceptable and unacceptable\
        \ mobile code and mobile code technologies;\nb. Establish usage restrictions\
        \ and implementation guidance for acceptable mobile code and mobile code technologies;\
        \ and\nc. Authorizes, monitors, and controls the use of mobile code within\
        \ the information system."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-44
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:change-&-configuration-management
      ref_id: CCF 44
      name: Static & Dynamic Code Analysis
      description: The offering performs static and dynamic code analysis during development
        of the system. Any issues identified are followed up, documented, and resolved
        in a timely manner.
      annotation: '1. Obtain updated and approved SDLC methodology document in place.

        2. Verify offerings performs static and dynamic code analysis during development
        of the systems on a periodic basis

        3. Obtain records of tickets raised for code analysis

        4. Ensure the offering tracks tickets raised for code analysis until closure
        and has a list of all the issues identified for code analysis

        5. Obtain documentation for resolution of all tickets. The tickets should
        be closed in a timely manner'
      typical_evidence: '1. Provide the SDLC methodology document to refer good practices
        related to static and dynamic code analysis during development

        2. Provide records of static and dynamic code analysis in the form of ticket
        (e.g. JIRA ticket)

        3. Provide evidence that issues identified during code analysis are resolved
        in a timely manner

        4. Provide a mechanism to track, document such requests (e.g. JIRA ticket)

        5. Provide change history and previous review date for timeliness.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      assessable: false
      depth: 1
      name: Physical Security
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-45
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 45
      name: Building Perimeter Physical Access
      description: Physical security measures are in place to restrict and monitor
        for unauthorized access to the buildings which house sensitive or critical
        information, information systems, or other network infrastructure. Confirmed
        incidents are documented and tracked to resolution.
      annotation: "1.  Worldwide Badging Policy and Restricted Access Authorization\
        \ policy should be established  to determine whether requirements for physical\
        \ access provisioning are defined.\n \n2.  Physical security system to determine\
        \ whether requests for physical access require management approval and required\
        \ documented specification of:\n\nAccount type: (visitor, vendor, or regular)\n\
        \nAccess privileges granted\n\nIntended business purpose\n\nVisitor identification\
        \ method, if applicable\n\nTemporary badge issued, if applicable\n\nAccess\
        \ start date\n\nAccess duration\n\n3. Physical access request documentation\
        \ need to be established for a selection of new physical access requests to\
        \ in-scope corporate owned data center and data rooms to determine whether\
        \ access is approved and included the required documentation, prior to the\
        \ access being provisioned.\n \n4. Physical access request documentation need\
        \ to be established for a selection of new physical access requests to in-scope\
        \ corporate colocation data centers to determine whether access is approved\
        \ and included the required documentation, prior to the access being provisioned.\n\
        \n5. Regular corporate offices require similar access documentation as well,\
        \ and evidence of badging, front desk sign in, and have access control measures\
        \ in place for the building. High risk areas should have elevated security\
        \ such as loading docks, mailroom, server rooms, and more."
      typical_evidence: "1. Provide the Worldwide Badging Policy and Restricted Access\
        \ Authorization policy\n2. Walkthrough all security measures such as camera\
        \ monitoring, front desk sign in, badging and more. \n3. Validate if there\
        \ have been any incidents during the period, and how the report of incidents\
        \ is generated (including time and date timestamp)\n4. Evidence of incident\
        \ documentation and resolution for any confirmed incidents.\n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-DCS-02.01: Inventory\
        \ [Assignment: organization-defined physical access devices] every [inventory\
        \ annually] and change combinations and keys annually \n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-DCS-02.01:\
        \ physical intrusion alarms and surveillance equipment are used.\n\nFedRAMP\
        \ High - The following attribute should be validated for CCF-DCS-02.01: physical\
        \ access is monitored for the facility and the info systems."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-46
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 46
      name: Building Fail-Safe Mechanisms
      description: The supply of the data centers (e. g. water, electricity, temperature
        and moisture control) is secured, monitored, maintained and tested at regular
        intervals. The data center has been designed with automatic fail-safe mechanisms
        and other redundancies. Maintenance is performed by authorized personnel at
        designated intervals and targets recommended by the suppliers. Maintenance
        records are stored for the agreed upon time intervals and then properly and
        permanently destroyed thereafter.
      annotation: '1. Organization''s Global Business Resiliency Program Policy and
        Physical and Environmental Security Standard should be established

        2. Backup Generators should be configured at organization corporate offices
        and owned data center and data rooms to determine whether they are employed
        to support critical systems in the event of a power disruption or failure.

        3. Temperature and humidity monitoring system should be configured at organization
        corporate offices and owned datacenter to determine whether appropriate thresholds
        are configured within the system. Additional failover mechanisms (such as
        fire safety and fire hydrant expiration checks) can be included as well if
        deemed necessary.

        4. Additional Failover mechanisms are reviewed, tested, and documented. Action
        items result in ticket creation and are tracked to completion.

        5. If maintenance activities are performed by suppliers or third-parties,
        maintenance activities are supervised with appropriate personnel and approved
        prior to authorization.'
      typical_evidence: "1.Provide the Global Business Resiliency (GBR) Program Policy\
        \ and Physical and Environmental Security Standard\n2. Provide evidence that\
        \ data centers and corporate offices are secured, monitored, maintained with\
        \ fail-over mechanisms. Observe how supply of utilities and other communication\
        \ is secured, maintained, and monitored.\n3. Obtain the most recent fail over\
        \ mechanism test, and obtain action items/tickets of issues identified.\n\
        4. Obtain and sample the tickets around issues identified and tracked to resolution.\n\
        \nNIST 800-53 (Moderate & High) - The following attribute should be validated\
        \ for CCF-DCS-02.02: Capability of shutting off power to the information system\
        \ components in emergency situations; and other redundancies. Maintenance\
        \ is performed by authorized personnel at designated intervals and targets\
        \ recommended by the suppliers\n\nNIST 800-53 (Low, Moderate, & High) - The\
        \ following attribute should be validated for CCF-DCS-02.02: \n- organization\
        \ employs and maintains automatic emergency lighting for the information system\
        \ that activates in the event of a power outage or disruption and that covers\
        \ emergency exits and evacuation routes within the facility.\n- The organization\
        \ employs and maintains fire suppression and detection devices/systems for\
        \ the information system that are supported by an independent energy source.\n\
        \nTX-RAMP Level 2 - The following attribute should be validated for CCF-DCS-02.02:\
        \ \n- include telecommunication redundencies or alternate telecom capabilities\
        \ \n- Provide the capability of shutting off power to [x] system components\
        \ in emergency situations. Place shutoff switches or devices in [x] location\
        \ to facilitate access for authorized personnel; and protect emergency power\
        \ shutoff capability from unauthorized activation.\n\nFedRAMP Moderate & High\
        \ - The following attribute should be validated for CCF-DCS-02.02: \n- tools\
        \ carried into facility are reviewed for improper or unauthorized modifications.\n\
        - maintenance support and spare parts are obtained by corporate within an\
        \ appropriate time of failure.\n- The organization employs temperature and\
        \ humidity monitoring that provides an alarm or notification of changes potentially\
        \ harmful to personnel or equipment.\n- Organization Provides:\n a. Provides\
        \ the capability of shutting off power to the information system or individual\
        \ system components in emergency situations;\n b. Places emergency shutoff\
        \ switches or devices in [Assignment: organization-defined location by information\
        \ system or system component] to facilitate safe and easy access for personnel;\
        \ and\n c. Protects emergency power shutoff capability from unauthorized activation."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-47
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 47
      name: Building Safeguards
      description: Environmental security measures and safeguards are in place to
        protect the premises or buildings that house sensitive or critical information
        against environmental threats or threats caused by humans.
      annotation: "1. Obtain a review the documented procedures in place for building\
        \ an implementing environmental security measures an safeguards\n2. Validate\
        \ that the environmental security measures and safeguards are in place by\
        \ performing walkthroughs and reviews of the premises or buildings storing\
        \ sensitive or critical information and ensure the following:\n\u2022 Perimeters\
        \ of an building or site containing information processing facilities should\
        \ be physically sound (i.e. there should be no gaps in the perimeter or areas\
        \ where an break-in could easily occur); the exterior roof, walls an flooring\
        \ of the site should be of solid construction an all external doors should\
        \ be suitably protected against unauthorized access with control mechanisms,\
        \ (e.g. bars, alarms, locks); doors and windows should be locked when unattended\
        \ an external protection should be considered for windows, particularly at\
        \ ground level.   \n\u2022 Physical barriers should, where applicable, be\
        \ built to prevent unauthorized physical access and environmental contamination.\
        \ \n\u2022 All fire doors on an security perimeter should be alarmed, monitored\
        \ and tested in conjunction with the walls to establish the required level\
        \ of resistance in accordance with suitable regional, national and\ninternational\
        \ standards; they should operate in accordance with the local fire code in\
        \ an failsafe manner. \n\u2022 Suitable intruder detection systems should\
        \ be installed to national, regional or international standards and regularly\
        \ tested to cover all external doors and accessible windows; unoccupied areas\
        \ should be alarmed at all times; cover should also be provided for other\
        \ areas, e.g. computer room or communications rooms. \n3. Verify that the\
        \  measures are implemented in accordance with the criticality of information,\
        \ wherein such measures can include backup electricity, fire detection & prevention\
        \ measures, backup servers, etc.\n\nAll other types of environmental threats\
        \ should be examined and security measures should be implemented as needed.\
        \ Environmental threats can include flood, earthquake, civil unrest, humidity\
        \ monitor, etc."
      typical_evidence: "1. Provide documented policies/procedures for building an\
        \ implementing environmental security measures an safeguards to protect the\
        \ premises or buildings\n2. Provide walkthrough of premises or buildings that\
        \ house sensitive or critical information\n3. Provide evidence of appropriate\
        \ implementation an review of environmental security measures an safeguards\
        \ to protect the premises or buildings that house sensitive or critical information\
        \ against environmental threats or threats caused by humans (i.e. political\
        \ riots, floods, earthquakes, etc.)\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-DCS-02.03: The organization provides\
        \ a short-term uninterruptible power supply to facilitate [Selection (one\
        \ or more): an orderly shutdown of the information system; transition of the\
        \ information system to long-term alternate power] in the event of a primary\
        \ power source loss.\n\nFedRAMP High - The following attribute should be validated\
        \ for CCF-DCS-02.03: \n- The organization provides a long-term alternate power\
        \ supply for the information system that is capable of maintaining minimally\
        \ required operational capability in the event of an extended loss of the\
        \ primary power source.\n- The organization employs and maintains automatic\
        \ emergency lighting for the information system that activates in the event\
        \ of a power outage or disruption and that covers emergency exits and evacuation\
        \ routes within the facility.\n- The organization employs and maintains fire\
        \ suppression and detection devices/systems for the information system that\
        \ are supported by an independent energy source.\n- The organization employs\
        \ fire suppression devices/systems for the information system that provide\
        \ automatic notification of any activation to Assignment: organization-defined\
        \ personnel or roles] and [Assignment: organization-defined emergency responders].\n\
        - The organization employs an automatic fire suppression capability for the\
        \ information system when the facility is not staffed on a continuous basis.\n\
        - The organization employs temperature and humidity monitoring that provides\
        \ an alarm or notification of changes potentially harmful to personnel or\
        \ equipment.\n- alternate work sites: ensure they are sufficiently secure\
        \ and follow the same regulations as primary sites\n\nFedRAMP High - The following\
        \ attribute should be validated for CCF-DCS-02.03: \n- The organization employs\
        \ fire detection devices/systems for the information system that activate\
        \ automatically and notify [Assignment: organization-defined personnel or\
        \ roles] and [Assignment: organization-defined emergency responders] in the\
        \ event of a fire.\n- The organization employs automated mechanisms to detect\
        \ the presence of water in the vicinity of the information system and alerts\
        \ [Assignment: organization-defined personnel or roles].\n- Organization positions\
        \ information system components within the facility to minimize potential\
        \ damage from [Assignment: organization-defined physical and environmental\
        \ hazards] and to minimize the opportunity for unauthorized access."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-48
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 48
      name: Cloud Provider Geographical Locations
      description: The cloud service provider informs cloud service customers of the
        geographical locations of the provider's organization and countries where
        the provider can store the customer data.
      annotation: "1. Obtain a list of all assets that customer information resides\
        \ on.\_\n2. Validate the geographical location of each asset. Depending on\
        \ the service used, this can be AWS, GCP, corporate Data Center locations,\
        \ or other. \n3. Verify with legal that the geographical locations and countries\
        \ that customer information is stored is appropriate and allowed.\n4. Provide\
        \ customers with details of the geographical locations that the customer information\
        \ resides in. This could be done through a web page, announcement, direct\
        \ customer requests, etc."
      typical_evidence: "1. Obtain the ticket or page that identifies all assets that\
        \ store customer data is identified and documented. \n2. Validate that geographical\
        \ locations of each asset is included.  \n3. Obtain guidance or documentation\
        \ showing where the customer data resides is legally appropriate in the geographic\
        \ location it is stored.\n4. Review the communication channel is up-to-date\
        \ and appropriately communicates geographic locations that customer data is\
        \ stored."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-49
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 49
      name: Building Perimeter Physical Access
      description: "Physical access provisioning to organization data centers requires\
        \ management approval and documented specification of:\n\u2022 account type\
        \ (e.g., standard, visitor, or supplier)\n\u2022 access privileges granted\n\
        \u2022 intended business purpose\n\u2022 visitor identification method, if\
        \ applicable\n\u2022 temporary badge issued, if applicable\n\u2022 access\
        \ start date\n\u2022 access duration (with end date)"
      annotation: "1. All physical access to organization data centers require management\
        \ approval and documentation.\n2. A ticket must be created to obtain organization\
        \ data center access, detailing the type of access needed (standard, visitor,\
        \ or supplier). Additionally, level of access privilege needed, intended business\
        \ purposes, access start date and access duration must be included.\n3. An\
        \ approval must be obtained by both the requestor's manager and data center\
        \ manager. Once approved, access can be provisioned to the requestor's badge\
        \ and/or separate badge.\n4. When accessing any data center, badge access\
        \ must be scanned, and visitor authentication must be validated before entering\
        \ the data center. \n5. An audit log must be retained showing each time the\
        \ use accessed the data center.\n6. Access must be automatically terminated\
        \ upon access duration expiration."
      typical_evidence: "1. Provide a list of personnel with access to organization\
        \ data centers.\n2. Obtain corresponding ticket and/or approval for data center\
        \ access.\n3. Validate data centers must have badge access to enter and any\
        \ other validation methods such as front desk personnel. \n4. Validate each\
        \ ticket includes details around access account type, privileges granted,\
        \ business purposes, start date, duration, approval.\n5. Validate access is\
        \ programmed to match ticket details (start date, duration, account type).\
        \ \n6. Validate access is automatically terminated upon duration expiry.\n\
        \nFedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-DCS-02.05:  \na. Develops, approves, and maintains a list of individuals\
        \ with authorized access to the facility where the information system resides;\n\
        \ b. Issues authorization credentials for facility access;\n c. Reviews the\
        \ access list detailing authorized facility access by individuals [Assignment:\
        \ organization-defined frequency]; and\n d. Removes individuals from the facility\
        \ access list when access is no longer required."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-50
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 50
      name: Building Perimeter Physical Access
      description: Physical access to premises and buildings related to cloud services
        that is no longer required in the event of a termination or role change is
        revoked. If applicable, temporary badges are returned prior to exiting facility.
      annotation: "1. Organization's Worldwide Badging Policy should exist and it\
        \ determine whether requirements for physical access de-provisioning are defined.\n\
        2. System configuration of the automated feed from the HR system to the badging\
        \ system should be determined  and configured to automatically revoke access\
        \ to the organization-owned data center when access is no longer required\
        \ as a result of a termination or role change.\n3. Documentation should be\
        \ maintained of physical access de-provisioning for a selection of terminated\
        \ full time or temporary employees, and role changes to determine whether\
        \ their physical access is removed in a timely manner.\n4. List of users with\
        \ active access to in-scope co-location data centers should be compare with\
        \ terminated employee listings from the examination period to determine that\
        \ no terminated contractors or employees retain physical access.\n \n5. Organization's\
        \ Physical Access Visitor Procedure should exist to determine whether the\
        \ requirement for temporary badges to be returned prior to exiting the facility\
        \ is defined. Visitor badges should be reconciled on a cadenced basis, to\
        \ validate all visitor badges are returned appropriately.\n\n6. Any access\
        \ not used for more than 2 months needs to be evaluated and withdrawn if needed."
      typical_evidence: '1. Please provide organization''s Worldwide Badging Policy

        2. Please provide the system configuration of the automated feed from the
        HR system to the badging system, and removal of access upon termination

        3. Please provide evidence of removal of badge access for sample of terminated
        employees.

        4. Reconcile temporary badges to the inventory of temporary badges to validate
        all temporary badges were accounted for and returned to existing facility
        appropriately.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-51
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 51
      name: Physical Access Review
      description: The organization performs physical access account reviews at least
        semi-annually; corrective action is taken where applicable.
      annotation: "1. Identify all organization data centers and organization office\
        \ sites\n2. For each data center, obtain a complete user access list, identifying\
        \ all users with access to the data center. Guest access, as well as access\
        \ to sensitive areas shall be identified.\n3. For those users identified,\
        \ a review of each users' access for appropriateness.\n4. Take screenshots\
        \ of the complete user access listing with any filters used for completeness\
        \ and accuracy purposes. \n5. Alternatively, physical access logs can be pulled,\
        \ and reviewed for any inappropriate access and/or incidents.\n5. Any access\
        \ deemed inappropriate, validate access was removed immediately. If needed,\
        \ perform additional validation over any inappropriate activities that may\
        \ have occurred by the inappropriate user.\n6. Perform this review on an at\
        \ least semi-annual (6 monthly) basis. \n7. Document 1-6 on a corresponding\
        \ ticket."
      typical_evidence: "1. Obtain the most recent Physical Access Control review.\n\
        2. Validate completeness and accuracy of the user listing by reviewing screenshots\
        \ and user logs attached.\n3. Identify any inappropriate users identified,\
        \ and validate their access was terminated. Review any inappropriate activity\
        \ that may have occurred by the inappropriate user, and remediate accordingly.\
        \ \n4. Obtain previous quarterly reviews and validate timeliness of the review.\
        \ \n\nTX-RAMP Level 1 & 2 - The following attribute should be validated for\
        \ CCF-DCS-02.07: Review physical access logs at least quarterly"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-52
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 52
      name: Physical Access Monitoring
      description: All Physical access is managed through monitoring, maintaining
        records, and escorting (for visitors). Access records (including visitor access
        records) to the facilities are kept for at least a year.
      annotation: '1. Obtain and review the documented policies/procedures in place
        for managing an provisioning visitor''s physical access

        2. Evaluate the security mechanisms implemented for secure visitor''s physical
        access provisioning including monitoring, maintaining records, temporary badge
        access, and escorting

        3. All visitor access should adhere to these security mechanisms and tested

        4. Verify that the visitor access records to the facilities are kept securely
        for at least an year

        5. Evaluate visitor access form for completeness used to maintain records
        while provisioning physical access to visitors'
      typical_evidence: "1. Provide documented policies/procedures for managing visitor's\
        \ physical access\n2. Obtain evidence of monitoring in place while provisioning\
        \ physical access to visitors\n3. Obtain evidence of escorting while allowing\
        \ physical access to visitors\n4. Provide records maintained for physical\
        \ access provided to visitors\n5. Obtain evidence of secure storage of visitor\
        \ access records\n\nFedRAMP Moderate & High - The following attribute should\
        \ be validated for CCF-DCS-02.08:\n- Implement procedures for the use of maintenance\
        \ personnel that lack appropriate security clearances or are not U.S. citizens,\
        \ that include the following requirements:\n    (1)   Maintenance personnel\
        \ who do not have needed access authorizations, clearances, or formal access\
        \ approvals are escorted and supervised during the performance of maintenance\
        \ and diagnostic activities on the information system by approved organizational\
        \ personnel who are fully cleared, have appropriate access authorizations,\
        \ and are technically qualified;\n   (2)   Prior to initiating maintenance\
        \ or diagnostic activities by personnel who do not have needed access authorizations,\
        \ clearances or formal access approvals, all volatile information storage\
        \ components within the information system are sanitized and all nonvolatile\
        \ storage media are removed or physically disconnected from the system and\
        \ secured; and\n- Develops and implements alternate security safeguards in\
        \ the event an information system component cannot be sanitized, removed,\
        \ or disconnected from the system.\n- Maintains physical access audit logs\
        \ for [Assignment: organization-defined entry/exit points]"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-53
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 53
      name: Surveillance Feed Data
      description: Surveillance feed data is retained for at least 3 months, unless
        otherwise restricted by the law.
      annotation: 1. Ensure surveillance feed data is retained for at least 3 months,
        unless otherwise restricted by the law
      typical_evidence: '1. Provide relevant documentation related to Electronic Surveillance
        policy/ CCTV surveillance

        2. Provide screenshot showing retention timelines of surveillance feed data'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-54
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 54
      name: Payment Card Data
      description: Devices that physically capture payment card data are inspected
        for evidence of tampering at least quarterly.
      annotation: 1. Inspect devices that physically capture payment card data on
        a quarterly basis to ensure devices are not tampered
      typical_evidence: '1. On a sample basis, inspect physical devices that capture
        payment card data to check devices are not tampered

        2. Provide evidence that physical devices are inspected on quarterly basis
        to ensure the devices are not tampered'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-55
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 55
      name: Cybersecurity Positions
      description: Any positions of cybersecurity functions in organization's Saudi
        data centers must be filled with qualified and suitable Saudi nationals.
      annotation: 1. Ensure all positions of cybersecurity functions in organization's
        Saudi data centers are filled with qualified and suitable Saudi nationals
        only
      typical_evidence: 1. Provide evidence such as national IDs/ passports of cybersecurity
        personnel working in Kingdom of Saudi Arabia to affirm their citizenship status
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-56
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 56
      name: Security Area Rules
      description: The cloud service provider defines activities and assets that may/shall/not/shall
        be used in every security area.
      annotation: '1. Obtain and observe policy and procedure documents detailing
        activities and assets that may/shall not/shall be used in every security area.

        2. Ensure security area rulesets for activities and assets are established/enforced
        in accordance with policy and procedure.'
      typical_evidence: 1. Provide policy and procedure documents detailing activities
        and assets that may/shall not/shall be used in every security area.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-57
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 57
      name: Wiring Scheme
      description: The cloud service provider establishes a wiring scheme and is reviewed
        on an annual basis.
      annotation: 1. Ensure a wiring scheme is established and reviewed on an annual
        basis.
      typical_evidence: '1. Provide the most recent wiring scheme documentation.

        2. Provide evidence of the wiring scheme''s most recent review.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-58
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 58
      name: Physical Security Officer
      description: The organization has a dedicated Physical Security Officer who
        is responsible for providing guidance and overseeing the organization's physical
        security program.
      annotation: '1. Ensure a Physical Security Officer has been formally appointed
        i.e. appointment letter, communication mail, organizational chart, any charter
        document(s) etc.

        2. Ensure roles and responsibilities of the Physical Security Officer have
        been formally documented, established and communicated to the Physical Security
        Officer which include providing guidance and overseeing the physical security
        program at organization.'
      typical_evidence: '1. Provide proof of appointment that may include i.e. appointment
        letter, communication mails, organizational chart, any charter document(s)
        etc.

        2. Provide governance roles and responsibility document highlighting roles
        and responsibilities of the Physical Security Officer.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-59
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 59
      name: Wiring Plan
      description: The organization documents and maintains a wiring plan.
      annotation: 1. Ensure a wiring plan is documented, and undergoes regular review/maintenance.
      typical_evidence: "1. Provide the most recent wiring plan documentation. \n\
        2. Provide evidence that the wiring plan is maintained and reviewed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-60
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 60
      name: Pending Equipment Protection
      description: The organization service providers maintains and implements documented
        procedures for the protection of pending equipment.
      annotation: "1. Ensure documented policies and procedures are in place for the\
        \ protection of pending equipment. \n2. Verify appropriate protection measures\
        \ and procedures are in place for pending equipment."
      typical_evidence: '1. Provide documented policies/procedures in place for the
        protection of pending equipment.

        2. Obtain evidence of appropriate protection measures in place for pending
        equipment.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-61
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 61
      name: Removal of Access
      description: Any physical access and logical user accounts that have not been
        used for two months after approval are automatically withdrawn or disabled.
        In addition, any user accounts that have been locked for more than six months
        are automatically revoked or terminated.
      annotation: "1. Obtain Identity & Access Management process an password management\
        \ policy\n2. Applications should be configured such that:  \n\u2022 User accounts\
        \ are disabled after they have not been used for an period of two months or\
        \ after an predefined number of failed login attempts\n\u2022 Locked user\
        \ accounts are automatically removed after six months after inactivity (i.e.\
        \ they stay locked for 6 months)"
      typical_evidence: "1. Obtain list of users who have not used access for more\
        \ than 2 months, and validate access has been terminated.\n2. Snapshots for\
        \ the following: \n\u2022 User accounts are disabled after they have not been\
        \ used for an period of two months or after an predefined number of failed\
        \ login attempts\n\u2022 Locked user accounts are automatically removed after\
        \ six months. \n\nFedRAMP Moderate & High - The following attribute should\
        \ be validated for CCF-DCS-02.17: identifiers not used for 35 days are revoked,\
        \ not the 2 months called out.  \n\nCCCS medium cloud profile specific requirement:\n\
        Any physical access and logical user accounts that have not been used for\
        \ three months after approval are automatically withdrawn or disabled."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-62
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 62
      name: Device and Hardware Transfer
      description: Devices and hardware may only be transferred to external premises
        after it has been approved by authorized committees or bodies at organization.
      annotation: '1. Obtain and review the documented procedures for transfer of
        assets such as devices, hardware, software or data or off-site removals

        2. Validate that the devices, hardware, software or data are transferred to
        external premises post obtaining approvals from the authorized committees
        or bodies of the cloud provider

        3. Verify that the assets are tagged an classified according to information
        classification scheme to ensure that the transfer takes place securely according
        to the type of the assets to be transferred

        4. Verify that the list of approvers to authorize device an hardware transfer
        is maintained and communicated to relevant personnel

        5. Validate that the list of authorized approvers is reviewed periodically,
        and only this list of authorized approvers can approve device, hardware, software,
        data transfers to external premises. An external premises can be categorized
        as any location outside of an organization controlled building and data center.'
      typical_evidence: "1. Provide documented policies/procedures in place for transfer\
        \ of assets\n2. Provide evidence of approvals obtained from authorized committees\
        \ or bodies of the cloud provider, prior to allowing the transfer of devices,\
        \ hardware, software or data to external premises\n3. Obtain evidence of appropriate\
        \ device tagging and classification on sample basis\n4. Provide list of approvers\
        \ authorized to allow device, hardware, software or data transfer to external\
        \ premises\n5. Obtain evidence of review performed on the list of authorized\
        \ `approvers\n6. List of authorized approvers\n\nFedRAMP Moderate & High -\
        \ The following attribute should be validated for CCF-DCS-04.01:\n (a)   Verifying\
        \ that there is no organizational information contained on the equipment;\
        \ \n (b)   Sanitizing or destroying the equipment;\n (c)   Retaining the equipment\
        \ within the facility; or\n (d)   Obtaining an exemption from [Assignment:\
        \ organization-defined personnel or roles] explicitly authorizing removal\
        \ of the equipment from the facility.\n- the organization maintains records\
        \ for everything entering and exiting the facility is maintained."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-63
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 63
      name: Asset Onboarding
      description: New assets to be installed into the secure premises are approved
        by authorized committees or bodies at organization.
      annotation: "1. Obtain and review documented procedures for asset onboarding\n\
        2. Validate that the approvals from authorized committees or bodies of the\
        \ cloud provider are taken prior to installation of new assets into the secure\
        \ premises and data centers. Assets needing approval include any new assets\
        \ that may affect the processing capabilities of organization, network, data\
        \ center equipment, cabling, any equipment with access to sensitive information,\
        \ etc. \n3. Verify that assets are tagged and classified as per the information\
        \ classification scheme to ensure secure onboarding of assets in accordance\
        \ with the type of asset\n4. Verify that the list of approvers to authorize\
        \ asset onboarding or installation is maintained and communicated to relevant\
        \ personnel\n5. Validate that the list of authorized approvers is reviewed\
        \ periodically\n6. Prior to putting into operation, a study will be made of\
        \ the following aspects:  \n\u2022   Processing needs. \n\u2022   Information\
        \ storage needs: during processing and during the retention period. \n\u2022\
        \   Communication needs.\n\u2022   Personnel needs: number and professional\
        \ qualifications. \n\u2022   Needs in terms of facilities and auxiliary resources.\n\
        7. The asset must be installed by an authorized personnel after approval.\
        \ The asset must be installed appropriately. After the asset is installed,\
        \ validate the asset is securely installed, and verify if there are any vulnerabilities\
        \ to the installed asset that need to be remediated. If needed, the vulnerability\
        \ will be addressed as part of the installation. Once installed, confirmation\
        \ of the installed asset is recorded."
      typical_evidence: '1. Provide documented policies/procedures in place for asset
        onboarding

        2. Provide evidence of approvals obtained from authorized committees or bodies
        of the cloud provider prior to installation of new assets into the secure
        premises. Obtain population of new assets (can be via system generated report
        with screenshot of parameters used to botain report) and select a sample of
        new assets and verify approval.

        3. Obtain evidence of asset tagging an classification

        4. Provide list of approvers authorized to allow installation of new assets
        into the secure premises

        5. Obtain evidence of review performed on the list by authorized approvers


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-DCS-04.02: baseline security checks must be done before any new asset
        gets added, and that baseline security checks are being done upon start, patch,
        booted, etc. Basically ensuring a minimum baseline security set is maintained
        for all hardware/server/environment.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-64
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 64
      name: Physical Access Device Change
      description: Only authorized staff have access to change/configure physical
        access devices and physical security measures (e.g. key card system).
      annotation: '1. Obtain list of personnel authorized to change/configure physical
        access devices and physical security measures (e.g. key card system, biometric
        system, etc.)

        2. Ensure that only authorized personnel can access and make changes/configure
        physical access devices and physical security measures'
      typical_evidence: 1. Provide list of personnel authorized to change/configure
        physical access devices and physical security measures (e.g. key card system,
        biometric system, etc.)
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-65
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 65
      name: Authorized Courier Use
      description: Devices and hardware are transported safely and securly via authorized
        couriers only. An authorized courier list is maintained and procedures on
        how sensitive devices and hardware shall be maintained.
      annotation: '1. Ensure authorized couriers are used to transfer hardware and
        devices in a secure and safe manner.

        2. Verify procedures are in place on how to maintain sensitive hardware and
        a list of authorized couriers.'
      typical_evidence: '1. Provide the list of the courier service providers.

        2. Provide documented procedure for maintaining sensitive hardware and a list
        of authorized courier service providers.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-66
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 66
      name: Asset Maintenance
      description: Policies and instructions with technical and organizational safeguards
        are documented, communicated and describe the maintenance (especially remote
        maintenance), deletion, updating and re-use of assets in information processing.
      annotation: '1. Asset maintenance policies with technical and organizational
        safeguards should exist.

        2. Asset management policy should have instructions to verify if asset maintenance
        safeguards are described (especially remote maintenance), deletion, updating
        an re-use of assets for information processing in outsourced premises or by
        external personnel.

        3. Assets should be appropriately sanitized and cleaned before deletion and/or
        re-use of an asset. In addition, asset updates and maintenance should follow
        a prescribed process detailed in the policy and standard.

        4. An audit log and/or inventory history of each asset should be maintained
        that tracks maintenance, deletion, updating, and re-use of assets, and the
        procedures taken for each asset.

        5. These policies and standards shall be reviewed annually.'
      typical_evidence: "1. Provide documented asset maintenance policies an instructions\
        \ with technical an organizational safeguards\n2. Provide evidence to demonstrate\
        \ the remote maintenance), deletion, updating an re-use of assets.\n3. Provide\
        \ evidence that the policy/standard has been followed by selecting samples\
        \ and validating assets were followed policy/standard of maintenance, deletion,\
        \ updating, and re-use of asset. \n\nNIST 800-53 (Moderate & High) - The following\
        \ attribute should be validated for CCF-DCS-05.01: The organization obtains\
        \ maintenance support and/or spare parts for [Assignment: organization-defined\
        \ information system components] within [Assignment: organization-defined\
        \ time period] of failure.\n\nTX-RAMP Level 1 & 2 - The following attribute\
        \ should be validated for CCF-DCS-05.01: Review and update the current maintenance:\n\
        \n1. Policy every three years and following significant changes and\n2. Procedures\
        \ annually and following significant changes \n\nTX-RAMP Level 2 - The following\
        \ attribute should be validated for CCF-DCS-05.01:\n- review of previously\
        \ approved system maintenance tools at least annually\n- Obtain maintenance\
        \ support and/or spare parts for system components within [time period] of\
        \ failure. (note that a specifc time period requirement is not required by\
        \ the framework).  \n\nFedRAMP Moderate & High - The following attribute should\
        \ be validated for CCF-DCS-05.01:\n a. Approves and monitors nonlocal maintenance\
        \ and diagnostic activities;\n b. Allows the use of nonlocal maintenance and\
        \ diagnostic tools only as consistent with organizational policy and documented\
        \ in the security plan for the information system;\n c. Employs strong authenticators\
        \ in the establishment of nonlocal maintenance and diagnostic sessions;\n\
        \ d. Maintains records for nonlocal maintenance and diagnostic activities;\
        \ and\n e. Terminates session and network connections when nonlocal maintenance\
        \ is completed.\n\nFedRAMP High - The following attribute should be validated\
        \ for CCF-DCS-05.01: \n- remote maintenance is done an info system with security\
        \ capabilities equally implemented on the system being serviced.\n- The organization\
        \ applies non-destructive sanitization techniques to portable storage devices\
        \ prior to connecting such devices to the information system under the certain\
        \ circumstances, and organization needs to come up with procedures for such\
        \ instances.\n\nFedRAMP Moderate & High - The following attribute should be\
        \ validated for CCF-DCS-05.01: we receive documentation and configurations\
        \ for purchased hardware and software such as COTS products as needed, if\
        \ not publically available."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-67
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:physical-security
      ref_id: CCF 67
      name: Safe and Secure Work Environment
      description: Policies and documentation are in place to establish a safe and
        secure work environment. These policies are reviewed at least annually and
        updated as necessary. Revision histories and review periods are defined within
        the policies themselves and the organization Policy Governance Policy.
      annotation: '1. Policy regarding the management approved safe and secure work
        environment should exist within organization.

        2. The safe and secure work environment policies an documentation are reviewed
        at least annually an updated as necessary or on any major changes

        3. Revision histories an review periods are defined within the safe and secure
        work environment policies an documentation

        4. Organization shall be able to demonstrate a safe and secure work environment
        that aligns with the policy and standard.'
      typical_evidence: '1. Provide policies an documentation in place to establish
        safe and secure work environment

        2. Provide evidence of annual review performed on safe and secure work environment
        policies an documentation

        3. Validate and observe the safe and secure work environment policies/standards
        have been adhered to in the office or where applicable.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      assessable: false
      depth: 1
      name: Data Security Management
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-68
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 68
      name: Customer Data Protection
      description: Data protection policies are in place to help ensure that confidential,
        personal and sensitive customer data is properly secured and restricted to
        authorized personnel. Included are policies of how Controlled Unclassified
        Information (CUI) data is handled.
      annotation: "1. If the business unit has been required to align with the organization\
        \ corporate data protection policy then a new policy does not need to be created.\
        \ Contact the organization privacy office to understand the requirements that\
        \ must be met to be onboarded into the corporate data classification process.\
        \ Implementation of the procedures, architectures, technologies, and strategies\
        \ that are necessary to meet the requirements of the corporate policy are\
        \ the responsibility of the business unit\n2. Ensure that yearly updates to\
        \ the organization corporate data protection policy are addressed\n3. If the\
        \ business unit has not been required to align with the organization corporate\
        \ data protection policy, then create and document a new data protection policy.\
        \ Creating the policy consists of the following steps, at a minimum:\n\n\u2022\
        \ Establish a data catalog\n\u2022 Conduct an impact assessment for each type\
        \ of data\n\u2022 Define and implement a data labeling strategy\n\u2022 Define\
        \ handling guidelines for each data type\n\u2022 Implement continuous monitoring\
        \ of data\n\u2022 Store the documented policy in a backed-up, access-controlled\
        \ location\n\u2022 Review and update the data protection policy annually\n\
        \u2022 Handling of CUI Data\n\n4. Validate each BU is following the appropriate\
        \ data protection policy, and appropriately securing data by testing different\
        \ types of data and validating it is secure. \n5. Access to customer data\
        \ must be restricted and cannot be used outside of production."
      typical_evidence: '1. Provide the data protection policy documentation

        2. Provide the most recent review of the policy, and previous review for timeliness.

        3. For each BU, validate that the BU is appropriately following the Data Protection
        Policy guidelines, and data is appropriately secured and restricted. Samples
        of data maybe selected to validate it is appropriately secure and restricted.


        FedRAMP High - The following attribute should be validated for CCF-DSP-01.01:
        must have a Data Loss Prevention tool in place (DLP) and that it prevents
        data from residing outside of boundary (i.e. packet filtering) and that its
        not just a policy control. Needs to be executed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-69
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 69
      name: Production Asset Inventory
      description: A formal inventory of production system assets is maintained, and
        any discrepancies are tracked and resolved.
      annotation: "Corporate Inventory (such as computers/data center equipment etc.)\n\
        \u2022 All inventory assets should be evaluated and documented on an annual\
        \ basis. One way of identifying production assets is:\n* Configure a vulnerability\
        \ scanner such as Qualys to perform inventory scans of the production system\n\
        \u2022 Store the inventory results within a configuration management database\
        \ (CMDB) software such as those offered by ServiceNow or SolarWinds\n\u2022\
        \ Update the inventory at least each time the vulnerability scans are performed\n\
        \u2022 Configure a ticketing system such as Jira or Service Now to track inventory\
        \ update activities\n\nProduction Instances (such as AWS/Azure):\n\u2022 Identify\
        \ all production instances and databases in production.\n* Configure AWS Systems\
        \ Manager Inventory or GCP Cloud Asset Inventory to dynamically capture inventory\
        \ details for AWS or GCP resources respectively. For other cloud providers,\
        \ if asset inventory exists, configure the cloud native inventory service\
        \ to dynamically capture inventory details for cloud resources\n\u2022 Configure\
        \ a ticketing system such as Jira or Service Now to track inventory update\
        \ activities"
      typical_evidence: "1. Provide the details of tools used to gather inventory\
        \ details\n2. Provide the tools used to store inventory details\n3. Provide\
        \ documentation of full inventory list.\n4. Provide a sample inventory update\
        \ ticket and review to validate all system assets are reviewed annually. \n\
        \nTX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-DSP-01.02:\
        \ Review and update the system component inventory quarterly\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-DSP-01.02:\
        \  \n- When managing multiple inventories ensure that they are not duplicating\
        \ any components and having components appear in multiple inventories. \n\
        - specific critcal assets are called out and inventoried as such.\n\nPCI -\
        \ The following attribute should be validated for CCF-DSP-01.02: \n- Need\
        \ to make sure card holder data inventory is actually documented and inventoried.\n\
        - Assets need to be tagged and documented.\n- Reconcile inventory annually\n\
        \nSOC 2 2022 - The following attribute should be validated for CCF-DSP-01.02:\
        \ Information assets include physical endpoint devices and systems, virtual\
        \ systems, data and data flows to be tested"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-70
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 70
      name: Cloud Asset Labeling
      description: The organization's assets are labelled in accordance with organization's
        standards, and have designated owners.
      annotation: '1. Identify any assets being used by the service/provider. This
        includes all assets in production and/or store customer information (AWS,
        Azure, etc.).

        2. Document the assets and their use/purpose accordingly in a ticket or page.
        Each asset is given a designated owner.

        3. Validate each asset is labelled, managed, and appropriately protected/secured
        according to the organization asset management standard and data protection
        policies.'
      typical_evidence: '1. Obtain the page and/or ticket identifying all cloud service
        production assets. This includes assets where the production instance sits
        and/or where customer information resides.

        2. Validate the asset listing is complete and accurate and labelled accordingly
        (i.e. what the asset is used for).

        3. Validate each asset has a designated owner, and is labelled according to
        organization''s standards.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-DSP-01.03: Organization prohibits the use of portable storage devices
        in organizational information systems when such devices have no identifiable
        owner.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-71
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 71
      name: Cloud Service Functionality
      description: The organization's cloud service provides customers with details
        around their service functionality, to allow customers the ability to classify
        and label the information and associated assets.
      annotation: "1. Publish a customer facing page or announcement page detailing\
        \ the services offered by the organization service. This page can additionally\
        \ include details such as what customer information is taken, types of cloud\
        \ service providers used and/or location (i.e. AWS, GCP, organization data\
        \ center), type of service that is provided. \n2. Validate this page is up-to-date\
        \ on an on-going basis, and update if there are any inaccuracies or major\
        \ changes that have occurred."
      typical_evidence: 1. Obtain the public facing page or announcement detailing
        the services offered by the organization service, information collected, and
        any additional details such as locations, etc. Look to make sure details of
        the service are provided to customer.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-72
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 72
      name: Data classification and treatment Criteria
      description: The organization's data classification criteria are reviewed, approved
        by management, and communicated to authorized personnel at least annually;
        the data security management determines the treatment of data according to
        its designated data classification level. Revision histories and review periods
        are defined within the documents themselves and the organization Policy Governance
        Policy.
      annotation: '1. A data classification and handling standard should exist. Organization
        data classification criteria are reviewed annually, and approved by management.

        2. The criteria should be communicated to authorized personnel, and used to
        determine the treatment of data classification policies and documentation

        3. Validate the policies and standards include the treatment of different
        types of data, such as customer data and/or PII, and how to classify them,
        and handle the data.'
      typical_evidence: "1. Provide documented policies and procedures in place for\
        \ data classification\n2. Provide evidence of annual review performed on data\
        \ classification policies an documentation\n3. Provide evidence of communication\
        \ of the data classification policies an documentation\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-DSP-01.06:\
        \ Organization uses FIPS-199 for data classification as part of their ssp\
        \ that covers:\n a. Categorizes information and the information system in\
        \ accordance with applicable federal laws, Executive Orders, directives, policies,\
        \ regulations, standards, and guidance;\n b. Documents the security categorization\
        \ results (including supporting rationale) in the security plan for the information\
        \ system; and\n c. Ensures that the security categorization decision is reviewed\
        \ and approved by the authorizing official or authorizing official designated\
        \ representative."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-73
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 73
      name: Sharing of Confidential Data
      description: Sharing organization confidential (non-public) data via messaging
        technologies (unless permitted by organization for sharing of such data i.e.
        webex), social media, and public websites is prohibited.
      annotation: 1. Ensure relevant mechanisms/controls are implemented to prohibit
        sharing organization confidential data via messaging technologies, social
        media, and public websites. Tools allowed by organization for sharing can
        be used if needed (i.e. Webex). A Non-Disclosure Agreement (NDA) must be obtained
        prior to any type of sharing occuring.
      typical_evidence: '1. Provide relevant code of conduct documentation


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-DSP-01.07: Organization has rules of behaviors specifically docuented/called
        out regarding social media restrictions.


        CCCS medium cloud profile specific requirement:

        Organization has rules of behaviors specifically docuented/called out regarding
        social media restrictions.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-74
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 74
      name: Cardholder Asset Inventory
      description: The organization's asset inventory includes in-scope cardholder
        related systems, devices, and media.
      annotation: 1. Obtain organization's asset inventory and ensure that the inventory
        includes all in-scope cardholder related systems, devices, and media
      typical_evidence: 1. Provide evidence showing asset inventory includes details
        about all in-scope card holder related systems, devices, and media
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-75
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 75
      name: Inventory of Wireless Access Points
      description: The organization maintains an inventory of authorized wireless
        access points including a documented business justification.
      annotation: 1. Obtain organization's asset inventory and ensure that authorized
        wireless access points are recorded along with a valid business justification
      typical_evidence: 1. Provide asset inventory for authorized wireless access
        points
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-76
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 76
      name: CUI Marking
      description: All assets and media (both physical and electronic) that handle
        CUI are marked accordingly. These assets and media are additionally appropriately
        handled, and securely stored (both electronically and physical storage)
      annotation: '1. Each Systems is responsible for identifying and documenting
        assets and media that handle CUI.

        2. Assets that handle CUI are protected, and securely handled and stored both
        electronically and physical storage via secure means of protection (encryption,
        etc.)

        3. Each asset shall also be marked accordingly via an asset register as handling
        CUI.

        4. The asset register shall be updated in at least annually.'
      typical_evidence: '1. Validate if the Systems has an asset register of all assets
        that handle CUI.

        2. Validate that such assets are appropriately protected via sufficient means.

        3. Validate the asset register is updated.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-77
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 77
      name: Asset Ownership
      description: Roles and responsibilities, as well as ownership of assets are
        defined and documented.
      annotation: '1. Ensure organization-defined personnel and roles are defined,
        including asset ownership.

        2. Verify all assets have owners, and policy/procedure is in place for asset
        ownership.

        3. Verify components and assets are reviewed at the organization defined frequency.'
      typical_evidence: '1. Provide organization-defined personnel or roles including
        asset ownership.

        2. Provide evidence all assets have owners

        3. Provide organization-defined frequency for review of the components'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-78
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 78
      name: Third-party and Bespoke Asset Inventory
      description: The organization's asset inventory includes bespoke and custom
        software, and third-party software components incorporated into bespoke and
        custom software to facilitate vulnerability and patch management.
      annotation: '1. Ensure that documentation is in place and personnel are educated
        on the requirement that an inventory of bespoke and custom software and third-party
        software components incorporated into bespoke and custom software is maintained,
        and that the inventory is used to identify and address vulnerabilities.

        2. Verify that software documentation, including for bespoke and custom software
        that integrates third-party software components, and compare it to the inventory
        to verify that the inventory includes the bespoke and custom software and
        third-party software components.'
      typical_evidence: '1. Examine documentation and interview personnel to verify
        that an inventory of bespoke and custom software and third-party software
        components incorporated into bespoke and custom software is maintained, and
        that the inventory is used to identify and address vulnerabilities.

        2. Examine software documentation, including for bespoke and custom software
        that integrates third-party software components, and compare it to the inventory
        to verify that the inventory includes the bespoke and custom software and
        third-party software components.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-79
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 79
      name: Customer Incident System
      description: A support system is used to manage customer issues including system
        information on failures, incidents, concerns, and other complaints.
      annotation: "1. Engage the BU support team and complete required onboarding\
        \ actions. This includes, but is not limited to:\n\u2022 Identifying a mechanism\
        \ or tool (ticketing system, etc.) to record all customer submitted issues\
        \ and requests (this can follow a corporate central support system or BU specific)\n\
        * Identifying BU specific support personnel for escalation or use corporate\
        \ support team to handle all issues and requests.\n* Identify how customer\
        \ tickets are assigned\n\u2022 Identifying urgency and importance classifications\
        \ for support to reference during triage\n* Follow up and resolve all customer\
        \ issues and requests in a timely manner with pre-defined SLA's in customer\
        \ MSA's or Corporate policy."
      typical_evidence: '1. Provide the support system used to handle customer requests.

        2. Test the system to validate all customer issues/requests are captured.

        3. Provide details of resolution once customer issues/requests are submitted
        and identification of issue/request owner.

        4. Obtain population of customer issues/requests.

        5. Sample test customer issues/requests and validate they were tracked to
        completion in a timely manner, and escalated if necessary.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-80
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 80
      name: Data Flow Diagram
      description: A data flow diagram is documented and maintained for data that
        processed (analyzed, stored or transmitted, etc.) within the services' applications
        and infrastructure network and systems. The data flow diagram is reviewed
        at least annually and any changes are updated in the diagram.
      annotation: "1. A data flow diagram shall be documented and reviewed on an annual\
        \ basis.\n2. The data flow diagram shall include a service infrastructure\
        \ diagram with details regarding where customer data is stored, and how it\
        \ is transmitted within the services' applications and infrastructure. \n\
        3. The diagram shall clearly articulate any 3rd party suppliers and services\
        \ used such as AWS, GCP, etc. The diagram, shall clearly label what is owned\
        \ and hosted by organization as well. \n4. If applicable, an abbreviated diagram\
        \ can be provided publicly to customers as well. \n5. As part of its annual\
        \ review, any changes are accurately reflected/updated to the diagram.\n6.\
        \ As part of the data flow diagram, the Systems should have network diagrams\
        \ that are available upon request per CSDL's requirement around CCF-IVS-13.01\
        \ - The Systems has network diagrams that are available to authorized personnel\
        \ upon request. Teams should work directly with the CSDL team with any questions\
        \ regarding this CSDL requirement."
      typical_evidence: "1. Obtain the data flow diagram of the service, and validate\
        \ the accuracy of the diagram.\n2. Validate the last review date and previous\
        \ review date to validate timeliness.\n3. Validate that the data flow diagram\
        \ is complete and accurate, and reflects the production environment and tools\
        \ accordingly. \n\nFedRAMP Moderate & High - The following attribute should\
        \ be validated for CCF-DSP-02.02: need boundary and security archtiecture\
        \ diagram that is updated annually or as part of a significant change."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-81
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 81
      name: Non-Production data
      description: Data classified as Customer Data and any Personal Data attributable
        to the customer is prohibited from being used or stored in non-production
        systems or environments. If Customer Data must be used for staging and research
        environments, customers shall be notified of such use, and such environments
        must be protected in accordance with applicable policies and standards for
        such data.
      annotation: "1. All production data (including customer data) is prohibited\
        \ from being used and/or stored in non-production systems and environments.\
        \ \n2. Production data (including customer data) cannot be used for testing\
        \ purposes or development purposes. \n\nNOTE - IF CUSTOMER DATA IS USED OUTSIDE\
        \ OF PRODUCTION, the following controls must be implemented in all instances\
        \ customer data exists: CCC-02.08, CCC-04.02, DSP-01.01, DSP-01.02, DSP-07.03,\
        \ CEK-03.02, GRM-01.02, GRM-02.03, IAM-01.01, IAM-02.02, IAM-02.06, IAM-02.04,\
        \ IAM-02.09, IVS-06.01, IVS-06.02, STA-05.04, TVM-01.01, TVM-02.01, TVM-02.02,\
        \ TVM-02.06, TVM-02.11, AIS-01.01, CCC-04.01, DCS-02.04, DSP-01.04, DSP-01.05,\
        \ IVS-13.02, PRV-01.01, PRV-01.02, TVM-02.05, TVM-02.07  for CCF Baseline"
      typical_evidence: "1. Haphazardly select production data (i.e. customer ID)\
        \ and query for it in non-production environments such as test environments\
        \ to validate production data does not reside in non-production systems or\
        \ environments. \n\nNOTE - IF CUSTOMER DATA IS USED OUTSIDE OF PRODUCTION,\
        \ the following controls must be implemented in all instances customer data\
        \ exists: CCC-02.08, CCC-04.02, DSP-01.01, DSP-01.02, DSP-07.03, CEK-03.02,\
        \ GRM-01.02, GRM-02.03, IAM-01.01, IAM-02.02, IAM-02.06, IAM-02.04, IAM-02.09,\
        \ IVS-06.01, IVS-06.02, STA-05.04, TVM-01.01, TVM-02.01, TVM-02.02, TVM-02.06,\
        \ TVM-02.11, AIS-01.01, CCC-04.01, DCS-02.04, DSP-01.04, DSP-01.05, IVS-13.02,\
        \ PRV-01.01, PRV-01.02, TVM-02.05, TVM-02.07  for CCF Baseline"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-82
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 82
      name: Data Transfer
      description: The organization only transfers Customer Personal Data to a country
        outside of the European Economic Area (EEA), if it was agreed upon as part
        of a Cloud Service Agreement with customers. All transfers and agreements
        must meet GDPR requirements.
      annotation: '1. Obtain the cloud service agreements signed with the customers

        2. Ensure that customer personal data is transferred outside EEA, only if
        it was agreed upon as part of a Cloud Service Agreement with customers

        3. Ensure all transfers and agreements meet GDPR requirements'
      typical_evidence: '1. Provide cloud service agreements signed with customers
        including GDPR clauses


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-83
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 83
      name: Company Retention and Disposal Policies
      description: Formal retention and disposal procedures are in place to guide
        the secure retention and disposal of Company data.
      annotation: "1. Obtain relevant policies and standards regarding retention and\
        \ disposal procedures of company data (i.e. Data Protection Policy/standard,\
        \ Media Handling, etc.).\n2. Validate the policies/standards include guidelines\
        \ and appropriate methods regarding the retention and disposal of company\
        \ data. \n3. Validate these policies and standards are reviewed on an annual\
        \ basis and a review history is included. \n4. Each service must adhere to\
        \ the formal retention and disposal procedures (such as appropriate deletion\
        \ of company data, retention/encryption requirements of data, etc.)."
      typical_evidence: '1. Obtain the relevant polices and standards regarding retention
        and disposal procedures of company data. Validate they were reviewed in a
        timely manner.

        2. Haphazardly select certain assets and validate the policy and standards
        are followed (i.e. shredders, etc.)'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-84
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 84
      name: Electronic Media Handling
      description: Electronic media containing confidential information is wiped in
        accordance with best practices.
      annotation: "1. Organization should adhere electronic media handling and disposal\
        \ Standard to determine whether requirements for destroying media containing\
        \ data had been established, as well as requirements for maintaining an log\
        \ of such activities.\n2. Ensure that the electronic media containing confidential\
        \ information is purged or destroyed in accordance with management approved\
        \ documentation an best practices. Ensure that the confidential information\
        \ within the media cannot be accessed again, and appropriately sanitized upon\
        \ destruction.\n3. Certification should be issued of destruction for each\
        \ device destroyed \n4. An inventory of all destroyed electronic media should\
        \ be maintained and updated regularly."
      typical_evidence: "1. Provide documented policies and procedures in place for\
        \ electronic media handling and disposal\n2. An asset register/inventory should\
        \ be obtained that includes a list of all electronic media destroyed.\n3.\
        \ Provide evidence certification of destruction for each device destroyed\
        \ or disposed, or evidence that the asset was appropriately destroyed.\n\n\
        FedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-DSP-07.02: The organization:\n a. Sanitizes [Assignment: organization-defined\
        \ information system media] prior to disposal, release out of organizational\
        \ control, or release for reuse using [Assignment: organization- defined sanitization\
        \ techniques and procedures] in accordance with applicable federal and organizational\
        \ standards and policies; and\n b. Employs sanitization mechanisms with the\
        \ strength and integrity commensurate with the security category or classification\
        \ of the information.\nc. The organization reviews, approves, tracks, documents,\
        \ and verifies media sanitization and disposal actions."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-85
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 85
      name: Customer data removal
      description: Customer data containing confidential and personal information
        is purged or removed from the application environment (including backups and
        data shared with other offers) upon customer request according to organization
        policy and/or contractual obligations.
      annotation: "1. Each service must provide a method or ticketing system for customers\
        \ to request for deletion of their account and information. \n2. Upon request\
        \ of deletion, the customer account and information is immediately purged\
        \ and deleted from databases and the production instances (AWS, GCP, etc.).\n\
        3. Once purged, a confirmation message or email is provided back to the customer\
        \ confirming the deletion of their account and information."
      typical_evidence: "1.Identify the repository or ticketing system with all customer\
        \ requests for deletion. \n2. Select a sample of customer deletion requests,\
        \ and query the production instance for the customer details (i.e. customer\
        \ ID, data, etc.) to validate the customer details were purged upon request.\n\
        3. Review tickets to validate communication was provided to customer confirming\
        \ deletion of their account and information."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-86
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 86
      name: Customer Retention and Disposal Policies
      description: Formal retention and disposal procedures are in place to guide
        the secure retention and disposal of customer and personal data.
      annotation: "1. Obtain relevant policies and standards regarding retention and\
        \ disposal procedures of customer data (i.e. Data Protection Policy/standard,\
        \ Media Handling, etc.).\n2. Validate the policies/standards include guidelines\
        \ and appropriate methods regarding the retention and disposal of customer\
        \ data. \n3. Validate these policies and standards are reviewed on an annual\
        \ basis and a review history is included. \n4. Each service must adhere to\
        \ the formal retention and disposal procedures (such as appropriate deletion\
        \ of customer data, retention/encryption requirements of customer data, etc.)."
      typical_evidence: "1. Obtain the relevant polices and standards regarding retention\
        \ and disposal procedures of customer data. Validate they were reviewed in\
        \ a timely manner.\n2. Haphazardly select certain assets and validate the\
        \ policy and standards are followed (i.e. encryption of customer data, termination\
        \ of customer data upon request, etc.)\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-DSP-07.04: FedRAMP requires offerings\
        \ to retain information in accordance with the applicable federal laws, Executive\
        \ Orders, directives, policies, regulations, and standards. In addition, the\
        \ offering should document  their customer specific retention requirements\
        \ they may have as well refer to NARA and FOIA for retention periods. \n\n\
        PCI - The following attribute should be validated for CCF-DSP-07.04: Data\
        \ Retention Scan - Quarterly Process"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-87
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 87
      name: SDN Procedures
      description: If the cloud service offers functions for software-defined networking
        (SDN), the service uses suitable SDN procedures to ensure the confidentiality
        of the cloud user data.
      annotation: "1. Validate whether or not the service uses any software-defined\
        \ networking (SDN) solutions.\n2. If an SDN is used, verify suitable SDN procedures\
        \ are defined and documented. SDN procedures should include steps to harden\
        \ the SDN system and ensure confidentiality of the cloud user data residing\
        \ within it. \n3. Validate the SDN procedures and instances include the encryption\
        \ of traffic, routing protocol security measures, authentication of endpoints\
        \ and secure tunneled traffic and access restrictions.\n4. The cloud service\
        \ provider validates the functionality of the SDN functions before providing\
        \ any new SDN features to its customers or existing SDN features. \n5. Any\
        \ SDN deficiencies or defects are assessed and corrected accordingly."
      typical_evidence: "1. Obtain production instances that are using SDN solutions.\n\
        2. Validate SDN protection procedures (i.e. encryption, routing measures,\
        \ authentication, etc.) exist and are in-place over these networking solutions.\
        \ \n3. Provide hardening requirements of SDN system, and validate they are\
        \ implemented."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-88
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 88
      name: Company Retention and Disposal Policies
      description: Hardcopy Materials containing confidential information are purged
        or destroyed in accordance with organization policy, such as cross-cutting,
        shredding, incinerating, pulpling, etc.
      annotation: '1. Organization should document a best practices with destroying
        hardcopy materials containing confidential information.

        2. Hardcopy material containing confidential information is purged or destroyed
        in accordance with management approved documentation an best practices, such
        as cross-cutting, shredding, incinerating, pulping, etc.

        3. Organization should share these best practices and make them available
        for organization employees to see. Communications can include emails, posting
        the practices in offices, reminders to employees, etc.'
      typical_evidence: '1. Provide documented policies and procedures in place for
        electronic media handling and disposal

        2. Obtain evidence or communications showing hard copy materials should be
        purged in a secure manner. Alternatively, evidence of mechanisms to securely
        dispose of hardcopy materials can be provided (i.e. designated recycle/trash
        bins)


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-89
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 89
      name: IPv6 support status
      description: The cloud service provider provides the cloud service customer
        with information on the IPv6 support status of the service provided by the
        cloud service provider.
      annotation: '1. The Systems shall use IPv6 to provide their service to cloud
        service customers.

        2. The Systems shall provide information of the IPv6 support status to their
        cloud service customers via a communication line (email, page, announcement
        site, etc.)'
      typical_evidence: 1. Validate the Systems provides its cloud service customers
        with information on the IPv6 support status of the service.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-90
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 90
      name: Service Storage and Processing
      description: Systems must store and process data (including technical data)
        within the European Union. Furthermore, the administration and supervision
        of the service must be carried out from the European Union as well.
      annotation: "1. The Systems must have their systems and databases reside in\
        \ the EU. \n2. Data must not be transferred out of the EU unless specific\
        \ guidance and approval has been obtained. \n3. The administration and supervision\
        \ of the service must be carried out from the European Union."
      typical_evidence: '1. Validate the Systems has systems and databases that reside
        in the EU to host and process customer data.

        2. Provide evidence the administration and supervision of the service is carried
        out from the EU.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-91
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 91
      name: Error Handling
      description: Any errors generated to customers must not include any sensitive
        customer information.
      annotation: '1. Verify organization connects to external networks or information
        systems only through managed interfaces consisting of boundary protection
        devices arranged in accordance with an organizational security architecture

        - routes internal communications traffic to external networks through authenticated
        proxy servers at managed interfaces.

        -prevents the unauthorized exfiltration of information across managed interfaces

        -protects the confidentiality and integrity of transmitted information.

        2. Ensure the offering employs boundary protection mechanisms to separate
        information system components supporting missions and/or business functions
        which limits unauthorized information flows among system components and also
        provides the opportunity to deploy greater levels of protection for selected
        components.'
      typical_evidence: 'Organization shall provide:

        1. Provide organization-defined internal communications trafficand organization-defined
        external networks

        2. Provide documentation for each exception to the traffic flow policy with
        a supporting mission/business need and the duration of that need

        3. Provide organization-defined frequency for traffic flow policy'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-92
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:data-security-management
      ref_id: CCF 92
      name: Sanitization Equipment
      description: The organization tests sanitization equipment and procedures at
        least semi-annually to verify that the intended sanitization is being achieved.
      annotation: '1. Verify that organization schedules, performs, documents, and
        reviews records of maintenance and repairs on information system components
        in accordance with manufacturer or vendor specifications and/or organizational
        requirements;

        2. Verify that organization approves and monitors all maintenance activities,
        whether performed on-site or remotely, and whether the equipment is serviced
        on-site or removed to another location

        3. Verify that organization requires that organization-defined personnel or
        roles explicitly approve the removal of the information system or system components
        from organizational facilities for off-site maintenance or repairs

        4. Verify organization sanitizes equipment to remove all information from
        associated media prior to removal from organizational facilities for off-site
        maintenance or repairs

        5. Check all potentially impacted security controls to verify that the controls
        are still functioning properly following maintenance or repair actions, and

        6. Verify organization-defined maintenance-related information are included
        in organizational maintenance records.'
      typical_evidence: '1. Provide organization policy and procedures relating to
        tests of sanitization equipment

        2. Provide list of organization-defined personnel or roles involved in sanitization
        equipment and procedures

        3. Provide organization-defined maintenance-related information and records


        FedRAMP Moderate & High - The following attribute should be validated for
        the new control: for moderate it is a 6 month frequency.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      assessable: false
      depth: 1
      name: Cryptography Management
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-93
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 93
      name: Cryptographic Key Custodians
      description: Cryptographic Key Custodians and Cryptographic Materials Custodians
        (CMC) acknowledge in writing or electronically that they understand and accept
        their cryptographic-key-custodian responsibilities.
      annotation: "1. All Cryptographic Key Custodians and Cryptographic Materials\
        \ Custodians must acknowledge in writing or electronically that they understand\
        \ and accept their cryptographic-key-custodian responsibilities. \n2. Acknowledgement\
        \ must be obtained upon hire if they are responsible, and at least on an annual\
        \ basis thereafter."
      typical_evidence: 1. Validate cryptographic Key Custodians and Cryptographic
        Materials Custodians have acknowledged in writing or electronically that they
        understand and accept their cryptographic-key-custodian responsibilities upon
        hire and at least annually thereafter.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-94
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 94
      name: Key Management
      description: 'Key management procedures are documented, reviewed at least annually,
        and define the following processes:

        -Prevent unauthorized substitution of cryptographic keys

        -Specify how to generate strong keys

        -Specify how to securely distribute keys

        -Requirements for cryptographic key changes for keys that have reached the
        end of their crypto period

        -Requirements for retirement or replacement (for example, archiving, destruction,
        and/or revocation) of keys as deemed necessary when the integrity of the key
        has been weakened

        -Store secret and private keys used to encrypt/decrypt data

        -Securely Store cryptographic keys in the fewest possible locations


        Revision histories and review periods are defined within the documents themselves
        and the organization Governance Policy.'
      annotation: "1. Use the CSP specific KMS (for e.g. AWS KMS) service to provide\
        \ key management capabilities where possible. If key management is required\
        \ to be performed by a third-party software that is fully controlled by the\
        \ business unit deploy and configure a software tool such as Hashicorp Vault\n\
        2. Limit access to key storage and generation mechanisms\n3. Configure logging\
        \ and ensure that key creation, editing, and deletion is captured via logs\
        \ and that alerts are configured to notify personnel of these actions so that\
        \ the validity of the action can be confirmed\n4. Develop a formal key management\
        \ policy / procedure that minimally includes:\n\n\u2022 Prevent unauthorized\
        \ substitution of cryptographic keys (Specify how to generate strong keys)\n\
        \u2022 Specify how to securely distribute keys\n\u2022 Requirements for cryptographic\
        \ key changes for keys that have reached the end of their crypto period\n\u2022\
        \ Requirements for retirement or replacement (for example, archiving, destruction,\
        \ and/or revocation) of keys as deemed necessary when the integrity of the\
        \ key has been weakened\n\u2022 Store secret and private keys used to encrypt/decrypt\
        \ data should follow CSDL requirements around CCF-CEK-04.01. Please refer\
        \ to CSDL requirements for this.\n\u2022 Securely store cryptographic keys\
        \ in the fewest possible locations\n\n5. Store the policy / procedure documentation\
        \ in an organization-approved, backed-up, and access-controlled storage location\n\
        6. Create a template in the ticketing system for annual reviews of the policy\
        \ and procedure\n7. Select a review date and enter a ticket to track review\
        \ activities to completion\n8. When needed teams should use an approved random\
        \ number generation (RNG) algorithm for all random numbers and other primitives\
        \ and parameters as part of CSDL's control around CCF-CEK-03.05-Cryptographic\
        \ key owners must formally acknowledge that they understand and accept their\
        \ key owner responsibilities upon hire and at least an annual basis thereafter.\
        \ Teams should work with CSDL team with any further questions around this\
        \ CSDL requirement.\n9. Teams should follow CSDL's method of storing secret\
        \ and private keys called out as part of CSDL requirement CCF-CEK-04.01 -\
        \ Store secret and private keys used to encrypt/decrypt data in one (or more)\
        \ of the following forms at all times: -Encrypted with a key-encrypting key\
        \ that is at least as strong as the data encrypting key, and that is stored\
        \ separately from the data-encrypting key -Within a secure cryptographic device\
        \ (such as a hardware (host) security module (HSM) or PTS-approved point-of-interaction\
        \ device) -As at least two full-length key components or key shares, in accordance\
        \ with an industry accepted method. Teams should work with CSDL team with\
        \ any further questions around this CSDL requirement."
      typical_evidence: '1. Provide the key management policy and procedure documents

        2. Provide screenshot of an annual review ticket


        AgID (Critical) - The following attribute should be validated for CCF-CEK-02.01:
        The cloud service supports a Bring Your Own Key (BYOK) encryption mechanism,
        which allows the Administration to generate autonomously, at least the main
        encryption key (root key), through a hosted HSM


        FedRAMP High - The following attribute should be validated for CCF-CEK-02.01:
        documentation/inventory of keys that are both active and inactive in the event
        that keys have been lost are included.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-95
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 95
      name: Public Key Certificates
      description: The Systems issues public key certificates under an approved certificate
        authority or obtains public key certificates from an approved service provider.
      annotation: '1. BU''s should only use public key certificates under an approved
        certificate authority.

        2. Examine the key management policy for lists of approved certificate authorities.

        3. SSL certificates can be obtained  from the S&TO-provided services, for
        both public and private PKI certificates.

        4. Certificate from the S&TO-provided service can be checked from the root
        CA

        5. Certificate should be approved from the approved service provider.'
      typical_evidence: "1. Provide the key management policy\n2. Provide a sample\
        \ certificate from the BU and validate that certificate is from the approved\
        \ service provider. \n\nTX-RAMP Level 2 - The following attribute should be\
        \ validated for CCF-CEK-02.02: \n- Implements a local cache of revocation\
        \ data to support path discovery and validation in case of inability to access\
        \ revocation information via the network\n- Include only approved trust anchors\
        \ in trust stores or certificate stores managed by the organization.\n\nFedRAMP\
        \ Moderate & High - The following attribute should be validated for CCF-CEK-02.02:\
        \ \n- the organization produces, controls, and dstributes asymmetric cryptographic\
        \ keys using approved PKI Class 3 certificates  prepositioned keying material;\
        \ approved PKI Class 3 or Class 4 certificates and hardware security tokens\
        \ that protect the user\u2019s private key].\n- BU will need to create a certificate\
        \ policy document on how we obtain certs. \n- DNSSEC using digital signatures\
        \ must be used, not only DNS.\n\nSpanish ENS High - This control is deemed\
        \ good to have for Spanish ENS High, but not deemed mandatory if remaining\
        \ ENS controls are effective. If any remaining ENS controls are deficient,\
        \ these controls maybe scoped in as needed."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-96
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 96
      name: Cryptography Use
      description: The organization communicates to its cloud service customers when
        cryptography is used to protect the customer data and provides information
        and cryptographic technologies to cloud service customers to use.
      annotation: "1. If an Systems uses cryptography to protect customer data, it\
        \ communicates what methods and technologies are used to their respective\
        \ customers. Communication can be high level, and does not need to include\
        \ exact cryptography configurations. \n2. If confidential/secure methods are\
        \ provided to customers, the communication shall be via a secure method (i.e.\
        \ in account inbox, account notification page, etc. that only customers can\
        \ access). Methods that are high level can be published externally if deemed\
        \ appropriate."
      typical_evidence: '1. Provide documented notification to be sent to cloud service
        customers when cryptography is used to protect customer data

        2. Provide evidence of communication provided to cloud service customers when
        cryptography is used to protect customer data'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-97
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 97
      name: Encrypted Media Devices
      description: Portable user endpoints are encrypted, and removable media are
        monitored when in use. For NIST, FedRAMP, and CMMC, portable and removable
        media devices are encrypted using FIPS 140-2 or FIPS 140-3 encryption method
        to protect data at rest, and in transit.
      annotation: '1. Procedures/Standards should be documented an maintained for
        the management of portable and removable media device

        2. Portable and removable media should not contain any confidential or secure
        data that can be accessed at a non-organization controlled endpoint. The ability
        to write to portable and removable media should be controlled.

        3. If write access is allowed, cryptographic techniques should be used  to
        protect data on portable an removable media

        4. Documented approvals should be fetched for usage of portable an removable
        media

        5. Portable and removable media devices are monitored when in use

        6. Evaluate controls in place to check that portable and removable media containing
        information is protected against unauthorized access, misuse or corruption
        during transportation.

        7.  For NIST, FedRAMP, and NIST 800-171, FIPS 140-2 encryption method is used
        to protect data at rest and in transit.'
      typical_evidence: "1. Provide documented policies and procedures in place for\
        \ the management of portable an removable media devices\n2. Provide evidence\
        \ that the ability to write to portable and removable media is managed and/or\
        \ disabled.\n3. Provide evidence of encryption applied when using portable\
        \ an removable media devices - Provide screenshot by accessing the contents\
        \ on the removable media from other device\n4.Provide the evidence to show\
        \ that the portable an removable media devices are monitored when in use\n\
        5. For NIST, FedRAMP, and NIST 800-171, FIPS 140-2 encryption method is used\
        \ to protect data at rest and in transit. \n\nFedRAMP Moderate & High - The\
        \ following attribute should be validated for CCF-CEK-03.01: any removable\
        \ media needs to have  FIPS 140-2 encryption method is used to protect data\
        \ at rest and in transit."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-98
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 98
      name: Cryptographic Algorithm and Methods, Secure Data Transmission Protocols,
        Encryption at Rest
      description: Approved cryptographic algorithms and methods are used for securing
        assets with confidential, personal, and sensitive data both at rest and in-transit
        over public networks. For NIST, FedRAMP, and NIST 800-171, FIPS 140-2 or FIPS
        140-3 Cryptography method is used to protect data at rest and in transit.
      annotation: "1. Organization Common Cryptography Modules (C3M) module should\
        \ be established or called out\n2. PKI Standard should be established and\
        \ reviewed on an annual basis as part of the module.\n3. Approved cryptographic\
        \ Algorithm or other industry accepted standards such as accredited National\
        \ Cryptological Center algorithms should be used in organization. Voice over\
        \ internet protocol (VoIP) shall be considered and encrypted as well.\n4.\
        \ Evidence of data at rest and in-transit are both protected and encrypted\
        \ should be readily available. \n5. Specific to NIST, FedRAMP, and NIST 800-171,\
        \ appropriate cryptographic methods are used such as FIPS 140-2 Cryptography\
        \ methods to protect data at rest and in transit. \n6. For data in transit,\
        \ TLS1.2 at a minimum should be used."
      typical_evidence: "1. Provide evidence that data at rest and in-transit are\
        \ both protected and encrypted via approved cryptographic algorithms and methods\
        \ over all networks and production databases.\n2. Validate that methods of\
        \ encryption come from organization Common Cryptography Modules, and vulnerable\
        \ algorithms are not used.\n3. Validate TLS1.2 at the minimum should be used.\n\
        \nFedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-CEK-03.02: \n- this extends to passwords and how passwords are encrypted/protected\
        \ at rest. What kind of encryption is used? Are they salted and hashed? Are\
        \ you using HSM, AWS Vault, etc. \n- offering needs to document the use of\
        \ SSL/TLS/HTTPS and FIPS modules in place\n- must be TLS 1.2 and above.\n\
        - BU's must define what information is protected at rest and the kind of encryption\
        \ that is in place to protect that information\n\nFedRAMP High - The following\
        \ attribute should be validated for CCF-CEK-03.02: includes info systems of\
        \ nonlocal maintenance and diagnostic coms as well."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-99
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 99
      name: Cryptographic Algorithm and Methods
      description: Access to the cryptographic keystores is limited to authorized
        personnel.
      annotation: '1. Key management procedure should be adhered

        2. For each service team, verify cryptographic keystores are stored in Vault
        or CyberArk.

        3. Process should be adhered for retirement or replacement (for example, archiving,
        destruction, and/or revocation) of keys when the integrity of the key has
        been weakened i.e. expiry, excess usage, compromise, unauthorized disclosure,
        employee termination etc.

        4. Process should be in place for key change/ rotation for keys that have
        reached the end of their crypto period

        5. Access controls should be implemented to restrict access to keys and key
        storage to authorized personnel only

        6. Periodic reviews performed for key records maintained by business unit/
        product team.

        7. Cryptographic Key Owners should follow CSDL requirements around CCF-CEK-01.01
        as well provided by the CSDL team. CCF-CEK-01.01 - Cryptographic key owners
        must formally acknowledge that they understand and accept their key owner
        responsibilities upon hire and at least an annual basis thereafter. Teams
        should work with CSDL team with any further questions on this requirement.'
      typical_evidence: '1. Provide Key management procedure

        2. Provide evidence of access control in place to restrict access to key stores

        3. Provide evidence of key change/rotation performed in the past 90 days.

        4. Provide evidence for reviews undertaken for key records including access
        granted by business unit/ product team.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-100
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 100
      name: Personal Account Number
      description: The organization restricts personal account number (PAN) data such
        that only the first six and last four digits are displayed; authorized users
        with a legitimate business need may be provided the full PAN.
      annotation: '1. Ensure personal account number (PAN) data is restricted/masked
        such that only the first six and last four digits are displayed

        2. Ensure full PAN is only provided to authorized users with a legitimate
        business need'
      typical_evidence: '1. Provide screenshot showing PAN data masked with only first
        six and last four digit displayed

        2. Provide list of users with whom full PAN details were shared

        3. Provide evidence showcasing full PAN details were only shared with authorized
        users with a legitimate business need'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-101
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 101
      name: Full Disk Encryption Access
      description: Where full disk encryption is used, logical access must be managed
        independently of operating system authentication; decryption keys must not
        be associated with user accounts.
      annotation: "1. Check if full disk encryption is implemented. If yes,\n \u2022\
        \ Ensure logical access is managed independently of operating system authentication\n\
        \ \u2022 Decryption keys must not be associated with the user accounts"
      typical_evidence: '1. Provide screenshot showing full disk encryption used and
        logical access being managed independently of operating system authentication

        2. Provide evidence showing decryption keys are not associated with user accounts'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-102
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 102
      name: Encryption Key
      description: "Storage of data encryption keys that encrypt or decrypt cardholder\
        \ data meet at least one of the following:\n\u2022 the key-encrypting key\
        \ is at least as strong as the data encrypting key and is stored separately\
        \ from the data encrypting key\n\u2022 stored within a secure cryptographic\
        \ device (such as a host security module (HSM) or\nPTS-approved point-of interaction\
        \ device)\n\u2022 keys are stored as at least two full-length key components\
        \ or key shares"
      annotation: "1. Ensure data encryption keys that encrypt or decrypt cardholder\
        \ data meet at least one of the following storage requirements:\n\u2022 the\
        \ key-encrypting key is at least as strong as the data encrypting key and\
        \ is stored separately from the data encrypting key\n\u2022 Data encryption\
        \ keys are stored within a secure cryptographic device (such as a host security\
        \ module (HSM) or PTS-approved point-of interaction device)\n\u2022 Data encryption\
        \ keys are stored as at least two full-length key components or key shares"
      typical_evidence: '1. Provide Key management procedure

        2. Provide evidence of adherence to PCI-DSS guidelines regarding storage of
        data encryption keys'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-103
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 103
      name: Compromised Cryptographic Keys
      description: Cryptographic keys, shared data encryption keys, and passwords
        are invalidated or changed when compromised, at the end of their defined lifecycle
        period, or upon termination/transfer of employees with access to the keys.
      annotation: 1. Ensure a formal process is followed for retirement or replacement
        (for example, archiving, destruction, and/or revocation) of keys and passwords
        when the integrity of the key or passwords have been weakened i.e. expiry,
        end of life, compromised, unauthorized disclosure, employee termination/transfer
        etc.
      typical_evidence: '1. Provide Key management procedure

        2. Provide details regarding the process of key and password archival/revocation
        process.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-104
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 104
      name: Clear-text Cryptographic Key Management
      description: If applicable, manual clear-text cryptographic key-management operations
        must be managed using split knowledge and dual control.
      annotation: '1. Key management procedure should be adhered.

        2. Ensure manual clear-text cryptographic key-management operations are managed
        using split knowledge and dual control.'
      typical_evidence: "1. Provide key management procedure \n2. Provide evidence\
        \ manual clear-text cryptographic key-management operations are managed using\
        \ split knowledge and dual control."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-105
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 105
      name: Random Number Generator
      description: All random numbers and other primitives and parameters used are
        generated using only approved random number generation (RNG) algorithms or
        libraries. RNG algorithms, libraries and other primitives must be chosen from
        industry standards.
      annotation: '1. Obtain details regarding the generation of random numbers, primitives,
        and parameters.

        2. Obtain snapshots of the algorithms or libraries used for generating random
        numbers and other primitives and parameters.

        3. Ensure all random numbers and other primitives and parameters used are
        generated using only approved random number generation (RNG) algorithms or
        libraries chosen from industry standards.'
      typical_evidence: '1. Provide details regarding the generation of random numbers,
        primitives, and parameters.

        2. Provide snapshots of the algorithms or libraries used for generating random
        numbers and other primitives and parameters.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-106
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 106
      name: Single Use Media
      description: Removable media used in the technical infrastructure or for IT
        administration tasks is dedicated to a single use.
      annotation: '1. Obtain organization''s removable media policy and validate it
        includes a requirement that removable media used in the technical infrastructure
        or for IT administration tasks is dedicated to a single use.

        2. Ensure the removable media policy is implemented and adhered to such that
        removable media used in the technical infrastructure or for IT administration
        tasks is dedicated to a single use.'
      typical_evidence: '1. Provide organization''s removable media policy.

        2. Provide evidence policy is implemented such that removable media used in
        the technical infrastructure or for IT administration tasks is dedicated to
        a single use.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-107
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 107
      name: Key Based Authentication
      description: The offering maintains a local list of revoked certification for
        any PKI/Key based authentication.
      annotation: 'For PKI-based authentication, organization:

        1. Validates certifications by constructing and verifying a certification
        path to an accepted trust anchor including checking certificate status information

        2. Enforces authorized access to the corresponding private key

        3. Maps the authenticated identity to the account of the individual or group,
        and

        4. Implements a local cache of revocation data to support path discovery and
        validation in case of an inability to access revocation information via the
        network.'
      typical_evidence: '1. Provide status information for certification [TSL/SSL,
        etc.] and their path

        2. Provide list of PKI/key based authentication certificates being used within
        the scope

        3. Provide evidence to support the revocation of such certifications (for
        those which have been revoked in the past)'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-108
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 108
      name: Cryptographic PAN Hashes
      description: Hashes used to render PAN unreadable are one-way keyed cryptographic
        hashes based on strong cryptography of the entire PAN.
      annotation: "1. Ensure doucmentation is in place about the hashing method used\
        \ to render PAN unreadable, including the vendor, type of system/process,\
        \ and the encryption algorithms (as applicable) to verify that the hashing\
        \ method results in keyed cryptographic hashes of the entire PAN, with associated\
        \ key management processes and procedures. \n2. Ensure documentation is in\
        \ place about the key management procedures and processes associated with\
        \ the keyed cryptographic hashes to verify keys are managed in accordance\
        \ with Requirements 3.6 and 3.7 of PCI v4.\n3. Verify data repositories are\
        \ configured to render PAN unreadable\n4. Ensure audit logs including payment\
        \ application logs render PAN unreadable."
      typical_evidence: '1. Examine documentation about the hashing method used to
        render PAN unreadable, including the vendor, type of system/process, and the
        encryption algorithms (as applicable) to verify that the hashing method results
        in keyed cryptographic hashes of the entire PAN, with associated key management
        processes and procedures.

        2. Examine documentation about the key management procedures and processes
        associated with the keyed cryptographic hashes to verify keys are managed
        in accordance with Requirements 3.6 and 3.7 of PCI v4.

        3. Examine data repositories to verify the PAN is rendered unreadable.

        4. Examine audit logs, including payment application logs, to verify the PAN
        is rendered unreadable.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-109
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 109
      name: Disk-Level Encryption
      description: If disk-level or partition-level encryption is used to render PAN
        unreadable, it is implemented only on removable electronic media.
      annotation: '1. Ensure policy is in place to ensure if disk-level or partition-level
        encryption is used to render PAN unreadable, it is implemented only as follows:
        On removable electronic media.

        2. Verify the system is configured according to vendor documentation and the
        result is that the disk or the partition is rendered unreadable.'
      typical_evidence: '1. Examine encryption processes to verify that, if disk-level
        or partition-level encryption is used to render PAN unreadable, it is implemented
        only as follows: On removable electronic media.

        2. Examine configurations and/or vendor documentation and observe encryption
        processes to verify the system is configured according to vendor documentation
        the result is that the disk or the partition is rendered unreadable.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-110
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 110
      name: Key Storage
      description: "Store secret and private keys used to encrypt/decrypt data in\
        \ one (or more) of the following forms at all times:\n -Encrypted with a key-encrypting\
        \ key that is at least as strong as the data encrypting key, and that is stored\
        \ separately from the data-encrypting key\n -Within a secure cryptographic\
        \ device (such as a hardware (host) security module (HSM) or PTS-approved\
        \ point-of-interaction device)\n -As at least two full-length key components\
        \ or key shares, in accordance with an industry accepted method"
      annotation: '1. Obtain and observe the key management procedure.

        2. Ensure secret and private keys are encrypted for storage with a key-encrypting
        key that is at least as strong as the data encrypting key, and that is stored
        separately from the data-encrypting key.

        3. Ensure secret and private keys are stored within a secure cryptographic
        device.

        4. Ensure secret and private keys are stored as at least two full-length key
        components or key shares (in accordance with an industry accepted method).'
      typical_evidence: "1. Provide key management procedure \n2. Provide evidence\
        \ secret and private keys are encrypted for storage with a key-encrypting\
        \ key that is at least as strong as the data encrypting key, and that is stored\
        \ separately from the data-encrypting key.\n3. Provide evidence secret and\
        \ private keys are stored within a secure cryptographic device.\n4. Provide\
        \ evidence secret and private keys are stored as at least two full-length\
        \ key components or key shares (in accordance with an industry accepted method)."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-111
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:cryptography-management
      ref_id: CCF 111
      name: Removable Media Policy
      description: A removable media usage policy is developed and implemented.
      annotation: '1. Ensure organization has a documented removable media usage policy
        in place

        2. Verify organization has evidence that the removable media usage policy
        is communicated to authorized personnel

        3. Verify organization has evidence that the removable media usage policy
        is approved and reviewed annually

        4. Ensure organization has evidence that version history is avalable for the
        removable media usage policy'
      typical_evidence: "1. Provide the documented removable media usage policy \n\
        2. Provide evidence that the removable media usage policy is communicated\
        \ to authorized personnel\n3. Validate that the removable media usage policy\
        \ is approved and reviewed annually\n4. Validate that proper version history\
        \ is avalable for the removable media usage policy"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      assessable: false
      depth: 1
      name: Governance, Risk and Compliance
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-112
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 112
      name: Network & System Hardening
      description: Network and system hardening standards are documented, implemented,
        and reviewed at least annually. These standards are deployed to all networks
        and production systems. Revision histories and review periods are defined
        within the documents themselves and the organization Policy Governance Policy.
      annotation: '1. Network Security Standard, Firewall, Router and Switch Configuration
        Standard need to be established and reviewed on an annual basis.

        2. Obtain evidence of the configuration of network and system components need
        to meet network and system and validate they meet the policies and standards
        of #1.

        3. Validate the standards are reviewed annually, and validate configurations
        of network and systems are appropriate as part of the annual review (i.e.
        if there is an update to the standard, the network and systems are updated
        accordingly as well).'
      typical_evidence: "1. Provide the Network Security Standard, Firewall, Router\
        \ and Switch Configuration Standard\n2. Provide Screenshot of network/hardening\
        \ checklists or methods used\n3. Provide Screenshot of a sample ticket with\
        \ review of the network and system hardening standards and approval\n4. Obtain\
        \ the previous review and validate the current review was performed timely.\n\
        5. Validate production systems have reviewed and tried to include the network/system\
        \ hardening standards. \n\nTX-RAMP Level 1 & 2 - The following attribute should\
        \ be validated for CCF-GRM-01.02: Review and update the current system and\
        \ information integrity:\n\n1. Policy every three years and following significant\
        \ changes and\n2. Procedures annually and following significant changes \n\
        \nFedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-GRM-01.02: at a minimum CIS Level 1 benchmarks are a starting point\
        \ for the configuration."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-113
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 113
      name: Security Gateways
      description: Network perimeter is controlled by security gateways. For cross-network
        access, the access authorization is based on security requirements of the
        cloud customers.
      annotation: '1. Identify security mechanisms, service levels and management
        requirements of all network services and include in network services agreements,
        whether these services are provided in-house or outsourced. The organization
        network perimeter should be controlled by specific security gateways.

        2.  Network perimeter controls are implemented and ensure defined process
        is followed to satisfy the security requirements of customers

        3.  Cross-network access should be granted to authorized personnel which is
        based on security requirements of the cloud customers

        4. Evaluate the list of authorized personnel having access to the cross-network'
      typical_evidence: "1. Provide process defined for validating the network perimeter\
        \ within the environment\n2. Obtain the list of authorized personnel having\
        \ access to the cross-network\n3. Provide network service agreement which\
        \ includes security mechanisms, service levels and management requirements\
        \ of all network services\n\nFedRAMP Moderate & High - The following attribute\
        \ should be validated for CCF-GRM-01.03: \n- Define access control list within\
        \ application firewall (i.e. how access to our firewall is done, AND how our\
        \ firewall and network regulates access to our systems to only specific addresses)\
        \  I.e. we should detail how we regulate right traffic into our network/application.\
        \ \n- Organization prohibits the direct connection of secure device with classified\
        \ information to external information systems.\n- exceptions to trafflic flow\
        \ policy must be documented with justification and rationale.\n\nFedRAMP High\
        \ - The following attribute should be validated for CCF-GRM-01.03: BU to be\
        \ able to detect unauthorized network services and provide alerts if/when\
        \ these are discovered."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-114
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 114
      name: Virtual Private Network Hardware
      description: When applicable, hardware devices are used for the establishment
        and use of virtual private networks.
      annotation: '1. If allowable, Hardware devices will preferably be used in the
        establishment and use of the virtual private network.

        2. If Hardware devices were not used, a documented rationale should be documented.'
      typical_evidence: '1. Validate when virtual private networks are used, hardware
        devices are used for the establishment of the network. If not, obtain an understanding
        as to why hardware devices were not used.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-GRM-01.04: different subnets and VPC''s are utilized to separate system
        components and security tools.


        CCCS medium cloud profile specific requirement:

        Different subnets and VPC''s are utilized to separate system components and
        security tools.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-115
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 115
      name: Security Management System Risk Assessment Methodology
      description: A documented Information Security Management System Risk Assessment
        Methodology is in place that includes guidance on the identification of potential
        threats, rating the significance of the risks associated with the identified
        threats, and mitigation strategies for those risks, documentation and communication
        of those risks, as well as possible vulnerabilities within the cloud service
        provider and their impacts. Upper management, or its designated representative(s),
        owns this methodology and is responsible for its adherence.
      annotation: '1. Risk management standard should be established and reviewed
        annually

        2. Risk Management Standard should contain the guidance on the identification
        of potential threats, rating the significance of the risks associated with
        the identified threats, and mitigation strategies for those risks, documentation
        and communication of those risks, as well as possible vulnerabilities within
        the cloud service provider'
      typical_evidence: "1. Provide the Risk assessment Methodology Document\n2. Validate\
        \ the Risk assessment methodology is reviewed annually and updated accordingly.\
        \ \n\nTX-RAMP Level 1 & 2 - The following attribute should be validated for\
        \ CCF-GRM-02.01: Review and update the current assessment, authorization,\
        \ monitoring, as well as the risk assessment:\n1. Policy every 3 years and\
        \ following significant changes and\n2. Procedures annually  and following\
        \ significant changes\n\nUpdate the risk assessment at least every 3 years\n\
        \nFedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-GRM-02.01: The following events are included in audit logs - \nsuccessful\
        \ and unsuccessful account logon events, account management events, object\
        \ access, policy change, privilege functions, process tracking, and system\
        \ events. For Web applications: all administrator activity, authentication\
        \ checks, authorization checks, data deletions, data access, data changes,\
        \ and permission changes\n\nSOC 2 (A/C/S) 2022 - The following attribute should\
        \ be validated for CCF-GRM-02.01: \n- risk tolerance is considered relative\
        \ to objectives\n- financial reporting objectives align with accounting standards\n\
        - materiality considered in financial statement presentation\n- External reporting\
        \ reflects the underlying transactions and events to show qualitative characteristics\
        \ and assertions.\n- External nonfinancial reporting complies with external\
        \ frameworks & considers the level of precision required\n- External reporting\
        \ reflects the underlying transactions and events within a range of acceptable\
        \ limits.\n- Internal reporting objectives reflect management's choices &\
        \ consider level of precision required \n- Internal reporting reflects entity\
        \ activities\n- Tolerance for risk is considered relative to achieving operations\
        \ objectives. Sub-objectives should be established to support objectives\n\
        - Ensure policy around risk assessment/identification addressess internal\
        \ and external factors\n- analyze threats and vulnerabilities from vendors\n\
        - insurance is considered as a mitigation strategy for certain risks\n- Management\
        \ considers control activities at various levels in the entity.\n- GCC to\
        \ perform a RA for all BU's to cover the entire POF (if possible). Cover and\
        \ include in our testing the Enterprise IT-level risk management that is including\
        \ the assessment of risks and mitigation activities. \n- Management understands\
        \ and determines the dependency and linkage between business processes, automated\
        \ control activities, and technology general controls. Could be addressed\
        \ via small policy change, etc."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-116
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 116
      name: Security Readiness Plan
      description: The Systems specifies its objectives in its annual risk assessment
        and any existing Security Readiness Plan (SRP) to enable the identification
        and assessment of risks related to the objectives and any deviations or exceptions.
        The risk assessment and SRP are reviewed periodically.
      annotation: '1. Obtain the most recent risk assessment and Security Readiness
        Plan.

        2. Ensure the risk assessment and Security Readiness Plan are reviewed at
        least annually and updated as necessary.'
      typical_evidence: '1. Provide the most recent risk assessment and Security Readiness
        Plan (SRP).

        2. Provide artefacts demonstrating periodic review of the risk assessment
        and SRP.


        SOC 2 (A/C/S) 2022 - The following attribute should be validated for CCF-GRM-02.02:
        management choices are reflected in objectives'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-117
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 117
      name: Risk Assessments and Mitigation Strategy
      description: Risk assessments are performed at least annually. As part of this
        process, threats and changes (environmental, regulatory, and technological)
        to service commitments are identified and the risks are formally assessed.
        The risk assessment includes risk mitigation strategies and acceptance levels
        based on organization risk criteria. The risk assessment includes a consideration
        of the potential for fraud and how fraud may impact the achievement of objectives.
        The results of the risk assessment are reviewed by leadership at least annually.
      annotation: "1. Organization's Technology Risk Management Standard should exist\
        \ and the following requirements should be defined and followed.\n\u2022 Annual\
        \ risk assessment performed by management\n\u2022 Risk assessment results\
        \ review\n\u2022 Prioritized mitigation of identified risks\n\u2022 The annual\
        \ risk assessment includes consideration of the potential for fraud, and performs\
        \ a fraud risk assessment as well. \n2. Management and/or each BU execute\
        \ and review the risk assessment activities annually.\n3. Any identified issues\
        \ will have a corresponding risk treatment plan or corrective action plan\
        \ should be in place. Each issue needs to be tracked to completion.\n4. Risk\
        \ assessments should consider any risks associated with running customer supplied\
        \ software within the cloud services offered by the service provider/BU."
      typical_evidence: "1. Provide the Risk Management Standard\n2. Obtain the most\
        \ recent risk assessment performed, and provide the population of identified\
        \ deficiencies, discovered as a result of Risk Assessment. \n3. Obtain evidence\
        \ of a fraud risk assessment as part of the annual risk assessment. \n4. Please\
        \ provide corrective action plan for a sample of identified deficiencies and\
        \ remediation completion.\n5. Validate the appropriate personnel and teams\
        \ are involved and review the risk assessments on an annual basis (BU/BE teams,\
        \ Strategy, Execution teams, etc.)\n6. Risk assessments should consider any\
        \ risks associated with running customer supplied software within the cloud\
        \ services offered by the service provider/BU. \n\nTX-RAMP Level 1 & 2 - The\
        \ following attribute should be validated for CCF-GRM-02.03: \n- Update existing\
        \ plan of action and milestones at least quarterly\n- Review and update position\
        \ risk designations at least every three years.\n\nSOC 2 (A/C/S) 2022 - The\
        \ following attribute should be validated for CCF-GRM-02.03: \n- consider\
        \ risks resulting from incentives and pressures, opportunities, attitudes\
        \ and rationalizations\n- consider risks resulting from changes in the business\
        \ model, changes in leadership, and from changes in vendor and business partner\
        \ relationships\n\nPCI - The following attribute should be validated for CCF-GRM-02.03:\
        \ review and perform RA annually"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-118
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 118
      name: Risk Assessments and Mitigation Strategy
      description: As part of their risk assessment, cloud service providers review
        the risks associated with customer supplied software within the cloud services
        offered by the provider.
      annotation: "1. As part of the annual risk assessment, cloud service providers/Systemss\
        \ shall evaluate the risks associated with customer supplied software within\
        \ the cloud service Systems provided by the provider. This can include any\
        \ additional add-on's/software the customer installs/adds to their instance\
        \ within the cloud service provider's service.\n2. The cloud service provider\
        \ shall evaluate any potential security impact that these add-ons may have\
        \ on the instance, and whether or not there are any new security risks that\
        \ are introduced. \n3. All risks/action items that come from the risk assessment\
        \ are followed up upon, and tracked to completion in a timely manner."
      typical_evidence: '1. Validate that cloud service providers reviewed the risks
        associated with customer supplied software within the cloud services offered
        by the provider on an annual basis as part of the risk assessment. Validate
        the assessment was performed timely (i.e. annual).

        2. Validate all action items are followed up upon and resolved in a timely
        manner.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-119
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 119
      name: Shared Data Types
      description: As part of their risk assessment, organization determines the data
        types that can be shared with a managed service provider.
      annotation: '1. Ensure risk assessment process is established, documented and
        followed

        2. Determine data types that can be shared with a managed service provider

        3.  Obtain data risk assessment report'
      typical_evidence: '1. Provide documentation regarding risk assessment process
        followed within organization

        2. Provide evidence of data types shared with a managed service provider

        3. Provide data risk assessment report'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-120
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 120
      name: Roles and Responsibilities over Security and Control Environment
      description: Management has established defined roles and responsibilities to
        oversee the implementation of the security and control environment.
      annotation: "1. A defined team at organization should be defined an responsible\
        \ for overseeing the security an control environment at organization. This\
        \ can be the S&TO team as well as other teams involved in internal audit,\
        \ or other audit functions.\n2. Verify the roles of each member and validate\
        \ security an control environments are being reviewed and followed up upon.\
        \ \n3. Managers checks in with each member to review responsibilities and\
        \ roles at least annually."
      typical_evidence: "1. Obtain the team directory and roles and responsibilities,\
        \  that oversee the implementation of security and control environments.\n\
        \nAgID (Critical) - The following attribute should be validated for CCF-GRM-03.01:\
        \ person in charge's contact info is communicated to National Cybersecuirty\
        \ Agency (ACN). There is a list containing all internal and external personnel\
        \ employed in cybersecurity processes with specific roles and liability. The\
        \ list is disseminated to the competent departments of subject.\n\nNIST 800-53\
        \ (Low, Moderate, & High) - The following attribute should be validated for\
        \ CCF-GRM-03.01: Assigns a risk designation to all organizational positions\
        \ and reviews the designations\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-GRM-03.01: looks for categorizations\
        \ of positions:\n a. Assigns a risk designation to all organizational positions;\n\
        \ b. Establishes screening criteria for individuals filling those positions;\
        \ and\n c. Reviews and updates position risk designations annually for high,\
        \ 3 years for moderate.\n\nSOC 2 (A/C/S) 2022 - The following attribute should\
        \ be validated for CCF-GRM-03.01: \n- changes to objectives, roles, and responsibilities\
        \ are communicated in a timely manner"
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-121
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 121
      name: Board of Directors & Sub-Committees
      description: "The Board of Directors provides corporate oversight, strategic\
        \ direction, and review of management for organization. The Board of Directors\
        \ meets at least quarterly and has 5 sub-committees: \n\u2022 Audit Committee\n\
        \u2022 Compensation and Management Development Committee\n\u2022 Nomination\
        \ and Governance Committee\n\u2022 Acquisition Committee\n\u2022 Finance Committee"
      annotation: '1. Board of Directors responsibilities and members should be documented
        within an charter.

        2. Board of Directors meet at least quarterly, and document meeting minutes
        of each meeting.

        3. Board of directors have at least 3 sub-committees defined and formed, audit
        committee, executive compensation an nominating committee, an governance committee.

        4. Board of directors will meet with each sub-committee at least annually
        to provide updates in each respective area.

        5. Action items from each board of directors meeting should be documented
        and actioned upon. The Board of Directors shall discuss plans of succession
        when needed and develop contingency plans for assignments of responsibility
        important for internal control when needed.'
      typical_evidence: "1. Obtain the most recent board of directors charter.\n2.\
        \ Obtain the most recent board of directors meetings minutes and validate\
        \ the timeliness of the meeting an any action items that have come out of\
        \ the meeting. \n\nSOC 2 (A/C/S) 2022 - The following attribute should be\
        \ validated for CCF-GRM-03.02: The board of directors defines, maintains,\
        \ and periodically evaluates the skills and expertise needed among its members.\
        \ The board of directors should have sufficient amount of members who are\
        \ independent from management and objective in evaluations and decision making."
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-122
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 122
      name: Audit Committee Charter & Oversight
      description: "The Audit Committee is governed by a Charter, is independent from\
        \ organization Management, is composed of outside directors (Industry Experts),\
        \ and meets at least quarterly.\n\nThe Audit Committee oversees: \n\u2022\
        Financial Statement Quality \n\u2022Enterprise Risk Management\n\u2022Regulatory\
        \ & Legal Compliance\n\u2022Internal Audit Functions\n\u2022Information Security\
        \ Functions\n\u2022External Audit Functions"
      annotation: "1. Obtain documented information on the Audit Committee and Audit\
        \ Committee Charter\n2. Verify that the audit committee is independent and\
        \ meets quarterly as defined within the charter. Document the most recent\
        \ meeting in the form of an audit committee minutes form. \n3. Verify that\
        \ the audit committee includes outside directors (industry experts)\n4. Validate\
        \ and review audit reports/document information to verify audit review including\
        \ various activities such as financial statement quality, enterprise risk\
        \ management, regulatory & legal compliance, internal and external audit function,\
        \ an information security functions.\n5. Review any open items from previous\
        \ audit committee meetings to ensure they are being worked on an closed out.\n\
        6. Continuously evaluate results of audits and ensure audit committees' requirements\
        \ are met, and any concerns are addressed and/or remediated."
      typical_evidence: '1. Provide the list of members on the audit committee and
        back ground.

        2. Provide the audit committee charter.

        3. Obtain the most recent meeting minutes and previous meeting minutes for
        timeliness.

        4. Review the reports and minutes for meeting discussions, and review action
        items/follow up items are tied to corresponding tickets or action plans.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-123
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 123
      name: Legal Assessments
      description: The organization identifies geographies with legal and regulatory
        risks such as embargoed countries. Systemss shall not operate out of, or have
        administrators that reside in such geographies.
      annotation: "1. Each Systems is responsible for identifying geographies with\
        \ legal and regulatory risks such as embargoed countries, countries with legal\
        \ bans, countries marked as non-cooperative countries or territories (NCCTs),\
        \ etc. Such countries shall be labeled accordingly with \"jurisdiction risk\"\
        .\n2. Once identified, Systemss shall not operate out of, or have administrators\
        \ that reside in such geographies.\n3. Teams must adhere to the Global Export\
        \ Policy in place which address which countries organization would do business\
        \ with and which ones we won\u2019t. In addition, teams must adhere to the\
        \ following."
      typical_evidence: '1. Validate that Systemss have evaluated geographies with
        legal and regulatory risks.

        2. Validate the Systemss do not operate out of, or have administrators that
        reside in such geographies.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-124
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 124
      name: Roles and Responsibilities of Cloud Customers and Providers
      description: Roles and responsibilities of the cloud computing customers and
        service providers are defined and agreed on. Included in the agreement are
        definitions including but not limited to data ownership, Information Security
        Accountability,  access provisioning and approval responsibilities, supplier
        use, and data backup and recovery responsibilities. Management designates
        stewardship to a person or group of people to govern these agreements.
      annotation: "1. Cloud service customers and cloud service providers should agree\
        \ on the appropriate allocation of information security roles and responsibilities,\
        \ and confirm that each party can fulfill its allocated roles and responsibilities.\
        \ These roles and responsibilities should be defined within an agreement between\
        \ the two parties. \n2. Cloud service customers should identify and manage\
        \ its relationship with the customer support and care functions of the cloud\
        \ service provider. \n3. Once agreed upon, the customer and providers are\
        \ responsible and accountable for the agreed upon terms and responsibilities.\
        \ Roles and responsibilities relating to operational activities, data ownership,\
        \ access controls, infrastructure maintenance, should be clearly defined to\
        \ avoid any legal disputes.\n4. Ownership of all assets, parties responsibilities\
        \ for operations associated with these assets, such as backup and recovery\
        \ operations, should be defined an documented. \n5. The use of sub-contractors\
        \ should also be defined and agreed upon between customers and providers,\
        \ and security risks associated with the use of sub-contractors should be\
        \ discussed. \n6. Details around an incident response policy and communication\
        \ line should be defined between customer and providers as well. Providers\
        \ should also communicate to customers that \"false reports\" of events that\
        \ do not subsequently turn out to be incidents do not have any negative consequences."
      typical_evidence: "1. Identify whether or not the service/BU is first a customer\
        \ or a provider.\n2. Provide an agreement between customers a providers detailing\
        \ the roles and responsibilities between the two parties. If the service is\
        \ a customer, an agreement between organization an the third-party service\
        \ should be defined. \n3. Review the agreement to validate roles and responsibilities\
        \ have been clearly defined, and include aspects of data ownership, security\
        \ accountability, supplier use, data backup and recovery.\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-GRM-03.05:\
        \ \n- agreements are in place regarding availability and priority.\n- Develop\
        \ primary and alternate telecommunications service agreements that contain\
        \ priority- of-service provisions in accordance with organizational availability\
        \ requirements (including recovery time objectives). Request Telecommunications\
        \ Service Priority for all telecommunications services used for national security\
        \ emergency preparedness in the event that the primary and/or alternate telecommunications\
        \ services are provided by a common carrier."
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-125
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 125
      name: Statement of Applicability
      description: Management prepares a statement of applicability that includes
        control objectives, implemented controls, and business justification for excluded
        controls. Management aligns the statement of applicability with the results
        of the risk assessment.
      annotation: '1. A statement of applicability (SOA) should be documented.

        2. The SOA should include control objectives, implemented controls, business
        justification for excluded controls, and should align with the risk assessments.

        3. The SOA should be reviewed and approved at least annually.'
      typical_evidence: '1. Provide the statement of applicability (SOA)

        2. Validate it includes a review of control objectives, implemented controls,
        business justification for excluded controls, and align with risk assessment.

        3. Validate the last review date, to ensure the SOA was reviewed annually.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-126
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 126
      name: ISMS Steering Committee
      description: The Information Security Management System (ISMS) steering committee
        conducts a formal management review of ISMS scope, risk assessment activities,
        control implementation, and audit results at least annually.
      annotation: '1. ISMS Steering committee should meet at least annually, and include
        meeting minutes from each meeting.

        2. Attendees of the steering committee meeting should be documented, and members
        of the information steering committee should include relevant members from
        business units and security and trust organization.

        3. Each meeting should include an discussion and review of current scope (products
        included), audit progress, ISMS scope, risk assessment activities, control
        implementation, and audit results. Included should be action items for any
        audit findings.'
      typical_evidence: "1. Provide the most recent ISMS Steering committee meeting\
        \ minutes.\n2. Review the meeting minutes and validate ISMS scope, risk assessment\
        \ activities, control implementation, and audit results have been communicated.\
        \ Review attendees to validate appropriate members were included in the meeting.\n\
        3. Obtain previous ISMS steering committee meeting minutes to validate timeliness\
        \ of meeting.\n4. Validate scope of ISMS Steering committee meeting is defined.\
        \ \n\nTX-RAMP Level 1 & 2 - The following attribute should be validated for\
        \ CCF-GRM-03.07: Assess the controls in the system and its environment of\
        \ operation at least annually\n\nUpdate the authorizations every 3 years or\
        \ when a significant change occurs"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-127
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 127
      name: Information Security Program
      description: The organization has an established security leadership team including
        key stakeholders in organization's Information Security Program; goals and
        milestones for deployment of the information security program are established
        and communicated to the company.
      annotation: '1. A security leadership team including key stakeholders in the
        organization Information Security Program should be identified an established
        at organization.

        2. The security leadership team oversees the information security program
        an should define the goals an milestones for deployment of the information
        security program at the company.'
      typical_evidence: '1. Provide a list of the members of the security leadership
        team at organization.

        2. Obtain documents showing the security leadership team''s involvement in
        the organization Information Security program, and validate goals an milestones
        for deployment of the information security program is discussed an defined.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-128
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 128
      name: ISMS Boundaries
      description: Information Security Management System (ISMS) boundaries are formally
        defined in an ISMS scoping document.
      annotation: '1. Document an ISMS scope document.

        2. Within the document, ensure the ISMS boundaries with respect to business
        units/their services, and supporting corporate platforms are included in the
        scope of certification.

        3. Review the scoping document and boundaries on an annual basis, updating
        it when necessary.'
      typical_evidence: '1. Provide the most recent ISMS scoping document.

        2. Review the document to ensure it includes ISMS boundaries.

        3. Revie the last modified date to ensure it was reviewed timely.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-129
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 129
      name: Periodic Security Staff Meetings
      description: At least annually, organization conducts a staff meeting to communicate
        and align on relevant security threats, program performance, and resource
        prioritization.
      annotation: "1. At least annually, organization should have an staff meeting\
        \ to discuss relevant security threats, program performance, and resource\
        \ prioritization. \n2. The meeting should be sent out through an formal invite\
        \ an should be recorded for organization. \n3. Corresponding meeting material\
        \ such as power point slides going over security threats, program performance,\
        \ an resource prioritization should be included as part of this meeting. \n\
        4. The meeting can be segregated into multiple meetings if necessary, an depending\
        \ on the audience, can be integrated with other organization meetings such\
        \ as ISMS Steering Committee meetings, or other announcements."
      typical_evidence: "1. Obtain a recent periodic staff meeting calendar/invite/email\
        \ communication.\n2. Review the meeting details, and if there were any recordings\
        \ available to validate security threats, program performance, and resource\
        \ prioritization were included. \n3. Obtain any previous meeting invites an\
        \ validate that the meeting was conducted at least annually.\n\nSpanish ENS\
        \ High - This control is deemed good to have for Spanish ENS High, but not\
        \ deemed mandatory if remaining ENS controls are effective. If any remaining\
        \ ENS controls are deficient, these controls maybe scoped in as needed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-130
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 130
      name: Information Security Budget
      description: Information systems security implementation and management is included
        as part of the budget required to support organization's security program.
      annotation: '1. Ensure that all the security requirements for which budget is
        required as an part of organization''s Security program and corresponding
        business justification are identified, documented and maintained.

        2. Ensure that as a part of regular periodic management review meetings identified
        critical security requirements across organization are reviewed as well as
        analyzed and based on multiple factors as well as justifications basis which
        budget is allocated for management of organization''s security program and
        corresponding records are maintained.

        3. Ensure representation from all the key departments to ensure allocation
        of budget for security program is aligned with business objectives.

        4. Ensure the spending of allocated budget is aligned with business justification
        approved by top management and corresponding records are maintained.'
      typical_evidence: "1.Security requirements for which budget is required as and\
        \ part of organization's security program and corresponding business justification\
        \ are identified documented and maintained.\n2.Artefacts highlighting management\
        \ review meeting was conducted and key security requirements were discussed\
        \ \n3.Artefacts highlighting key stakeholders from all departments were part\
        \ of management review meetings and budget allocation was aligned with business\
        \ objectives \n4. Records of Budget allocation along with corresponding business\
        \ justification as well as approval.\n5.Records highlighting that spending\
        \ corresponding to allocated budget is spending of allocated budget is aligned\
        \ with business justification approved by top management"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-131
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 131
      name: Share Capital and Voting Rights
      description: 'The share capital and voting rights in the service provider''s
        company must not be, directly or indirectly:

        - individually held at more than 24%;

        - and collectively owned more than 39%;

        by third-party entities with their registered office, central or main administration
        establishment in a non-member state of the European Union.

        These aforementioned third-party entities cannot individually:

        - by virtue of a contract or statutory clauses, have a right of veto;

        - by virtue of a contract or statutory clauses, appoint the majority of the
        members of the administrative, management or supervisory bodies of the service
        provider.'
      annotation: '1. Obtain the company balance sheet detailing shareholder equities,
        documentation demonstrating the company voting rights, as well as revelant
        contracts or statutory clauses involving voting rights for third-party entities.

        3. Ensure share capital is not individually held at more than 24%, or collectively
        owned more than 39%.

        4. Ensure third-parties based out of a non-member state of the EU do not have
        a right of veto, or the ability to appoint the majority of the members of
        the administrative, management or supervisory bodies of the service provider.'
      typical_evidence: '1. Provide the most recent company balance sheet detailing
        shareholder equities.

        2. Provide artefacts demonstrating the most recent company voting rights.

        3. Provide relevant contracts or statutory clauses involving voting rights
        for third-party entities.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-132
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 132
      name: Roles and Responsibilities at BU
      description: "The Company maintains a roles and responsibilities for all personnel\
        \ responsible for information security management. The company clarifies the\
        \ following points in this division of duties.\n\u2022 Position names\n\u2022\
        \ Work details\n\u2022 The scope of responsibility of persons in charge\n\u2022\
        \ The knowledge required for work\n\u2022 The qualifications required for\
        \ work\n\u2022 The experience required for work"
      annotation: '1. Verify organization has an updated team directory and roles
        and responsibilities,  that oversee the implementation of information security
        management.

        2. Ensure organization has a mechanism to showcase segregation of duties among
        the personnels responsbile for the implementation of information security
        management on the basis of position names, work details, the scope of responsibility
        of persons in charge, the knowledge, qualifications and experience required
        for work'
      typical_evidence: '1. Provide the team directory and roles and responsibilities,  that
        oversee the implementation of information security management.

        2. Provide the mechanism of segregation of duties among the personnel responsible
        for the implementation of information security management on the basis of
        position names, work details, the scope of responsibility of persons in charge,
        the knowledge, qualifications and experience required for work'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-133
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 133
      name: Info Security Planning
      description: Management ensures that information security problems are considered
        in supporting business objectives.
      annotation: '1. Verify organization has records of VMOMs and MOMs covering information
        security problems as an agenda

        2. Verify organization has records of emails from the leadership to the employess
        regarding prirotizing information security initiatives

        3. Verify organization has valid subscriptions of information security forums,
        platforms to get the latest know how, trends related to information security.'
      typical_evidence: '1. Provide records of VMOMs of various leaders covering information
        security concerns as an agenda

        2. Provide evidence of MOMs for the monthly/quarterly team meetings showcasing
        discussions around the combination of information security problems with the
        business objectives

        3. Provide records of emails from leadership to employess regarding prirotizing
        information security initiatives

        4. Provide evidence of subscriptions of information security forums, platforms
        to get the latest know how, trends related to information security.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-134
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 134
      name: Risk Acknowledgement
      description: As part of the periodic risk assessment, risks are acknowledged
        and shall be ranked and prioritized accordingly.
      annotation: '1. Verify organization has reports of most recent risk assessment
        performed having the population of identified risks, as a result of Risk Assessment.

        2. Ensure organization has records of categorizaiton of risks available based
        on likelihood and impact ratings.

        3. Verify organization has corrective action plan for a sample of identified
        risks and remediation completion.

        4. Ensure organization has validated that appropriate personnel and teams
        are involved and review the risk assessments on an annual basis (BU/BE teams,
        Strategy, Execution teams, etc.)'
      typical_evidence: '1. Obtain the most recent risk assessment performed, and
        provide the population of identified risks, discovered as a result of Risk
        Assessment.

        2. Provide the categorizaiton of risks based on likelihood and impact ratings.

        3. Provide corrective action plan for a sample of identified risks and remediation
        completion.

        4. Validate the appropriate personnel and teams are involved and review the
        risk assessments on an annual basis (BU/BE teams, Strategy, Execution teams,
        etc.)'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-135
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 135
      name: Information Security Policies and Review
      description: Information security policies are documented and define the information
        security rules and requirements for the service environment. These policies
        are reviewed at least annually to review requirements and updated as needed.
        Revision histories and review periods are defined within the policies themselves
        and the organization Policy Governance Policy.
      annotation: '1. Document an maintain information security policy/policies and
        corresponding procedures ensuring coverage of the information security requirements
        for the service environment in compliance with different standards as well
        as frameworks.

        2. Ensure the policy an procedure documents are communicated, implemented,
        reviewed as well as updated if required on an annual basis and corresponding
        records are maintained.'
      typical_evidence: "1.Provide documented information security policy/policies\
        \ and corresponding procedures ensuring coverage of the information security\
        \ requirements for the service environment in compliance with different standards\
        \ as well as frameworks.\n2.Provide artefacts demonstrating that policy and\
        \ procedure documents are communicated, implemented, reviewed as well as updated\
        \ if required at and regular frequency. \n\nAgID (Ordinary) - The following\
        \ attribute should be validated for CCF-GRM-04.01: ensure self-service provisioning,\
        \ network access, and elasticity are covered by information security policies.\
        \ If not, add as attribute or additional control. Ensure interoperability\
        \ and portability is covered in organization policy documentation.\n\nTX-RAMP\
        \ Level 1 & 2 - The following attribute should be validated for CCF-GRM-04.01:\
        \ Review and update the current planning, personnel security, and system and\
        \ communications protection:\n1. Policy every three years and following significant\
        \ changes and\n2. Procedures annually and following significant changes \n\
        \nReview the security and privacy plans at least annually\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-GRM-04.01:\
        \ BU's are responsible for maintaining SSP's that covers:\n a. Develops a\
        \ security plan for the information system that:\n   1. Is consistent with\
        \ the organization\u2019s enterprise architecture;\n   2. Explicitly defines\
        \ the authorization boundary for the system;\n   3. Describes the operational\
        \ context of the information system in terms of missions and business processes;\n\
        \   4. Provides the security categorization of the information system including\
        \ supporting rationale;\n   5. Describes the operational environment for the\
        \ information system and relationships with or connections to other information\
        \ systems;\n   6. Provides an overview of the security requirements for the\
        \ system;\n   7. Identifies any relevant overlays, if applicable;\n   8. Describes\
        \ the security controls in place or planned for meeting those requirements\
        \ including a rationale for the tailoring and supplementation decisions; and\n\
        \   9. Is reviewed and approved by the authorizing official or designated\
        \ representative prior to plan implementation;\n b. Distributes copies of\
        \ the security plan and communicates subsequent changes to the plan to [Assignment:\
        \ organization-defined personnel or roles];\n c. Reviews the security plan\
        \ for the information system [Assignment: organization-defined frequency];\n\
        \ d. Updates the plan to address changes to the information system/environment\
        \ of operation or problems identified during plan implementation or security\
        \ control assessments; and\n e. Protects the security plan from unauthorized\
        \ disclosure and modification\n\nSOC 2 (A/C/S) 2022 - The following attribute\
        \ should be validated for CCF-GRM-04.01:  \n- The entity uses information\
        \ and reports that are complete, accurate, current, and valid in the operation\
        \ of controls. Ensure this is covered by policy document. \n- Policy and procedure\
        \ covers that offering selects a revelevant method of communication. The method\
        \ of communication considers the timing, audience, and nature of the information.\n\
        \nPCI - The following attribute should be validated for CCF-GRM-04.01: Annual\
        \ review shall happen.\n\nCCCS medium cloud profile specific requirement:\n\
        CCF-GRM-04.01 for CCCS: Information security policies are documented and define\
        \ the information security rules and requirements for the service environment.\
        \ These policies are reviewed at least monthly to review requirements and\
        \ updated as needed. Revision histories and review periods are defined within\
        \ the policies themselves and the organization Policy Governance Policy."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-136
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 136
      name: Information Security Policies and Review
      description: Privacy policies are documented and define the information privacy
        rules and requirements for the service environment. These policies are reviewed
        according to periodic review requirements and updated as needed. Revision
        histories and review periods are defined within the policies themselves and
        the organization Policy Governance Policy.
      annotation: '1. Document an maintain privacy policy/policies and corresponding
        procedures ensuring coverage of  the requirements pertaining to processing
        of personal identifiable information for the service environment in compliance
        with applicable privacy laws as well as industry standards and frameworks.

        2. Ensure the policy an procedure documents are communicated, implemented,
        reviewed as well as updated if required at an regular frequency and corresponding
        records are maintained.'
      typical_evidence: '1.Provide documented privacy policy/policies and corresponding
        procedures ensuring coverage of  the requirements pertaining to processing
        of personal identifiable information for the service environment in compliance
        with applicable privacy laws as well as industry standards and frameworks.

        2, Provide artefacts demonstrating that policy and procedure documents are
        communicated, implemented, reviewed as well as updated if required at and
        regular frequency.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-137
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 137
      name: Cloud Customer Information Security Policy and Risk Review
      description: A cloud service customers' information security policy is defined
        and maintained and is consistent with the organization's acceptable levels
        of information security risks for its information and other assets. Considerations
        around information being stored in the cloud computing environment, access
        management, maintenance, and geographical locations of cloud service provider's
        organization are included in the policy.
      annotation: '1. Each Systems should follow the corporate information security
        policy stated as part of GRM-04.01. However, as part of each BU''s responsibility,
        if they are a cloud service customer (i.e. utilize AWS, Azure, GCP, etc.)
        they should further define considerations around information being stored
        in the cloud computing environment, access management, maintenance, and geographical
        locations of cloud service provider''s organization as part of the policy.

        2. Policy should be  consistent with the organization''s acceptable levels
        of information security risks for its information and other assets

        3. The considerations can be documented as part of the Corporate Information
        Security Policy, or on a separate Systems specific document/page.

        3. This information security policy shall be reviewed annually with approvals.'
      typical_evidence: '1. Provide cloud service customer information security policy.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-138
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 138
      name: Cloud Provider Information Security Policy and Risk Review
      description: A cloud service providers' information policy is defined and maintained,
        and addresses the provision and use of its cloud services. Considerations
        around baseline information security requirements, multi-tenancy and cloud
        service customer isolation, access management, communication, lifecycle management
        of service customer accounts, and communication of breaches are included in
        the policy.
      annotation: '1. A cloud service provider (Systems)''s information policy can
        follow a corporate information policy, or maintain their own information policy.

        2. The information policy document for the cloud service provider shall cover
        various aspects such as but not limited to Baseline information security requirements,
        Multi-tenancy and cloud service customer isolation, access management, Lifecycle
        management of service customer accounts and communication of breaches in compliance
        with different standards as well as frameworks.

        3. Ensure the policy an procedure documents are communicated, implemented,
        reviewed as well as updated at least annually and corresponding records are
        maintained.'
      typical_evidence: "1. Provide documented cloud service providers' information\
        \ security policy for the cloud service customers covering various aspects\
        \ such as but not limited to Baseline information security requirements, Multi-tenancy\
        \ and cloud service customer isolation, Access management, Lifecycle management\
        \ of service customer accounts and communication of breaches in compliance\
        \ with different standards as well as frameworks.\n2. Validate if the policy\
        \ was reviewed annually. \n\nFedRAMP Moderate & High - The following attribute\
        \ should be validated for CCF-GRM-04.04: baseline security checks must be\
        \ done before any new asset gets added, and that baseline security checks\
        \ are being done upon start, patch, booted, etc. Basically ensuring a minimum\
        \ baseline security set is maintained for all hardware/server/environment."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-139
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 139
      name: Information Security Control Disclosure
      description: The cloud service provides information to the cloud service customers
        about the information security capabilities they use. Implementation details
        about security controls are disclosed as needed.
      annotation: '1. Cloud service providers/cloud Systemss provide customers details
        regarding the security capabilities they use via request, or general public
        page and/or announcement page.

        2. Cloud service providers/cloud Systemss upon request also provide details
        regarding their security posture via a SOC report if needed.

        3. The cloud Systems also provides details to customers with security capabilities
        the customer can implement while using the cloud services provided.'
      typical_evidence: 1. Provide evidence of notifying the customers about the information
        security controls
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-140
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 140
      name: Policies and Standard Review
      description: The organization's policies and standards are reviewed, approved
        by management, and communicated to authorized personnel periodically. Revision
        histories and review periods are defined within the policies and standards
        themselves and the organization Policy Governance Policy.
      annotation: '1. Ensure organization''s governance policies and procedures are
        documented in order to meet security requirements. These policies include
        any policy relevant to ISO, SOC, and other governance frameworks

        2. Policies and procedures are reviewed and approved by management in order
        to meet security requirements

        3. Policies and standards are communicated to authorized personnel on annual
        basis

        4. Roles and responsibilities should be defined in the policy

        5. Policies and procedures are reviewed and updated at least annually with
        revision history'
      typical_evidence: "1. Provide organization's governance policies and procedures\n\
        2. List of authorized personnel for communicating policies and procedures\n\
        3. Provide evidence that the policies and standards are communicated to authorized\
        \ personnel\n4. Validate the policy is reviewed annually. \n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-GRM-04.06: Review\
        \ and update the current media protection in addition to physical and environmental\
        \ protection:\n\n1. Policy every three years and following significant changes\
        \ and\n2. Procedures annually and following significant changes \n\nTX-RAMP\
        \ Level 2 - The following attribute should be validated for CCF-GRM-04.06:\
        \ (f) Prevent unauthorized exchange of control plane traffic with external\
        \ networks;\n(g) Publish information to enable remote networks to detect unauthorized\
        \ control plane traffic from internal networks; and\n(h) Filter unauthorized\
        \ control plane traffic from external networks."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-141
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 141
      name: Policy and Standard Exceptions
      description: A process is in place to request, review, and approve exceptions
        to policies, standards, and procedures.  The assessment of the exception is
        risk based and the approved exceptions are reviewed annually.
      annotation: '1. Exception to policies and procedures are documented and maintained

        2. Process should be in place to request, review and approve exceptions to
        policies and procedures

        3. Exception to policies and procedures are approved and reviewed annually
        by appropriate personnel

        4. Evaluate any defined Business user specific exceptions and review them
        for appropriateness'
      typical_evidence: '1. Provide documented process to request, review and approve
        exceptions to policies and procedures


        TX-RAMP Level 2 - The following attribute should be validated for CCF-GRM-04.07:
        Review exceptions to the traffic flow policy at least annually


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-142
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 142
      name: Policies and Standards over Metadata
      description: Policies and standards are in place to govern the collection, retention,
        and usage of metadata (customer usage data). Metadata is only collected for
        its intended use (e.g. troubleshooting, customer billing, etc.) and only authorized
        staff have access to the data.  Metadata is deleted once its intended collection
        purpose has been fulfilled.
      annotation: '1. Management approved policies and standards are maintained and
        followed to govern the collection, retention, and usage of metadata (customer
        usage data)

        2. The policy and standard shall define the restriction of access to data,
        and access to data shall be restricted and reviewed

        3. Customer usage data should be deleted once its intended collection purpose
        has been fulfilled, and/or upon customer request

        4. Evaluate access to customer usage data to be granted to authorized staff
        only

        5. The policy is reviewed annually'
      typical_evidence: '1. Provide management approved policies and standards to
        govern the collection, retention, and usage of metadata

        2. Obtain the list of authorized personnel having access to the customer data

        3. Provide deletion mechanism to ensure customer usage data is deleted once
        its intended collection purpose and/or upon customer request has been fulfilled


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-143
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 143
      name: Teleworking Policy
      description: The organization maintains a policy regarding the conditions and
        restrictions for teleworking (i.e. off site work/remote work). The policy
        includes considerations around security risks around physical security of
        buildings and local environments.
      annotation: '1. Verify organization has documented policy and procedure in place
        for teleworking/remote working

        2. Ensure organization establishes and documents usage restrictions, configuration/connection
        requirements, and implementation guidance for each type of remote access allowed.

        3. Verify that organization authorizes remote access to the information system
        prior to allowing such connections.'
      typical_evidence: '1. Provide the organization-defined teleworking/remote working
        policy

        2. Provide organization-defined access roles and their responsibilitiesies

        3. Provide the defined frequency for the review of documented policy/procedure.
        In addition, provide the previous teleworking policy as well as evidence of
        review


        TX-RAMP Level 2 - The following attribute should be validated for CCF-GRM-04.09:
        (f) Prevent unauthorized exchange of control plane traffic with external networks;

        (g) Publish information to enable remote networks to detect unauthorized control
        plane traffic from internal networks; and

        (h) Filter unauthorized control plane traffic from external networks.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-144
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 144
      name: Control Family Policies & Procedures
      description: 'The organization has policies and procedures (SOP''s) regarding
        every control family listed below that are reviewed at least annually:

        ACCESS CONTROL

        AWARENESS AND TRAINING

        AUDIT AND ACCOUNTABILITY

        SECURITY ASSESSMENT AND AUTHORIZATION

        CONFIGURATION MANAGEMENT

        CONTINGENCY PLANNING

        IDENTIFICATION AND AUTHENTICATION

        INCIDENT RESPONSE

        MAINTENANCE

        MEDIA PROTECTION

        PHYSICAL AND ENVIRONMENTAL PROTECTION

        PLANNING

        PERSONNEL SECURITY

        RISK ASSESSMENT

        SYSTEM AND SERVICES ACQUISITION

        SYSTEM AND COMMUNICATIONS PROTECTION

        SYSTEM AND INFORMATION INTEGRITY'
      annotation: "Obtain and verify that these control groups have the policies and\
        \ procedures documented, approved, implemented, and revised annually: \n1.\
        \ Access Control\n2. Awareness and training \n3. Audit and Accountability.\n\
        4. Security assessment and authorization.\n5. Configuration Management.\n\
        6. Contingency Planning identification and authentication.\n7. Incident response\
        \ maintenance\n8. Media Protection.\n9. Physical and environmental protection.\n\
        10. Planning \n11. Personnel security \n12. Risk Assessment \n13. System and\
        \ services acquisition \n14. System and communications \n15. Protection\n\
        16. System and information integrity"
      typical_evidence: "Provide evidence that the following policies or procedures\
        \ are in place and reviewed at least annually.\n1. Access Control\n2. Awareness\
        \ and training \n3. Audit and Accountability.\n4. Security assessment and\
        \ authorization.\n5. Configuration Management.\n6. Contingency Planning identification\
        \ and authentication.\n7. Incident response maintenance\n8. Media Protection.\n\
        9. Physical and environmental protection.\n10. Planning \n11. Personnel security\
        \ \n12. Risk Assessment \n13. System and services acquisition \n14. System\
        \ and communications \n15. Protection\n16. System and information integrity\n\
        \nFedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-GRM-04.10: security functions that the organization is authorizing access\
        \ to should be defined."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-145
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 145
      name: FedRAMP Documents
      description: The organization is responsible for maintaining necessary documents
        for their FedRAMP package that include SSP, SAP, POAM, and more, and ensuring
        they are up-to-date.
      annotation: "1. Verify that organization has a developed/maintained FedRAMP\
        \ package of information system documents that:\n   a. Accurately reflects\
        \ the current information system\n   b. Includes all components within the\
        \ authorization boundary of the information system\n   c. Is at the level\
        \ of granularity deemed necessary for tracking and reporting, and\n   d. Includes\
        \ organization-defined information deemed necessary (including SSP, SAP, POAM,\
        \ etc.)\n2. Verify organization reviews and updates the necessary documents."
      typical_evidence: '1. Provide organization-defined information deemed necessary
        to achieve effective information system component accountability

        2. Provide plan of action & milestones for the security findings of the systems
        from periodic assessments

        3. Provide the security assessment planand system security plans




        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-GRM-04.11: teams need to maintain a SSP, SAP, SAR, ROE, ISAW, Pen Test
        Report, POAM, Jab/ATO Letter'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-146
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 146
      name: PCI Roles and Responsibilities
      description: Roles and responsibilities and a program charter for the governance
        of PCI DSS compliance within organization are formally documented and communicated
        by management.
      annotation: '1. Ensure a program charter for the governance of PCI DSS compliance
        is established, documented and followed

        2. Ensure roles and responsibilities for the governance of PCI DSS compliance
        are defined and documented

        3. Ensure program charter and roles and responsibilities are communicated
        by the management'
      typical_evidence: '1. Provide a program charter that is used for the governance
        of PCI DSS compliance

        2. Provide defined roles and responsibilities document used for the governance
        of PCI DSS compliance

        3. Provide evidence that program charter and roles and responsibilities information
        are communicated by the management to the appropriate stakeholders'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-147
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 147
      name: GDPR Representative
      description: If a cloud service provider is not established in a member state
        of the European Union, and is in the scope for GDPR, it must designate a representative
        or controller  in a member state of the European Union.
      annotation: "1. Identify the scope of GDPR\n2. If the cloud service provider\
        \ is not established in a member state of the EU, verify if it's in- scope\
        \ of GDPR \n3. If it's in scope of GDPR, ensure the cloud service provider\
        \ designates a representative in a member state of the European Union"
      typical_evidence: '1. Provide the scope of GDPR

        2. Provide evidence that cloud service provider (CSP) is established in a
        member state of the European Union in case it is in scope of GDPR

        3. Provide evidence of appointment of a representative incase if CSP is not
        established in a member state of EU'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-148
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 148
      name: EU Code of Conduct transparency
      description: The cloud service provider transparently communicates to Customers
        their adherence to the EU Code of Conduct.
      annotation: '1. Ensure cloud service provider adhere to EU Code of Conduct

        2. Ensure the cloud service provider transparently communicates to customers
        their adherence to the EU Code of Conduct'
      typical_evidence: '1. Provide EU code of conduct guidelines

        2. Provide evidence that cloud service provider transparently communicates
        to customers their adherence to the EU Code of Conduct'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-149
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 149
      name: Interface Language
      description: The Systems ensure that when dealing with French customers, the
        interfaces of the service are available in French.
      annotation: 1. Ensure that the interfaces of the service are available in French.
      typical_evidence: 1. Provide snapshots demonstrating that interfaces of the
        service are available in French.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-150
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 150
      name: Policy Violation & Non Compliance Consequences
      description: The Company communicates policy violation and actions of non-compliance
        consequences to personnel within the Code of Conduct.
      annotation: "1. Ensure all policy violations and non-compliance including associated\
        \ implications, disciplinary and legal action are documented as well as maintained\
        \ in the Code of Conduct.\n2. Ensure that all employees including new joiners\
        \ provide acknowledgment for adhering to the Code of Conduct and corresponding\
        \ records are maintained.\n3. Ensure employees are notified in case of policy\
        \ violations and actions of non-compliance that may lead to disciplinary as\
        \ well as legal action and corresponding records are maintained. \n4. Ensure\
        \ frequent communication and awareness mailers are sent across to all organization\
        \ employees for updates to Code of Conduct and corresponding records are maintained.\n\
        5. A population/repository of employees with violations to COC should be documented\
        \ and captured if occurred."
      typical_evidence: "1.Provide Code of Conduct in which all policy violations\
        \ and non-compliance including associated implications, disciplinary and legal\
        \ action are documented.\n2. Provide records highlighting the following:\n\
        \u2022 All employees including new joiners provide acknowledgment for adhering\
        \ to the Code of Conduct.\n\u2022 Employees are notified in case of policy\
        \ violations and actions of non-compliance that may lead to disciplinary as\
        \ well as legal action and corresponding records. \n\u2022 Frequent communication\
        \ and awareness mailers sent across to all organization employees for updates\
        \ to Code of Conduct.\n\u2022 Validate if there have been any policy violations\
        \ that have occurred, and sample select COC violations and validate corresponding\
        \ actions were appropriate and reviewed.\n\nSOC 2 (A/C/S) 2022 - The following\
        \ attribute should be validated for CCF-GRM-07.01: deviations from the code\
        \ of conduct are addressed in a timely manner"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-151
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:governance,-risk-and-compliance
      ref_id: CCF 151
      name: Information Security Risk Assessment and developing IT General Control
        Activities
      description: As part of its annual information security risk assessment, management
        selects and develops manual and IT general control activities that contribute
        to the mitigation of identified risks.
      annotation: '1. Document and maintain the results of annual information security
        risk assessment

        2. Ensure that the results of annual information security risk assessment
        are discussed an finalized with designated risk owner(s), corresponding records
        of the same are also maintained.

        3. Ensure that risk treatment plan for closure of identified risks is documented
        as per the timelines and approvals based on cost benefit analysis leading
        to selection as well as development of manual and IT general controls, corresponding
        records of the same are also maintained. This can be considered and reviewed
        as part of CCF releases as well.'
      typical_evidence: '1.Provide documented annual information security risk assessment
        results

        2.Artefacts highlighting that the results of annual information security risk
        assessment are discussed and finalized with the designated risk owner(s).

        3.Provide documented Risk treatment plan for closure of identified risks as
        per the timelines and approvals based on cost benefit analysis leading to
        selection as well as development of manual and IT general controls.


        SOC 2 (A/C/S) 2022 - The following attribute should be validated for CCF-GRM-08.01:
        Management considers control activities at various levels in the entity. Controls
        should be developed and implemented to help ensure the completeness, accuracy,
        and availability of technology processing. Controls should be developed and
        implemented to restrict technology access rights to authorized users commensurate
        with their job responsibilities and to protect the entity''s assets from external
        threats. Controls should be developed over the acquisition, development, and
        maintenance of technology and its infrastructure to achieve management''s
        objectives.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      assessable: false
      depth: 1
      name: People and Communities
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-152
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 152
      name: Background Checks
      description: New personnel offered employment are subject to a background screening
        process consistent with their jurisdiction prior to the new hire's start date.
      annotation: '1. Background checks should be mentioned and included in a policy/standard.

        2. For all new hires, a background check must be completed prior to their
        hire date.'
      typical_evidence: '1. Obtain a population of new hires.

        2. For a sample of new hires, validate that they completed their background
        check prior to their hire date.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-153
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 153
      name: Candidate Competency and Compatibility
      description: For every candidate that is hired, there is an interview and approval
        process prior to the candidate receiving an offer.
      annotation: '1. Hiring process should be mentioned and included in a policy/standard
        highlighting details of what the hiring process is.

        2. For all new hires, an interview and approval process must be conducted
        prior to receiving an offer.

        3. Each new hire must have at least one approval prior to the candidate receiving
        an offer.'
      typical_evidence: '1. Obtain a population of new hires.

        2. For a sample of new hires, provide the documentation of the interview feedback
        given during the interview process, and validate that at least one approval
        was obtained prior to receiving an offer.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-154
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 154
      name: National Security Clearance Review
      description: The organization conducts screening and rescreening of authorized
        personnel for roles that require national security clearances. For national
        security clearances; a reinvestigation is required during the 5th year for
        top secret security clearance, the 10th year for secret security clearance,
        and 15th year for confidential security clearance. In addition, for law enforcement
        and high impact public trust level, a reinvestigation is required during the
        5th year.
      annotation: "1. Ensure list of roles requiring national security clearances\
        \ is reviewed an kept up-to-date\n2. Document and maintain a process on screening/\
        \ rescreening or vetting of employees that need national security clearances\n\
        3. Ensure that screening and rescreening of authorized personnel are conducted\
        \ for roles that require national security clearances\n4. For national security\
        \ clearances, ensure that rescreening is conducted for the following:\n\u2022\
        \ 5th year for top secret security clearance\n\u2022 10th year for secret\
        \ security clearance\n\u2022 15th year for confidential security clearance\n\
        5.  For law enforcement an high impact public trust level, ensure that an\
        \ reinvestigation is conducted during the 5th year"
      typical_evidence: "1. List of roles that requires national security clearances\n\
        2. Obtain list of personnel with national security clearances\n3. Obtain Evidence\
        \ for the personnel with national security clearances:\n\u2022 screening of\
        \ authorized personnel\n\u2022 rescreening of authorized personnel every 5th,\
        \ 10th or 15th year (based on security clearance)\n\u2022 reinvestigation\
        \ on the 5th year for law enforcement an high impact public trust level"
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-155
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 155
      name: Confidential Information Agreement
      description: 'As part of their onboarding process, contingent workers must sign
        the organization Confidential Information Agreement: Individuals (Suppliers,
        Contractors, Independent Contractors, Consultants, and Partners), which includes
        the organization Supplier and Independent Consultant Job Practice and Behavior
        Guide outlining expected behavior regarding data and information system usage.
        This agreement prohibits any disclosure of information and other data to which
        the employee has been granted access.'
      annotation: "1. Document and maintain onboarding process of contingent workers\
        \ (Suppliers, Contractors, Independent Contractors, Consultants, an Partners).\
        \ Document and maintain the organization Confidential Information Agreement.\
        \ \n2. Maintain a list of contingent workers being onboarded\n3. Ensure the\
        \ organization Confidential Information Agreement includes expected behavior\
        \ regarding data and information system usage, prohibiting disclosure of information\
        \ another data to which the contingent worker has been granted access\n4.\
        \ Ensure all contingent workers sign the organization Confidential Information\
        \ Agreement"
      typical_evidence: '1. Provide documented process for onboarding of contingent
        workers

        2. Provide organization Confidential Information Agreement

        3. Obtain list of new contingent workers onboarded

        4. For sampled cases, provide evidence of organization Confidential Information
        Agreement to ensure that the agreement is signed by contingent workers


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-HRS-03.01: Users need to sign and aknowledge access rights and responsibilities
        prior to access granted'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-156
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 156
      name: Non-Disclosure Agreement
      description: The organization employees are required to sign a non-disclosure
        agreement (PIIA) upon hire. This agreement prohibits any disclosure of information
        and other data to which the employee has been granted access. The organization
        employees in jurisdictions where PIIA is not applicable are required to sign
        offer letters that outline clauses relevant to non-disclosure.
      annotation: "1. Document an maintain an policy which enforces that employees\
        \ sign the terms and conditions of employment and the non-disclosure agreements\
        \ (PIIA). A formal non-disclosure agreement shall be maintained as well. \n\
        2. Ensure all full time employees sign the non-disclosure agreement (PIIA-\
        \ Proprietary Information an Invention Assignment) upon hire which prohibits\
        \ any disclosure of information to which the employee has been granted access\n\
        3. Where PIIA is not applicable, ensure that full time employees sign offer\
        \ letters that outline clauses relevant to non-disclosure"
      typical_evidence: '1. Provide documented policy which enforces that employees
        sign the terms and conditions of employment and the non-disclosure agreements
        (PIIA), and the non-disclosure agreement as well.

        2. Obtain list of full time employees who joined during the audit period

        3. For sampled cases, provide evidence of PIIA to ensure the agreement is
        signed by all full time employees

        4. Where PIIA is not applicable, provide evidence of an sample of signed offer
        letters to full time employees with clauses relevant to non-disclosure


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-HRS-03.02: Users need to sign and aknowledge access rights and responsibilities
        prior to access granted'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-157
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 157
      name: Code of Conduct
      description: The Company maintains a Code of Conduct, which describes employee
        responsibilities and expected behavior regarding data and information system
        usage. The organization's full-time employees must acknowledge that they have
        read and agree to the Code of Conduct as part of their onboarding process.
      annotation: '1. Ensure that an Code of Conduct and Acceptable Use Policy is
        documented and maintained

        2. Ensure that the Code of Conduct covers employee''s responsibilities regarding
        confidentiality, data protection, ethics as well as reputed practices expected
        by organization and is communicated to all employees

        3. Ensure that all full time employees acknowledge that they have read through
        and agree to the Code of Conduct as part of their onboarding process'
      typical_evidence: "1. Provide Acceptable Use Policy and Code of Conduct\n2.\
        \ For sampled cases, provide evidence that the acceptable use policy is communicated\
        \ to all new hires and existing employees \n3. For sampled cases, provide\
        \ evidence that the full time employees have read and agree to the Code of\
        \ Conduct as part of their onboarding process \n\nTX-RAMP Level 1 & 2 - The\
        \ following attribute should be validated for CCF-HRS-03.04: Review and update\
        \ the rules of behavior at least every 3 years, and require individuals to\
        \ re-acknowledge. Review and update the access agreements at least annually\n\
        \nTX-RAMP Level 2 - The following attribute should be validated for CCF-HRS-03.04:\
        \ Restrictions should be on: Use of organization-provided identifiers (e.g.,\
        \ email addresses) and authentication secrets (e.g., passwords) for creating\
        \ accounts on external sites/applications.\n\nFedRAMP Moderate & High - The\
        \ following attribute should be validated for CCF-HRS-03.04: \n- Organization\
        \ provides security safeguards for making personnel exposed to spilled information\
        \ aware of the federal laws, directives, policies, and/or regulations regarding\
        \ the information and the restrictions imposed based on exposure to such information.\n\
        - Users need to sign and aknowledge access rights and responsibilities prior\
        \ to access granted\n\nCCCS medium cloud profile specific requirement:\nOrganization\
        \ provides security safeguards for making personnel exposed to spilled information\
        \ aware of the federal laws, directives, policies, and/or regulations regarding\
        \ the information and the restrictions imposed based on exposure to such information."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-158
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 158
      name: Performance Review
      description: The organization uses multiple technology platforms such as Team
        Space or Talent Space, to enable leaders to complete performance assessments
        and maintain continual communication with their team members.
      annotation: '1. Document and maintain a check-in performance management process
        for on-going dialogue between managers and employees

        2. Establish a performance review criteria as part of performance management
        process

        3. Ensure periodic reminders are sent to managers for performing regular check-in
        performance. Each manager shall have regular check-in''s with employees to
        discuss performance. Check-In''s shall occur at least once a year, and can
        be included as part of compensation reviews.'
      typical_evidence: '1. Obtain documented check-in performance management process
        for on-going dialogue between managers and employees

        2. Obtain evidence of the periodic reminders sent to managers for regular
        check-in conversations at least annually

        3. Obtain a population, and select a sample of employees for check-in. Provide
        screenshots of parameters/query used if needed.

        4. Obtain evidence that check-in''s were performed, an additional evidence
        can be evidence of performance discussion as part of compensation reviews,
        V2Mom''s, TeamSpace, etc.


        SOC 2 (A/C/S) 2022 - The following attribute should be validated for CCF-HRS-04.01:
        Incentives and rewards are considered as part of the performance assessment.
        Pressures associated with achievement of objectives should be considered as
        part of the performance assessment. Incentives, rewards, and discipline are
        considered as part of the performance assessment'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-159
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 159
      name: Performance Review
      description: The organization uses a technology platform called Team Space,
        which enables leaders and their team members to maintain continual communication
      annotation: '1. Ensure leaders and team members have access to Team Space for
        on-going communication, goals, and feedback between them

        2. Establish continuous communication and 360 degree feedback via Team Space
        amongst the leaders and team members'
      typical_evidence: 1. Provide sample evidence/ screenshot of enabling Team Space
        to allow leaders and team members to maintain constant communication an feedback
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-160
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 160
      name: Mobile Device Management
      description: Authorized organization personnel must enroll mobile devices with
        the enterprise Mobile Device Management (MDM) solution prior to obtaining
        access to organization network resources on mobile devices.
      annotation: '1. Ensure that a defined procedure or a mobile device policy is
        maintained to enroll mobile devices with the enterprise Mobile Device Management
        (MDM) solution and that responsibilities with respect to the usage of mobile
        devices for accessing organization resources is communicated

        2. Ensure that only authorized organization personnel who are enrolled in
        a MDM solution are able to obtain access to the organization network on mobile
        devices'
      typical_evidence: "1. Provide the mobile device policy\n2. Provide evidence\
        \ to check whether authorized organization personnel are enrolled in an MDM\
        \ solution\n3. Validate that without the enterprise Mobile Device Management\
        \ (MDM) solution, users cannot access the organization network on their mobile\
        \ devices\n\nAgID (Critical) - The following attribute should be validated\
        \ for CCF-HRS-05.01: \n- Ensure MDM supports geo-location and data deletion\
        \ from devices\n- Firewall software must be installed on all devices"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-161
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 161
      name: Organizational Structure and Reporting Lines
      description: An organization chart is documented and defines the organizational
        structure and reporting lines.
      annotation: '1. Ensure that organizational structure an reporting lines for
        communicating clear paths of responsibilities within the organization are
        defined, documented an available as necessary

        2. This can be maintained in organization Directory or Active Directory, or
        alternative methods as well.

        3. The organizational chart should serve as a method to developing contingency
        plans for assignments of responsibility important for internal control as
        well'
      typical_evidence: '1. Provide organization chart defining the organizational
        structure an reporting lines


        SOC 2 (A/C/S) 2022 - The following attribute should be validated for CCF-HRS-07.01:
        external parties and authorities are included in the defined reporting lines
        based upon legal and contractual requirements'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-162
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 162
      name: Job Descriptions
      description: The organization provides guidance to employees regarding the posting
        of job descriptions, and each job description has a corresponding hiring manager
        responsible for the job description.
      annotation: '1. Ensure policies around appropriate posting of job descriptions
        are defined an documented

        2. Ensure the defined policies are implemented regarding the posting of job
        descriptions for employees supporting the service an include authorities an
        responsibilities for the design, development, implementation, operation, maintenance,
        and monitoring of the system

        3. Validate if the job descriptions, responsibilities and authorities are
        reviewed on an periodic basis. Further, job descriptions should not be posted
        publicly unless it has first undergone review and/or approval.'
      typical_evidence: '1. Provide policies defining the posting of job descriptions
        for employees supporting the service

        2. Provide evidence of defined authorities and responsibilities for the design,
        development, implementation, operation, maintenance, and monitoring of the
        system'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-163
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 163
      name: Security Awareness Training
      description: At least annually, the Company provides resources for security
        awareness training (including cloud security awareness) to enable organization
        organizations to assign and track security awareness completion.
      annotation: '1. Ensure resources are provided for security awareness training
        (including cloud security awareness) on at least an annual basis. The security
        awareness training shall include how to securely handle mobile devices and
        storage media, secure internet browsing, and use of social media.

        2. Ensure resources for security awareness trainings are provided to all employees
        (per their job responsibility)

        3. Ensure security awareness trainings are tracked for completion

        4. BU''s are responsible for identifying whether or not RB need to complete
        any type of security awareness training annually, and track them to completion.'
      typical_evidence: "1. Provide evidence of the security awareness training\n\
        2. For sampled employees, provide the security awareness training completion\
        \ evidence\n3. For RB's, each vendor is responsible for ensuring their RB's\
        \ take annual security awareness training or training of some sort for baselines.\
        \ However, each BU is also responsible for ensuring their RB's take appropriate\
        \ training when needed, and is responsible for tracking that to completion.\
        \ Validate if BU monitors/enforces any type of security awareness training\
        \ for RB's.\n\nTX-RAMP Level 1 & 2 - The following attribute should be validated\
        \ for CCF-HRS-09.01: Update security awareness training policy once every\
        \ three years and procedures once a year (and following significant changes\
        \ for both). Provide security and privacy literacy training at least annually.\
        \ Retain individual training records for at least 1 year\n\nTX-RAMP Level\
        \ 2 - The following attribute should be validated for CCF-HRS-09.01: Specific\
        \ security awareness training requirement for social engineering and social\
        \ mining. \n\nFedRAMP Moderate & High - The following attribute should be\
        \ validated for CCF-HRS-09.01: Individual training records are retained for\
        \ a period of one year\n\nFedRAMP Moderate & High - The following attribute\
        \ should be validated for CCF-HRS-09.01: Organization has to monitor training\
        \ of contractors at least annually too.\n\nSOC 2 (A/C/S) 2022 - The following\
        \ attribute should be validated for CCF-HRS-09.01: security awareness training\
        \ includes privacy awareness training\n\nPCI - The following attribute should\
        \ be validated for CCF-HRS-09.01: Educate upon hire and annually thereafter.\
        \ Security training realted to infosec annually\n\nCCCS medium cloud profile\
        \ specific requirement:\nSecurity training policy and procedures should be\
        \ updated every 3 years annually"
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-164
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 164
      name: Training for Development and Growth
      description: Training is provided to employees to support their continued development
        and growth.
      annotation: '1. Ensure information security, privacy, and various other types
        of trainings are provided to all the employees at their disposal

        2. Ensure trainings related to operational activities of the business unit
        are provided to respective employees in order to enable continued development
        and growth. Trainings can be offered through various platforms via Degreed,
        or budget for training for each individual, etc.'
      typical_evidence: "1. Provide evidence of information security, privacy trainings,\
        \ and other types of trainings provided to all employees via various methods\
        \ such as Degreed, budget for training, etc.\n\nFedRAMP Moderate & High -\
        \ The following attribute should be validated for CCF-HRS-09.02: \n- specific\
        \ training is needed for contingency planning as well. Training should be\
        \ provided to individuals within 10 days of joining and repeated annually\
        \ thereafter. \n- Organization has to monitor training of contractors at least\
        \ annually too."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-165
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 165
      name: Secure Coding Training
      description: The organization's software engineers are required to complete
        training based on secure coding techniques at least annually. Teams practice
        secure coding techniques and ethics as part of their daily responsibilities.
      annotation: '1. Verify if training module is available on secure coding techniques

        2. Obtain list of software engineers who are responsible for completion of
        this training

        3. Validate if the training based on secure coding techniques are completed
        by software engineers at least annually'
      typical_evidence: "1. Obtain list of applicable software engineers (anyone involved\
        \ in the development, maintenance, review, etc. of an Systems/application)\n\
        2. For sampled employees, provide the secure coding techniques training completion\
        \ evidence\n\nFedRAMP Moderate & High - The following attribute should be\
        \ validated for CCF-HRS-09.03: Individual training records are retained for\
        \ a period of one year\n\nISO 27001 2022 - The following attribute should\
        \ be validated for CCF-HRS-09.03: Secure Coding techniques tested as part\
        \ of the SDLC process. \n\nNote: If CCF-HRS-09.03 is not achievable, a team\
        \ must be able to achoeve CCF-CCC-01.01"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-166
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 166
      name: Training for Development and Growth
      description: The organization uses a learning experience platform called Degreed,
        which empowers employees to choose how they would like to learn about a specific
        skill or topic.
      annotation: "1. Ensure employees are enabled to access Degreed platform to take\
        \ on learning an training\n2. Communicate the uses an benefits of Degreed\
        \ platform to all employees on an periodic basis  \n3. Ensure trainings taken\
        \ by employees on Degreed platform are tracked"
      typical_evidence: 1. Validate the training/learning platform Degreed is available
        for all employees to access, and offers various different types of learnings
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-167
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 167
      name: Cardholder Awareness Training
      description: "The organization personnel that interact with cardholder data\
        \ systems receive awareness training to be aware of attempted tampering or\
        \ replacement of devices. Training should include the following:\n\u2022 verify\
        \ the identity of third- party persons claiming to be repair or maintenance\
        \ personnel, prior to granting them access to modify or troubleshoot devices.\n\
        \u2022 do not install, replace, or return devices without verification\n\u2022\
        \ be aware of suspicious behavior around devices (e.g., attempts by unknown\
        \ persons to unplug or open devices)\n\u2022 report suspicious behavior and\
        \ indications of device tampering or substitution to authorized personnel\
        \ (e.g., to a manager or security officer)"
      annotation: "1. Obtain the list of organization personnel that need to interact\
        \ with cardholder data systems \n2. Ensure personnel that interact with cardholder\
        \ data systems undergo awareness training\n3. Ensure the awareness training\
        \ covers the following:\n\u2022 Verify the identity of third- party persons\
        \ claiming to be repair or maintenance personnel, prior to granting them access\
        \ to modify or troubleshoot devices\n\u2022 Do not install, replace, or return\
        \ devices without verification\n\u2022 Be aware of suspicious behavior around\
        \ devices (e.g., attempts by unknown persons to unplug or open devices)\n\u2022\
        \ Report suspicious behavior and indications of device tampering or substitution\
        \ to authorized personnel (e.g. to a manager or security officer)"
      typical_evidence: "1. Provide list of organization personnel interacting with\
        \ cardholder data systems\n2. For sampled cases, provide evidence of awareness\
        \ training conducted for the personnel\n3. Provide evidence that the training\
        \ covers the following :\n\u2022 Verifying the identity of third- party personnel\
        \ prior to granting them access to modify or troubleshoot devices\n\u2022\
        \ Devices should not be installed, replaced, or returned without verification\n\
        \u2022 Be aware of suspicious behavior around devices (e.g. attempts by unknown\
        \ persons to unplug or open devices)\n\u2022 Report suspicious behavior and\
        \ indications of device tampering or substitution to authorized personnel\
        \ (e.g., to a manager or security officer)"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-168
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 168
      name: Security Space Training
      description: All users involved in organizational systems pursuing FedRAMP,
        NIST, and/or NIST 800-171 are required to take organization security space
        training and insider threat training.
      annotation: 1. For an Systems that is pursuing FedRAMP, NIST, and/or NIST 800-171,
        all users involved in the organizational system is required to take organization
        security space trading and insider threat training periodically. Records of
        the training shall be retained for at least 1 year.
      typical_evidence: "1. Validate that all users involved in the organizational\
        \ system has taken organization security space trading and insider threat\
        \ training in a periodic basis.\n\nNIST 800-53 (Low, Moderate, & High) - The\
        \ following attribute should be validated for CCF-HRS-09.06: Role based training\
        \ to be added \n\nFedRAMP Moderate & High - The following attribute should\
        \ be validated for CCF-HRS-09.06: Individual training records are retained\
        \ for a period of one year\n\nCCCS medium cloud profile specific requirement:\n\
        All users involved in organizational systems pursuing CCCS medium are required\
        \ to take Organization security space training and insider threat training."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-169
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 169
      name: Security Awareness Training Review
      description: At least annually, organization's security awareness training program
        is reviewed, updated as needed, and approved by management's information security
        officer.
      annotation: "1. Ensure that organization has a security awareness and training\
        \ policy in place that addresses purpose, scope, roles, responsibilities,\
        \ management commitment, coordination among organizational entities, and compliance.\
        \ \n2. Ensure organization facilitates the implementation of the security\
        \ awareness and training policy and associated security awareness and training\
        \ controls and\n3. Verify that at least annually, organization reviews and\
        \ updates the current security awareness program, training policy, and training\
        \ procedures"
      typical_evidence: '1. Provide a list of organization-defined personnel or roles
        eligible for training

        2. Provide the organization-defined security awareness and training policy,
        as well as the previous version of the policy with evidence of review.

        3. Provide an organization-defined procedure to implement the policy

        4. Provide the organization-defined frequency to perform review of the defined
        policy and procedure'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-170
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 170
      name: Role-Based Security Training
      description: The organization provides role-based security training to personnel
        with assigned security responsibilities prior to authorizing access to the
        information system, or performing assigned duties, when required by information
        system change, and on a periodic basis.
      annotation: '1. Obtain the security awareness and training policy that addresses
        purpose, scope, roles, responsibilities, management commitment, coordination
        among organizational entities, compliance, and the procedures to facilitate
        the implementation of the security awareness and training policy and associated
        security awareness and training controls.

        2. Verify that review and updating occurs for the security awareness and training
        policy and procedures

        3. Verify that role based security training is provided per policy to personnel
        with assigned security responsibilities prior to authorizing access to the
        information system, or performing assigned duties, when required by information
        system change, and on a periodic basis.'
      typical_evidence: '1. Provide documentation of the security awareness training
        policy and procedure

        2. Provide a list of organization-defined personnel or roles which require
        awareness training

        3. Provide evidence of the organization-defined frequency for information
        system updates or changes that supports the security awareness training procedure'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-171
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:people-and-communities
      ref_id: CCF 171
      name: Whistleblower Policy
      description: A formalized whistleblower policy is established as part of the
        Code of Conduct and an anonymous communication channel is in place for employees
        to report potential security issues or fraud concerns.
      annotation: '1. Process should be defined for reporting the issues related to
        ethics/code-of-conduct/any wrong-doings

        2. Quarterly Audit Committee presentations to determine whether Ethics hotline
        allegations and the resulting actions were presented to the Audit Committee
        should be established'
      typical_evidence: '1. Provide Whistleblower policy

        2. Provide communication methods through which this policy is conveyed to
        organization personnel

        3. Provide the EthicsPoint Incident Management Report (redact confidential
        information)

        4. Provide evidence as to who have access to the Ethics Point portal


        SOC 2 (A/C/S) 2022 - The following attribute should be validated for CCF-HRS-10.01:
        the anonymous communication channel is available to external parties'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      assessable: false
      depth: 1
      name: Access Management
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-172
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 172
      name: Privileged Access to Production
      description: Privileged access to in-scope system components and production
        environments is restricted to authorized and appropriate users only.
      annotation: '1. Organization''s Authentication Standard to determine whether
        the policies contain requirements for the creation, allocation, change, distribution
        and safeguarding of passwords should exist.

        2.Password complexity, consecutive re-use and change frequency requirements
        of passwords should be enforces at Group Policy/LDAP setting level.

        3. Enable console and programmatic privileged access to OSes for AWS/Azure/GCP
        EC2 instance administrators only.

        4. Enable console and programmatic privileged access to databases for AWS/Azure/GCP
        database administrators only

        5. Enable or disable console access within the user profile in the AWS IAM
        dashboard or via API or CLI command.

        6. Ensure that appropriate approvals are obtained from the application owner(s)
        BEFORE elevated/privileged access is granted to any user to the production
        environment for in-scope systems/tools'
      typical_evidence: "1. Provide the Authentication Standard to determine whether\
        \ the policies contain requirements for the creation, allocation, change,\
        \ distribution and safeguarding of passwords.\n2. Provide list of all the\
        \ in-scope systems/tools\n3. Provide the Group Policy/LDAP setting demonstrating\
        \ password complexity, consecutive re-use and change frequency requirements\
        \ of passwords.\n4. Provide the Screenshots of IAM policy configurations,\
        \ IAM policy assignment, sample access requests, MFA configurations and enforcement\
        \ page, firewall configurations, cloud native policies, application IAM configurations,\
        \ resources with a public IP, cloud interaction configurations\n5. Provide\
        \ list of users who have elevated/privileged access via. dashboard, API, and/or\
        \ CLI command\n6. Provide a screenshot of how the listing was generated, including\
        \ the configuration and date.\n\nFedRAMP Moderate & High - The following attribute\
        \ should be validated for CCF-IAM-01.01: \n- Access is based on least privilege\
        \ principal and restricted. All privileged access must be documented. \n-\
        \ Prevent non-privileged users from executing privileged functions. \n- expects\
        \ a separation of duties between end-user functionality and backend admin\
        \ functionality. And access is controlled, not everyone have priv access."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-173
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 173
      name: Limited Audit Trail Access
      description: Audit trails are secured through principles of least privilege
        to prevent unauthorized access or altering.
      annotation: '1. Logs of critical information system activity should be stored
        in secure repository

        2. Configuration that appropriately disables administrators the ability to
        delete or modify the enterprise audit logs. Should be enforced.

        3. Admins with (read only) access to the audit logs should be verified from
        the appropriateness perspective

        4. Enable console and programmatic privileged access to logs stored in AWS/Azure/GCP
        for logging (or security) administrators only'
      typical_evidence: '1. Provide audit logging related policies/procedures/standards
        and most recent sign-off.

        2. Provide the Logs of critical information system activity that is stored
        in secure repository

        3. Provide the configuration details that displays ability to delete or modify  audit
        logs by administrator is disabled

        4. Provide the Admins listing with access to the audit logs to validate from
        the appropriateness perspective

        5. Demo with an admin and a non-admin user that audit trails cannot be accessed
        or have limited (read only) access using their respective credentials

        6. Validate admin list of users to audit trails are appropriate and access
        is limited.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-01.02: audit logs are encrypted using FIPS 140-2'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-174
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 174
      name: Audit Log Monitoring
      description: The organization and its Systemss monitor and flag tampering to
        the audit logging and monitoring tools in the production environment.
      annotation: '1. Obtain relevant organizational policy/standard and ensure defined
        process regarding enabling audit logging and monitoring are adhered to

        2. Ensure specific mechanisms to monitor and flag tampering to the audit logging
        and monitoring tools in the production environment are documented

        3. Ensure appropriate mechanisms are implemented for protecting integrity
        of logs and to prevent/detect logs modified/tampered at the storage location.
        Additionally, ensure such activities are recorded and controlled

        4. Restrict and control administrative permissions to manage and modify audit
        logs to authorized personnel only

        5. Ensure all administrative and operational activities are logged and events
        are captured to trace back to a particular user in case of any modifications/tampering
        performed

        6. Replicate and store all applicable logs on a centralized server and restrict
        access to only authorized personnel'
      typical_evidence: '1. Provide relevant organizational policy/standard details
        that enforces this requirement

        2. Provide relevant process documentations

        3. Provide screenshots of IAM configurations showing access to audit logs
        are limited

        4. Provide some sample event logs to showcase how are all admin and operational
        activities logged and captured

        5. Validate if there has been any tampering in audit logs, or events that
        have occurred


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-01.03: audit logs are encrypted using FIPS 140-2


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-175
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 175
      name: Log Ambiguity
      description: Log data generated allows an unambiguous identification of user
        accesses at the tenant level to support (forensic) analysis in the event of
        a security incident.
      annotation: "1. All audit logs shall allow an unambiguous identification of\
        \ user accesses at the tenant level. All activities should correspond or be\
        \ able to be traced back to a corresponding owner. \n2. In all security events\
        \ or incidents, logs can be traced back to a user, to identify any malicious\
        \ activity or support forensic analysis."
      typical_evidence: '1. Provide evidence that all audit logs (or security logs
        at the minimum) can be traced back to a user, to identify any malicious activity
        or support forensic analysis.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-01.04: log data captures who/what/where/when/why of each log. the
        following is also included - session, connection, transaction, or activity
        duration; for client-server transactions, the number of bytes received and
        bytes sent; additional informational messages to diagnose or identify the
        event; characteristics that describe or identify the object or resource being
        acted upon


        CCCS medium cloud profile specific requirement:

        Log data should capture all the details each log.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-176
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 176
      name: Vendor Accounts
      description: Vendor accounts used for remote access are enabled only during
        the time period needed, disabled when not in use, and monitored while in use.
      annotation: '1. Ensure the process to be followed by vendors for remote access
        are established, documented and followed

        2. Ensure vendor accounts used for remote access are enabled only during the
        time period needed, disabled when not in use, and monitored while in use'
      typical_evidence: '1. Provide a walkthrough of the process used by vendors for
        remote access

        2. Provide list of vendors/vendor accounts using remote access

        3. For sampled cases, provide evidence of the remote access being enabled
        only during the time period needed, disabled when not in use, and monitored
        while in use


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-01.05: any vendor accounts that have access need to be uniquely identified
        as so, and authenticate as non-organizational user/vendor. We can also add
        attribute typically this is N/A, and only applicable for systems that allow
        outsourced/vendor/public account access.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-177
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 177
      name: Service Provider access
      description: Where applicable, service providers with remote access to customer
        premises (e.g., for support of POS systems or servers) must use a unique authentication
        credential (such as a password/phrase) for each customer.
      annotation: '1. Obtain Password management policy

        2. Ensure service providers with remote access to customer premises have a
        unique authentication credential (such as a password/phrase) for each customer

        3. Organization Customer Identity (CCI) provides an IT solution for external
        customers'
      typical_evidence: '1. Provide password management policy

        2. Provide snapshot of group policy management console showing password parameters
        and complexity configured for each customer'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-178
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 178
      name: Remote Sessions and logging
      description: Remote access sessions are logged and event logs are retained for
        review when required.
      annotation: '1. Obtain Log management procedure

        2. Ensure remote access session details are logged

        3. Retain event logs and ensure it''s available for review whenever required'
      typical_evidence: "1. Provide log management procedure \n2. Provide evidence\
        \ of logs being maintained for remote access sessions\n3. Provide evidence\
        \ of event logs being retained for review\n\nTX-RAMP Level 2 - The following\
        \ attribute should be validated for CCF-IAM-01.07: Add automated mechanisms\
        \ for monitoring/controlling remote access"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-179
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 179
      name: Privileged Account Activities
      description: Use of Privileged accounts should be limited. Privileged accounts
        are not used to perform daily regular activities such as maintenance, non-security
        activity, etc.
      annotation: '1. Access to privileged accounts should be limited. Privileged
        accounts can be defined as any account with direct access to production, or
        ability to make direct changes.

        2. Such Privileged accounts shall not be used to perform daily regular activities
        such as maintenance, non-security activity, etc.

        3. Accounts used to perform daily regular activities should have limited access
        (i.e. no direct edit access), and dedicated accounts for them. These accounts
        shall be closely monitored to validate no inappropriate changes are made by
        them.'
      typical_evidence: '1. Validate that access to privileged accounts are limited
        (i.e. any accounts with direct edit access).

        2. Validate privileged accounts are not used to perform daily regular activities
        such as maintenance, non-security activity, etc.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-01.08:

        - Change authenticators for group/role accounts when membership to those accounts
        changes.

        - security tools should have SOD from non-security tools as well. And access
        is controlled.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-180
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 180
      name: Remote Access Disconnect
      description: Remote access to an information system can be disabeled or disconnected
        immediately if needed.
      annotation: '1. Verify that organization has established and documented usage
        restrictions, configuration/connection requirements, and implementation guidance
        for each type of remote access allowed.

        2. Ensure that organization authorizes remote access to the information system
        prior to allowing such connections.'
      typical_evidence: '1. Provide documentation regarding organization-defined conditions
        or events requiring session disconnect

        2. Provide evidence of the organization-defined time period in place to expeditiously
        disable or disconnect remote access'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-181
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 181
      name: Access to Production & Multi-Factor Authentication
      description: Access to production systems is restricted to authorized employees
        with a valid multi-factor (MFA) token over an encrypted [organization virtual
        private network (VPN) ] connection.
      annotation: "1. Access to all production instances should be only accessed via\
        \ organization VPN and a valid multi-factor (MFA). \n\n2. Production instances\
        \ should be integrated such that direct access to the application outside\
        \ of the organization VPN is prevented when possible.\n\n3. Shall a production\
        \ instance be accessed outside of organization VPN and multi-factor authentication,\
        \ additional termination and password controls maybe evaluated. \n\n4. All\
        \ access to \"root\" should be restricted to employees with valid MA token\
        \ per CSDL requirement around CCF-IAM-02.40 - Escalating user or account privileges\
        \ to 'root' [ on development, build, and production systems ] is restricted\
        \ to authorized employees with a valid multi-factor (MFA) token [ and an authorized\
        \ business need ]. Teams should work with CSDL team with any further questions\
        \ they have around this CSDL requirement."
      typical_evidence: "1. Verify that multi-factor (MFA) token are generated and\
        \ access to production systems is only established after a secure organization\
        \ VPN connection is completed.\n\nNote - If not all access is managed via\
        \ MFA/VPN and there is the opportunity for direct access. IAM -11.01 and IAM-11.02\
        \ MUST BE TESTED separately.\n\nTX-RAMP Level 2 - The following attribute\
        \ should be validated for CCF-IAM-02.02: Organization has the capability to\
        \ disconnect or disable remote access to the system within 15 minutes.\n\n\
        FedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-IAM-02.02: \n- has to be FedRAMP ATO'd tools such as AD, Okta, etc.\n\
        - MFA implements replay-resistant authentication mechanisms.\n- MFA is on\
        \ a separate device.\n- VPN is needed to disable split tunneling.\n- offering\
        \ needs to document what kind of VPN is in place and/or if SFTP is used. \n\
        - looking for use of symmetric keys such as IPSec VPN.\n- Establishing minimum\
        \ and maximum lifetime restrictions and reuse conditions for authenticators;\n\
        \  1. Changing/refreshing authenticators [Assignment: organization-defined\
        \ time period by authenticator type];\n  2. Protecting authenticator content\
        \ from unauthorized disclosure and modification;\n  3. Requiring individuals\
        \ to take, and having devices implement, specific security safeguards to protect\
        \ authenticators"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-182
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 182
      name: User Provisioning
      description: Logical access provisioning to information systems requires approval
        from appropriate personnel.
      annotation: '1. Organization''s Logical Access Policy, Logical Access Account
        Standard and Role Based Access Control Standard should exist.

        2. Organization''s Joiner workflow configurations for automatically creating
        an AD account should be tested

        3. On network layer, Users gaining new access to the LDAP groups should have
        appropriate approver.

        4. On application layer, for in-scope information systems, ensure that approval
        is obtained from an appropriate approver PRIOR to access being granted

        5. SUDO access and privileged commands should follow the guidance located
        at:'
      typical_evidence: "1. Please provide organization Logical Access Policy, Logical\
        \ Access Account Standard and Role Based Access Control Standard.\n2. List\
        \ of all in-scope information systems\n3. List of members that are authorized\
        \ to approve user access provisioning for these in-scope information systems\n\
        4. System generated list of users that have access to in-scope information\
        \ systems \n5. Provide a screenshot of how the listing was generated, including\
        \ the configuration and date.\n6. Please provide access provisioning system\
        \ logs for a selection of users who were granted access to the production\
        \ systems.\n7. Validate each user was approved prior to obtaining access and\
        \ access matches what was approved. \n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-IAM-02.04: access is only provisioned\
        \ based on least privilege and based on job duties.\n\nFedRAMP High - The\
        \ following attribute should be validated for CCF-IAM-02.04: All privileged\
        \ access is based on the principal of least privilege. Any access via faceless/generic\
        \ accounts needs to be strictly monitored, and approved. Approvers should\
        \ verify that faceless software accounts do not have higher privilege levels\
        \ than users executing the software."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-183
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 183
      name: Cloud Access Management
      description: The organization provides access controls to its cloud service
        customer to restrict access to its cloud services, cloud service functions,
        and data.
      annotation: '1. As part of its systems, the systems provides the ability to
        manage and monitor access to their customers, to restrict access to the customer''s
        own instance of the systems''s cloud services.

        2. This can include the ability to delegate different types of access (i.e.
        read only, admin).

        3. Organization Customer Identity (CCI) provides an IT solution for external
        customers'
      typical_evidence: '1. Provide evidence that the Systems provides access control
        ability provided to cloud service customers


        Spanish ENS - provide evidence of the default roles that customer can create
        on their instance to manage and restrict user accesses.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-184
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 184
      name: Quarterly Access Reviews
      description: Periodic access reviews are conducted by management for the in-scope
        system components to ensure that access is restricted appropriately. Tickets
        are created to remove or modify access as necessary in a timely manner.
      annotation: "1. Organization's Logical Access Account Standard should exist.\n\
        2. Quarterly or semi-annual review process should be established for user\
        \ access review for core application and tools. Quarterly cadence should be\
        \ strived, however if access is extremely limited to a number of users, or\
        \ type of access is extremely limited in action (i.e. no one can make changes\
        \ to production), then semi-annual cadence can be utilized.\n3. Population\
        \ of users must be complete and accurate and pulled directly from the source\
        \ application.\n4. Approval should be provided by Manager for the user access\
        \ review. In case of any discrepancy \n\nNote: Each framework requires different\
        \ cadences. For example C5 requires semi-annual review at the minimum. GCC\
        \ shall verify cadence with teams (quarterly should be standard cadence most\
        \ teams adhere to)."
      typical_evidence: "1. Validate all privileged access is reviewed on a quarterly\
        \ basis or semi-annual basis. \n2. Provide the evidence approval by Manager\
        \ for the user access review. \n3. Validate the population of users is complete\
        \ and accurate and pulled directly from the source application.\n4. Validate\
        \ that all discrepancies are removed in a timely manner. \n\nNote: Each framework\
        \ requires different cadences. For example C5 requires semi-annual review\
        \ at the minimum. GCC shall verify cadence with teams (quarterly should be\
        \ standard cadence most teams adhere to).\n\nTX-RAMP Level 1 & 2 - The following\
        \ attribute should be validated for CCF-IAM-02.06: Review accounts for compliance\
        \ with account management requirements at least annually\n\nTX-RAMP Level\
        \ 2 - The following attribute should be validated for CCF-IAM-02.06: Review\
        \ and reevaluate privileges at least quarterly\n\nSOC 2 (A/C/S) 2022 - The\
        \ following attribute should be validated for CCF-IAM-02.06: \n- The current\
        \ access review process in IAM-02.06 should be expanded to include the mapping\
        \ of applicable AD groups and specific permissions attached to the groups.\n\
        - In Scope specific Privileged groups to be reviewed for employees, contractors,\
        \ vendors, business partner personnel"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-185
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 185
      name: Quarterly Access Review Exceptions
      description: Inappropriate access identified as part of quarterly user access
        reviews must be remediated within 7 days.
      annotation: "1. Documented procedure for performing user access reviews in accordance\
        \ with organization policies which covers the following should exist\n\u2022\
        \ Quarterly access reviews are performed for in-scope systems components;\n\
        \u2022 Keeping audit trails and maintaining tickets for all requests for addition,\
        \ modification or deletion of user accounts/ IDs and access rights;\n\u2022\
        \ Reviewing user accounts at specified intervals(quarterly) to identify and\
        \ facilitate removal/ deactivation of inactive accounts or accounts that have\
        \ not been used for a longer duration\n\n2. Quarterly review process should\
        \ be established for user access review.\n3. Approval should be provided by\
        \ Manager for the user access review. \n4. Any discrepancies identified as\
        \ part of the user access review (i.e. inappropriate access), must be remediated\
        \ within 7 days (access removed and/or modified)."
      typical_evidence: "1. For a selection of service, Provide  the sample accounts\
        \ for the quarterly access review been performed or not\n2. Provide the evidence\
        \ approval by Manager for the user access review. In case of any discrepancy\
        \ \n3. Provide the user access review documentation\n4. Provide tickets raised\
        \ for access modifications as a result of access reviews \n5. Provide the\
        \ evidence to show that Inappropriate access identified as part of quarterly\
        \ user access reviews must be remediated within 7 days."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-186
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 186
      name: Unique ID Log-In
      description: Authentication to in-scope systems require unique organization
        ID credentials.
      annotation: '1. Ensure unique organization ID credentials are used for all in-scope
        systems. Additionally, ensure organization id''s are not reused. ID''s shall
        not be shared between employees, and no employees/users shall be provisioned
        identical ID''s to access organization applications and network.

        2. Ensure access to all in-scope systems is authenticated via unique organization
        ID credentials'
      typical_evidence: "1. Provide snapshot showing access to system is authenticated\
        \ via unique organization ID credentials. Validate each user at organization\
        \ has a unique ID, could be via sample select, query, etc.\n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-IAM-02.08: Preventing\
        \ reuse of identifiers for at least 2 years\n\nTX-RAMP Level 2 - The following\
        \ attribute should be validated for CCF-IAM-02.08: include contractors; foreign\
        \ nationals; non-organizational users\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-IAM-02.08: identifiers need to: \n\
        \ a. Receiving authorization from [Assignment: organization-defined personnel\
        \ or roles] to assign an individual, group, role, or device identifier;\n\
        \ b. Selecting an identifier that identifies an individual, group, role, or\
        \ device;\n c. Assigning the identifier to the intended individual, group,\
        \ role, or device;\n d. Preventing reuse of identifiers for [Assignment: organization-defined\
        \ time period] during a 2 year period.\n e. access must be via unique ID."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-187
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 187
      name: Password Management & Configuration
      description: Passwords for in-scope system components are configured according
        to the Company's policy.
      annotation: "1. Validate if access to production systems follows organization\
        \ AD and VPN. \n2. Should access to production systems not follow organization\
        \ AD and VPN, direct application password criteria shall be reviewed to ensure\
        \ it meets Company policy.\n3. If needed, passwords are stored within a centralized\
        \ directory to simplify password management, and configure the password requirements\
        \ and enforce them on all accounts."
      typical_evidence: "1. Validate if application access follows organization AD\
        \ and VPN.\n2. If access does not follow organization AD and VPN, provide\
        \ a screenshot of the application's password configuration\n2. Validate the\
        \ application's password configuration follows organization's policy.\n\n\
        AgID (Ordinary) - The following attribute should be validated for CCF-IAM-02.09:\
        \ ensure specific time attribute is covered: Passwords are updated at least\
        \ every year.\n\nTX-RAMP Level 1 & 2 - The following attribute should be validated\
        \ for CCF-IAM-02.09: case sensitive, minimum twelve characters, at least one\
        \ upper-case, lower-case, letters, numbers, and special characters\n\nspecific\
        \ password requirements such as common password list should be added \n\n\
        PCI - The following attribute should be validated for CCF-IAM-02.09: Password\
        \ - we have 180 days change it to 90 days.\n\nCCCS medium cloud profile specific\
        \ requirement:\nPasswords for in-scope system components are configured according\
        \ to the CCCS password complexity/character requirements as specified below:\n\
        One-day minimum, sixty-day maximum; Ensure company policy matches CCCS password\
        \ complexity/character requirements (case sensitive, minimum of eight characters,\
        \ and at least one each of upper-case letters, lower-case letters, numbers,\
        \ and special characters)"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-188
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 188
      name: Password Management & Configuration
      description: Passwords for the corporate active directory is configured according
        to the Company's policy. Company policy requires the following:- 8-character
        minimum, - Complexity enabled, No password reuse for 5 years.
      annotation: "1. Obtain company policy for password management\n2. Ensure the\
        \ corporate active directory password settings meet company policy requirements\
        \ for all active directory accounts. Company policy requires following:\n\u2022\
        \ Passwords must have minimum 8 character length\n\u2022 Passwords must have\
        \ complexity enabled\n\u2022 No password reuse for 5 years"
      typical_evidence: "1. Provide relevant organizational policy that enforces this\
        \ requirement\n2. Provide snapshot of group policy management console showing\
        \ password parameters and complexity configured\n\nAgID (Ordinary) - The following\
        \ attribute should be validated for CCF-IAM-02.10: ensure specific time attribute\
        \ is covered: Passwords are updated at least every year.\n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-IAM-02.10: case\
        \ sensitive, minimum twelve characters, at least one upper-case, lower-case,\
        \ letters, numbers, and special characters\n\nspecific password requirements\
        \ such as common password list should be added \n\nFedRAMP Moderate & High\
        \ - The following attribute should be validated for CCF-IAM-02.10: tools to\
        \ verify password settings are used. \n\nPCI - The following attribute should\
        \ be validated for CCF-IAM-02.10: Password - we have 180 days change it to\
        \ 90 days."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-189
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 189
      name: Cloud User Access Management
      description: The organization provides user access management, authentication
        functions, secret authentication information, and specifications for customers
        to access their own instances of organization's cloud services.
      annotation: '1. The systems provides user access management, authentication
        functions, and password or log in customization functions for its customers
        to access their own instances of organization''s cloud services

        2. Functions/Features can include the ability to use customer SSO, VPN, password
        log-in, credential verification, etc.'
      typical_evidence: '1. Provide evidence regarding specifications being provided
        to customers to access their own instances of organization''s cloud services

        2. Procedures for management of secret authentication information of cloud
        services provided to cloud related product customers.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-190
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 190
      name: Unique Customer Identifier and ID
      description: The organization requires unique identifiers for user accounts
        and prevents identifier reuse.
      annotation: "1. The Systems validates that access to each of its production\
        \ instances can only be accessed via unique ID and login. \n2. The Systems\
        \ shall not allow identifier re-use to be allowed. Each user should have a\
        \ unique log in, and cannot be re-used, even with retired ID's. \n3. Organization\
        \ Customer Identity (CCI) provides an IT solution for external customers"
      typical_evidence: "1. Validate that access to the Systems's services can only\
        \ be accessed via unique ID, and ID's cannot be re-used. \n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-IAM-02.13: Preventing\
        \ reuse of identifiers for at least 2 years\n\nTX-RAMP Level 2 - The following\
        \ attribute should be validated for CCF-IAM-02.13: include contractors; foreign\
        \ nationals; non-organizational users\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-IAM-02.13: specific users are tagged\
        \ when applicable such as foreign nationals or contractors."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-191
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 191
      name: User account disablement
      description: User accounts are locked after they have not been used for a period
        of two months or after a predefined number of failed login attempts. Locked
        user accounts are automatically removed after six months.
      annotation: "1. Obtain Identity & Access Management process an password management\
        \ policy\n2. Applications should be configured such that:  \n\u2022 User accounts\
        \ are disabled after an predefined number of failed login attempts"
      typical_evidence: "1. Identity & Access Management process an password management\
        \ policy\n2. Snapshots for the following: \n\u2022 User accounts are disabled\
        \ after an predefined number of failed login attempts\n\nTX-RAMP Level 2 -\
        \ The following attribute should be validated for CCF-IAM-02.14: Accounts\
        \ also disabled if they have been inactive for 180 days \n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-IAM-02.14: limit\
        \ of 5 bad logins before the account is disabled for 15 minutes \n\nFedRAMP\
        \ Moderate & High - The following attribute should be validated for CCF-IAM-02.14:\
        \ \n- User accounts are disabled after they have not been used for: 90 days\
        \ \n- The information system enforces a limit of three consecutive invalid\
        \ logon attempts by a user during a 15 minute period before locking the account\
        \ for 3 hours or until an admin unlocks the account.\n\nNote: Change control\
        \ such that specific time period is not selected. Include attribute for BSI\
        \ C5:\n2 months - C6\n\nFedRAMP High - The following attribute should be validated\
        \ for CCF-IAM-02.14: BYODs that have access to production, but do not have\
        \ sufficient encryption are purged/wiped after 3 unsuccessful login attempts.\
        \ \n\nPCI - The following attribute should be validated for CCF-IAM-02.14:\
        \ \n- User accounts are disabled after 90 days of inactivity.\n- Lockout -\
        \ Once disabeled, there must be a lockout duration of minimum of 30 min. limit\
        \ of 6 attempts.\n\nCCCS medium cloud profile specific requirement:\nThe information\
        \ system enforces a limit of three consecutive invalid logon attempts by a\
        \ user during a 15 minute period before locking the account for 3 hours or\
        \ until an admin unlocks the account."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-192
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 192
      name: Inactivity Monitoring
      description: The organization uses tools, such as inactivity monitoring, to
        help ensure that sessions with cloud customers are managed, to protect against
        attacks that can affect organization's service commitments.
      annotation: "1. Documented procedure for facilitating inactivity monitoring\
        \ of active sessions should exist\n2. Inactivity monitoring tools should be\
        \ configured as per the requirements defined in documented organizational\
        \ policy and procedure.\n3. Sessions with cloud customers (i.e. customer chats,\
        \ customer help channels, customer access, etc.) are secured by session management\
        \ ensuring that the sessions are expired if inactive for longer duration and\
        \ sessions are secured over encrypted connections. \n4. Sessions can include\
        \ instances where customers have accessed an application with no activity,\
        \ having a mechanism of auto-log out enabled."
      typical_evidence: "1. Provide the user session management and inactivity monitoring\
        \ documentation\n2. Provide evidence of inactive session management compliance\
        \ with documented requirements\n3. Verify that the session expires as per\
        \ inactivity parameters defined\n4. At the minimum, #2 and 3 should be followed\
        \ and tested to ensure inactivity monitoring is enabled. \n\nSpanish ENS High\
        \ - This control is deemed good to have for Spanish ENS High, but not deemed\
        \ mandatory if remaining ENS controls are effective. If any remaining ENS\
        \ controls are deficient, these controls maybe scoped in as needed."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-193
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 193
      name: Provisioning and Modifying Authentication Credentials
      description: Authorized personnel verify the identity of users before provisioning
        and modifying authentication credentials on their behalf.
      annotation: "1. Process should exist for authentication method to include allocation/revocation/replacement\
        \ of possession factor (such as password, security token, OTP, certificates,\
        \ passphrase).\n2. Unique user IDs should be used to enable users to be linked\
        \ to and held responsible for their actions.\n3. log-on information should\
        \ be validated  only on completion of all input data. If an error condition\
        \ arises, the system should not indicate which part of the data is correct\
        \ or incorrect \n4. Identity of users should be verified by authorized personnel\
        \ before provisioning and modifying their authentication credentials. This\
        \ shall be done initially when providing access, or during trouble shooting\
        \ a user's access.\n5. Access to generic/faceless accounts should always be\
        \ monitored, and provisioning access to them should not be allowed until approval\
        \ and identity of user is confirmed."
      typical_evidence: '1. Provide the authentication credentials provisioning and
        modifying documentation

        2. Provide list of authorized personnel who verify the identity of users before
        provisioning and modifying authentication credentials

        3. Obtain results of verification performed by authorized personnel. This
        can be done via an approval ticket, or validation of access afterwards

        4. Provide the audit logs provisioned as part of provisioning and modifying
        authentication credentials

        5. Users should not have multiple log-in ID''s accounts to privileged systems,
        faceless accounts, where impersonation could be implied. If needed, this should
        be limited to a select number of privileged users. Validate access to the
        application or account cannot be accessed outside of who was provisioned access.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-02.16: if hard-tokens are used, there is a process in place to distribute
        the hard-tokens that are used in the environment and validating identity.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-194
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 194
      name: Concurrent Login Sessions
      description: Information systems are configured to limit concurrent login sessions.
        Session termination initiated from any session must terminate all concurrent
        sessions.
      annotation: 1. Each Systems shall limit the number of concurrent login sessions
        to information systems, and once a session is terminated, the inactive user's
        interface is no longer displayed. Once the session is terminated, users must
        re-log in to access the information system.
      typical_evidence: 1. Snapshots showcasing restrictions to limit concurrent login
        sessions and the inactive user interface is not displayed when the session
        is terminated. I.e. once a session is terminated, re-log in is enforced to
        view the information system.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-195
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 195
      name: Inactive Session Termination
      description: Information systems are configured to terminate inactive sessions
        after a set amount of time, or when the user terminates the session.
      annotation: '1. Obtain Identity & Access Management process an verify the session
        timeout details.

        2. Each Systems shall set a set time limit upon which inactive sessions will
        automatically terminate. Once the session is terminated, users must re-log
        in to access the information system.

        3. Workstation and employee laptops are configured to automatically lock after
        a set amount of time. When the workstation is locked, no confidential information
        shall be displayed or accessible.

        4. Once the set amount of time is achieved, the workstation requires users
        to re-enter credentials to access the workstation.'
      typical_evidence: "1. Identity & Access Management process\n2. Snapshots showcasing\
        \ inactive sessions timeout, or when the user terminates the session. Further\
        \ validate the system automatically terminates upon inactive session time\
        \ set is reached via test.\n3. Validate workstations are configured to automatically\
        \ lock after a set amount of time, and requires users to re-enter credentials\
        \ to access the workstation.\n\nTX-RAMP Level 2 - The following attribute\
        \ should be validated for CCF-IAM-02.18: users must log out if expected to\
        \ be inactive for 30 minutes. Device lock after 30 minutes of inactivity \n\
        \nFedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-IAM-02.18: \n- The organization requires that users log out when inactivity\
        \ is anticipated to exceed Fifteen (15) minute. This must be defined in organization\
        \ policices/procedures.\n- System prevents further access to the system by\
        \ initiating a session lock after 15 minutes of inactivity\n- Offerings should\
        \ terminate transmission control protocol connections via automated timeout.\
        \ \n\nFedRAMP High - The following attribute should be validated for CCF-IAM-02.18:\
        \  System displays an explicit logout message to users indicating the reliable\
        \ termination of authenticated communications sessions.\n\nPCI - The following\
        \ attribute should be validated for CCF-IAM-02.18: Idle Lockout - If account\
        \ has been idle for more than 15 minutes, lockout shall occur.\n\nCCCS medium\
        \ cloud profile specific requirement:\nSystem prevents further access to the\
        \ system by initiating a session lock after 15 minutes of inactivity"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-196
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 196
      name: U.S. Federal Government Access
      description: "Systems leveraged by the U.S. Federal Government present a login\
        \ screen that displays the following language:\n\u2022 users are accessing\
        \ a U.S. Government information system\n\u2022 system usage may be monitored,\
        \ recorded, and subject to audit\n\u2022 unauthorized use of the system is\
        \ prohibited and subject to criminal and civil penalties\n\u2022 use of the\
        \ system indicates consent to monitoring and recording"
      annotation: "1. For systems leveraged by the U.S Federal Government, Systemss\
        \ shall present a login screen that displays the following language:\n\u2022\
        \ users are accessing an U.S. Government information system\n\u2022 system\
        \ usage may be monitored, recorded, an subject to audit\n\u2022 unauthorized\
        \ use of the system is prohibited an subject to criminal and civil penalties\n\
        \u2022 use of the system indicates consent to monitoring an recording"
      typical_evidence: "1. Evidence of systems leveraged by the U.S Federal Government\
        \ presenting an login screen that displays the following language:\n\u2022\
        \ users are accessing an U.S. Government information system\n\u2022 system\
        \ usage may be monitored, recorded, an subject to audit\n\u2022 unauthorized\
        \ use of the system is prohibited an subject to criminal and civil penalties\n\
        \u2022 use of the system indicates consent to monitoring an recording"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-197
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 197
      name: Authorized Session Manager
      description: Privileged logical access to trusted data environments is enabled
        through an authorized session manager; session user activity is recorded and
        tunneling to untrusted data environments is restricted.
      annotation: "1. Obtain user access management process for managing privileged\
        \ access to trusted data environments in accordance with organization policies\
        \ and verify the following:\n\u2022 Creation and allocation of privileged\
        \ user accounts/ IDs on the information systems is controlled through a formal\
        \ authorization process.\n\u2022 Privilege access to trusted data environments\
        \ are enabled through an authorized session manager\n\u2022 Privileged access\
        \ rights are allocated to users on a time bound need-to-use basis and on an\
        \ event-by event basis in line with the access control policy, i.e. based\
        \ on the minimum requirement for their functional roles and must be revoked\
        \ post that defined time period;\n\u2022 All session user activities are recorded\
        \ and tunnelling to untrusted data environments is restricted\n\u2022 As applicable,\
        \ terminate inactive sessions after a set amount of time, or when the user\
        \ terminates the session.\n\u2022 Expiry of privileged access rights is defined;\n\
        2. SUDO access and privileged commands should follow the guidance located\
        \ at:"
      typical_evidence: "1. User access management process covering privilege identity\
        \ management.\n2. Screenshot showing privilege access to trusted data environments\
        \ is granted by authorized session manager.\n3. Configuration showing session\
        \ recording for user activity is recorded\n4. Configuration showing tunneling\
        \ to untrusted data environments is restricted\n5. List of users that have\
        \ privileged logical access to trusted data environments\n\nFedRAMP High -\
        \ The following attribute should be validated for CCF-IAM-02.20: additional\
        \ monitoring of users with privileged access should be implemented. This can\
        \ typically be through heightened auditing based on user privileges or tracking\
        \ of admin activities. \n\nSpanish ENS High - This control is deemed good\
        \ to have for Spanish ENS High, but not deemed mandatory if remaining ENS\
        \ controls are effective. If any remaining ENS controls are deficient, these\
        \ controls maybe scoped in as needed."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-198
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 198
      name: Approved Information Technology Products
      description: The organization employs only information technology products on
        the FIPS 201-approved products list for Personal Identity Verification (PIV)
        capability implemented within organizational information systems.
      annotation: '1. Obtain and validate list of applicable/in-scope information
        technology products

        2. Obtain and validate list of FIPS 201 Approved Products List (also available
        on idmanagement.gov)

        3. Validate if all, in-scope, IT products employed are FIPS 201-approved products
        with Personal Identity Verification (PIV) capability implemented to ensure
        physical access control are in place.

        4. Document and maintain this validation as an audit evidence'
      typical_evidence: "1. List of applicable/in-scope information technology products\n\
        2. List of FIPS 201 Approved Products List (also available on idmanagement.gov)\n\
        3. Validate the BU/BE only uses FIPS 201 Approved Products list for Personal\
        \ Identity Verification (PIV).\n\nFedRAMP High - The following attribute should\
        \ be validated for CCF-IAM-02.21: need to include a policy regarding time\
        \ period and ensure it is configured as such.\n\nFedRAMP Moderate & High -\
        \ The following attribute should be validated for CCF-IAM-02.21: \n- BU needs\
        \ to provide capability of accepting PIV/CAC for an agencies (not just internal),\
        \ and only accept FICAM approved credentials/information system components\
        \ and profiles.\n- this is agency responsibility, and that BU is only responsible\
        \ for allowing agency to use PIV/CAC option.\n\nCCCS medium cloud profile\
        \ specific requirement:\nIf there are any hard-tokens used for system access\
        \ such as an RSA token or Yubikey, they should follow CCCS's ITSP.30.031 token\
        \ quality requirements."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-199
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 199
      name: Default Supplier Passwords
      description: Supplier supplied default passwords are changed prior to device
        installation on the organization network or immediately after software or
        operating system installation.
      annotation: "1. Review the password policy at organization.\n2. Organization\
        \ shall ensure that Supplier supplied default passwords should change prior\
        \ to device installation on the organization network or immediately after\
        \ software or operating system installation.\n3. Each Systems shall validate\
        \ that all default accounts in the production instances are changed prior\
        \ to use. \n4. If possible, access to all applications and devices should\
        \ at the minimum follow Corporate AD and log in procedures (VPN)."
      typical_evidence: "1. Provide with the documented password policy \n2. Review\
        \ application and system access to validate default passwords are not being\
        \ used. \n3. Validate applications follow organization AD and VPN.\n4. If\
        \ not, validate application access passwords have been changed from the default\
        \ password provided if applicable. \n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-IAM-02.22: have policies/standards\
        \ in place for:  Establishing and implementing administrative procedures for\
        \ initial authenticator distribution, for lost/compromised or damaged authenticators,\
        \ and for revoking authenticators;\n\nChanging default content of authenticators\
        \ prior to information system installation;\n\nCCCS medium cloud profile specific\
        \ requirement:\nPolicies/standards should be created for:  Establishing and\
        \ implementing administrative procedures for initial authenticator distribution,\
        \ for lost/compromised or damaged authenticators, and for revoking authenticators;\n\
        Changing default content of authenticators prior to information system installation;"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-200
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 200
      name: Remote Activation of Collaborative Computing Devices
      description: Where applicable, collaborative computing devices used at organization
        are configured to restrict remote activation and provide an explicit indication
        that they are in use.
      annotation: '1. Obtain minimum baseline security standard policy or procedural
        document covering considerations for collaborative computing devices. Collaborative
        computing devices include, for example, networked white boards, cameras, and
        microphones.

        2. Identify list of collaborative computing devices that are in-scope

        3. For such computing devices, validate if they are configured to reflect
        baseline security standard/considerations, like - remote activation restriction,
        explicit indication when such devices or related components are in use. Explicit
        indication of use includes, for example, signals to users when collaborative
        computing devices are activated.'
      typical_evidence: '1. Minimum baseline security standard policy or procedural
        document covering considerations for collaborative computing devices

        2. For such computing devices, screenshot from the dashboard reflecting that
        the baseline security standard/considerations are reflected in the configuration,
        like - remote activation restriction, explicit indication when such devices
        or related components are in use'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-201
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 201
      name: Access Tracking and Responsibilities
      description: All successful login accesses and failed attempts are logged.
      annotation: '1. Obtain sample logs to review user specific activities.

        2. Validate if in-scope applications are configured to log all successful
        and failed login attempts.

        3. Validate if in-scope applications are configured to notify users of security
        obligations (such as acceptable use) immediately upon gaining access. A banner
        should be displayed that shows the security obligations.

        4. Validate and confirm that no user has modify access to the repository where
        all the successful and failed login logs are stored

        5. Validate if organization AnyConnect Secure Mobility Client/VPN logs all
        successful and failed attempts of access.'
      typical_evidence: '1.Screenshot of sample logs containing successful and failed
        login attempts

        2. Screenshot showing notification prompt detailing acceptable use upon login

        3. Screenshot of configuration showing all successful and failed login attempts
        will be logged

        4. Screenshot of configuration showing who has access to view/modify logs


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-02.24: all access related activity (account creation, modification,
        enabling, disabling, and removal actions) should be logged.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-202
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 202
      name: Digital Electronic Signature
      description: Digital signatures include timestamps, use industry standard encryption
        programs, and are validated to confirm authenticity.
      annotation: '1. Digital signatures must include timestamps and use standard
        encryption programs. They must be validated to confirm authenticity as well.

        2. Time stamps will be applied to information that is likely to be used as
        electronic evidence in the future.

        3. The pertinent data for the subsequent verification of the date will be
        treated with the same security as the information dated for the purposes of
        availability, integrity and confidentiality.

        4. Time stamps will be regularly renewed until the protected information is
        no longer required by the administrative process it supports.'
      typical_evidence: "1. Procedure for managing digital signature/certificates\n\
        2. List/ Tracker containing details of digital signatures in use and ownership\n\
        3. Cryptographic Controls Policy, Cryptographic Implementation Standard\n\
        4. Tasks from Product Team side to validate and confirm the authenticity \n\
        5. Validate digital signatures include timestamps and use industry standard\
        \ encryption\n\nFedRAMP Moderate & High - The following attribute should be\
        \ validated for CCF-IAM-02.25: DNSSEC using digital signatures must be used,\
        \ not only DNS.\n\nSpanish ENS - The following attribute should be validated\
        \ for CCF-IAM-02.25: this control is only applicable if the offering stores\
        \ digital signatures.\n\nCCCS medium cloud profile specific requirement:\n\
        DNSSEC using digital signatures must be used, not only DNS."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-203
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 203
      name: Cardholder Data Log
      description: "The organization logs the following activity for cardholder data\
        \ environments:\n\u2022 individual user access to cardholder data\n\u2022\
        \ administrative actions\n\u2022 access to logging servers\n\u2022 failed\
        \ logins\n\u2022 modifications to authentication mechanisms and user privileges\n\
        \u2022 initialization, stopping, or pausing of the audit logs\n\u2022 creation\
        \ and deletion of system-level objects\n\u2022 security events\n\u2022 logs\
        \ of all system components that store, process, transmit, or could impact\
        \ the security of cardholder data (CHD) and/or sensitive authentication data\
        \ (SAD)\n\u2022 logs of all critical system components\n\u2022 logs of all\
        \ servers and system components that perform security functions (e.g., firewalls,\
        \ intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication\
        \ servers, ecommerce redirection servers, etc.)"
      annotation: "1. Obtain log management procedure\n2. Ensure the following activities\
        \ for cardholder data environments are logged:\n\u2022 individual user access\
        \ to cardholder data\n\u2022 administrative actions\n\u2022 access to logging\
        \ servers\n\u2022 failed logins\n\u2022 modifications to authentication mechanisms\
        \ and user privileges\n\u2022 initialization, stopping, or pausing of the\
        \ audit logs\n\u2022 creation and deletion of system-level objects\n\u2022\
        \ security events\n3. Ensure logs of all critical system components and system\
        \ components that store, process, transmit, or could impact the security of\
        \ cardholder data (CHD) and/or sensitive authentication data (SAD) are maintained\n\
        4. Ensure logs of all servers and system components that perform security\
        \ functions (e.g., firewalls, intrusion-detection systems/intrusion-prevention\
        \ systems (IDS/IPS), authentication servers, ecommerce redirection servers,\
        \ etc.) are maintained"
      typical_evidence: "1. Provide log management policy/procedure \n2. Provide evidence/snapshots\
        \ of below details being logged for cardholder data environments:\n\u2022\
        \ individual user access to cardholder data\n\u2022 administrative actions\n\
        \u2022 access to logging servers\n\u2022 failed logins\n\u2022 modifications\
        \ to authentication mechanisms and user privileges\n\u2022 initialization,\
        \ stopping, or pausing of the audit logs\n\u2022 creation and deletion of\
        \ system-level objects\n\u2022 security events\n3. Provide evidence of logs\
        \ being maintained for all servers and system components that perform security\
        \ functions\n4. Provide evidence of logs being maintained for all critical\
        \ system components\n5. Provide evidence of logs being maintained for all\
        \ system components that store, process, transmit, or could impact the security\
        \ of cardholder data"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-204
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 204
      name: Password Hashing
      description: The organization uses secure methods and algorithms for saving,
        displaying, and processing passwords such as hashing functions, and ensures
        they are obscured and not displayed in plain text.
      annotation: 1. Ensure secure methods and algorithms such as hashing functions
        are used for saving, displaying, and processing passwords
      typical_evidence: '1. Provide details regarding secure methods and algorithms
        used by organization

        2. Provide snapshots of the algorithms used for saving, displaying, and processing
        passwords


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-02.27: unencrypted static authenticators/passwords are not embedded
        in applications or code or scripts.


        FedRAMP High - The following attribute should be validated for CCF-IAM-02.27:
        Accounts should not use the same authenticator for multiple systems, but if
        they do, there needs to be someway to manage the risk of compromise of multiple
        systems if the authenticator gets comrpromised.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-205
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 205
      name: Interactive Login Management
      description: 'If accounts used by systems or applications can be used for interactive
        login, they are managed as follows:

        - Interactive use is prevented unless needed for an exceptional circumstance.

        - Interactive use is limited to the time needed for the exceptional circumstance.

        - Business justification for interactive use is documented.

        - Interactive use is explicitly approved by management.

        - Individual user identity is confirmed before access to account is granted.

        - Every action taken is attributable to an individual user.

        - Passwords/passphrases for any application and system accounts that can be
        used for interactive login are not hard coded in scripts, configuration/property
        files, or bespoke and custom source code.

        - Passwords/passphrases for any application and system accounts that can be
        used for interactive login are changed periodically and upon suspicion or
        confirmation of compromise.

        - Passwords/passphrases for any application and system accounts that can be
        used for interactive login are constructed with sufficient complexity appropriate
        for how frequently the entity changes the passwords/passphrases.'
      annotation: '1. Verify that application and system accounts that can be used
        interactively and interview administrative personnel to verify that application
        and system accounts are managed in accordance with all elements specified
        in this requirement.

        2. Ensure documentation is in place and that personnel are educated on system
        development procedures to verify that processes are defined for application
        and system accounts that can be used for interactive login, specifying that
        passwords/passphrases are not hard coded in scripts, configuration/property
        files, or bespoke and custom source code.

        3. Ensure that scripts, configuration/property files, and bespoke and custom
        source code for application and system accounts that can be used for interactive
        login, do not have passwords/passphrases for those accounts present.'
      typical_evidence: '1. Examine application and system accounts that can be used
        interactively and interview administrative personnel to verify that application
        and system accounts are managed in accordance with all elements specified
        in this requirement.

        2. Interview personnel and examine system development procedures to verify
        that processes are defined for application and system accounts that can be
        used for interactive login, specifying that passwords/passphrases are not
        hard coded in scripts, configuration/property files, or bespoke and custom
        source code.

        3. Examine scripts, configuration/property files, and bespoke and custom source
        code for application and system accounts that can be used for interactive
        login, to verify passwords/passphrases for those accounts are not present.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-206
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 206
      name: MFA Configuration
      description: MFA systems are configured to be resistant to replay attacks, and
        cannot be bypassed by any users, including administrative users unless specifically
        documented, and authorized by management on an exception basis, for a limited
        time period.
      annotation: "1. Ensure that vendor system documentation is in place demonstrating\
        \ that MFA system is not susceptible to replay attacks.\n2. Verify system\
        \ configurations for MFA are configured in accordance with all elements specified\
        \ in this requirement.\n3. During walkthroughs with employees, verify that\
        \ any requests to bypass MFA are specifically documented and authorized by\
        \ management on an exception basis, for a limited time period.\n4. Verify\
        \ for personnel logging into system components in the CDE, that access is\
        \ granted only after all authentication factors are successful.\n5. Ensure\
        \ that for personnel connecting remotely from outside the entity\u2019s network\
        \ that access is granted only after all authentication factors are successful."
      typical_evidence: "1. Examine vendor system documentation to verify that the\
        \ MFA system is not susceptible to replay attacks.\n2. Examine system configurations\
        \ for the MFA implementation to verify it is configured in accordance with\
        \ all elements specified in this requirement.\n3. Interview responsible personnel\
        \ and observe processes to verify that any requests to bypass MFA are specifically\
        \ documented and authorized by management on an exception basis, for a limited\
        \ time period.\n4. Observe personnel logging into system components in the\
        \ CDE to verify that access is granted only after all authentication factors\
        \ are successful.\n5. Observe personnel connecting remotely from outside the\
        \ entity\u2019s network to verify that access is granted only after all authentication\
        \ factors are successful."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-207
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 207
      name: Root Privileges
      description: Escalating user or account privileges to 'root' [ on development,
        build, and production systems ] is restricted to authorized employees with
        a valid multi-factor (MFA) token [ and an authorized business need ].
      annotation: "1. Obtain population of users escalated to 'root' privileges and\
        \ their corresponding approval. \n2. Ensure only authorized employees with\
        \ a valid multi-factor (MFA) token and an authorized business need were escalated\
        \ to 'root'. \n3. Ensure that appropriate approvals are obtained  BEFORE 'root'\
        \ privileges are granted to any user."
      typical_evidence: "1. Provide a population of users escalated to 'root' privileges\
        \ for the audit period and their corresponding approval. \n2. Provide evidence\
        \ only authorized employees with a valid multi-factor (MFA) token and an authorized\
        \ business need were escalated to 'root'."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-208
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 208
      name: Shared Account Access
      description: For access to non-personal shared accounts, users are authenticated
        with their personal account before being able to access the technical accounts
      annotation: '1. Obtain access records for non-personal shared accounts.

        2. Ensure users were authenticated with their personal account before being
        able to access the technical accounts.'
      typical_evidence: '1. Provide a population of access to non-personal shared
        accounts.

        2. Provide evidence and validate users were authenticated with their personal
        account before being able to access the technical accounts.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-209
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 209
      name: Admin Interface Management
      description: 'The organization separates the administration interfaces made
        available to customers from those made available to its internal and external
        employees, and in particular:

        - The administration accounts under the responsibility of organization shall
        be managed using tools and directories that are separate from those used for
        the management of user accounts under the responsibility of the customer;

        - The administration interfaces made available to customers shall not allow
        for any connection from accounts under the responsibility of organization;

        - The administration interfaces used by organization shall not be accessible
        from the public network and as such shall not allow for any connection from
        accounts under the responsibility of the customer.'
      annotation: "1. Ensure administration interfaces are separate from internal/external\
        \ user interfaces. \n2. Ensure tools and directories used to manage administration\
        \ accounts are separate from those used to manage user accounts.\n3. Ensure\
        \ organization accounts have no ability to connect to customer administration\
        \ interfaces. \n4. Ensure administration interfaces cannot be accessed from\
        \ the public network or accounts under the responsibility of the customer."
      typical_evidence: "1. Provide artefacts demonstrating administration interfaces\
        \ are separate from internal/external user intefaces.\n2. Provide evidence\
        \ that the tools and directories used to manage administration accounts are\
        \ separate from those used to manage user accounts.\n3. Provide evidence organization\
        \ accounts have no ability to connect to customer administration interfaces.\
        \ \n4. Provide evidence administration interfaces cannot be accessed from\
        \ the public network or accounts under the responsibility of the customer."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-210
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 210
      name: Admin Interface Authentication
      description: For an administrative interface accessible from a public network,
        authentication takes place before any interaction between the user and interface.
      annotation: 1. Ensure authentication takes place before any interaction between
        the user and interface for an administrative interface accessible from a public
        network.
      typical_evidence: 1. Provide artefacts demonstrating authentication takes place
        before any interaction between the user and interface for an administrative
        interface accessible from a public network.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-211
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 211
      name: Service Resource Separation
      description: When organization uses an IaaS, CaaS, or PaaS service as the basis
        of another type of service, the resources allocated for the use of organization
        are not accessible via the public interface made available to other IaaS,
        CaaS, or PaaS sponsors.
      annotation: 1. Ensure when organization uses an IaaS, CaaS, or PaaS service
        as the basis of another type of service, the resources allocated for the use
        of organization are not accessible via the public interface made available
        to other IaaS, CaaS, or PaaS sponsors.
      typical_evidence: 1. Provide evidence that when organization uses an IaaS, CaaS,
        or PaaS service as the basis of another type of service, the resources allocated
        for the use of organization are not accessible via the public interface made
        available to other IaaS, CaaS, or PaaS sponsors.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-212
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 212
      name: Shared Account Credential Reset
      description: Upon employee termination or transfer, any privileged shared/group
        account credentials the individual was apart of is reissued/reset.
      annotation: '1. Ensure user access reviews are done monthly. Verify proper tickets
        are raised while making changes to the access rights, and necessary approvals
        are obtained from senior management.

        2. Verify that the report is shared with infosec manager regarding termination,
        transfer of individual, or any changes made in access rights.'
      typical_evidence: '1. Provide evidence of monthly User Access Review carried
        out during audit period

        2. Provide evidence the report is shared with infosec manager regarding termination,
        transfer of individual, or any changes made in access rights.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-213
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 213
      name: Shared Account Justification
      description: Group/Shared accounts that exist must have documented justification
        for use and existance. Access to group/shared accounts is restricted and monitored.
      annotation: "1. Obtain shared account documentation, including who has access\
        \ to the account, who is responsible for managing the account, what the account\
        \ will be used for, and how long the account is needed.\n2. Verify that the\
        \ decision to use a shared account is made with oversight from the security\
        \ team, regulatory bodies, IT management, and system administrators. \n3.\
        \ Verify that shared accounts are documented to include who has access to\
        \ the account, who is responsible for managing the account, what the account\
        \ will be used for, and how long the account is needed."
      typical_evidence: '1. Organization to provide a document that shares the details
        on usage of shared accounts, including:

        - the justification for the shared account.

        - how it''s monitored and audit trails can be audited.

        - configuration evidence of a high level alert when multiple users are accessing
        it.

        2. Provide evidence shared accounts are used in conjunction with a password
        management system. The password management system should keep the password
        secret from its users, and record access to the account (when it was used
        and the system it was used to access).'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-214
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 214
      name: Access Policy
      description: Access control policies are in place and reviewed annually to help
        manage access to information, applications, and production environments. Revision
        histories and review periods are defined within the policies and standards
        themselves and the organization Policy Governance Policy.
      annotation: '1. Policies are maintained that govern access control to information,
        applications, and production environments.

        2. Such policies shall be reviewed annually and documented.'
      typical_evidence: "1. Validate organization has access control policies in place\
        \ governing access to information, applications, and production environments.\n\
        2. Validate these policies are reviewed annually. \n\nTX-RAMP Level 1 & 2\
        \ - The following attribute should be validated for CCF-IAM-03.01: Review\
        \ and update the access control, identification, and authentication:\n\n1.\
        \ Policy every three years and following significant changes and\n2. Procedures\
        \ annually and following significant changes \n\nFedRAMP High - The following\
        \ attribute should be validated for CCF-IAM-03.01: Define access points and\
        \ how system accounts can be used. Ensure defined system behaviors are enforced.\n\
        \nFedRAMP Moderate & High - The following attribute should be validated for\
        \ CCF-IAM-03.01: Define atypical usage of information system accounts, and\
        \ generate audit logs/alerts based on indications of atypical usage."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-215
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 215
      name: Access Control Matrix
      description: A documented user access control matrix of incompatibility between
        access rights is maintained, and enforced when assigning access rights to
        a user.
      annotation: '1. Obtain and observe the user access control matrix of incompatibility
        between access rights.

        2. Ensure the user access control matrix of incompatibility between access
        rights is enforced when assigning access rights such that users are not assigned
        incompatible access rights'
      typical_evidence: '1. Provide the user access control matrix of incompatibility
        between access rights.

        2. Validate no user has been assigned incompatible access rights.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-216
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 216
      name: Segregation of Duties
      description: Segregation of duties are documented and maintained.
      annotation: '1. Obtain documented separation of duties of individuals and information
        system access authorizations to support the separation of duties.

        2. Verify that segregation of duties is documented and maintained.'
      typical_evidence: '1. Provide documented separation of duties of individuals.

        2. Provide documented information system access authorizations to support
        the separation of duties.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-217
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 217
      name: Contingent Worker Termination
      description: Contingent workers are terminated timely from their contract end
        date.
      annotation: "1. A user access management process for managing contingent workers\
        \ access should be completed and reviewed annually (this can be a corporate\
        \ policy/standard).\n2. Upon contract expiration or contingent worker termination,\
        \ AD access, Directory, and Badge access should be suspended immediately within\
        \ 2 business days.\n3. After 16 days, AD access, Directory, and Badge access\
        \ must be terminated completely (i.e. record removed). \n4. During the 16\
        \ days, access for contingent workers can be extended by 30 days, or the life\
        \ of a new contract, that is approved by management. \n5. If workers have\
        \ access to sensitive tools and applications that have their own log-in credentials\
        \ (i.e. outside of VPN & organization Active Directory), each BU is responsible\
        \ for ensuring contingent worker access to all tools where direct access is\
        \ permitted is terminated timely upon contract end date or termination."
      typical_evidence: '1. Obtain a User access management process for managing contingent
        workers access.

        2. List contingent workers that were terminated within the audit period

        3. For sampled terminated contingent workers or contract expiration contingent
        workers, provide evidence that their access was terminated within 2 business
        days.

        4. Evidence of off-boarding ticket covering end-to-end termination process.

        5. Validate badge access was removed timely as wekk,


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-11.01: access is removed within 8 hrs


        CCCS medium cloud profile specific requirement:

        All privileged access held by a terminated contingent worker must be revoked
        within the same day'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-218
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 218
      name: Full Time Worker Termination
      description: Upon termination, full-time employee access is revoked for employees
        in a timely manner.
      annotation: "1. Review the corporate user access management process\n2. As per\
        \ the user access management process, create a ticket or a formal documentation\
        \ chain/thread capturing when the user access was finalized to be terminated\
        \ (Term date), who triggered this task, identify systems/tools that the user\
        \ had access to, confirmation from each application owner stating when they\
        \ deactivated/removed access\n3. If possible, attach screenshots from the\
        \ systems/tools showing that the access was removed within 2 business days\
        \ from the date of termination\n4. Validate access is to all applications\
        \ and active directory is terminated 2 business days within the Workday Termination\
        \ date. \n5. If workers have access to sensitive tools and applications that\
        \ have their own log-in credentials (i.e. outside of VPN & organization Active\
        \ Directory), each BU is responsible for ensuring full time worker access\
        \ to all tools where direct access is permitted is terminated timely upon\
        \ contract end date or termination."
      typical_evidence: "1. User access management process\n2. List employees that\
        \ were terminated within the audit period from Workday\n3. Sample evidences\
        \ showing access revoked for a terminated full time employee within 2 business\
        \ days of termination.\n4. For each sampled terminated user, list of applications\
        \ they had access to\n5. Updated list from SSO or individual applications\
        \ (As applicable) showing access was removed within 2 business days of termination\n\
        6. Evidence of off-boarding ticket covering end to end termination process\n\
        7. Validate badge access was removed timely as well. \n\nTX-RAMP Level 1 &\
        \ 2 - The following attribute should be validated for CCF-IAM-11.02: Disable\
        \ system access within 1 day\n\nFedRAMP High - The following attribute should\
        \ be validated for CCF-IAM-11.02: The organization disables accounts of users\
        \ posing a significant risk within one hour of discovery.\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-IAM-11.02:\
        \ access is removed within 8 hrs"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-219
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 219
      name: Full Time Worker Termination
      description: Upon termination, management is notified to collect organization
        property from terminated employees, and all organization owned assets are
        returned within 30 business days.
      annotation: '1. Obtain HR exit policy/process around access termination and
        procedures around collection of organization property (laptops, etc.)

        2. Validate that a process exists to obtain the asset(s) when organization
        owned asset(s) is/are not returned within 30 business days.

        3. Maintain evidence when the request to return the asset was first requested
        to the terminated personnel and following communication/notification that
        were made

        4. Update IT asset inventory indicating returned assets along with return
        date

        5. Validate within 30 days of the termination date in Workday, assets are
        returned within 30 days. This can be done via approved vendors shipping (FedEx,
        UPS, etc.), or returned physically on site.'
      typical_evidence: "1. HR exit policy/process around access termination and procedures\
        \ around collection of organization property (laptops, etc.)\n2. List employees\
        \ that were terminated within the audit period from Workday\n3. ServiceNow\
        \ or export from IT asset tracking and management system mapping users (organization\
        \ personnel) to organization IT assets assigned\n4. For the sampled terminated\
        \ users sample, provide evidence that covers the following:\n\u2022 Evidence\
        \ when the terminated employee was notified to return the asset(s)\n\u2022\
        \ Evidence when the asset(s) was returned\n\u2022 If the asset was not returned\
        \ within 30 business days, evidence steps taken to ensure asset(s) was obtained\n\
        5. Updated IT asset inventory indicating returned assets along with return\
        \ date"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-220
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 220
      name: Full Time Worker Termination
      description: Upon termination, all privileged access held by a terminated employee
        is revoked within 48 hours.
      annotation: '1. Obtain user access management process for managing privileged
        access

        2. Verify if process includes requirements to revoke privilege access for
        employees within 48 hours of termination

        3. Upon a user is marked as terminated in workday, all privileged access related
        to the user is removed within 48 hours either automatically or manually.'
      typical_evidence: '1. User access management process for managing privileged
        access

        2. List of terminated employees

        3. Sample evidences showing privilege access revoked for a terminated employee
        within 48 hours of termination.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IAM-11.04: access is removed within 8 hrs


        CCCS medium cloud profile specific requirement:

        All privileged access held by a terminated employee must be revoked within
        the same day'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-221
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 221
      name: Termination Notification
      description: The People Resources system sends a notification to relevant personnel
        in the event of a termination of an employee.
      annotation: "1. Once a user is marked as terminated in workday, the relevant\
        \ personnel, such as the user's managers, are notified of the termination.\
        \ \n2. Notifications can include either a WebEx message, email, or alternative\
        \ method of communication."
      typical_evidence: '1. Obtain list of terminated employees.

        2. Validate a notification was sent to relevant personnel such as managers
        regarding the termination.


        TX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-IAM-11.05:
        Add a time period for notification (organization defined).


        FedRAMP High - The following attribute should be validated for CCF-IAM-11.05:
        there should be an automated mechanism for notification.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-222
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 222
      name: Termination Exit Interviews
      description: Upon employee termination, management conducts exit interviews
        for the terminated employee.
      annotation: '1. Once a user is terminated in workday, corresponding exit interviews
        are conducted. HR, managers, legal, or any other relevant team shall be involved
        in the exit interview process.

        2. A record of the interview shall be retained via calendar invite, Workday
        tracking, or alternative method of tracking.'
      typical_evidence: '1. Obtain a list of terminated employees.

        2. Validate an exit interview was conducted for each relevant terminated employee.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-223
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 223
      name: Transfer Access
      description: Upon notification of an employee reassignment or transfer, management
        reviews the employee's access for appropriateness. Access that is no longer
        required is revoked and documented.
      annotation: "1. When an employee transfers teams in Workday, each employee's\
        \ corresponding access should be reviewed and adjusted as necessary.\n2. The\
        \ employee's previous manager is responsible for ensuring all access is adjusted\
        \ accordingly. \n3. As part of the review process, a ticket or alternative\
        \ documentation method should be retained demonstrating a review of the employee's\
        \ access, and the changes of access that occurred."
      typical_evidence: '1. Obtain user access management process

        2. List of employee reassignment/transfers from Workday

        3. For sample of employee transfers/reassignment, validate access review was
        documented, and access was adjusted accordingly.

        4. Sample list of transferred/reassigned employees and validate access was
        appropriately removed if applicable, by validating the user no longer has
        access to the previous team''s applications.


        TX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-IAM-11.07:
        notify within 5 days following formal transfer action'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-224
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:access-management
      ref_id: CCF 224
      name: Alternative Resources
      description: Upon employee termination, management validates there are sufficient
        resources for ongoing operations.
      annotation: 'Upon the termination of individual employment:

        1. The management confirms there are enough resources available for continuous
        operations

        2. Verify organization disables information system access within the organization-defined
        time period

        3. Verify that organization terminates/revokes any authenticators/credentials
        associated with the individual

        4. Ensure organization conducts exit interviews that include a discussion
        of organization-defined information security topics

        5. Verify organization retrieves all security-related organizational information
        along with system/personnel-related property

        6. Ensure organization retains access to organizational information and information
        systems formerly controlled by terminated individual, and

        7. Verify organization notifies personnel or roles within the organization-defined
        time period'
      typical_evidence: '1. Provide list of available resources for the continuous
        operations of the ongoing projects

        2. Provide the organization-defined time period to disable the information
        system access of the personnel

        3. Provide the list of defined information security topics on which the exit
        interviews rely upon

        Provide the defined time period on which organization notifies the personnel
        about the termination'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      assessable: false
      depth: 1
      name: Infrastructure Operations
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-225
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 225
      name: Monitoring Event Trends
      description: A log management tool is utilized to identify trends that may have
        a potential impact on the Systems's ability to achieve its security and privacy
        objectives.
      annotation: '1. Obtain and observe standards and policies in place corresponding
        to log management.

        2. Ensure a log management tool is in place to identify trends that may have
        a potential impact on the Systems''s ability to achieve its security and privacy
        objectives.'
      typical_evidence: "1. Provide relevant standards and policies regarding log\
        \ management.\n2. Provide log management tool configurations \n3. Provide\
        \ evidence the log management tool is used to identify trends that may have\
        \ a potential impact on the Systems's ability to achieve its security and\
        \ privacy objectives.\n\nFedRAMP Moderate & High - The following attribute\
        \ should be validated for CCF-IVS-01.01: \n- Define atypical usage of information\
        \ system accounts, and generate audit logs/alerts based on indications of\
        \ atypical usage.\n- Audit logs need to be reviewed weekly, and a SIEM tool\
        \ should be used to help generate reports/dashboards/alerts that are reviewable\
        \ and able to be reported on. \n- Logging/SIEM tool does not alter the original\
        \ content or time ordering of audit records.\n\nCCCS medium cloud profile\
        \ specific requirement:\nSIEM tool should be used to help generate automated\
        \ reports/dashboards/alerts that are reviewable and able to be reported on."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-226
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 226
      name: Network Security Monitoring
      description: An intrusion detection system (IDS) and intrusion prevention system
        (IPS) are used to provide continuous monitoring of the Company's Corporate
        network and early detection of potential security breaches.
      annotation: "1. Identifying scope for continuous monitoring of organization's\
        \ network that may include but not limited to: network and infrastructure\
        \ devices, systems, applications, services/products etc.\n2. Verify if intrusion\
        \ detection system (IDS) and prevention system (IPS) are implemented on organization's\
        \ Corporate network from the Network Diagram to detect any potential security\
        \ breaches on its network. \n3. Validate if adequate staffing of personnel\
        \ is in place responsible for continuous monitoring (real-time) of IDS and\
        \ IPS and for responding to various information security incidents, events\
        \ and breaches.\n4. Verify if internal and external communication strategies\
        \ and Service Level Agreements (SLAs) are in place to ensure early detection\
        \ of incidents that will allow timely response and recovery from incident,\
        \ events and breaches.\n5. All events and breaches should be followed up and\
        \ resolved in a timely manner. Resolution should be documented, and communicated\
        \ to appropriate parties/management. \n6. BU's should explore using IDS and\
        \ IPS systems as well to protect their production instances of their applications."
      typical_evidence: "1. Network Monitoring policy and evidence of most recent\
        \ review and signoff\n2. Network architecture diagram (HLD / LLD)\n3. Security\
        \ Incident management process\n4. Validate organization's corporate network\
        \ includes IDS and IPS systems to monitor security breaches.\n5. Validate\
        \ if there have been any breaches, and if so, corresponding documentation\
        \ and follow up were completed to resolve the breach. Corresponding parties\
        \ are notified as part of the breach. \n6. Validate if BU's production instances\
        \ have IDS/IPS mechanisms in place as well.\n\nFedRAMP Moderate & High - The\
        \ following attribute should be validated for CCF-IVS-01.04: \n- IDS/IPS/WAF\
        \ is used to prevent information from being shared to other systems that is\
        \ shouldn't be shared to. Additionally, information should not be able to\
        \ be re-used or leaked to multiple locations. In addition, that these are\
        \ used to prevent DOS/DDOS attacks.\n- IDS implemented should be both signature\
        \ based and heuristic-based.\n- If BU's have physical devices on prem that\
        \ they need wireless intrusion detection systems to be in place on wireless\
        \ networks. \n- A host-based detection/and/or IDS such as Tripwire or Trend\
        \ Micro should be used."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-227
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 227
      name: Virtual Machine Integrity Check
      description: Where applicable, the information system performs an integrity
        check of virtual machine images at startup, restart, shutdown and abort transitional
        states. The system alerts administrators of any potential discrepancies during
        integrity verification.
      annotation: '1.  Cloud Systemss, hardening must be managed, reviewed, and updated
        periodically, including whenever the Systems is enhanced or changed, and upon
        discovery of new threats.

        2. Integrity check should be configured in virtual machine at startup, restart,
        shutdown and abort transitional states.

        3. Resolution steps should be taken in case of potential discrepancies during
        integrity verification and check

        4. The Integrity check must be done at start-up. If the image is not restarted,
        shutdown or aborted then no additional integrity checks need to be performed.
        An integrity check must only be performed should any of those events occur.'
      typical_evidence: '1. Provide the configuration of the integrity check of virtual
        machine images at startup, restart, shutdown and abort transitional states.

        2. List of administrators from the tool who will receive the alert notification

        3. Provide alert notifi+cation configuration settings

        4. For a Selected  sample provide the potential discrepancies identified  using
        integrity verification and check what resolution been taken to act upon that
        action.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IVS-02.01: baseline security checks must be done before any new asset
        gets added, and that baseline security checks are being done upon start, patch,
        booted, etc. Basically ensuring a minimum baseline security set is maintained
        for all hardware/server/environment.


        FedRAMP High - The following attribute should be validated for CCF-IVS-02.01:
        that alert is created and resolved timely.


        CCCS medium cloud profile specific requirement:

        Baseline security checks must be done before any new asset gets added, and
        that baseline security checks are being done upon start, patch, booted, etc.
        Basically ensuring a minimum baseline security set is maintained for all hardware/server/environment.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-228
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 228
      name: Virtual Machine Integrity Check
      description: Networks used by organization's Systems to migrate or create virtual
        machines are logically separated from other networks.
      annotation: '1. Network architecture (HLD / LLD) is defined and documented by
        BU.

        2. If virtual machines are used, the networks used to migrate or create virtual
        machines are segregated from other networks.

        3.  Networks used for the administrative management of the infrastructure
        and for the operation of management consoles are logically or physically separated
        from the cloud customer''s network and protected from unauthorized access
        by multi-factor authentication'
      typical_evidence: '1. Provide network architecture (HLD / LLD)

        2. Provide evidence to show the network details to migrate or create virtual
        machines are logically separated from other networks.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-229
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 229
      name: Virtual Machine Integrity Check
      description: 'If virtual machines or containers are provided, the cloud service
        provider must ensure:

        - Customers can restrict the selection of images of virtual machines or containers
        according to their specifications

        - Informs the customer of any changes made to previous virtual machine or
        container versions.

        - Images are hardened according to generally accepted industry standards.'
      annotation: '1. Validate if virtual machines or containers are provided to customers
        to use.

        2. If virtual machines are provided for customer use, virtual machine integrity
        checks should be performed to ensure customers can restrict the selection
        of images of virtual machines or containers according to their specifications

        3. The Systems informs customers about changes made to previous virtual machine
        or container versions.

        4. Hardening standards are documented and compliance checks are performed
        to validate each customers virtual machine/container is hardened accordingly.

        5. Images should be hardened according to generally accepted industry standards.'
      typical_evidence: '1. Validate if the Systems provides virtual machines or containers
        to customers for use.

        2. If offered, validate customers can restrict the selection of images of
        virtual machines or containers according to their specifications.

        2. Validate the Systems informs customers of any changes made to previous
        virtual machines via communication channel, blog, webpage, or alternative
        method of communication.

        3. The Systems shall harden the images in the virtual machine/container and
        provide evidence of hardening review / compliance check performed for images
        as per generally accepted industry standards.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-230
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 230
      name: Cardholder System Components
      description: Where appliable, System components that store cardholder data (such
        as a database), including payment card collection devices are stored in an
        internal network zone, segregated from the DMZ and other untrusted networks.
        Access is strictly limited to authorized personnel.
      annotation: '1. Ensure system components that store cardholder data, including
        payment card collection devices are stored in an internal network zone

        2. Ensure internal network zone is segregated from the DMZ and other untrusted
        networks

        3. Obtain the list of personnel that need to be granted access to internal
        network zone

        4. Ensure access is strictly limited to only these authorized personnel'
      typical_evidence: '1. Provide evidence showing system components that store
        cardholder data including payment card collection devices are stored in an
        internal network zone

        2. Provide snapshot of internal network zone segregated from DMZ and other
        untrusted networks

        3. Provide list of personnel having access to the internal network zone

        4. For sampled cases, provide evidence showing only authorized users have
        access to the internal network zone'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-231
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 231
      name: Clock Synchronization
      description: The Systems components are configured to use Universal Time Coordinated
        (UTC) and the clocks are synchronized with an external time source. The Systems
        further provides cloud service customers, when applicable, information about
        how the customer can synchronize local clocks with the cloud service clock
        if applicable.
      annotation: "1. NTP configuration should be configured at the hosts/Golden Image\
        \ to synchronize information system time clocks based on International Atomic\
        \ Time or UTC. \n2. For NIST, FedRAMP, and NIST 800-171, considerations around\
        \ using NIST time servers should be considered and evaluated."
      typical_evidence: "1. Validate how components are configured to use UTC and\
        \ how clocks are synchronized. \n2. Validate whether or not the Systems provides\
        \ cloud service customers information on how to synchronize local clocks with\
        \ the cloud service clocks.\n3. If validated, evidence of how/documentation\
        \ of how customers can syncrhonize clocks with the provider.\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-IVS-03.01:\
        \ clocks point to: http://tf.nist.gov/tf-cgi/servers.cgi"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-232
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 232
      name: Access to Modify Time
      description: Access to modify time data is restricted to authorized personnel.
      annotation: '1. Ensure access to modify time data/time-synchronization settings
        is restricted to only personnel with a business need to access time data

        2. Ensure any changes to time settings on critical systems are logged, monitored,
        and reviewed'
      typical_evidence: "1. Provide screenshots of system configurations/time-synchronization\
        \ settings to verify that access to time data is restricted to only  authorized\
        \ personnel \n2. Provide evidence showing any changes to time settings on\
        \ critical systems are logged, monitored, and reviewed"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-233
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 233
      name: Production Firewall Security
      description: Firewalls [or security groups] are used and configured to prevent
        unauthorized access to the production environment.
      annotation: '1. Organization''s Policies and Standards should exist and the
        requirements should be defined for managing network traffic to and from untrusted
        networks.

        2.  Network traffic logs (Security Group report) should go under the Review.

        3.  Security group report, Firewall perimeter policy, Data Center Egress Policy
        and Internet Packet Filtering guide should go under review.

        4. Security rule deviations for cloud accounts to determine whether the identified
        deviations from network security requirements are remediated should go under
        review.'
      typical_evidence: "1. Obtain relevant standards and policies regarding managing\
        \ firewalls.\n2. Please provide Firewall configurations for cloud service/On\
        \ Premise\n3. List of users that have access to modify firewall configurations\n\
        4. Validate how firewall works and if there are any custom configurations\
        \ such as blacklisted IP addresses.\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-IVS-06.01: \n- Define access control\
        \ list within application firewall (i.e. how access to our firewall is done,\
        \ AND how our firewall and network regulates access to our systems to only\
        \ specific addresses)  I.e. we should detail how we regulate right traffic\
        \ into our network/application. \n- implements host based firewalls."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-234
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 234
      name: Firewall Ruleset Review
      description: Firewall rulesets are reviewed by management at least annually.
        Change tickets are created to track any firewall modifications as a result
        of the review.
      annotation: '1.Policy and procedure document should exist in order to govern
        Firewall configuration management

        2.Regular review should be conducted of the Firewall configuration (at least
        annually), records of review meetings should be maintained and configuration
        should be updated as when required based on different threats and vulnerabilities.

        3.Configuration changes of the Firewall should follow the change management
        lifecycle and tracking of changes should be possible.

        4. For each firewall ruleset change, there should be a documentation clearly
        articulating the reason for change, who did the change, who approved the change,
        and when the change was made (date/time-stamp).'
      typical_evidence: '1. Policy and procedure document around Firewall configuration
        management.

        2. List of Firewall configuration reviews conducted during the ruleset review
        period.

        3. Artifacts pertaining to sampled Firewall configuration review meetings.

        4. List of Firewall configuration changes during the review and their corresponding
        ticket.


        PCI - The following attribute should be validated for CCF-IVS-06.02: Firewall
        - review rulesets every 6 months'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-235
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 235
      name: Firewall Equipment
      description: Firewall systems consist of two or more pieces of equipment made
        by different manufacturers, following a waterfall model layout. Redundant
        firewall systems are installed.
      annotation: '1. Physical/Hardware firewall systems must consist of 2 or more
        pieces of equipment made by different manufactures, and follow a waterfall
        model layout.

        2. Redundant firewall systems shall be installed as well.'
      typical_evidence: '1. Validate, if used, physical firewall systems must consist
        of 2 ore more pieces of equipment made by different manufacturers, following
        a waterfall model layout.

        2. Validate redundant firewall systems are installed.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-236
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 236
      name: Firewall DMZ
      description: Firewalls configure and utilize a DMZ to limit inbound and outbound
        traffic to only system components that provide authorized publicly accessible
        services, protocols, and ports.
      annotation: 1. Configure firewalls and utilize a DMZ to limit inbound and outbound
        traffic to only system components that provide authorized publicly accessible
        services, protocols, and ports
      typical_evidence: "1. Provide snapshot of firewall configuration\n2. Provide\
        \ evidence showing DMZ used to limit inbound and outbound traffic\n\nFedRAMP\
        \ Moderate & High - The following attribute should be validated for CCF-IVS-06.04:\
        \ \n- Define access control list within application firewall (i.e. how access\
        \ to our firewall is done, AND how our firewall and network regulates access\
        \ to our systems to only specific addresses)  I.e. we should detail how we\
        \ regulate right traffic into our network/application. \n- Define how many\
        \ points of entry exist in the system. \n- firewall/boundary devices need\
        \ to have fail-secure, i.e. if they fail they will prevent all traffic by\
        \ default"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-237
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 237
      name: Firewall Dynamic Packet Filtering
      description: Firewalls enable dynamic packet filtering on the network.
      annotation: 1. Ensure dynamic packet filtering firewall is enabled
      typical_evidence: 1. Provide evidence of dynamic packet filtering firewall enabled
        on the network
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-238
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 238
      name: ANSSI Computer Guide
      description: The ANSSI [HYGIENE] reinforced level computer guide is applied
        to the information system.
      annotation: 1. Ensure the ANSSI [HYGEINE] reinforced level computer guide is
        applied to the information system.
      typical_evidence: 1. Provide evidence the ANSSI [HYGEINE] reinforced level computer
        guide is applied to the information system.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-239
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 239
      name: Pre-Production Test Data Integrity
      description: Procedures are in place to ensure integrity of test data in pre
        production enviornments where applicable.
      annotation: 1. Verify documented policies and procedures in place corresponding
        to ensuring the integrity of test data in pre-production environments.
      typical_evidence: 1. Provide documented policies and procedures in place corresponding
        to ensuring the integrity of test data in pre-production environments.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-240
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 240
      name: Firewall WAF
      description: A web application firewall (WAF) is installed in front of public-facing
        web applications to detect and prevent web-based attacks.
      annotation: 1. Ensure that a WAF firewall is installed in front of all public-facing
        web applications that detects and prevents web-based attacks.
      typical_evidence: 1. For public-facing web applications, examine the system
        configuration settings and audit logs, and interview responsible personnel
        to verify that an automated technical solution that detects and prevents web-based
        attacks is in place in accordance with all elements specified in this requirement.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-241
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 241
      name: Private IP Address
      description: The organization does not disclose private IP addresses and routing
        information to unauthorized parties.
      annotation: '1. Identify authorized parties

        2. Ensure private IP addresses and routing information is not disclosed to
        unauthorized parties'
      typical_evidence: '1. Provide list of identified authorized parties

        2. Provide evidence showing private IP addresses and routing information is
        disclosed only to authorized parties'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-242
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 242
      name: Network Segmentation
      description: The network is segmented to prevent unauthorized access.
      annotation: "For systems/solutions hosted on AWS :\n\n1. Design the system VPC\
        \ with subnetworks to segment the network into smaller parts isolated in accordance\
        \ with functionality\n2. At minimum configure public and private subnets to\
        \ isolate resources that should not be publicly accessible from those that\
        \ should\n3. To further segment the network, create subnets that contain system\
        \ resources that perform similar functions such as a specific subnet for databases,\
        \ web servers etc.\n4. Assign public IP only to resources that require direct\
        \ access from the public internet\n5. Isolate traffic between private resources\
        \ and the internet via managed interfaces like bastion hosts, elastic load\
        \ balancers, AWS VPNs, and NAT Gateway\n6. Configure Security Groups and NACLs\
        \ for public subnets to explicitly allow public traffic only from the required\
        \ ports and protocols and from a limited set of IPs if possible\n7. Configure\
        \ Security Groups and NACLs to deny ingress traffic by default. Only allow\
        \ communication from private subnets to public subnets that is required\n\
        8. Configure Security Groups and NACLs for private subnets to allow traffic\
        \ only from the public and private subnets in the network that require communication\
        \ for system function. Only permit traffic between subnets where required\
        \ for system operation and only explicitly allow the required ports and protocols\
        \ for that system function\n\nFor systems/solutions hosted on GCP :\n\n1.\
        \ Design the system VPC with subnetworks to segment the network into smaller\
        \ parts isolated in accordance with functionality\n2. At minimum configure\
        \ public and private subnets to isolate resources that should not be publicly\
        \ accessible from those that should\n3. To further segment the network, identify\
        \ further isolation of resources through configuration of subnets that contain\
        \ system resources that perform similar functions such as specific subnet\
        \ for databases, webservers etc.\n4. Assign public IP only to resources that\
        \ require direct access from the public internet\n5. Isolate traffic between\
        \ private resources and the internet via managed interfaces like bastion hosts,\
        \ cloud load balancers, Cloud VPNs, and Cloud NAT\n6. Configure VPC firewall\
        \ rules for public subnets to explicitly allow public traffic only from the\
        \ required ports and protocols and from a limited set of IPs if possible \
        \ \u2022 Configure VPC firewall rules to deny ingress traffic by default\n\
        7. Only allow communication from private subnets to public subnets that is\
        \ required\n8. Configure VPC firewall rules for private subnets to allow traffic\
        \ only from the public and private subnets in the network that require communication\
        \ for system function \n9. Only permit traffic between subnets where required\
        \ for system operation and only explicitly allow the required ports and protocols\
        \ for that system function\n\nFor systems/solutions hosted on other CSP's\
        \ :\n\n1. Configure the system network (VPC) with VLANs (subnets) to segment\
        \ the network into smaller parts isolated in accordance with functionality\n\
        2. At minimum configure public and private VLANs (subnets) to isolate resources\
        \ that should not be publicly accessible from those that should\n3. To further\
        \ segment the network, identify further isolation of resources through configuration\
        \ of VLANs (subnets) that contain system resources that perform similar functions\
        \ such as a specific VLANs (subnets) for databases.\n4. Assign public IPs\
        \ only to resources that require direct access from the public internet\n\
        5. Isolate traffic between private resources and the internet via managed\
        \ interfaces like bastion hosts, load balancers, VPNs, and NAT instances\n\
        6. Configure firewall rulesets for public VLANs (subnets) to explicitly allow\
        \ public traffic only from the required ports and protocols and from a limited\
        \ set of IPs if possible\n7. Configure firewall rulesets to deny ingress traffic\
        \ by default. Only allow communication from private VLANs (subnets) to public\
        \ VLANs (subnets) that is required\n8. Configure firewall rulesets for private\
        \ VLANs (subnets) to allow traffic only from the public and private VLANs\
        \ (subnets) in the network that require communication for system function\n\
        9. Only permit traffic between VLANs (subnets) where required for system operation\
        \ and only explicitly allow the required ports and protocols for that system\
        \ function\n\nNetworks for publicly accessible system components are also\
        \ segregated from internal networks"
      typical_evidence: "1. Provide the network architecture diagram of the system/solution\n\
        2. Provide screenshots of firewall and network configurations showing the\
        \ network is segmented (such as prod vs dev networks), independent databases\
        \ servers, webservers, IP addresses, etc. different types of networks segmented\
        \ \n\nPCI - The following attribute should be validated for CCF-IVS-09.01:\
        \ CDE should be segmented."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-243
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 243
      name: Customer Network Segmentation
      description: Customer environments are segregated such that customers only have
        access to their own environments.
      annotation: '1. Obtain network architecture diagrams for oversight on segregation
        of network environment for each customer

        2. Verify if customers environment are segregated physical and logically (as
        per applicability) to ensure customers only have access to their own environments.

        3. Verify if customer''s environment access to internal environment is filtered
        at network level components(Router, L3 Switches etc.) to prevent logical access.
        Customers should not be able to access other customer instances.'
      typical_evidence: '1. Network architecture diagrams

        2. Validate customers cannot access other customer instances (this can be
        done by creating a demo account or validating via demo with product team)


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-244
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 244
      name: Production Environment Segmentation
      description: Production environments are segregated from non-production environments
        such as development and test environments.
      annotation: "1. Obtain the relevant policy that enforces this requirement and\
        \ ensure segregation of production environment from non-production environments\
        \ such as development and test environments \n2. Production environments and\
        \ non-production environments are segregated. Development and Test environments\
        \ shall not share a same environment as production.\n3. All testing shall\
        \ be performed in development and test environments, and only pushed to production\
        \ upon completion of testing and approval."
      typical_evidence: '1. Provide relevant policy that enforces this requirement

        2. Provide evidence that production environments and non-production environments
        are segregated.


        FedRAMP High - The following attribute should be validated for CCF-IVS-09.03:
        the ability to dynamically isolate/segregate different aspects of info system
        are capable/allowed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-245
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 245
      name: Wireless Access to Network
      description: The organization restricts access to network services via wireless
        access points to authenticated users and services; approved wireless encryption
        protocols are required for wireless connections.
      annotation: "1. Obtain wireless access policy\n2. Access to network services\
        \ shall be limited to specific wireless access points only provisioned to\
        \ authenticated users and services. \n3. Only approved wireless encryption\
        \ protocols are in use for wireless connections. Consideration shall be taken\
        \ for voice over internet protocol (VoIP) to validate it is encrypted if applicable.\n\
        4. Organization's network shall be protected to prevent inappropriate access\
        \ to the network and internal sites\n5. Access to modify the network services\
        \ and access points is limited to a select group of organization users, and\
        \ strictly managed."
      typical_evidence: "1. Wireless access policy\n2. Validate the mechanisms in\
        \ place to control access to organization's network via wireless access points,\
        \ and validate access shall be limited to only organization employees. \n\n\
        TX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-IVS-09.04:\
        \ This control requires network administrators to adjust their DNS settings\
        \ from \u201Cresolve anything\u201D to \u201Ctrust but verify\u201D. Doing\
        \ this requires an overlay of digital signatures and cryptographic keys on\
        \ top of DNS queries to help confirm the identity and authenticity. THis can\
        \ be done via DNSSEC in both parent and child zones.\n\nPCI - The following\
        \ attribute should be validated for CCF-IVS-09.09: Access Mapping - identify\
        \ all authorized and unauthorized wireless access points on quarterly basis"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-246
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 246
      name: Mobile Encryption
      description: Mobile devices (i.e., laptops, smartphones, tablets) that are used
        to access data from organization internal resources are encrypted.
      annotation: '1. Obtain mobile and portable device management policy

        2. All mobile devices that access data from organization''s internal resources
        are encrypted and monitored. Devices that are not adequately encrypted cannot
        access organization''s internal resources.'
      typical_evidence: '1. Mobile and portable device management policy

        2. Sample evidence (screenshot) of mobile device management solution installed
        in the mobile device

        3. Validate mobile devices without sufficient encryption cannot access organization''s
        internal resources


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-247
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 247
      name: Portable Device Security
      description: Where applicable, portable and mobile devices are configured to
        ensure unnecessary hardware capabilities and functionalities are disabled,
        and management defined security features are enabled.
      annotation: "1. Obtain mobile and portable device management policy\n2. Each\
        \ mobile devices should have a mobile device management solution installed\
        \ on each mobile device to monitor and manage the mobile device.\n3. Verify\
        \ portable and mobile devices permissions are managed, and security/admin\
        \ features for each mobile devices is controlled. Baseline security features\
        \ on each mobile device shall not be modifiable by regular users, and shall\
        \ be managed centrally. \n4. Should baseline security features be modified\
        \ or changed to insufficiently meet organization's standards, access to organization's\
        \ internally resources shall be removed/inaccessible. \n5. Access to the mobile\
        \ device management solution should be restricted and limited."
      typical_evidence: '1. Mobile and portable device management policy

        2. Sample evidence (screenshot) of mobile device management solution installed
        in the mobile device

        3. Validate users cannot change baseline security features of a mobile device.
        Should the security features be modifiable, validate access to organization''s
        internal resources will be removed once security features are not sufficient.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-248
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 248
      name: Mobile Device Tampering
      description: Mobile devices (i.e., laptops, smartphones, tablets) are equipped
        with violation detectors that notify relevant parties of any tampering that
        has occurred to the device. Any identified tampering is identified and followed
        up upon until resolution.
      annotation: '1. All mobile devices are equipped with violation detectors that
        notify relevant parties of any tampering that has occurred to the devices.

        2. Any identified tampering is identified and followed up until resolution,
        and an impact assessment shall be identified.'
      typical_evidence: '1. Validate mobile devices are equipped with violation detectors
        that notify relevant parties of any tampering that has occurred.

        2. Validate if there have been any incidents that have occurred so far.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-249
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 249
      name: Production primary function
      description: Only one primary function per server is implemented within the
        production environment; the information system maintains a separate execution
        domain for each executing process.
      annotation: '1. Ensure only one primary function per server is implemented within
        the production environment

        2. Ensure the information system maintains a separate execution domain for
        each executing process'
      typical_evidence: '1. Provide evidence showing only one primary function implemented
        per server in the production environment

        2. Provide evidence of separate execution domain maintained for each executing
        process by information system


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IVS-09.08: teams are expected to use a multi-state processsor such as
        Linux, Redhat, etc. Any single processors will need to have separate execution
        domains for each executing process.


        CCCS medium cloud profile specific requirement:

        Teams are expected to use a multi-state processsor such as Linux, Redhat,
        etc. Any single processors will need to have separate execution domains for
        each executing process.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-250
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 250
      name: Access Point Mapping
      description: At least annually, organization performs an access point mapping
        exercise to identify and remove unauthorized wireless access points.
      annotation: '1. Obtain relevant wireless access policy

        2. Ensure access to network services via wireless access points is restricted
        and only provisioned to authenticated users and services

        3. Perform access point mapping exercise annually to identify and remove unauthorized
        wireless access points'
      typical_evidence: '1. Provide wireless access policy

        2. Provide reports/results of annual access point mapping exercise

        3. Provide evidence showing removal of unauthorized wireless access points(if
        applicable)'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-251
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 251
      name: VoIP
      description: If Voice over Internet Protocol (VoIP) technologies are used, the
        offering establishes restrictions and implementation guidance.
      annotation: '1. Obtain and verify policy in place to ensure that organization
        uses strong password techniques and two factor authentication when using VoIP.

        2. Obtain and verify policy is in place to ensure timely updates are given
        to mobile devices to latest versions of software including security patch
        updates.

        3. Ensure call logs have evidence of monitoring.

        4. Verify organization requires remote employees to use VPN if working from
        home or remotely to protect internet activity including phone calls ( Voip)'
      typical_evidence: "1. Provide policy to ensure that organization uses strong\
        \ password techniques and two factor authentication when using VoIP.\n2. Provide\
        \ policy to ensure timely updates are given to mobile devices to latest versions\
        \ of software including security patch updates.\n3. Provide call logs and\
        \ evidence of monitoring.\n4. Provide evidence organization requires remote\
        \ employees to use VPN if working from home or remotely to protect internet\
        \ activity including phone calls ( Voip)\n\nFedRAMP Moderate & High - The\
        \ following attribute should be validated for CCF-IVS-09.10: \na. Establishes\
        \ usage restrictions and implementation guidance for Voice over Internet Protocol\
        \ (VoIP) technologies based on the potential to cause damage to the information\
        \ system if used maliciously; and\n b. Authorizes, monitors, and controls\
        \ the use of VoIP within the information system.\n\nCCCS medium cloud profile\
        \ specific requirement:\na. Establishes usage restrictions and implementation\
        \ guidance for Voice over Internet Protocol (VoIP) technologies based on the\
        \ potential to cause damage to the information system if used maliciously;\
        \ and\n b. Authorizes, monitors, and controls the use of VoIP within the information\
        \ system."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-252
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 252
      name: Network Diagrams
      description: The Systems has network diagrams that are available to authorized
        personnel upon request.
      annotation: '1. Obtain and verify network diagrams are in place.

        2. Verify network diagrams are available to authorized personnel upon request.'
      typical_evidence: '1. Provide network diagrams.

        2. Provide evidence that upon request, network diagrams are available to authorized
        personnel.


        TX-RAMP Level 2 - The following attribute should be validated for CCF-IVS-13.01:
        Review and update the architectures at least annually


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IVS-13.01: need boundary and security archtiecture diagram that is updated
        annually or as part of a significant change.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-253
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 253
      name: Denial of Service Protection
      description: The Systems or BU has deployed technology to protect against or
        limits the effects denial of service attacks.
      annotation: '1. Obtain threat management process

        2. Each Systems shall include technology shall include an Anti-Ddos solution
        along with endpoint security, intrusion detection and preventions (IDS and
        IPS) are implemented to protect against denial of service attacks

        3. Each Systems''s solution shall include  spam protection mechanisms and
        manage information system access entry and exit points as well

        4. Access to the solution shall be strictly limited, and managed.

        5. Any incidents shall be reported, documented, and tracked to completion.
        Corresponding parties of management and customers shall be notified of any
        successful DDOS attacks as well.'
      typical_evidence: '1. Threat management process

        2. Validate technology used to protect against DDOSS and Spam protection mechanisms.

        3. Validate access to the solution is limited.

        4. Validate if there have been any incidents, and if there were any successful
        incidents, validate a resolution, remediation was documented and corresponding
        communication was included.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-IVS-13.02: offerings need to define the types of attacks BU protects against,
        and what response plan is taken in response.


        CCCS medium cloud profile specific requirement:

        Offerings need to define the types of attacks BU protects against, and what
        response plan is taken in response.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-254
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 254
      name: Sub-system Protection
      description: Sub-systems used for publishing information are protected against
        threats to which they may be exposed, including unauthorized read and alternation,  alternative
        routing, "cross site scripting" attacks, URL and customer information manipulation,
        code injection, and user impersonation.
      annotation: '1. Obtain list of all sub systems or verify asset inventory to
        include sub systems that can publish information

        2. Each sub system shall be adequately protected from threats such as unauthorized
        read and alternation, alternative routing, "cross site scripting" attacks,
        URL and customer information manipulation, code injection, and user impersonation.

        3. Each Systems and central organization site shall have mechanisms to protect
        from DNS spoofing, impersonation, and central secure organization systems
        and pages shall be secure from risks listed above.

        4. Access to such systems shall be strictly monitored and limited.'
      typical_evidence: '1. Asset register / asset inventory

        2. Validate systems have mechanisms in place to protect Systemss and customers
        from DNS spoofing, unauthorized read and alternation,  alternative routing,
        "cross site scripting" attacks, URL and customer information manipulation,
        code injection, and user impersonation.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-255
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:infrastructure-operations
      ref_id: CCF 255
      name: Payment Script Management
      description: "All payment page scripts that are loaded and executed in the consumer\u2019\
        s browser are managed as follows: \n- A method is implemented to confirm that\
        \ each script is authorized.\n- A method is implemented to assure the integrity\
        \ of each script.\n- An inventory of all scripts is maintained with written\
        \ justification as to why each is necessary."
      annotation: "1. Ensure policies and procedures are in place to verify that processes\
        \ are defined for managing all payment page scripts that are loaded and executed\
        \ in the consumer\u2019s browser, in accordance with all elements specified\
        \ in this requirement.\n2. Ensure personnel are informed that all payment\
        \ page scripts that are loaded and executed in the consumer\u2019s browser\
        \ are managed in accordance with all elements specified in this requirement.\n\
        3. Verify inventory records and system configurations demonstrate that all\
        \ payment page scripts that are loaded and executed in the consumer\u2019\
        s browser are managed in accordance with all elements specified in this requirement."
      typical_evidence: "1. Examine policies and procedures to verify that processes\
        \ are defined for managing all payment page scripts that are loaded and executed\
        \ in the consumer\u2019s browser, in accordance with all elements specified\
        \ in this requirement.\n2. Interview responsible personnel and examine inventory\
        \ records and system configurations to verify that all payment page scripts\
        \ that are loaded and executed in the consumer\u2019s browser are managed\
        \ in accordance with all elements specified in this requirement."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      assessable: false
      depth: 1
      name: Privacy
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-256
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 256
      name: Personal Data (or PII) Processing Identification
      description: The Systems identifies, documents, and complies to the specific
        purposes for which the PII will be processed.
      annotation: '1.Privacy policy and procedure documents should be present and
        implemented  in order to ensure that personal identifiable information is
        processed for a specified, explicit and legitimate purpose.

        2.Processing is done only in a manner that is compatible with the specified
        purpose apart from specific exceptions corresponding to national security,
        public health, defense, scientific/historic/ statistical research purposes
        dependent on applicable privacy regulation(s).'
      typical_evidence: "1.Data Privacy Policy and Procedure documents\n2.Validate\
        \ what the Systems uses PII for and validate the Systems uses PII as stated\
        \ in the following documents:\n\u2022 External Privacy Notice\n\u2022 End\
        \ user license agreements\n\u2022 Master Service agreements\n\u2022 Data Flow\
        \ Diagrams around data lifecycle\n\u2022 Documentation around Records of processing\
        \ activity, Privacy by design, Privacy gap assessment reports etc.\n\nSpanish\
        \ ENS High - This control is deemed good to have for Spanish ENS High, but\
        \ not deemed mandatory if remaining ENS controls are effective. If any remaining\
        \ ENS controls are deficient, these controls maybe scoped in as needed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-257
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 257
      name: Lawful Basis for Processing Personal Data (PII)
      description: The Systems determines, documents and complies with the relevant
        lawful basis for the processing of PII for the identified purposes.
      annotation: '1.Privacy policy and procedure documents should be present and
        implemented  in order to ensure that there is a lawful basis for processing  personal
        identifiable information as per the specified, explicit and legitimate purpose.

        2.Processing as per the specified purpose will only be lawful in case the
        criteria for lawful basis applies subject to the applicable privacy regulation(s).'
      typical_evidence: "1.Data Privacy Policy and Procedure documents\n2.Screenshots\
        \ of implemented controls for compliance with processing of personal data\
        \ as per the relevant lawful basis for processing of PII corresponding to\
        \ the specified purpose, such as but not limited to following:\n\u2022 External\
        \ Privacy Notice\n\u2022 End user license agreements\n\u2022 Master Service\
        \ agreements\n\u2022 Data Flow Diagrams around data lifecycle\n\u2022 Documentation\
        \ around Records of processing activity, Privacy by design, Privacy gap assessment\
        \ reports etc."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-258
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 258
      name: Consent for Processing Personal Data (or PII)
      description: When Consent is the lawful basis for the processing of PII, the
        Systems will determine, document, and implement a process by which it can
        demonstrate and record if, when and how consent for the processing of PII
        was obtained from PII principals, as well as determine, document, and implement
        a process to remove consent per the data subject's or their proxy's request.
      annotation: '1.Privacy policy and procedure documents should be present and
        implemented  in order to ensure that when consent is a lawful basis for processing  personal
        identifiable information as per the specified, explicit and legitimate purpose
        appropriate controls are implemented around consent management to demonstrate,
        renew and withdraw consent.

        2.For consent to be lawful basis of processing personal data, it should be
        freely given, informed, unambiguous indication of wishes, withdrawable and
        explicit/implicit dependent on the applicable privacy regulation(s).'
      typical_evidence: "1.Data Privacy Policy and Procedure documents\n2.Screenshots\
        \ of implemented controls for compliance with processing of personal data\
        \ when the relevant lawful basis for processing of PII is consent corresponding\
        \ to the specified purpose, such as but not limited to following:\n\u2022\
        \ External Privacy Notice\n\u2022 End user license agreements\n\u2022 Master\
        \ Service agreements\n\u2022 Data Flow Diagrams around data lifecycle\n\u2022\
        \ Documentation around Records of processing activity, Privacy by design,\
        \ Privacy gap assessment reports etc.\nf)Tracker and corresponding documents\
        \ pertaining to consent management"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-259
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 259
      name: Personal Data (or PII) Privacy Assessment
      description: The Systems must undergo a privacy assessment whenever new PII,  new
        processing of PII or changes to existing processing of PII is planned and
        update/verify the assessment before the Systems is released for production
        or annually if no changes in PII, its processing environment, or controls
        have occurred since the last assessment.
      annotation: "1.Document and maintain the Privacy Information Security Management\
        \ System Risk Assessment Methodology with the requirement to conduct a privacy\
        \ risk assessment on an annual basis including risk mitigation strategies\
        \ and acceptable levels defined based on organization risk criteria pertaining\
        \ to risks associated with processing PII. Refer to CCF-PRV-04.01 for additional\
        \ details. \n2.Guidance on high risks pertaining to protection of personal\
        \ data and performance of privacy impact assessment dependent on the applicable\
        \ privacy regulation(s).\n3. Performance of privacy assessments should be\
        \ in conjunction with the organization privacy office. Contact the organization\
        \ privacy office to understand the requirements for coordinating the privacy\
        \ assessment activities and providing required documentation and evidence.\
        \ Ensure that the Privacy Risk assessments are performed on an annual basis\
        \ taking into consideration that threats and changes (environmental, regulatory\
        \ and technological) to service commitments are identified and the associated\
        \ risks are formally assessed and corresponding records are maintained. All\
        \ risks identified in CCF-PRV-04.01 should be considered and included in the\
        \ assessment.\n4. It is the responsibility of the business unit to support\
        \ assessment activities and evidence gathering for applications that fall\
        \ under their scope. Additionally, implementation of the procedures, architectures,\
        \ technologies, and strategies that are necessary to meet the requirements\
        \ of the corporate privacy policy are the responsibility of the business unit\n\
        5. Ensure that the PII Privacy Assessment process is implemented for all existing\
        \ and new applications in-scope. Ensure review of the privacy risk assessments\
        \ and corresponding records are maintained.\n6. Obtain the results of recent\
        \ privacy impact assessment conducted by CSDL team for application and ensure\
        \ gaps were closed as per timelines\n7. Ensure PII privacy assessment is conducted\
        \ whenever new PII, new processing of PII or changes to existing processing\
        \ of PII is planned. Ensure PIMS Risk Assessment is conducted regularly(annually)\
        \ or earlier in case of any changes in the environment, to ensure effective\
        \ management of privacy risks and corresponding documentation is maintained.\n\
        8. Ensure privacy assessment results are updated/verified with appropriate\
        \ approvals before moving applications to production"
      typical_evidence: '1.Data Privacy Policy and Procedure documents, and validate
        if the Systems handles PII.

        2.List of major enhancements around the PII processing operations and corresponding
        reason(s) for performing as well as not performing privacy impact assessment.

        3. Validate if there have been any new PII, new processing of PII, or changes
        to exiting processing of PII that occurred during audit period. Validate corresponding
        privacy impact assessments completed for them.

        4. Provide the documented Privacy Information Security Management System Risk
        Assessment Methodology including risk mitigation strategies and acceptable
        levels defined based on organization risk criteria pertaining to risks associated
        with processing PII.

        5. Provide latest risk assessment and treatment documentation demonstrating
        implementation of methodology and are conducted annually taking into consideration
        threats as well as  changes (environmental, regulatory, and technological)
        to service commitments are identified and the risks related to PII processing
        are formally assessed'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-260
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 260
      name: Personal Data (or PII) Controller & Processor Contract
      description: 'The Systems has written contract with any PII processors or controllers
        that it uses, and shall ensure that their contracts address the implementation
        of the appropriate controls. The controls include but are not limited to:                                                                                                                       A)
        for notice regarding the processing of their PII or changes to the processing
        of their PII (including changes in sub-processors, if any)

        B) to modify or withdraw their consent (if consent if the lawful basis for
        processing the PII)

        C) objection of the processing of their PII

        D) restriction of the processing of their PII

        E) to access, correct and/or erase their PII

        F) retrieve in a secure manner any PII or user-generated content they have
        provided the Systems in human and machine-readable formats

        G) to provide in a secure manner a copy of the PII that is processed

        H) to handle and respond to legitimate requests from PII principals'
      annotation: "1. Each Systems shall define any PII processors it uses, and customers\
        \ (controllers)\n2. Obtain the written contract/data processing agreement\
        \ in place with any PII processors or controllers identified.\n3. Verify agreements\
        \ are in place with processors and controllers that address:\n\u2022 Controls\
        \ for notice regarding the processing of their PII or changes to the processing\
        \ of their PII (including changes in sub-processors, if any)\n\u2022 Controls\
        \ to modify or withdraw their consent (if consent if the lawful basis for\
        \ processing the PII)\n\u2022 Controls for objection of the processing of\
        \ their PII\n\u2022 Controls for restriction of the processing of their PII\n\
        \u2022 Controls to access, correct and/or erase their PII\n\u2022 Controls\
        \ to retrieve in a secure manner any PII or user-generated content they have\
        \ provided the Systems in human and machine-readable formats\n\u2022 Controls\
        \ to provide in a secure manner a copy of the PII that is processed\n\u2022\
        \ Controls to handle and respond to legitimate requests from PII principals\n\
        \n4. Agreements with controllers can be included in the Customer Terms of\
        \ Service or MSA's. Any additional agreements with controllers shall be documented\
        \ and retained. Any individual agreements with controllers shall at the minimum\
        \ address the items above."
      typical_evidence: "1. Provide the list of identified PII processors and customers\
        \ identified.\n2. Validate the agreement between PII Processors and customers\
        \ have the following controls/agreements in place that cover: \n\u2022 for\
        \ notice regarding the processing of their PII or changes to the processing\
        \ of their PII (including changes in sub-processors, if any)\n\u2022 to modify\
        \ or withdraw their consent (if consent if the lawful basis for processing\
        \ the PII)\n\u2022 objection of the processing of their PII\n\u2022 restriction\
        \ of the processing of their PII\n\u2022 to access, correct and/or erase their\
        \ PII\n\u2022 retrieve in a secure manner any PII or user-generated content\
        \ they have provided the Systems in human and machine-readable formats\n\u2022\
        \ to provide in a secure manner a copy of the PII that is processed\n\u2022\
        \ to handle and respond to legitimate requests from PII principals"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-261
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 261
      name: Processing Personal Data (or PII) Obligations
      description: The Systems determines and securely maintain the necessary records
        in support of its obligations for the processing of PII.
      annotation: '1. Each Systems shall evaluate the legal regulations, and agreements
        they have with customers in regards to processing PII.

        2. Each Systems shall go through internal audits to demonstrate their commitment
        toward processing PII.

        3. Each Systems shall have a method of publishing their adherence to obligations
        around processing of PII. This can be done via securely providing SOC reports,
        specialized certification reports/certificates, customer notifications, etc.

        4. Such methods shall be available upon request.'
      typical_evidence: '1. Validate each Systems has evaluated corresponding legal
        regulations and agreements in regards to processing PII.

        2. Validate each Systems goes through internal audits, and have a method of
        communicating their commitment and obligations to processing of PII.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-262
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 262
      name: Personal Data (or PII) Legal, Regulatory, and Business Obligations
      description: "The Systems determines and documents their legal, regulatory and\
        \ business obligations to PII principals (data subjects) related to the processing\
        \ of their PII and provide the means to meet these obligations. These controls\
        \ include but are not limited to:                                        \
        \                                                                        \n\
        A) for notice regarding the processing of their PII or changes to the processing\
        \ of their PII (including changes in sub-processors, if any)\nB) to modify\
        \ or withdraw their consent (if consent is the lawful basis for processing\
        \ the PII)\nC) objection of the processing of their PII\nD) restriction of\
        \ the processing of their PII\nE) to access, correct and/or erase their PII\n\
        F) retrieve in a secure manner their PII  they have provided the Systems in\
        \ human and machine-readable formats\nG) to provide in a secure manner a copy\
        \ of the PII that is processed\nH) to handle and respond to legitimate requests\
        \ from PII principals for PII and provide the means to meet these obligations."
      annotation: "1. Obtain the Privacy Data Sheet/Record of Processing activities,\
        \ Data Inventories and Data Processing Agreements/Binding Corporate Rules,\
        \ all PII related documents the Systems must adhere to.\n2. Evaluate the Privacy\
        \ Data Sheet/Record of Processing activities, Data Inventories and Data Processing\
        \ Agreements/Binding Corporate Rules/PII documents for the following:\n\u2022\
        \ Applicable Data Subject Rights\n\u2022 Cross Border Data Transfer\n\u2022\
        \ Technical and Organization Security Measures\n\u2022 Legal grounds of processing\n\
        \u2022 Appropriate Level of Security across Processors/Joint Controller\n\u2022\
        \ Divisions/Third Parties processing PII/SPI\n\n3. Repercussions of non-compliance\
        \ to such privacy requirements, are articulated and widely known to the relevant\
        \ stakeholders within the organization\n4. Timely review of the Privacy Data\
        \ Sheet/Record of Processing activities, Data Inventories and Data Processing\
        \ Agreements/Binding Corporate Rules, and check document control."
      typical_evidence: '1. Provide Privacy Data Sheet/Record of Processing activities,
        Data Inventories and Data Processing Agreements/Binding Corporate Rules/ other
        PII related documents

        2. Review records of Privacy Data Sheet/Record of Processing activities, Data
        Inventories and Data Processing agreements/Binding Corporate Rules/other PII
        related documents, and validate the Systems has evaluated the processing and
        legal requirements around handling PII.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-263
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 263
      name: Personal Data (or PII) Release Request & Documentation
      description: The Systems determines and documents the information to be provided
        to Customer/Controller and/or PII principals regarding the processing of their
        PII and the timing of such a provision and creates a customer ready document
        detailing this information prior to the Systems being released and makes it
        available or be prepared to make it available upon request once the Systems
        has been released.
      annotation: "1. Obtain the privacy notice and check for the below requirements:\n\
        \u2022 Information about PII/SPI data from Data Subjects and processing operations.\n\
        \u2022 Legal grounds of handling and processing PII\n\u2022 Technical & Security\
        \ measures provided to collected PII/SPI data.\n\u2022 Third Party/Processor\
        \ the PII/SPI data can be shared with..\n\u2022 Rights of Data Subjects.\n\
        \u2022 Cross-Border transfer of collected PII/SPI data.\n\u2022 Explicit consent\
        \ procedure for SPI data collection.\n\u2022 Details of Privacy Grievance\
        \ Office or Data Protection Officer.\n\n2. A document detailing all the above\
        \ items should be maintained, and reviewed at least annually.\n3. This document\
        \ should be readily available to customers to demonstrate legal regulations\
        \ and other considerations have been taken when processing customer PII."
      typical_evidence: '1. Validate each Systems has evaluated corresponding legal
        regulations and agreements in regards to processing PII.

        2. Validate the Systems provides a customer ready document detailing all the
        PII requirements it must adhere to. This can be combined with PRV-01.07 that
        details how they address each requirement as well.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-264
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 264
      name: Privacy & Protection of PII
      description: Privacy and protection of personally identifiable information is
        ensured as required in relevant legislation and regulation where applicable.
      annotation: '1. Ensure legal standards of the geographical location with respect
        to privacy and protection of personally identifiable information are identified
        and documented

        2. Ensure appropriate standards such as encryption, isolated customer environments,
        retention period of customer data, etc. are defined to protect PII

        3. Ensure PII is protected as per the documented requirements'
      typical_evidence: '1. Provide the relevant process documentations maintained
        to ensure protection of PII

        2. Provide identified / documented legal standards as per geographical location

        3. Provide evidence of encryption standards or other measures implemented
        to protect PII as per the legal standards of the geographical location'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-265
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 265
      name: Personal Data (or PII) Withdrawal or Objection Notification to Third Parties
      description: The Systems informs third parties with whom PII has been shared
        of any modification, withdrawal or objections pertaining to the shared PII,
        and implement appropriate policies, procedures and/or mechanisms to do so.
        The offer documents the third parties confirming receipt of updating records
        and use of data per the communication.
      annotation: "1. Each Systems shall have guidelines/procedures with third party\
        \ suppliers where PII has been shared with regarding:\n\u2022 modification\
        \ of PII\n\u2022 Withdrawal or objections around shared PII\n\n2. Each third\
        \ party supplier shall adhere to these procedures, and when requested, make\
        \ the corresponding changes to PII. For example, shall a customer request\
        \ all PII to be deleted and remove, third parties involved in the processing\
        \ of PII shall adhere to this request as well. \n3. Each third party supplier\
        \ shall not modify any customer PII without the consent of the customer or\
        \ Systems."
      typical_evidence: '1. Obtain the guidelines/procedures in regards to handling
        PII with third party suppliers.

        2. Validate the third party supplier adheres to the guidelines/procedures
        by validating third party agreement with them.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-266
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 266
      name: Collection and Processing of Personal Data (or PII)
      description: The Systems limits the collection and processing of PII to the
        minimum that is adequate, relevant, proportional and necessary for the identified
        purposes.
      annotation: "1. Ensure there is a documented formalized process that the personal\
        \ information collected is used\n\u2022 in conformity with the purposes identified\
        \ in the privacy notice\n\u2022 in agreement with the consent received from\
        \ the individual\n\u2022 in compliance with applicable laws and regulations\n\
        2. PII shall only be collected and retained at a minimum. Amount of PII needed\
        \ shall be limited to that needed for the service to operate. Additional PII\
        \ shall not be collected."
      typical_evidence: '1. Provide the PII collection and processing documentation

        2. Provide examples to verify that collection and processing of PII is limited
        to identified purposes only

        3. Provide application PII collection and processing activities walkthrough

        4. Validate all PII collected is necessary for the service, and additional
        PII was not collected.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-267
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 267
      name: Personal Data (or PII) Minimization and De-Identification
      description: The Systems defines and documents data minimization objectives
        and what mechanisms (such as de-identification, pseudonymization, or anonymization)
        are used to meet those objectives. Collection and processing of PII is limited
        to the minimum that is adequate, relevant, proportional and necessary for
        the identified purposes.
      annotation: '1. Each Systems defines and documents the data minimization objectives
        and techniques it uses to manage customer PII.

        2. Each Systems shall use industry best practices to define data minimization
        objectives, and identify industry best practices to meet these objectives
        such as (de-identification).

        3. The Data minimization objectives and mechanisms are reviewed at least annually.'
      typical_evidence: 1. Obtain the document detailing how each Systems adheres
        to data minimization objectives and validate it was reviewed annually.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-268
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 268
      name: Deletion of Personal Data (or PII)
      description: The Systems either deletes PII or renders it in a form which does
        not permit identification or re-identification of PII principals, as soon
        as the original PII is no longer necessary for the identified purpose(s).  This
        includes temporary files created as a result of processing PII.
      annotation: '1. Obtain the documented procedure in place for deletion of PII

        2. Verify that the mechanisms to delete PII are implemented in the Systems.
        Each Systems shall only obtain and retain PII needed for the use of the service.

        3. Evaluate the Systems if either it deletes PII or renders it in a form which
        prohibits identification or re-identification of PII principals, as soon as
        the original PII is no longer necessary for the identified purpose(s). An
        example of this is when a customer requests for deletion, the PII shall be
        adequately removed or re-identified with the customer.

        4. Check if temporary files created as a result of processing PII are also
        deleted when original PII is no longer required'
      typical_evidence: '1. Provide the documented procedure for deletion of PII

        2. Sample records of PII deletion to verify that the PII and temporary files
        created as a result of processing PII were deleted/rendered within the defined
        timeline

        3. Sample select deleted customers, and validate their PII is no longer identifiable
        and/or removed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-269
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 269
      name: Retention of Personal Data (or PII)
      description: The Systems does not retain PII for longer than is necessary for
        the purposes for which the PII is processed.
      annotation: 1. Each Systems shall identify the use of PII and ensure that PII
        is not retained longer than necessary for the purposes for which PII is processed.
      typical_evidence: 1. Validate PII is not processed for longer than is necessary
        for the purposes of providing the Systems's service.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-270
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 270
      name: Access, Correction and Disposal of Personal Data (or PII)
      description: The Systems has documented policies, procedures and/or mechanisms
        for the access, correct, and disposal of PII.
      annotation: "1. Each Systems shall have a document to check whether it addresses\
        \ methods to the access, correction, and disposal of PII has effectively put\
        \ in place controls to ensure appropriate mechanisms are implemented within\
        \ the Systems\n2. Evaluate the documentation around following Data Subject\
        \ Rights:\n\u2022 Access to the PII\n\u2022 Correction of the PII\n\u2022\
        \ Disposal of the PII\n\n3. PII shall never be accessed or corrected without\
        \ the customer's knowledge. Furthermore PII shall only be deleted upon the\
        \ customer request.\n4. Validate these policies and procedures are reviewed\
        \ annually."
      typical_evidence: "1. Obtain documentation that shows how PII is accessed, corrected,\
        \ and disposed of.\n2. Validate that the documentation includes that PII shall\
        \ never be accessed, corrected or deleted without the customers consent. \n\
        3. Validate the documentation was reviewed annually."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-271
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 271
      name: Transfer of Personal Data (or PII)
      description: The Systems identifies and documents the relevant basis for transfers
        of PII between jurisdictions, external entities (i.e., third-parties), and
        internal entities.
      annotation: "1. Each Systems shall evaluate the relevant basis and legal basis\
        \ for transfers of PII between jurisdictions, external entities, and internal\
        \ entities. Each Systems shall adhere to local laws and international laws.\n\
        \n2. Evaluate the Data Processing agreements/Binding Corporate Rules for cross-border\
        \ data transfer.\n\n3. Each Systems shall adhere to the document, and be able\
        \ to. demonstrate adherence to the document. For example, each Systems shall\
        \ follow and demonstrate compliance to local transfer laws of GDPR. \n\n4.\
        \ This document shall be reviewed at least annually and updated accordingly."
      typical_evidence: "1. Obtain each Systems's documentation regarding transfer\
        \ of PII between jurisdictions, external entities, and internal entities.\
        \ \n2. Provide with list of countries, external entities (i.e. third-parties),\
        \ and internal entities to which PII can be transferred to\n3. Validate the\
        \ document was reviewed annually."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-272
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 272
      name: Third Party Disclosure of Personal Data (or PII)
      description: The Systems records all requests, all transfers and all disclosures
        of PII to and from third parties, including what PII has been disclosed, to
        whom and at what time, for what purpose, and will contractually ensure cooperation
        with/from those parties to support future requests related to obligations
        to the PII principals.
      annotation: "1. Each Systems shall retain documentation of all requests, transfers,\
        \ and disclosures of PII to and from third parties\n2. The documentation shall\
        \ include the following:\n\u2022 what PII has been disclosed\n\u2022 whom\
        \ is the PII disclosed to\n\u2022 what time thee PII is disclosed\n\u2022\
        \ purpose of PII disclosure\n\u2022 contractual obligations of third-parties\
        \ to support future requests related to obligations to the PII principals\n\
        \n3. Each Systems is responsible for validating all requests, all transfers,\
        \ and all disclosures of PII to third parties are appropriate, and any inappropriate\
        \ requests are denied.  \n4. All requests should kept and retained in a central\
        \ repository.\n5. If necessary or contractually obligated, corresponding customers\
        \ and parties may be notified of the request, transfers, and disclosures."
      typical_evidence: '1. For all instances of requests, transfers, and disclosures
        of PII to third parties, a record shall be kept.

        2. Sample test all instances of requests, transfers and disclosures and validate
        a record was kept. Validate the request was evaluated for appropriateness.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-273
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 273
      name: Personal Data (or PII) Collection and Processing
      description: The Systems ensures that PII processed on behalf of a customer
        are only processed for the purposes expressed in the documented instructions
        of the customer/controller.
      annotation: "1. Each Systems only obtains and processes PII in a method agreed\
        \ upon with the customer via individual contract, MSA, or Terms of Service.\
        \ \n2. Systemss shall not collect or handle PII outside of the agreement,\
        \ or obtain extraneous PII that is not needed for the use of the service."
      typical_evidence: '1. Validate the Systems only retains PII to what is needed
        to use the service.

        2. Validate the Systems does not inappropriately handle PII, such as for marketing
        purposes, and/or obtain PII that is not needed to use the service. Validate
        all PII requested and obtained serves a purpose for the Systems.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-274
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 274
      name: Processing of Personal Data (or PII) Compliance and Obligations
      description: The Systems determines and maintains the necessary records in support
        of demonstrating compliance with its obligations (as specified in the applicable
        contract) for the processing of PII carried out on behalf of a customer/controller.
      annotation: "1. Perform a review of the regulatory compliance process to assess\
        \ if following processes have been designed at minimum:\n\u2022 Process is\
        \ established to track and manage all applicable privacy legal and regulatory\
        \ requirements\n\u2022 Process involves reviewing on a periodic basis and/\
        \ or whenever there are changes in the privacy landscape\n\u2022 Repercussions\
        \ of non-compliance to such privacy requirements, are articulated and widely\
        \ known to the relevant stakeholders within the organization\n\u2022 Instruments\
        \ are in place that enforce and invoke the liability\n\n2. Verify internal\
        \ or external audit testing results to ensure compliance to the terms of services\
        \ and any other agreements(such as privacy agreements) with customers\n\n\
        3. Verify records supporting systems's ability to demonstrate compliance with\
        \ obligations are available for customers. This can be via organization Trust\
        \ Portal and/or providing SOC reports, ISO certifications, or other accreditations."
      typical_evidence: '1. Provide legal and regulatory requirements list and verify
        all applicable privacy, legal and regulatory requirements have been captured.
        Exceptions if any has to be reported to the senior management

        2. Provide review records and verify if the list is reviewed and updated on
        a regular and/ or whenever there are changes to the legal and regulatory privacy
        acts

        3.Provide evidence of compliance to any specific requirements, this can be
        via internal or external audit reports with findings, published BU webpages
        etc. to demonstrate compliance with the terms of services and any other agreements,
        or real time evidence of any regulations that need to be adhered to.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-275
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 275
      name: Automatic Processing of Personal Data (or PII) Requirements
      description: The Systems identifies decisions made by the Systems based on the
        automatic processing of PII that can have a legal or similarly significant
        effect, so that Systems can get Customer/Controller's instruction on how to
        handle processing of PII to meet legal, contractual, policy, and regulatory
        requirements associated with automatic decision making that may have a legal
        or similarly significant effect on a PII Principal and do not occur without
        human review or approval of the Customer/Controller.
      annotation: "1. Each Systems shall identify and document instances where automatic\
        \ processing of PII may occur. \n2. Once identified, validate if any automatic\
        \ processing of PII that can have a legal or similarly significant effect.\
        \ \n3. Validate if the decisions that can be taken based on the automatic\
        \ processing of PII that can have a legal or similarly significant effect,\
        \ do not occur without human review or approval of the Customer/Controller\
        \ in order to avoid vulnerable data subjects.\n4. Should customers have specific\
        \ requests/agreements regarding the automatic processing of PII, these requests/agreements\
        \ shall be adhered to."
      typical_evidence: '1. Obtain the document highlighting each Systems''s automatic
        processing of PII.

        2. Validate each Systems''s automatic processing of PII is evaluated from
        a legal perspective.

        3. Validate for each instances where there is automatic processing of PII,
        the Systems seeks the customer/controller''s approval and/or has an agreement
        documented in place on how to handle the automatic processing of PII.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-276
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 276
      name: Personal Data (or PII) Accuracy
      description: The Systems documents and validates that PII is as accurate, complete
        and up-to-date as is necessary for the purposes for which it is processed,
        throughout the life-cycle of the PII.
      annotation: "1. Ensure that there is a documented procedure for PII accuracy\
        \ which addresses the following:\n\u2022 PII is accurate; \n\u2022 PII is\
        \ complete;\n\u2022 PII is up-to-date as is necessary for the purpose for\
        \ which it is processed, throughout the lifecycle of PII\n\n2. The Systems\
        \ shall have no users with the ability to modify Customer PII. If needed,\
        \ the Systems can also ask the customer to revalidate the PII details at a\
        \ scheduled cadence."
      typical_evidence: '1. Provide the relevant documentation/process in place to
        ensure PII accuracy

        2. Validate no users have ability to modify customer PII. Or validate there
        is a process in place to have customers validate the accuracy of their PII.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-277
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 277
      name: Personal Data (or PII) Transmission
      description: The Systems subjects PII transmitted (e.g. sent to another organization)
        over a data-transmission network to appropriate controls designed to ensure
        that the data reaches its intended destination.
      annotation: "1. Each Systems identifies instances where PII is transmitted over\
        \ a data-transmission network. \n2. Each Systems validates for each instance\
        \ where PII is transmitted over a data-transmission network, there is a method\
        \ in place to validate data reaches its intended destination. \n3. Validate\
        \ if PII/SPI is protected at motion by deploying encryption protocols, i.e.\
        \ SSL.\n4. Validate if PII/SPI sent over any electronic transmission such\
        \ as email, an end to end email encryption is in place."
      typical_evidence: 1. Validate that PII is securely transmitted over a data-transmission
        network, and has methods to validating the data reaches its intended destination.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-278
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 278
      name: Personal Data (or PII) Disclosures
      description: The Systems notifies customers of any legally binding requests
        for disclosure of customer data or PII, unless prohibited by the legal authority.
      annotation: '1. Each Systems reviews all requests for disclosures for customer
        data or PII. Each Systems shall determine if the request is legally binding
        at all.

        2. Each request shall be documented and kept in a central repository. The
        documentation shall include an assessment of the request, and result of it.

        3. Should a request be legally binding, the Systems notifies the customer
        via a secure channel of the request and disclosure of customer data or PII,
        and includes the corresponding party it is being sent to.'
      typical_evidence: '1. Obtain a list of all request for disclosure of customer
        data or PII.

        2. Validate each request was evaluated and reviewed for appropriateness, and
        the legal appropriateness of the request.

        3. For any legally binding requests for disclosure of customer data or PII,
        validate the customer was notified via a secure channel.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-279
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 279
      name: Personal Data (or PII) Disclosures
      description: The Systems rejects any requests for PII disclosures that are not
        legally binding, and consults the corresponding customer before making any
        PII disclosures and accepting any contractually agreed requests for PII disclosures
        that are authorized by the corresponding customer.
      annotation: "1. Maintain the documented legally binding requests for disclosure\
        \ of customer PII\n2. Ensure PII disclosures other than the ones identified\
        \ as legally binding with customers are rejected and maintain records of the\
        \ same.\n3. Ensure that customers are consulted before making any PII disclosures\
        \ and accepting any contractually agreed requests for PII disclosures. All\
        \ PII disclosures between organization and the customer are reviewed with\
        \ the customer prior to releasing any PII. \n4. Validate PII disclosures made\
        \ are legally binding requests or only post consultation with customer, and\
        \ maintain records of the same."
      typical_evidence: "1. Documented legally binding requests for disclosure of\
        \ customer PII.\n2.Records of PII disclosures other than the ones identified\
        \ as legally binding and notified to customers are rejected. \n3.Records highlighting\
        \ customers are consulted before making any PII disclosures and accepting\
        \ any contractually agreed requests for PII disclosures that are authorized\
        \ by the customer.\n4.Records of PII disclosures made are legally binding\
        \ requests or only post consultation with customer and maintain records of\
        \ the same."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-280
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 280
      name: Personal Data (or PII) Collection
      description: The organization notifies users whether personal information is
        collected from sources other than the user, and validates the information
        was collected fairly and lawfully from reliable sources.
      annotation: "1. Ensure there is a documented formalized process that the personal\
        \ information collected is used\n\u2022 in conformity with the purposes identified\
        \ in the privacy notice\n\u2022 in agreement with the consent received from\
        \ the individual\n\u2022 in compliance with applicable laws and regulations\n\
        \n2. Ensure that PII collected from other sources was obtained fairly and\
        \ lawfully\n\n3. Ensure customers are notified about PII collected from other\
        \ sources than what user provided"
      typical_evidence: '1. Provide the PII collection and processing documentations

        2. Provide application PII collection and processing activities walkthrough

        3. Provide examples of recent notifications being sent to users notifying
        that their personal data is collected from any other sources'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-281
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 281
      name: Compliance with French Regulations
      description: 'For BU operating in France, procedures are in place to to identify
        and confirm compliance to applicable laws and regulations, specifically:

        - personal data [LOI_IL] [GDPR] ;

        - professional secrecy [CP_ART_226-13], where appropriate, without prejudice
        to the application of

        article 40 (2) of the Code of Criminal Procedure concerning reporting to a
        judicial authority;

        - abuse of trust [CP_ART_314-1]

        - the secrecy of private correspondence [CP_ART_226-15];

        - breach of privacy [CP_ART_226-1]

        - fraudulent access to or maintenance of an information system [CP_ART_323-1].


        Procedures would be available to clients upon request.'
      annotation: '1. Obtain procedure documents corresponding to the identification
        and confirmation of compliance to French laws and regulations.

        2. Ensure procedure documents contain guidance related to personal data, professional
        secrecy, abuse of trust, the secrecy of private correspondence, breach of
        privacy, and fraudulent access to or maintenance of an information system.

        3. Verify procedure documents are available to clients upon request.'
      typical_evidence: "1. Provide procedure documents corresponding to the identification\
        \ and confirmation of compliance to French laws and regulations related to\
        \ personal data, professional secrecy, abuse of trust, the secrecy of private\
        \ correspondence, breach of privacy, and fraudulent access to or maintenance\
        \ of an information system. \n2. Provide evidence that procedure documents\
        \ are available to clients upon request."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-282
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 282
      name: Personal Data (or PII) Processing Roles & Responsibilites
      description: The Systems determines respective roles and responsibilities for
        the processing of PII (including PII protection and security requirements)
        with any joint PII controller and ensures that their contracts with any processor
        or joint PII controllers address the implementation of the appropriate controls.
      annotation: "1. Each Systems shall identify their role and responsibility in\
        \ processing PII. If third party vendors/suppliers are involved in the processing\
        \ of PII, each Systems shall identify each party's responsibility in processing\
        \ PII as well.\n2. Validate the roles and responsibilities are documented,\
        \ and included in agreements with any third party vendors/suppliers. \n3.\
        \ Each Systems shall validate the third party vendor/supplier has sufficient\
        \ controls over the processing of PII, and validate the vendor/supplier effectively\
        \ implements the controls on an annual basis. Such validation can come from\
        \ an external supplier/vendor report, SOC report, attestation, etc.\n4. Each\
        \ Systems shall define roles and responsibilities between them and corresponding\
        \ customers as well for the processing of PII."
      typical_evidence: '1. Validate roles and responsibilities are defined between
        the Systems and customers and/or third party vendors and suppliers.

        2. Validate appropriate controls are defined if necessary to validate the
        secure processing of PII.

        3. Validate the Systems obtains evidence of effectiveness of controls called
        out in #2.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-283
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 283
      name: Transfer of Personal Data (or PII)
      description: The Systems specifies and documents the countries and Systemss
        to which PII can possibly be transferred when the company as the processor/controller
        is processing PII.
      annotation: '1. Obtain relevant organizational policy/ and or legal documentation
        that addresses cross-border data transfer requirements and has effectively
        put in place controls to ensure safe transfer of data as per the legal and
        regulatory requirements

        2. Ensure the legal and regulatory requirements are identified and documented

        3. Ensure relevant documentations related to countries and Systemss to which
        PII data can be transferred are maintained

        4. Ensure relevant documentation is maintained on the transfer / storage of
        PII data

        5. Ensure each Systems follows legal and regulatory requirements documented
        when transferring PII. Such regulatory requirements can include GDPR requirements,
        and more.'
      typical_evidence: '1. Provide legal and regulatory requirement documentations

        2. Provide documented evidence on PII information processed or stored

        3. Provide the list of countries and Systemss to which PII can be transferred
        to

        4. Validate the Systems follows the legal and regulatory requirements for
        transferring PII.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-284
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 284
      name: Data Protection Officer
      description: 'The organization has a dedicated independent data protection officer
        who is responsible for following:

        - Reports to management all issues relating to PII

        - Act as a point of contact for supervisory authorities

        - Inform top-level management and employees of the organization of their obligations
        regarding processing PII

        - Review and provide advice on privacy impact assessments conducted by organization.'
      annotation: "1. Ensure dedicated independent Data Protection Officer (DPO) is\
        \ appointed\n2. Maintain documented roles and responsibilities (R&R) of the\
        \ designated DPO\n3. Ensure that as a part as a part of R&R implementation:-\n\
        \u2022 DPO reports all the issues related to PII to the management covered\
        \  and records of the same are maintained.\n\u2022 DPO is a point of contact\
        \ and responsible for communications with supervisory authorities covered\
        \ and records of the same are maintained.\n\u2022 DPO communicates to top-level\
        \ management and employees of the organization of their obligations regarding\
        \ processing PII and records of the same are maintained.\n\u2022 DPO reviews\
        \ and provides advice on privacy impact assessments conducted by organization\
        \ and records of the same are maintained."
      typical_evidence: '1. Documented data protection officer roles and responsibilities.

        2. Evidence of issues related to PII being reported to the management by the
        DPO

        3. Evidence of communication done by DPO to inform top-level management and
        employees of the organization of their obligations regarding processing PII

        4. Evidence of communications with supervisory authority if any in case of
        enquiries/ audits etc. highlighting DPO as a point of contact for communications
        with Supervisory Authority.

        5. Review records by DPO for privacy impact assessments conducted by the organization'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-285
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 285
      name: Personal Data (or PII) Breach and Notification
      description: Relevant Parties are notified in a timely basis when breaches of
        PII occur (with details of the breach, consequences of the breach, and resolution
        taken to resolve the breach), or of any PII transfers between jurisdictions
        and of any intended changes in this regard.
      annotation: '1. Each BU/BE is responsible for reviewing/identifying any breaches
        of PII that may occur.

        2. If there is a breach, each BU/BE must maintain information of latest PII
        breaches

        3. Ensure that relevant parties to be notified of any PII breaches or of any
        PII transfers between jurisdictions or of any intended changes in this regards,
        are identified and documented.

        4. Ensure that means to notify relevant parties to be notified of any PII
        breaches or of any PII transfers between jurisdictions or of any intended
        changes in this regards, are in place and maintain records of the same.

        5. Ensure that relevant parties are timely notified of any PII breaches or
        of any PII transfers between jurisdictions or of any intended changes in this
        regards and maintain records of the same.'
      typical_evidence: '1. Provide contracts and relevant documentation that specifies
        the notification process and associated implications in case of data breach,
        or of any PII transfers between jurisdiction and of any intended changes in
        this regard

        2. Provide list of all events of any PII breaches or of any PII transfers
        between jurisdictions or of any intended changes in this regards and corresponding
        action in terms of  notifications which were sent to relevant parties'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-286
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 286
      name: Personal Data (or PII) Marketing and Advertising
      description: The Systems does not use Pll processed under a contract for the
        purposes of marketing and advertising without establishing that prior consent
        was obtained from the appropriate Pll principal. The organization does not
        make providing such consent a condition for receiving the service.
      annotation: "1. All PII processed by the Systems should not be used for marketing\
        \ and advertising purposes.\n2. If used for marketing and advertising purposes,\
        \ consent must be obtained by the customer first.\n3. Services cannot include\
        \ PII marketing and advertising as a condition to use their service within\
        \ its Terms of Conditions or contracts with customers. \n4. Approval from\
        \ customers for using PII for marketing and advertising purposes should be\
        \ captured within a ticket, contract, and/or email before releasing PII."
      typical_evidence: '1. Provide evidence that PII processed under a contract is
        not used for the purposes of marketing and advertising without consent from
        the appropriate Pll principal.

        2. Records of consent taken from the appropriate PII principal prior to use
        of PII for the purposes of marketing and advertising

        3. Provide the PII collection and processing documentation in order to ensure
        that  consent for usage of PII for the purposes of marketing and advertising
        is not made a condition for receiving the service.

        4. Sample select any instances where PII was used for marketing and advertising,
        and obtain the corresponding consent for it.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-287
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 287
      name: Personal Data (or PII) Customer Obligations
      description: The Systems ensures, where relevant, that the contract to process
        PII addresses the Systems's role in meeting the customer/controller's obligations
        of purpose, minimization, proportionality, security, etc., to meet their contracts
        with their users and regulations where the data is processes (taking into
        account the nature of processing and the information available to the Systems).
      annotation: "1. Follow the corporate privacy policy, or ensure the Systemss\
        \ obligations regarding processing of PII are documented and agreed with the\
        \ customer. The agreement can be implicit and/or included as part of terms\
        \ of service, or more. \n2. The Systems's role and obligation to customers\
        \ in regards to handling customer PII is defined as part of the documentation.\n\
        3. The Systems shall define the type of PII and information it ingests and\
        \ processes it."
      typical_evidence: '1. Provide the PII Customer obligations documentation (if
        they don''t adhere to corporate Privacy policy)

        2. Provide relevant contractual agreements with customers or agreements with
        customers'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-288
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 288
      name: Roles and Responsibilities of Processing of Personal Data (or PII)
      description: The Systems determines respective roles and responsibilities for
        the processing of PII (including PII protection and security requirements)
        including when it is acting on behalf of itself (and does not require instruction
        from the Customer/Controller), when it is acting as proxy for the Customer/Controller
        (and does not require additional permission or instruction) and it requires
        instruction and permission from the Customer and ensure Systems resources
        are appropriately trained.
      annotation: "1. Maintain the documented roles and responsibilities for the processing\
        \ of PII\n2. Ensure and document the roles and responsibilities, including\
        \ the following:\n\u2022 PII protection and security requirements\n\u2022\
        \ When the Systems is acting on behalf of itself and does not require instruction\
        \ from the Customer/Controller\n\u2022 When the Systems is acting as a proxy\
        \ for the Customer/Controller and does not require additional permissions\
        \ or instructions\n\u2022 When the Systems requires instruction and permissions\
        \ from the customer\n3. Ensure that the Systems resources are appropriately\
        \ trained for the identified roles and responsibilities, corresponding records\
        \ are also maintained."
      typical_evidence: '1. Provide the documented roles and responsibilities for
        the processing of the PII

        2. Evidence of training provided to the Systems resources for the identified
        roles and responsibilities


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-289
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 289
      name: Personal Data (or PII) Permissions
      description: The Systems does not use PII processed under a contract for the
        purposes other than providing the contracted services without proper permission
        from the Controller and the PII principals.  The Systems does not make providing
        such permission a condition for receiving the service.
      annotation: '1. Ensure PII is only processed based on the agreed upon terms
        of service and contractual agreement

        2. Any changes to the processing of customer PII must have a prior customer
        approval

        3. Ensure PII processed under a contract is not used for marketing and advertising
        purposes without prior consent from the customer. Additionally, BU teams should
        not make providing such consent a condition for receiving the service'
      typical_evidence: '1. Provide contract between BU and customer

        2. Provide evidence that any changes to the processing of customer PII is
        done post customer approval/consent only

        3. Provide evidence of the process to obtain customer consent before obtaining
        PII'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-290
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 290
      name: Processing of PII Infringement
      description: The Systems informs the customer/controller if, in its opinion,
        a processing instruction received from  the customer/controller infringes
        applicable legislation and/or regulation.
      annotation: "1. Ensure there is a documented process in place for PII infringement\
        \ which covers the following:\n\u2022 Notifying customer/controller if in\
        \ any case a specific processing instruction given by the customer infringes\
        \ a legislation and/or legal regulation; \n\u2022 Seeking additional legal\
        \ counsel in case if any infringement occurs (if needed) prior to fulfilling\
        \ the customer's instructions/request\n\n2. Each Systems should review all\
        \ processing instructions for legislation and/or regulation infringements.\
        \ Legal shall be included in these reviews if needed."
      typical_evidence: '1. Provide PII Infringement process documentation

        2. Provide evidence of notification sent to users in case of PII processing
        requests leads to infringement'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-291
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 291
      name: Subcontractor Processing of Personal Data (or PII)
      description: The Systems discloses to the customer/controller, no less than
        30 days before, any use of third-parties/subcontractors to process PII to
        the customer/controller before use and provides a method for the customer/controller
        to object to any changes.
      annotation: '1. If customer PII is processed by BU and subcontractors are used
        for processing of PII ensure:

        2. BU maintains a list of sub-contractors used for processing of PII

        3. Customers are notified or informed on the use of subcontractors

        4. Each BU will also validate the legal and contractual requirements prior
        to using subcontractors to process PII as well. Within the contract or if
        legally subcontractors cannot be used, this must be adhered to. In addition,
        if any additional legal or contractual procedures exist with the customer,
        these must be adhered to as well.'
      typical_evidence: '1. Provide list of subcontractors used for processing PII

        2. Provide evidence of communication sent to the customer if a subcontractor
        is used for processing PII'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-292
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 292
      name: PII Compliance & Obligations
      description: The Systems provides the customer/controller with the appropriate
        information and access to necessary controls and mechanism such that the customer
        can demonstrate compliance with their obligations.
      annotation: "Need to consider legal and contractual requirements too.\n\n1.\
        \ Ensure obligations of the BU on behalf of customer/controller should be\
        \ documented and maintained \n2. Ensure the Systems provides details and information\
        \ regarding how they are achieving their security obligations to customers.\
        \ This can be done via a newsletter, front facing webpage, SOC report, etc.\
        \ \n3. The Systems reviews and considers legal and contractual requirements\
        \ to the customer and provides documentation showing compliance to those legal\
        \ and contractual requirements\n4. Ensure information request from controller/customer\
        \ around their obligations in terms of design and operating effectiveness\
        \ is shared timely as per the request, post review of authenticity as well\
        \ as applicability and corresponding records are maintained."
      typical_evidence: "1. Documentation around obligations of BU on behalf of customer/controller\
        \  \n2. Validate the Systems provides customers/controllers with appropriate\
        \ information and access to controls via a front facing webpage, SOC report,\
        \ etc. \n3. Any additional legal and contractual requirements should be considered\
        \ as well, and validate the Systems adheres to the legal and contractual requirements\
        \ stated."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-293
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 293
      name: Personal Data (or PII) Subcontractor Changes and Replacement
      description: The Systems, in the case of having general written authorization,
        informs the customer/controller of any intended changes concerning the addition
        or replacement of subcontractors to process PII, thereby giving the customer/controller
        the opportunity to object to such changes.
      annotation: "1. If a BU has subcontractors who process customer PII ensure there\
        \ is documented information in place that covers the following at a minimum\
        \ in case of a change in subcontractor processing PII (addition or replacement\
        \ of subcontractor)\n\n\u2022 Any change in the subcontractor(addition or\
        \ replacement) who processes PII, is notified to customer/controller\n\u2022\
        \ Rights to the controller/customer to object any changes in subcontractor\
        \ who process PII\n\u2022 Notify the customer/controller of alternatives or\
        \ service discontinuity possibility in case if any objection is received"
      typical_evidence: "1. Provide documented information on requirements for processing\
        \ customer PII \n2. Provide the sample notification sent to customer/controller\
        \ in case of any change in the subcontractor processing PII\n3. Provide evidence\
        \ of resolution provided to objections raised by customer/controller for any\
        \ subcontractor changes"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-294
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 294
      name: Customer Log Records
      description: Procedures are in place for customers to request access to their
        own log records. Upon request, organization provides access to the respective
        log records.
      annotation: '1. Ensure documentation of controls and mechanisms to provide customer
        access to their own log records for the in-scope system components

        2. Ensure records of the all requests received are maintained

        3. Ensure review is conducted of the requests, and basis authenticity as well
        as applicability of the request is confirmed upon request of log records.

        4. Ensure documented process is followed out, and log records are provided
        to customers in a secure manner.'
      typical_evidence: "1. Documentation of controls and mechanisms to provide customer\
        \ access to  their own log records for the in-scope system components\n2.\
        \ Artefacts demonstrating following:-\n\u2022 Records of the all requests\
        \ received are maintained.\n\u2022 Review is conducted of all the requests\
        \ and basis authenticity as well as  applicability of the request as per review\
        \ appropriate action is performed.\n\u2022 Implementation and review of all\
        \ the controls as well as mechanisms documented to provide customer access\
        \ to  their own log records  for the in-scope system components. \n\u2022\
        \ sample test any customer requests if applicable, and validate logs were\
        \ provided in a secure manner."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-295
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 295
      name: Privacy Information Security Management System Risk Assessment Methodology
      description: A documented Privacy Information Security Management System Risk
        Assessment Methodology is in place that includes guidance on the identification
        of potential threats related to the processing of PII, rating the significance
        of the risks associated with the identified threats, and mitigation strategies
        for those risks, documentation and communication of those risks, as well as
        possible vulnerabilities within the cloud service provider and their impacts.
        Upper management, or its designated representative(s), owns this methodology
        and is responsible for its adherence.
      annotation: "1. Document and maintain the Privacy Information Security Management\
        \ System(PIMS) Risk Assessment Methodology and ensure it includes guidance\
        \ on the following aspects:\n\u2022 Identification of potential threats related\
        \ to the processing of PII\n\u2022 Rating the significance of the risks associated\
        \ with the identified threats\n\u2022 Mitigation strategies for the identified\
        \ risks\n\u2022 Documentation and communication of the identified risks, as\
        \ well as possible vulnerabilities within the cloud service provider and their\
        \ impacts\n\u2022 Regular review and approval by the upper management, or\
        \ its designated representative(s)\n\n2. Ensure PIMS Risk Assessment is conducted\
        \ regularly(annually) or earlier in case of any changes in the environment,\
        \ to ensure effective management of privacy risks and corresponding documentation\
        \ is maintained.\n\n3. Validate the Methodology is reviewed annually and updated\
        \ if needed."
      typical_evidence: "1. Provide the documented Privacy Information Security Management\
        \ System Risk Assessment Methodology covering following aspects:\n\u2022 Identification\
        \ of potential threats related to the processing of PII\n\u2022 Rating the\
        \ significance of the risks associated with the identified threats\n\u2022\
        \ Mitigation strategies for the identified risks\n\u2022 Documentation and\
        \ communication of the identified risks, as well as possible vulnerabilities\
        \ within the cloud service provider and their impacts\n\u2022 Regular review\
        \ and approval by the upper management, or its designated representative(s)"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-296
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 296
      name: Privacy Risk Assessment Control Mitigation
      description: As part of its annual privacy risk assessment, management selects
        and develops control activities that contribute to the mitigation of identified
        risks.
      annotation: "1. Ensure communication about the results of privacy risk assessments\
        \ conducted annually to management and corresponding records corresponding\
        \ records are maintained. \n2. Ensure review meetings are conducted for finalization\
        \ of controls to mitigate risks identified during privacy risk assessments\
        \ and corresponding records are maintained.\n3. Validate risks from CCF-PRV-04.02\
        \ are reviewed going forward, and have corresponding mitigating or compensating\
        \ controls. If needed, new controls are tested as part of the project plan\
        \ going forward."
      typical_evidence: '1. Evidence of communication of the results of the latest
        privacy risk assessments to management conducted annually.

        2.Evidence of review meetings conducted for finalization of controls to mitigate
        risks identified during privacy risk assessments'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-297
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:privacy
      ref_id: CCF 297
      name: Personal Data (or PII) Restoration Tests
      description: The Systems performs PII restoration tests at least annually. Details
        of the restoration test are logged and include details over who performed
        the test, a description of the restored PII, as well as an integrity check
        of the restored PII.
      annotation: "1. Create a documented PII restoration procedure and a schedule\
        \ for restoration of PII\n2. Ensure PII restoration testing is performed at\
        \ least annually\n3. Review the PII restoration testing process and ensure\
        \ that the details of the restoration tests are logged including following:\n\
        \u2022 Who performed the restoration testing\n\u2022 Description of the restored\
        \ PII\n\u2022 Integrity check performed on the restored PII\n\u2022 Any failures\
        \ are followed up and resolved as part of the restoration test"
      typical_evidence: '1. Provide the documented procedure for performing PII restoration
        testing

        2. Provide evidence of performing PII restoration testing as detailed logs
        about restoration testing(who performed, description of PII restored and integrity
        check of restored data) and corresponding communication.

        3. Validate the restoration test was performed annually.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      assessable: false
      depth: 1
      name: Security Incident
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-298
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 298
      name: Security & Privacy Incident Response
      description: Security incident response policies and procedures are documented
        and communicated to authorized personnel.
      annotation: '1. Security incident management policy and procedure should be
        documented, reviewed and updated based on learning(s).

        2. Incident management policy and procedure provide information on the roles
        and responsibilities of different individuals at the time of incident in order
        to provide an effective response and minimize the impact of an incident.

        3. Incident management policy and procedure should be communicated to authorized
        personnel regularly through training as well as awareness sessions and corresponding
        communication records should also be maintained.  .'
      typical_evidence: "1. Policy and procedure document(s) corresponding to security\
        \ incident management.\n2. Screenshots of artefacts demonstrating communications\
        \ of the policies and procedures to authorized personnel(s).\n3. List of Security\
        \ Incident Response team members\n\nTX-RAMP Level 1 & 2 - The following attribute\
        \ should be validated for CCF-SEF-01.01: Review and update the current incident\
        \ response:\n1. Policy every three years and following significant changes\
        \ and\n2. Procedures annually and following significant changes \n\nReview\
        \ and approve incident response plan at least annually\n\nPCI - The following\
        \ attribute should be validated for CCF-SEF-01.01: Implement an incident response\
        \ plan"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-299
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 299
      name: Security & Privacy Incident Response
      description: Privacy incident response policies and procedures are documented
        and communicated to authorized personnel.
      annotation: '1.Privacy incident management policy and procedure should be documented,
        reviewed and updated based on learning(s).

        2. Incident management policy and procedure provide information on the roles
        and responsibilities of different individuals at the time of incident in order
        to provide an effective response and minimize the impact of an incident.

        3. Incident management policy and procedure should be communicated to authorized
        personnel regularly through training as well as awareness sessions and corresponding
        communication records should also be maintained.


        Note: Corporate control unless BU manages own policy/management standard.
        If BU manages own policy/standard, they must review it annually.'
      typical_evidence: '1. Policy and procedure document(s) corresponding to privacy
        incident management.

        2. Screenshots of artefacts demonstrating communications of the policies and
        procedures to authorized personnel(s).

        3. List of Privacy Incident Response team members


        Note: Corporate control unless BU manages own policy/management standard.
        If BU manages own policy/standard, they must review it annually.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-300
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 300
      name: Security Incident Response Resources
      description: The organization provides incident response resources that offers
        advice and assistance on handling and reporting security incidents for all
        organization employees to use.
      annotation: '1. Ensure Security Incident Management policy and procedure are
        defined and documented

        2. Ensure policy covers requirements for handling and reporting security incidents
        for all organization employees

        3. Ensure communication channel has been established and communicated to aid
        employees by systems advice and assistance to handling security incidents.
        This channel should also serve as a means for organization employees to report
        security incidents

        4. In certain scenarios, organization employee details should be kept anonymous
        and protected, and legal should be consulted depending on the severity of
        the security incident'
      typical_evidence: "1. Provide the documented security incident management procedure\n\
        2. Validate resources and communication channels exist to advise organization\
        \ employees on how to handle and report security incidents.\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-SEF-01.03:\
        \ \n- FedRAMP looks for specific incident response training we provide as\
        \ well for applicable people. In addition, the training should be catered\
        \ to past incident responses and on-going incident handling activities.\n\
        - Organization defines where the IR resources/people reside/are.\n- FedRAMP\
        \ looks for specific incident response training we provide as well for applicable\
        \ people. In addition, the training should be catered to past incident responses\
        \ and on-going incident handling activities.\n- Info spill training is included\
        \ at a scheduled cadence.\n- Organization provides security safeguards for\
        \ making personnel exposed to spilled information aware of the federal laws,\
        \ directives, policies, and/or regulations regarding the information and the\
        \ restrictions imposed based on exposure to such information.\n\nPCI - The\
        \ following attribute should be validated for CCF-SEF-01.03: Review and test\
        \ plan annually \n\nSpanish ENS High - This control is deemed good to have\
        \ for Spanish ENS High, but not deemed mandatory if remaining ENS controls\
        \ are effective. If any remaining ENS controls are deficient, these controls\
        \ maybe scoped in as needed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-301
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 301
      name: Privacy Incident Response Resources
      description: The organization provides incident response resources that offers
        advice and assistance on handling and reporting privacy and human rights incidents
        for all organization employees to use.
      annotation: '1. Ensure privacy and human rights incident management policy and
        procedure are defined and documented

        2. Ensure policy covers requirements for handling and reporting privacy and
        human rights incidents for all organization employees

        3. Ensure communication channel has been established and communicated to aid
        employees by systems advice and assistance to handling privacy and human rights
        incidents. This channel should also serve as a means for organization employees
        to report security incidents

        4. In certain scenarios, organization employee details should be kept anonymous
        and protected, and legal should be consulted depending on the severity of
        the privacy and human rights incident'
      typical_evidence: '1. Provide the documented privacy and human rights incident
        management procedure

        2. Validate resources and communication channels exist to advise organization
        employees on how to handle and report privacy and human rights incidents.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-302
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 302
      name: Incident Response Approval
      description: The organization allows customers to approve a solution for a corresponding
        incident before approving and implementing the solution.
      annotation: "1. Obtain and observe policy and procedure document(s) corresponding\
        \ to security incident management and change management. \n2. Obtain a population\
        \ of incidents from the security incident management tracker and corresponding\
        \ details pertaining to the remediation/closure of the event(s) classified\
        \ as an incident(s).\n3. Obtain snapshots of customer approvals for incident\
        \ solutions. \n4. Ensure that organization allowed customers to approve a\
        \ solution before approving and implementing the solution."
      typical_evidence: "1. Provide policy and procedure document(s) corresponding\
        \ to security incident management and change management. \n2. Provide a population\
        \ of incidents from the security incident management tracker and corresponding\
        \ details pertaining to the remediation/closure of the event(s) classified\
        \ as an incident(s).\n3. Provide corresponding customer approvals for incident\
        \ solutions."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-303
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 303
      name: Security Incident Management
      description: All events related to security, confidentiality, and availability
        are logged, tracked, and evaluated on an on-going basis. When events are triggered
        as incidents, they are evaluated and resolved based on severity levels and
        communicated to affected parties by management until the Company has recovered
        from the incidents.
      annotation: "1. Security incident management policies and procedures should\
        \ be documented, reviewed and updated based on learning(s).\n2. Logging capability\
        \ should be enabled and logs should be generated for different devices in\
        \ the environment. Generated logs should be fed into a (Push/Pull) SIEM solution\
        \ or any other monitoring tool for review/ analysis and tracking of logs.\
        \ Review of each event should include an analysis if the event resulted in\
        \ an Systemss security commitment failure and/or incident.\n3. Regular review\
        \ and update of the use cases in the SIEM/Monitoring solution should be done\
        \ in order to limit the false positive(s).\n4. Security Incident Management\
        \ tracker should be maintained having complete details pertaining categorization,\
        \ investigation and remediation/ closure of the event(s) classified as an\
        \ incident(s).\n5. Events should be created for all events relating to security,\
        \ confidentiality and availability\n6. A log management tool should be utilized\
        \ to identify trends that may have a potential impact on the Systems's ability\
        \ to achieve its security, availability and confidentiality objectives per\
        \ CSDL requirement around CCF-IVS-01.01 - A log management tool is utilized\
        \ to identify trends that may have a potential impact on the Systems's ability\
        \ to achieve its security and privacy objectives. Teams should work with the\
        \ CSDL team directly if they have any questions regarding this CSDL requirement.\n\
        \nAzure:\n\n- Ensure the logging for critical and sensitive Azure resources\
        \ is enabled\n- Ensure the activity log alert exists for create/update/delete\
        \ SQL Server Firewall Rule\n- Ensure diagnostic logs are enabled for all services\
        \ which support it\n- Ensure storage logging is enabled for Queue, Blob and\
        \ Table service for read, write, and delete requests\n\nAWS:\n\n- Ensure CloudTrail\
        \ is enabled in all regions\n- Ensure CloudTrail trails are integrated with\
        \ CloudWatch Logs\n- Ensure S3 bucket access logging is enabled on the CloudTrail\
        \ S3 bucket\n- Ensure a log metric filter and alarm exist for CloudTrail configuration\
        \ changes\n- Ensure a log metric filter and alarms exist for S3 bucket, Network\
        \ Gateway,     Route Tables and VPC policy changes\n- Ensure VPC flow logging\
        \ is enabled in all VPCs\n- Ensure that object-level logging for read/write\
        \ events is enabled for S3 buckets\n- Ensure a log metric filter and alarm\
        \ exist for AWS Management Console authentication failures\n- Ensure a log\
        \ metric filter and alarm exist for disabling or scheduled deletion of customer\
        \ created CMKs\n- Ensure a log metric filter and alarm exist for AWS Config,\
        \ security group and Network Access Control List (NACL) configuration changes\n\
        \nGCP: \n\n- Ensure the log metric filter and alerts exist for critical sensitive\
        \ resource changes\n- Ensure VPC Flow Logs are enabled for every subnet in\
        \ a VPC Network\n\nOther CSP's :\n\n- Enable cloud-native logging if applicable\n\
        - Ensure Linux rsys configs is adequately set for system security logging\
        \ for Linux systems\n- Ensure Windows OS security log is enabled for windows\
        \ systems\n- Enable network and firewall logs\n- Enable Kubernetes logging\
        \ framework for managed clusters"
      typical_evidence: "1. Policy and procedure document(s) corresponding to security\
        \ incident management highlighting event management.\n2. Artefact(s) demonstrating\
        \ that for different devices in the environment logging is enabled, logs are\
        \ generated and generated logs are fed into a(Push/Pull) SIEM solution or\
        \ any other monitoring tool for review/ analysis and tracking of logs.\n3.\
        \ Security incident management tracker and corresponding details pertaining\
        \ to classification, investigation and remediation/closure of events classified\
        \ as incidents.\n4. Validate events around confidentiality, security, and\
        \ availability are captured. Provide all security, confidentiality, and availability\
        \ events during the examination period, and screenshots of parameters/query\
        \ used to generate the report including date and timestamp.\n\nTX-RAMP Level\
        \ 1 & 2 - The following attribute should be validated for CCF-SEF-02.01: Review\
        \ and analyze system audit records at least monthly\n\nAlso, make sure RFI\
        \ includes an increase in review based upon current threat information/increased\
        \ risk\n\nFedRAMP Moderate & High - The following attribute should be validated\
        \ for CCF-SEF-02.01: \n- Audit logs are revisited annually for review.\n-\
        \ The following is included - session, connection, transaction, or activity\
        \ duration; for client-server transactions, the number of bytes received and\
        \ bytes sent; additional informational messages to diagnose or identify the\
        \ event; characteristics that describe or identify the object or resource\
        \ being acted upon\n- audit logs need to be reviewed weekly, and a SIEM tool\
        \ should be used to help generate reports/dashboards/alerts that are reviewable\
        \ and able to be reported on. \n- events include insider threats, information\
        \ spill, , external organization threats, etc.\n- should implement a SIEM\
        \ tool to perform real-time analysis of events. \n\nFedRAMP High - The following\
        \ attribute should be validated for CCF-SEF-02.01: BU should use some type\
        \ of threat intelligence feed into SIEM tool to monitor systems and compromise.\n\
        \nPCI - The following attribute should be validated for CCF-SEF-02.01: Security\
        \ Events - All security events are evaluated at least daily, immediately if\
        \ possible. Daily Review of: \n\u2022  All security events\n\u2022  Logs of\
        \ all system components that store, process, or transmit CHD and/or SAD\n\u2022\
        \  Logs of all critical system components\n\n\n\u2022  Logs of all servers\
        \ and system components that perform security functions (for example, firewalls,\
        \ intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication\
        \ servers, e-commerce redirection servers, etc.).\n\nCCCS medium cloud profile\
        \ specific requirement:\nThe following events are included in audit logs -\
        \ \nsuccessful and unsuccessful account logon events, account management events,\
        \ object access, policy change, privilege functions, process tracking, and\
        \ system events. For Web applications: all administrator activity, authentication\
        \ checks, authorization checks, data deletions, data access, data changes,\
        \ and permission changes"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-304
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 304
      name: Privacy Incident Management
      description: All events related to privacy and human rights are logged, tracked,
        and triggered on an on-going basis. When events are triggered as incidents,
        they are evaluated and resolved based on severity levels and communicated
        to affected parties by management until the Company has recovered from the
        incidents.
      annotation: "1.  Document and maintain privacy incident management policy highlighting\
        \ following aspects:\n\u2022 Monitoring, logging and tracking privacy related\
        \ incidents as well as maintaining corresponding records\n\u2022 Requirement\
        \ to perform root cause analysis of incidents to identify if an incident lead\
        \ to a loss or breach of personal information , evaluate and perform mitigation\
        \ steps as well as maintain corresponding records\n\u2022 Internal and external\
        \ communications to communicate all affected parties and maintaining corresponding\
        \ records\n\n2. Ensure incident communication channel is in place for users\
        \ to report privacy related incident as well as breaches and corresponding\
        \ records are maintained.\n3. Review all incidents that maybe reported internally\
        \ and externally to validate if there are any confirmed incidents effecting\
        \ organization's commitments to privacy.\n4. Maintain a privacy Incident Management\
        \ tracker with all the details around privacy incidents and breaches.\n5.\
        \ Review all incidents that may affect organization's commitments to privacy\
        \ and validate they are followed up upon, and tracked to completion. If needed,\
        \ legal maybe involved as well."
      typical_evidence: "1. Approved documentation around privacy incident management\
        \ policy highlighting following aspects:\n\u2022 Logging and tracking privacy\
        \ related incidents\n\u2022 Requirement to perform root cause analysis of\
        \ an incident to identify if the incident lead to a loss or breach of personal\
        \ information, evaluate and perform mitigation steps\n\u2022 Internal and\
        \ external communications to communicate all affected parties\n2. Validate\
        \ communication channels in place internally and externally to report incidents.\n\
        3. Obtain sample of privacy incidents, and validate the following:\n\u2022\
        \ Monitoring, logging and tracking privacy related incidents\n\u2022 Root\
        \ cause analysis of incidents to identify if an incident lead to a loss or\
        \ breach of personal information and  mitigation steps post evaluation\n\u2022\
        \ Internal and external communications to all the affected parties\n\nSpanish\
        \ ENS High - This control is deemed good to have for Spanish ENS High, but\
        \ not deemed mandatory if remaining ENS controls are effective. If any remaining\
        \ ENS controls are deficient, these controls maybe scoped in as needed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-305
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 305
      name: Cloud Customer Event Logging Requirements
      description: As a cloud service customer, organization has defined its requirements
        for event logging and verify that the cloud service meets those requirements.
      annotation: "1. Document and maintain the requirements for event logging of\
        \ cloud services as a customer in terms of approved organization policy and\
        \ procedure \n2. Organization services that are a cloud service customer (i.e.\
        \ services that utilize AWS, Azure, GCP, and/or other service providers) validate\
        \ with the provider defined requirements in terms of event logging, monitoring,\
        \ alerting/communication and corresponding action details are maintained in\
        \ an audit trail. Each Systems should ensure the cloud service provider meets\
        \ the Systemss and organization's minimum event logging requirements. \n3.\
        \ If insufficient event logging standards are provided, such as length of\
        \ logs, details of logs, etc. each Systems should work with the provider to\
        \ see if the standards can be met. If standards cannot be met, the provider\
        \ should be further analyzed for feasibility and use."
      typical_evidence: "1. Obtain Systems documentation highlighting event logging\
        \ requirements as a cloud service customer.\n2. Evidence that the cloud service\
        \ provider is able to meet the Systems's requirements for event logging and\
        \ audit trail details. \n3. Validate the audit trail and event logs are easily\
        \ requestable and/or accessible by the Systems."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-306
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 306
      name: Cloud Logging Capabilities
      description: The Systems has provided  logging capabilities to its cloud service
        customers upon request.
      annotation: "1. Each Systems should be able to provide an audit log or logging\
        \ capabilities of each customer instance if needed. \n2. The Systems documents\
        \ and maintains the requirements and specifications of event logging capabilities\
        \ which can be provided to cloud service customers upon request\n3. Ensure\
        \ requests from the cloud service customer related to logging capabilities\
        \ are validated and recorded / documented. \n4. Ensure\_logging capabilities\
        \ are provided to its cloud service customers as per the request.\n5. Ensure\
        \ log data is provided to a customer securely, and that only the corresponding\
        \ customer can review the log data requested. \n6. Systemss can provide customers\
        \ an audit log of activity as part of their service. Each customer should\
        \ be given the ability to view their own history/audit log corresponding to\
        \ their own account. Customers shall not be given access to other customer\
        \ account logs."
      typical_evidence: "1. Approved documentation highlighting the requirements and\
        \ specifications of event logging capabilities which can be provided to cloud\
        \ service customers. \n2. Records of all the customers requested for logging\
        \ capabilities. \n3. Artefacts demonstrating that requests from the cloud\
        \ service customer related to logging capabilities are validated and implemented.\n\
        4. Alternatively to 2/3, the Systems can provide customers an audit log of\
        \ activity as part of their service. Customers shall be given the ability\
        \ to access this history/audit log via their own account.\n\nSpanish ENS -\
        \ each offering should be able to provide an audit log or logging information\
        \ capturing the details such as date and time of customer\u2019s last login\
        \ to their instance."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-307
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 307
      name: Intellectual Property Rights Complaints
      description: The cloud service provider establishes a process for responding
        to intellectual property rights complaints. Revision histories and review
        periods are defined within the policies and standards themselves and the organization
        Policy Governance Policy.
      annotation: '1. The cloud service provider shall establish a process for responding
        to intellectual property rights complaints.

        2. The process shall be reviewed annually, and updated accordingly.'
      typical_evidence: '1. Validate a process is defined for responding to intellectual
        property rights complaints.

        2. Validate if any complaints have occurred so far and if it has resulted
        in any implications.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-308
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 308
      name: Cardholder Confirmed Events
      description: "The organization records the following information for confirmed\
        \ events in the cardholder data environment:\n\u2022 user identification\n\
        \u2022 type of event\n\u2022 date and time\n\u2022 event success or failure\
        \ indication\n\u2022 origination of the event\n\u2022 identification of affected\
        \ data, system component, or resource"
      annotation: "1. Ensure at least the following audit trail entries are recorded\
        \ in the audit logs for all system components for each event occurring in\
        \ the cardholder data environment :\n \u2022 User identification\n \u2022\
        \ Type of event\n \u2022 Date and time\n \u2022 Success or failure indication\n\
        \ \u2022  Origination of event\n \u2022 Identity or name of affected data,\
        \ system component, or resource"
      typical_evidence: "1. Provide walkthrough of incident/event management process\
        \ followed for auditable security events in CDE\n2. Provide sample events\
        \ recorded in the cardholder data environment\n3. Provide evidence showing\
        \ the following audit trail entries are recorded in the audit logs:\n\u2022\
        \ User identification is included in log entries\n\u2022 Type of event is\
        \ included in log entries\n\u2022 Date and time stamp is included in log entries\n\
        \u2022 Success or failure indication is included in log entries\n\u2022 Origination\
        \ of event is included in log entries\n\u2022 Identity or name of affected\
        \ data, system component, or resources is included in log entries"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-309
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:security-incident
      ref_id: CCF 309
      name: Privileged Function Management
      description: All privileged functions and activity are logged and monitored.
        Any inappropriate use of privileged functions are followed up upon, and tracked
        to completion.
      annotation: "1. Obtain policy and procedure for the logging and monitoring of\
        \ privileged functions.\n2. Obtain and verify logs of privileged functions\
        \ and evidence of monitoring. \n3. Obtain list of inappropriate use of privileged\
        \ functions and the corresponding tickets for tracking.\n4. Verify any inappropriate\
        \ use of privileged functions are followed up upon, and tracked to completion."
      typical_evidence: '1. Provide list of organization-defined information system
        account types required to support organizational functions and organization-defined
        personnel or roles to grant approvals

        2. Provide organization-defined procedures or conditions to modify information
        system accounts

        3. Validate organization-defined frequency for privileged accounts review'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      assessable: false
      depth: 1
      name: Global Procurement Services
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-310
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 310
      name: Supplier Management Program
      description: 'A supplier management program is in place. Components of this
        program include:

        - Maintaining a list of critical third-party suppliers.

        - Requirements for third-party suppliers to maintain their own security and
        privacy practices and procedures.'
      annotation: '1. Policy and procedure document(s) corresponding to vendor risk
        management governing different steps of vendor lifecycle(Onboarding, review
        and offboarding) should be documented and implemented for all vendor(s).

        2. List of all critical vendors (suppliers) should be maintained as well as
        reviewed and updated at a regular frequency.

        3. Security compliance related requirements/clauses should be addressed in
        the contract(s) for all vendor(s).'
      typical_evidence: "1. Policy and procedure document(s) corresponding to vendor\
        \ risk management governing different steps of vendor lifecycle(Onboarding,\
        \ review and offboarding)\n2. List of critical vendors (suppliers)\n3. Artefacts\
        \ demonstrating implementation of the process corresponding to vendor risk\
        \ management for some sampled vendors across different stages.\n4. Artefacts\
        \ demonstrating that security requirements are addressed in the vendor contracts\
        \ via. MSA, SOW, etc.\n\nTX-RAMP Level 1 & 2 - The following attribute should\
        \ be validated for CCF-STA-01.01: \n- Once a supplier can't provide maintenance/support,\
        \ we stipulate in our contracts we EOL them.\n- external providers to notify\
        \ of any personnel transfers or terminations of external personnel who possess\
        \ organizational credentials and/or badges, or who have system privileges\
        \ within 1 day\n- Review and update the current system and services acquisition:\n\
        1. Policy every three years and following significant changes and\n2. Procedures\
        \ annually and following significant changes \n\nFedRAMP Moderate & High -\
        \ The following attribute should be validated for CCF-STA-01.01: \n- must\
        \ be an ATO'd tool.\n- external services can only be used that match the same\
        \ level as the system being tested/audited.\n- a focus on ports, protocols,\
        \ services and functions should be discussed in these agreements and be front\
        \ of mind when deciding which external services to connect to\n\nSOC 2 (A/C/S)\
        \ 2022 - The following attribute should be validated for CCF-STA-01.01: communication\
        \ protocols are established within requirements\n\nCCCS medium cloud profile\
        \ specific requirement\n- must be an ATO'd tool."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-311
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 311
      name: Supplier Exit Strategy
      description: For critical suppliers, exit strategies and/or alternative supplier
        relationships are established.
      annotation: '1. Ensure documentation in terms policy and/or procedure around
        the vendor/ supplier management in order to manage supplier/vendor risks.

        2. Maintain a list of all high dependency /critical suppliers. High dependency
        / critical suppliers can be identified as any supplier that effects the security,
        confidentiality, and availability of the Systems

        3. Ensure for all the suppliers in the above list exit strategies and alternate
        supplier relations are in place to ensure continuity of services'
      typical_evidence: '1. List of high dependency suppliers

        2. List of alternate suppliers identified

        3. Documented exit strategies with high dependency suppliers and corresponding
        process around vendor/supplier management.


        Spanish ENS High - This control is deemed good to have for Spanish ENS High,
        but not deemed mandatory if remaining ENS controls are effective. If any remaining
        ENS controls are deficient, these controls maybe scoped in as needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-312
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 312
      name: Supplier Management Program
      description: At least annually, management reviews controls within third party
        assurance reports to ensure that they meet organizational requirements; if
        control gaps, significant changes, or reported incidents are identified in
        the assurance reports, management takes action to address the impact the disclosed
        gaps have on the organization.
      annotation: "1. Corporate team enforces a relevant policy to manage the information\
        \ security aspects for the third-parties related to organization. It should\
        \ cover the security aspects in complete life-cycle of a third-party, encompassing\
        \ activities from selection of a service provider to disengagement of the\
        \ third-party (or service provider) \n2. BU team needs to ensure the defined\
        \ process is followed and relevant documentation is maintained\n3. Both Corporate\
        \ and BU team needs to ensure they obtain all relevant third party suppliers\
        \ (vendors)  attestation/assurance reports for their respective in scope vendors\n\
        4. Evaluate third party assurance reports and ensure controls within third\
        \ party assurance reports are reviewed by management at least annually\n5.\
        \ Evaluate identified control gaps in third party assurance reports and ensure\
        \ \nsignificant changes, and incidents are reviewed for impact and included\
        \ in risk assessment, as and when required"
      typical_evidence: '1. Vendor review criteria(s)

        (Audit/ Self-Assessment/ Independent Review reports).

        2. Tracker highlighting list of critical vendors and corresponding details
        as well as status of the review(Pass/Fail/Remediation/In Progress).

        3. Sampled vendor review results and corresponding remediation steps in case
        of findings.


        PCI - The following attribute should be validated for CCF-STA-01.03: Yearly
        review of backup facility is missing. Include an audit program to check PCI
        DSS compliance status annually.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-313
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 313
      name: Suppliers residing in KSA
      description: Contracts and agreements with third-party IT outsourced suppliers
        must include that cybersecurity managed services centers for monitoring and
        operations must be completely present inside the Kingdom of Saudi Arabia
      annotation: '1. Ensure that the contracts and agreements are in place with third-party
        IT outsourced suppliers

        2. Additionally, ensure that it''s clearly defined  within the contracts/agreements
        that the cybersecurity managed services centers for monitoring and operations
        must be completely present inside the Kingdom of Saudi Arabia'
      typical_evidence: 1. Provide sample third-party IT outsourced suppliers contracts
        and agreements clearly defining that cybersecurity managed services centers
        for monitoring and operations must be completely present inside the Kingdom
        of Saudi Arabia
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-314
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 314
      name: National Cybersecurity Authority requests
      description: The organization evaluates all National Cybersecurity Authority
        requests to remove software or services provided by third-party providers
        for appropriateness, and will remove the software or service upon validation
        of the request.
      annotation: '1. Obtain sample requests received from National Cybersecurity
        Authority to remove software or services provided by third-party providers

        2. Evaluate appropriateness of these requests

        3. Ensure that the third-party software or service is removed only post successful
        evaluation of National Cybersecurity Authority request for removal'
      typical_evidence: '1. Provide sample reports of evaluations done for National
        Cybersecurity Authority requests to remove software or services provided by
        third-party providers

        2. Provide details of third-party software or service removed upon validation
        of request'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-315
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 315
      name: Incident Response Plan
      description: The Company or Systems has established an incident response plan
        that is tested at least annually to assess the effectiveness of the incident
        response program.
      annotation: '1. Obtain relevant policy that enforces the incident response plan/program

        2. Contact the corporate Incident Response (IR) team to understand the requirements
        that must be met for incident response plan testing

        3. Coordinate with corporate IR team to test the IR plan at least annually

        4. Ensure the relevant test plan documentations and results are created and
        maintained'
      typical_evidence: "1. Provide the relevant policy in place that enforces this\
        \ requirement\n2. Provide test plan documentations\n3. Provide evidence of\
        \ completed tests with details regarding how often were these tests performed\n\
        \nTX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-STA-02.03:\
        \ Provide incident response training within 14 days and then annually thereafter\n\
        \nTX-RAMP Level 2 - The following attribute should be validated for CCF-STA-02.03:\
        \ Do a tabletop testing exercise at least annually\n\nFedRAMP High - The following\
        \ attribute should be validated for CCF-STA-02.03: \n- BU needs to define\
        \ and use automated mechanisms to help with IR process such as automated alerts/ticketing.\n\
        -  BU's need to decide applicability of dynamic reconfiguration and if they\
        \ do use it how it is implemented in incident response capability.\n- IR plan\
        \ should have specific scenarios and results/processes to follow for each\
        \ scenario.\n- IRP includes the threat of insider threats.\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-STA-02.03:\
        \ \nIR Plan:\n   1. Provides the organization with a roadmap for implementing\
        \ its incident response capability;\n   2. Describes the structure and organization\
        \ of the incident response capability;\n   3. Provides a high-level approach\
        \ for how the incident response capability fits into the overall organization;\n\
        \   4. Meets the unique requirements of the organization, which relate to\
        \ mission, size, structure, and functions;\n   5. Defines reportable incidents;\n\
        \   6. Provides metrics for measuring the incident response capability within\
        \ the organization;\n   7. Defines the resources and management support needed\
        \ to effectively maintain and mature an incident response capability; and\n\
        \   8. Is reviewed and approved by [Assignment: organization-defined personnel\
        \ or roles];\n b. Distributes copies of the incident response plan to [Assignment:\
        \ organization-defined incident response personnel (identified by name and/or\
        \ by role) and organizational elements];\n c. Reviews the incident response\
        \ plan [Assignment: organization-defined frequency];\n d. Updates the incident\
        \ response plan to address system/organizational changes or problems encountered\
        \ during plan implementation, execution, or testing;\n  e. Communicates incident\
        \ response plan changes to [Assignment: organization-defined incident response\
        \ personnel (identified by name and/or by role) and organizational elements];\
        \ and\nf. Protects the incident response plan from unauthorized disclosure\
        \ and modification.\n\nIRP includes processes for an information spill and\
        \ includes:\n a. Identifying the specific information involved in the information\
        \ system contamination;\n b. Alerting [Assignment: organization-defined personnel\
        \ or roles] of the information spill using a method of communication not associated\
        \ with the spill;\n c. Isolating the contaminated information system or system\
        \ component;\n d. Eradicating the information from the contaminated information\
        \ system or component;\n e. Identifying other information systems or system\
        \ components that may have been subsequently contaminated; and\n f. Performing\
        \ other [Assignment: organization-defined actions].\n g. Defines responsibilities\
        \ in the case of spills\n h. ensures personel impacted by info spill can continue\
        \ to carry out assigned tasks, while contaminated systems are undergoing corrective\
        \ actions, and lessons learned/remediation efforts are completed.\n\n\nPCI\
        \ - The following attribute should be validated for CCF-STA-02.03: Review\
        \ and test plan annually"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-316
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 316
      name: System Capacity Monitoring
      description: System capacity is evaluated continuously and system changes are
        implemented to help ensure processing capacity can meet demand.
      annotation: '1. Ensure system capacity monitoring is performed on a regular
        basis and capacity monitoring report is generated for applications

        2. Ensure if there are any capacity issue related findings, appropriate system
        changes are implemented to ensure capacity can always meet the demand

        3. If needed, ensure system capacity is increased to meet demand.'
      typical_evidence: "1. Provide example system capacity monitoring report \n2.\
        \ Provide process details regarding how is capacity monitoring performed on\
        \ a regular basis/cadence\n3. Provide snapshot of changes implemented based\
        \ on findings from capacity monitoring report"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-317
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 317
      name: Availability Monitoring
      description: Critical systems are monitored in accordance to predefined availability
        criteria and alerts are sent to authorized personnel.
      annotation: '1. Finalize/Scope systems/tools that are critical to ensure that
        your main product/ platform''s confidentiality, availability, and security
        is maintained as intended

        2. Define availability metrics that are based on internal organization or
        BU requirements and service commitments as it relates to availability made
        to your customers

        3. Obtain approval for these metrics from team leader or any other appropriate
        team member

        4. Configure your monitor to reflect defined availability metrics

        5. If the monitoring tool(s) allow, configure it to send alerts to authorized
        team members from your team

        6. Define thresholds for these alert configurations

        7. Validate that critical systems/tools are being monitored and alerts are
        triggered as predefined thresholds are met

        8. Check for any issues, follow up and resolution need to occur, as applicable

        9. Ensure changes to predefined criteria, and availability metrics are always
        approved before being configured into the monitoring system'
      typical_evidence: '1. Provide list of critical systems which are monitored for
        availability

        2. Provide the list of authorized personnel for sending alerts

        3. Provide follow up evidences and resolution plan, if applicable in case
        of issues in availability

        4. Configuration showing the alerting tool is configured as per defined criteria
        and to monitor all systems that are deemed critical

        5. Alerting configuration from the tool showing authorized personnel are alerted
        after certain defined thresholds are me

        6. Identify if there were any major availability outages or gaps, and review
        follow up to resolve the issues.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-318
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 318
      name: Capacity Budgeting
      description: Budgets for infrastructure capacity are established based on analysis
        of historical business activity and growth projections; purchases are made
        against the established budget and plans are updated at least annually.
      annotation: "1. Documentation around capacity management should be maintained\
        \ highlighting as well as implementing following aspects:\n\u2022 Budgets\
        \ for infrastructure capacity are established based on analysis of historical\
        \ business activity, growth projections and corresponding records are maintained.\n\
        \u2022 Purchases are made against the established budget, plans are updated\
        \ at least annually and corresponding records are maintained.\n\n2. Each Systems\
        \ should evaluate their infrastructure capacity needs on an annual basis and\
        \ obtain a budget and funding needed to expand the infrastructure capacity\
        \ if needed. \n3. Once the budget is funding is obtained, the infrastructure\
        \ capacity shall be expanded to meet demand."
      typical_evidence: '1. Approved documentation around capacity management

        2. Validate with Systems what if capacity was reviewed annually and if additional
        funding for capacity was needed.

        3. If additional budget and funding was needed, validate the Systems followed
        up to secure or at least communicate the funding needed.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-319
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 319
      name: Company Master Service Agreements
      description: Master Purchase Agreements (including Master Services Agreements/MSAs,
        Enterprise Agreements, etc.) agreed to between organization and customers
        includes the Company's commitments to their customers with respect to the
        relevant product(s) and service(s) comprising the cloud offer.
      annotation: '1. Evaluate Company Master Services Agreements (MSAs) detailing
        the business user commitments to their customers in terms of the product''s
        service, how the information is handled, and any legal documentation

        2. Within the MSA, the focus will be around service commitments that are made
        to the customer of product/platform, especially around security, availability,
        confidentiality, and privacy (as applicable)

        3. Check if MSA is maintained, reviewed, signed in case of any changes. The
        MSA maybe combined with the Terms of Service.'
      typical_evidence: "1. Provide Company Master service agreement (MSA), and validate\
        \ it is viewable by customers\n2. Within the MSA, the focus will be around\
        \ service commitments that are made to the customer of product/platform, especially\
        \ around security, availability, confidentiality, and privacy (as applicable)\n\
        \nAgID (Ordinary) - The following attribute should be validated for CCF-STA-05.01:\
        \ \n- MSA includes defined update frequency\n- SLAs are included as part of\
        \ MSA. The offering guarantees adherence to the SLAs as well as service level\
        \ objectives and service level indicators. SLAs define information sharing\
        \ methods. Any modification to the SLAs must require vustomer approval, and\
        \ violation of the SLAs guarantees the application of compensatory penalties.\n\
        - ensure methods and mechanisms on scalability are included in MSA or as part\
        \ of information security disclosure. If not, add as attribute"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-320
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 320
      name: Supplier sharing agreements and review
      description: Formal organization Legal Approved information sharing agreements
        are in place with related critical suppliers. These agreements include confidentiality
        commitments applicable to that entity.
      annotation: '1. Ensure documentation in terms policy and/or procedure around
        the vendor/ supplier management in order to manage supplier/vendor risks.

        2. Maintain list of all suppliers

        3. Ensure for all the suppliers who will have access to confidential information
        in the above list information sharing agreements signed with organization
        and agreements includes confidentiality commitments applicable to that entity
        (e.g. Non-disclosure agreement). Agreements shall be agreed upon prior to
        using the supplier.'
      typical_evidence: "1. List of suppliers\n2. Documented organization Legal Approved\
        \ information sharing agreements with the suppliers and corresponding process\
        \ around vendor/supplier management.\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-STA-05.03: before we use a 3rd party\
        \ personnel, organization:\n a. Establishes personnel security requirements\
        \ including security roles and responsibilities for third-party providers;\n\
        \ b. Requires third-party providers to comply with personnel security policies\
        \ and procedures established by the organization;\n c. Documents personnel\
        \ security requirements;\n d. Requires third-party providers to notify [Assignment:\
        \ organization-defined personnel or roles] of any personnel transfers or terminations\
        \ of third-party personnel who possess organizational credentials and/or badges,\
        \ or who have information system privileges within [Assignment: organization-defined\
        \ time period]; and\n e. Monitors provider compliance.\n\n- Organization additionally\
        \ has to ensure that contractors are taking training."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-321
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 321
      name: Terms of Service
      description: Consent is obtained for organization Terms of Service (ToS) prior
        to collecting customer or personal information.
      annotation: '1. Verify whether consent is obtained for Organization Terms of
        Service (ToS) prior to collecting customer or personal information. Consent
        can be obtained inherently as an option.

        2. Record consent when ToS is updated

        3. An agreement maybe by signature, acknowledgement, use, or other method
        (explicit or non-explicit).'
      typical_evidence: '1. Obtain updated ToS (Terms of Service)

        2. Provide evidence of consent obtained for updated ToS

        3. An agreement maybe by signature, acknowledgement, use, or other method
        (explicit or non-explicit).'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-322
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 322
      name: Cloud Service Customer Assets
      description: Assets of the cloud service customer that are on the cloud service
        provider's premise are removed, and returned if necessary, in a timely manner
        upon termination of the cloud service agreement.  Return of assets is documented
        and information regarding the returned assets is provided to the customers.
      annotation: '1. All customer assets that reside in a cloud service provider''s
        premise are documented and updated accordingly.

        2. Upon request or termination of the cloud service agreement, the customer
        assets are promptly returned in a timely manner.

        3. The return of assets are documented and information regarding the returned
        asset is provided to the customer.

        4. Details of the return are kept and maintained in a central repository.'
      typical_evidence: '1. Validate if cloud service customers have any assets that
        reside in the cloud service provider''s premise, and if it is documented in
        a central repository.

        2. Validate if there have any requests for return or termination of cloud
        service agreements.

        3. Should the customer have assets that reside on the provider''s premise,
        validate the asset was returned timely, and return of the asset was documented
        and information regarding the returned asset is provided to the customers.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-323
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 323
      name: Card Data storage
      description: The organization does not store full track credit card data, credit
        card authentication information, credit card verification code, or credit
        personal identification number (PIN) which organization processes for payment.
      annotation: "1. Obtain organization payment process documentation\n2. Check\
        \ the payment process and ensure that organization does not store the following\
        \ information:\n\u2022 full track credit card data;\n\u2022 credit card authentication\
        \ information;\n\u2022 credit card verification code, or\n\u2022 credit personal\
        \ identification number (PIN)"
      typical_evidence: '1. Provide organization payment process documentation

        2. Provide walkthrough of payment process and credit card data storage process'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-324
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 324
      name: Cardholder data protection
      description: If applicable, organization's services that manage, store, or transmit
        cardholder data on behalf of the customer must provide written acknowledgement
        to customers of their responsibility to protect cardholder data and the cardholder
        data environment.
      annotation: 1. If an organization's service manages, stores, or transmits cardholder
        data on behalf of customer, ensure a  written acknowledgement is provided
        to customers that organization will be responsible to protect cardholder data
        and the cardholder data environment
      typical_evidence: 1. Provide evidence of written acknowledgement provided to
        customer by organization's services that manage, store, or transmit cardholder
        data on behalf of customer, of their responsibility to protect cardholder
        data and the cardholder data environment
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-325
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 325
      name: Agreement Change Disclosure
      description: The organization informs internal employees and suppliers of any
        changes to their non-disclosure agreements or legally approved information
        sharing agreements.
      annotation: '1. Obtain documented version history for all non-disclosure agreements
        or legally approved information sharing agreements.

        2. Ensure communication to all internal stakeholders and suppliers regarding
        the changes to non-disclosure agreements or legally approved information sharing
        agreements.'
      typical_evidence: '1. Provide artefacts demonstrating changes to non-disclosure
        agreements or legally approved information sharing agreements.

        2. Provide evidence of communication to all internal stakeholders and suppliers
        regarding the changes to non-disclosure agreements or legally approved information
        sharing agreements.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-326
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 326
      name: Outsourced Development Requirements
      description: Procedures are in place to supervise and control outsourced software
        and system development activities to ensure that outsourced development activities
        complay with organization's secured development policy.
      annotation: '1. Obtain documented procedures in place corresponding to outsourced
        software and system development activities.

        2. Verify documented procedures are in place corresponding to outsourced software
        and system development activities and their compliance to organization''s
        secure development policy.'
      typical_evidence: 1. Provide documented procedures in place corresponding to
        outsourced software and system development activities and their compliance
        to organization's secure development policy.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-327
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 327
      name: Data Access for Non-EU Suppliers
      description: In the event organization requires assistance from a third party
        company to provide services to a customer, and the third party company is
        not based in a EU state, that third party should have no ability to access
        the data entrusted to organization by the customer.
      annotation: '1. Obtain a population of third party companies based in a non-EU
        state assisting organization to provide services.

        2. Ensure that third party companies based in a non-EU state do not have the
        ability to access customer data.'
      typical_evidence: "1. Provide a list of third party companies assisting organization\
        \ to provide services to a customer based outside of the EU. \n2. Provide\
        \ evidence that the non-EU based third parties do not have the ability to\
        \ access customer data.\n\nAgID (Ordinary) - The following attribute should\
        \ be validated for CCF-STA-05.10: Access to data for non-EU entities can be\
        \ granted, but approval must take place by the ACN and administration"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-328
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:global-procurement-services
      ref_id: CCF 328
      name: Supplier Management
      description: When a third party service provider is engaged to provide all or
        part of the service provided to customers, the Systems validates that the
        third party service provider is either SecNumCloud qualified or the continuous
        operations of the third party in the provision of the service is provided
        to the client.
      annotation: '1. Obtain population of third party companies assisting organization
        to provide services.

        2. Obtain documentation of SecNumCloud qualification from third parties.

        3. Ensure all third party companies assisting organization to provide services
        are SecNumCloud qualified.

        4. If third parties are unqualified, ensure that the  continuous operations
        of the third party in the provision of the service is provided to the client.'
      typical_evidence: "1. Provide a population of third party companies assisting\
        \ organization to provide services. \n2. Provide either evidence that the\
        \ third party companies are SecNumCloud qualified, or that the continuous\
        \ operations of the third party in the provision of the service is provided\
        \ to the client."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      assessable: false
      depth: 1
      name: Vulnerability Detection
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-329
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 329
      name: BU Anti-Malware Technology
      description: "Where applicable, organization has managed antivirus deployments\
        \ and ensures the following:\n\u2022 signature definitions are updated\n\u2022\
        \ full scans are performed monthly and real-time scans are enabled\n\u2022\
        \ alerts are reviewed and resolved by authorized personnel"
      annotation: '1.Policy and procedure document(s) corresponding to malware protection
        should be documented and implemented.

        2.All assets/devices in the production environment should be synchronized
        with the antimalware technology/solution as per the golden configuration and
        as a part of synchronization agent should be installed on each and every device
        to regularly push update(s) .

        3.Antimalware technology/solution should be integrated with SIEM solution
        in order to ensure logs are being fed(Pull/Push) to SIEM or any other monitoring
        solution for log analysis, event management and incident management.

        4.Records should be maintained, documented, and tracked pertaining to the
        updates in the configuration on the Antimalware technology/solution dashboard.

        5. Vulnerabilities are fixed accordingly to organization Policy per CSDL guidance
        CCF-TVM-02.40 - Newly discovered software vulnerabilities are fixed according
        to organization Policy. The reintroduction of similar or previously resolved
        vulnerabilities is prevented. Relevant Documentation: Expectations of Engineering  -
        section 4 ''Remediation''.'
      typical_evidence: '1.Policy and procedure document(s) corresponding to malware
        protection.

        2.Tracker of all assets in the production environment and corresponding status
        of synchronization/integration with the antimalware/antivirus technology.
        Validate virus signature definitions are up-to-date and valid.

        3. Validate full scans cadence of anti-virus scans on the environment for
        any virus''s, and validate anti-virus is completed.

        4. Validate the configuration of alerts is set up to notify corresponding
        people when malware is identified, or anti-virus unsuccessfully runs.

        5. Understand the review process and SLA.

        6. Sample antivirus incidents and validate they were followed up and resolved
        in a timely manner.


        NOTE - When anti-virus deployments cannot be made to certain environments
        and production instances, a justification shall be documented, as well as
        how the risk is compensated for.


        TX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-TVM-01.01:
        Perform periodic scans of the system at least weekly and include endpoints


        send alert to include alerting administrator or defined security personnel


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-TVM-01.01: there should ultimately be one group or team that oversees
        the malicious code protection machanisms process, receives alerts and responds.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-330
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 330
      name: Corporate Anti-Malware Technology
      description: Anti-malware technology is deployed for environments commonly susceptible
        to malicious attack and is configured to be updated routinely, logged, and
        installed on all employee workstations.
      annotation: '1. Ensure anti-malware technologies like antivirus software are
        in place for real time protection from malwares on all workstations/ devices
        in scope and are capable of detecting, removing, and protecting against all
        known types of malicious software and malicious code.

        2. Ensure the anti-virus programs are actively running and cannot be disabled
        or altered by users.

        3. Ensure antivirus definitions are updated on a regular basis or as per business
        requirements.

        4. Validate any malicious malware detected is logged and purged by the program.'
      typical_evidence: '1. Provide screenshot of antivirus management console (if
        available) dashboard showing overall status of all employee workstations/
        devices in scope including last scan performed, antivirus version installed,
        definition update etc.

        2. Provide screenshot for configuration of anti-virus solutions deployed on
        workstations/ devices in scope. Screenshots must include details such as anti-virus
        program version, admin controls in place to block system user to disable or
        alter configurations of the antivirus program.

        3. Provide screenshot of last updated antivirus definitions and admin control
        in place to block system user from disabling such updates. Validate definitions
        are up-to-date.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-TVM-01.02: there should ultimately be one group or team that oversees
        the malicious code protection machanisms process, receives alerts and responds.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-331
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 331
      name: Antivirus logs
      description: The organization's antivirus deployments generate audit logs which
        are retained at least annually with the data immediately available for analysis.
      annotation: '1. Obtain organization''s antivirus process documentation

        2. Ensure that the antivirus deployments generates audit logs

        3. Ensure that the audit logs generated by antivirus are retained at least
        for a year

        4. Additionally, ensure older audit logs are immediately available for analysis'
      typical_evidence: "1. Provide documentation regarding organization's antivirus\
        \ deployment process \n2. Provide sample audit logs generated by antivirus\
        \ deployments\n3. Provide evidence that audit logs generated by antivirus\
        \ deployments are retained for at least one year and will be available for\
        \ immediate analysis if required"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-332
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 332
      name: Antivirus mechanism access
      description: Antivirus mechanisms cannot be disabled or altered by users unless
        specifically authorized by management.
      annotation: '1. Ensure that the appropriate mechanisms are in place to restrict
        users from disabling or altering antivirus mechanisms

        2. Ensure access to disable or alter antivirus mechanisms is granted to users,
        post approval from management'
      typical_evidence: '1. Provide walkthrough of mechanisms/controls enforced on
        user''s systems to restrict user''s from disabling or altering antivirus mechanisms

        2. Provide evidence that user is only granted access to disable or alter antivirus
        mechanisms post approval from management'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-333
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 333
      name: Email Sandboxing
      description: The organization utilizes sandboxing to detect or block potentially
        malicious emails.
      annotation: 1. Ensure that organization utilizes sandboxing technique to detect
        or block potentially malicious emails
      typical_evidence: '1. Provide walkthrough of process in place to detect or block
        potentially malicious emails

        2. Provide evidence of sandboxing technique usage to detect or block potentially
        malicious emails


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-TVM-01.05: emails have spam protection in their email server. Email spam
        protection should be centrally managed. Spam protection should automatically
        be updated on an on-going basis.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-334
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 334
      name: Anti-Malware Removable Media Solution
      description: Anti-malware solutions are configured to perform automatic scans
        of removable media when the media is inserted, connected, or logically mounted,
      annotation: '1. Verify the anti-malware solution is configured to perform automatic
        scans of removable media when the media is inserted, connected, or logically
        mounted.

        2. Ensure system components with removable media connected meet this requirement.

        3. Verify from logs and scan results that the solution in place is in accordance
        with the requirement to perform automatic scans of removable media when the
        media is inserted, connected, or logically mounted.'
      typical_evidence: '1. Examine anti-malware solution(s) configurations to verify
        that, for removable electronic media, the solution is configured to perform
        at least one of the elements specified in this requirement.

        2. Examine system components with removable electronic media connected to
        verify that the solution(s) is enabled in accordance with at least one of
        the elements as specified in this requirement.

        3. Examine logs and scan results to verify that the solution(s) is enabled
        in accordance with at least one of the elements specified in this requirement.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-335
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 335
      name: Network Vulnerability Scans
      description: Vulnerability scans are performed periodically. Identified vulnerabilities
        are assigned for remediation.
      annotation: '1.Policy and procedure document(s) corresponding to vulnerability
        management should be documented and maintained.

        2.Internal and external network vulnerability scanning should be done at a
        regular frequency in order to ensure closure of vulnerabilities identified
        in past as well as identification of new vulnerabilities in the environment.

        3.Tracker of vulnerabilities identified in the internal as well as external
        scans and corresponding classification, timelines (as per classification),
        plan and responsibility for closure should be maintained.

        4. Vulnerabilities are fixed accordingly to organization Policy per CSDL guidance
        CCF-TVM-02.40 - Newly discovered software vulnerabilities are fixed according
        to organization Policy. The reintroduction of similar or previously resolved
        vulnerabilities is prevented. Relevant Documentation: Expectations of Engineering  -
        section 4 ''Remediation''.'
      typical_evidence: "1.Policy and procedure document(s) corresponding to vulnerability\
        \ management.\n2.Last internal and external network vulnerability scan reports.\n\
        3.Tracker of vulnerabilities identified in the last internal as well as external\
        \ scans and corresponding timelines, plan and responsibility for closure.\n\
        4.Latest vulnerability scan reports in order to ensure closure of the vulnerabilities\
        \ as per the plan.\n5. For those pursuing BSI C5, an impact assessment should\
        \ be performed as part of every vulnerability identified.\n\nFedRAMP Moderate\
        \ & High - The following attribute should be validated for CCF-TVM-02.01:\
        \ \n- entire environment is being scanned (OS, webapps, DB and containers)\
        \ and the BU must adhere to FedRAMP SLA's for remediation (30 days for high,\
        \ 90 days for moderate, 180 days for low).  Critical vulnerabilities per the\
        \ CVE rating will be treated as high for FedRAMP.\n- FedRAMP requires credentialed\
        \ vuln scans performed using admin credentials.\n- Engineers must practice\
        \ best pracitces for coding practices, and in their SDLC process, that includes\
        \ input validation. Organization engineers should only be allowed to code/input\
        \ into fields what is expected (inut validation), and test this. that as part\
        \ of monthly vuln testing, input validation should be tested as part of it\
        \ as well.\n-internal and external vuln scans\n\nTX-RAMP Low, Medium, & High\
        \ - Perform periodic scans of the system [Assignment: organization-defined\
        \ frequency] and real-time scans of files from external sources \n\nFedRAMP\
        \ High - The following attribute should be validated for CCF-TVM-02.01: if\
        \ multiple vulnerability scanning tools are implemented then their results\
        \ should be correlated or aggregated in some way. If there is a single scanner\
        \ used, this isn't applicable. \n\nPCI - The following attribute should be\
        \ validated for CCF-TVM-02.01: Vulnerability Scan - Re concile it to quarterly.\
        \ Quarterly external and internal scans should be done by ASV approved by\
        \ PCI SSC on quarterly basis.\n\nBSI C5 - System components in the area of\
        \ responsibility of the Cloud Service Provider for the provision of the cloud\
        \ service are automatically checked for known vulnerabilities at least once\
        \ a month\n\nSaudi CCC - Assessing and remediating vulnerabilities on external\
        \ components of Cloud Technology Stack at least once every month, and at least\
        \ once every three months for internal components of Cloud Technology Stack.\n\
        \nCSA STAR: Define, implement and evaluate processes, procedures and technical\
        \ measures for the detection of vulnerabilities on organizationally managed\
        \ assets at least monthly.\n\nSpanish ENS High - This control is deemed good\
        \ to have for Spanish ENS High, but not deemed mandatory if remaining ENS\
        \ controls are effective. If any remaining ENS controls are deficient, these\
        \ controls maybe scoped in as needed."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-336
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 336
      name: Penetration Testing
      description: Penetration testing  is performed at least annually. All discovered
        vulnerabilities must be triaged for criticality and assigned for remediation
        compliant to the internal S-Rating and SLAs as defined in the internal Standard
        S-Rating Classification.
      annotation: '1.Policy and procedure document(s) corresponding to vulnerability
        management should be documented and maintained.

        2.Penetration testing and network scanning should be done at a regular frequency
        in order to ensure closure of vulnerabilities identified in past as well as
        identification of new vulnerabilities in the environment.

        3.Tracker of vulnerabilities identified in the internal as well as external
        scans and corresponding classification, timelines (as per classification),
        plan and responsibility for closure should be maintained.

        4. Vulnerabilities are fixed accordingly to organization Policy per CSDL guidance
        CCF-TVM-02.40 - Newly discovered software vulnerabilities are fixed according
        to organization Policy. The reintroduction of similar or previously resolved
        vulnerabilities is prevented. Relevant Documentation: Expectations of Engineering'
      typical_evidence: '1.Policy and procedure document(s) corresponding to vulnerability
        management.

        2.Last penetration testing report highlighting the identified vulnerabilities.

        3.Tracker of vulnerabilities along with corresponding timelines, plan and
        responsibility for closure.

        4.Latest Penetration testing report  in order to ensure closure of the vulnerabilities
        as per the plan.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-TVM-02.02: independent penetration testing must be performed.


        PCI - The following attribute should be validated for CCF-TVM-02.02: Penetration
        Testing - An external and internal pen test need to be done annually. Reconcile
        it to external VAPT annually. Penetration testing should be done on segmentation
        controls at least every six months and after any changes to segmentation controls/methods.
        If segmentation is used to isolate CDE from other networks, pen test must
        be annually or whenver segmentation rules/methods change.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-337
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 337
      name: Security Bulletin and Email Alerts
      description: The Systems or Business Unit (BU) subscribes to relevant security
        bulletins and email alerts and uses them to monitor the impact of emerging
        technologies and security.
      annotation: '1. Each Systems should subscribe to special interest groups/bulletins/email
        alerts internal or external in order to receive updates in terms security
        bulletins and / or email alerts from forums like CERT, ISACA etc. and maintain
        corresponding records.

        2. Ensure controls or necessary solutions required to safeguard infrastructure
        are deployed as per latest updates and maintain corresponding records.

        3. Ensure compliance against the controls to monitor the impact of emerging
        technologies and security is monitored and recorded'
      typical_evidence: '1. Validate Systemss are subscribed to security bulletins
        and/or emails from internal or verified external resources to monitor impact
        of emerging technologies and any new security risks.


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-TVM-02.03: we should get alerts from US-CERT alerts and advisories, FBI,
        and also identify who within the BU to distribute this info to.


        FedRAMP High - The following attribute should be validated for CCF-TVM-02.03:
        an automated mechanism to share alerts is done for the BU.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-338
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 338
      name: Cloud Provider Vulnerability Management
      description: The cloud service provider provides information about the management
        of technical vulnerabilities that can impact customers.
      annotation: '1. Business unit/product team maintains information about how technical
        vulnerabilities that can impact customers are managed

        2. Details regarding management of these vulnerabilities should be provided
        to customers, and how the business unit/product team handles identified vulnerabilities.'
      typical_evidence: '1. Obtain Description of tools/application/utilities covering
        how technical vulnerabilities are managed that can impact customers

        2. Provide evidence of notification service subscribed with Cloud Service
        Provider for notifications about management of technical vulnerabilities undertaken
        by the cloud service provider. And validate how provider communicates how
        it handles vulnerabilities to customers.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-339
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 339
      name: Software Vulnerability Scanning
      description: Existing and emerging software vulnerabilities are detected at
        least monthly, and a vulnerability scan is included upon every code release.
        Any vulnerabilities identified are assigned a risk rating and reviewed and
        remediated accordingly.
      annotation: "1. The Systems performs a full vulnerability scans on their application\
        \ on a monthly basis. \n2. Upon every code release, the systems shall perform\
        \ a vulnerability scan on the code. If there is a vulnerability identified,\
        \ the code is not released and reverted back for changes and testing. Alternatively,\
        \ if there is a solution the mitigate the vulnerability, the code can still\
        \ be deployed. \n3. Any identified vulnerabilities are followed up upon, resolved,\
        \ and tracked to resolution on an on-going basis. Each vulnerability is assigned\
        \ a risk rating, reviewed and remediated. Each vulnerability should have a\
        \ corresponding ticket tracking the progress of resolution.\n4. Vulnerabilities\
        \ are fixed accordingly to organization Policy per CSDL guidance CCF-TVM-02.40\
        \ - Newly discovered software vulnerabilities are fixed according to organization\
        \ Policy. The reintroduction of similar or previously resolved vulnerabilities\
        \ is prevented. Relevant Documentation: Expectations of Engineering - section\
        \ 4 'Remediation'.\n\n* Note - If vulnerability scans cannot be completed\
        \ as part of change process (i.e. before every code release), a daily vulnerability\
        \ scan must be performed of the production environment."
      typical_evidence: "1. Sample monthly of vulnerability scans.\n2. Sample a select\
        \ number of changes and validate a vulnerability scan was performed as part\
        \ of the code change.\n3. Validate all vulnerabilities were assigned a risk\
        \ rating, reviewed, and remediated in a timely manner. Each vulnerability\
        \ should have a corresponding ticket. \n4. For those pursuing BSI C5, an impact\
        \ assessment should be performed as part of every vulnerability identified.\n\
        \n* Note - If vulnerability scans cannot be completed as part of change process\
        \ (i.e. before every code release), a daily vulnerability scan must be performed\
        \ of the production environment. \n\nTX-RAMP Level 2 - The following attribute\
        \ should be validated for CCF-TVM-02.05: Check media containing diagnostic\
        \ and test programs for malicious code before the media are used in the system\n\
        \nTX-RAMP Level 1 & 2 - The following attribute should be validated for CCF-TVM-02.05:\
        \ high and critical severity vulnerabilities mitigated within thirty days\
        \ from date of discovery; moderate severity vulnerabilities mitigated within\
        \ ninety days from date of discovery\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-TVM-02.05: \n- organization checks\
        \ media containing diagnostic and test programs for malicious code before\
        \ the media are used in the information system.\n- entire environment is being\
        \ scanned (OS, webapps, DB and containers) and the BU must adhere to FedRAMP\
        \ SLA's for remediation (30 days for high, 90 days for moderate, 180 days\
        \ for low).  Critical vulnerabilities per the CVE rating will be treated as\
        \ high for FedRAMP.\n- FedRAMP requires credentialed vuln scans performed\
        \ using admin credentials.\n- previous scans are saved and vulnerabilites\
        \ are saved, and an audit log of vulnerabilities are saved, so that automated\
        \ mechanisms can be used to compare scan over scan and do trend analysis.\n\
        \nPCI - The following attribute should be validated for CCF-TVM-02.05: Vulnerability\
        \ Scan - Re concile it to quarterly. Quarterly external scans should be done\
        \ by ASV approved by PCI SSC on quarterly basis."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-340
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 340
      name: Infrastructure & Application patching
      description: Infrastructure supporting the service, and applications are patched
        upon availability as a part of routine maintenance and as a result of identified
        vulnerabilities and supplier supplied patches to help ensure that applications
        and infrastructure network and system components supporting the service are
        hardened against security threats.
      annotation: '1. Obtain Patch Management policy

        2. Validate if there is a process to periodically identify and review vendor
        supplied patches (AWS/Azure/etc.)

        3. Validate if there is a process to identify patches provided by suppliers

        4. Obtain audit log tracker for patches updated for each asset type e.g. servers,
        OS, software/ applications, router, switches, firewall etc.

        5. Validate if patching is performed within specified time frame as defined
        by patch management policy.

        6. Verify if last patching followed formal change management process and if
        roll back strategy for patches was identified and documented'
      typical_evidence: "1. Provide Patch Management policy\n2. Provide list/scope\
        \ of infrastructure (tools/applications) that support the main product platform\n\
        3. List/Information of all the supplier provided patches for the audit period\n\
        4. All applicable internal and external vulnerabilities scanning reports\n\
        5. Provide audit log tracker for patches updated for each asset type e.g.\
        \ servers, OS, software/ applications, router, switches, firewall etc. Sample\
        \ select to validate that each asset is up-to-date with the most recent supplier\
        \ patch.\n\n\nTX-RAMP Level 1 & 2 - The following attribute should be validated\
        \ for CCF-TVM-02.06: Install security-relevant software and firmware updates\
        \ within 30 days of release of updates\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-TVM-02.06: (this is mostly for infrastructure\
        \ to make sure there is on-going maintenance and records of it. If infra is\
        \ in AWS, then we will rely on AWS infra.)\n\nBut for those who sit on organization\
        \ own Infra - they need to:\n a. Schedules, performs, documents, and reviews\
        \ records of maintenance and repairs on information system components in accordance\
        \ with manufacturer or vendor specifications and/or organizational requirements;\n\
        \ b. Approves and monitors all maintenance activities, whether performed on\
        \ site or remotely and whether the equipment is serviced on site or removed\
        \ to another location;\n c. Requires that [Assignment: organization-defined\
        \ personnel or roles] explicitly approve the removal of the information system\
        \ or system components from organizational facilities for off-site maintenance\
        \ or repairs;\n d. Sanitizes equipment to remove all information from associated\
        \ media prior to removal from organizational facilities for off-site maintenance\
        \ or repairs;\n e. Checks all potentially impacted security controls to verify\
        \ that the controls are still functioning properly following maintenance or\
        \ repair actions; and\n f. Includes [Assignment: organization-defined maintenance-related\
        \ information] in organizational maintenance records.\n g. Employs automated\
        \ mechanisms to schedule, conduct, and document maintenance and repairs; and\n\
        \ h. Produces up-to date, accurate, and complete records of all maintenance\
        \ and repair actions requested, scheduled, in process, and completed.\n i.\
        \ FR automated tools need to determine the current patch level of software\
        \ and alerting on flaws when they are discovered\n j. baseline security checks\
        \ must be done before any new asset gets added, and that baseline security\
        \ checks are being done upon start, patch, booted, etc. Basically ensuring\
        \ a minimum baseline security set is maintained for all hardware/server/environment.\n\
        \nPCI - The following attribute should be validated for CCF-TVM-02.06: Patches\
        \ - Critical Security Patches are done within 1 month."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-341
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 341
      name: Software & Firmware Updates
      description: The Systems or Business Unit (BU) installs security-relevant software
        and firmware updates per organization policy; and incorporates flaw remediation
        into the Systems's configuration management process.
      annotation: '1.Policy and procedure document(s) around receiving, testing and
        implementation of security related patch(s) to organization software should
        be documented and implemented.

        2.Implementation status tracker of the security related patch(s) across the
        Software devices in the environment should be maintained in order to ensure
        devices are protected from threats.'
      typical_evidence: '1.Policy and procedure document(s) around receiving, testing
        and implementation of security related updates.

        2.Tracker highlighting the threat advisories/ security bulletins received
        from different sources and corresponding status of their implementation across
        devices.

        3.Artefcat(s) demonstrating implementation of security related updates in
        some samples as per the tracker.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-342
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 342
      name: System Description & Boundaries
      description: The Company has prepared a description of the system and its boundaries
        and has provided this description to internal and external authorized users.
      annotation: "1. Verify if business unit maintains a description of the systems,\
        \ environment and boundaries of the product in scope\n2. Evaluate if all necessary\
        \ information is provided in the description (e.g. description of services,\
        \ tools used, boundaries of service, etc.)\n3. Verify if the documented description\
        \ includes versioning and maintains history of changes that may arise due\
        \ to critical changes to the systems, processes or environment.\n4. Verify\
        \ if the documented description was communicated to authorized internal and\
        \ external users (channels may include external public facing webpages).\n\
        5. Verify the description of system/boundaries are accurate and up-to-date.\
        \ \n6. For BSI C5, instructions and details on how to operate and manage the\
        \ product shall be included."
      typical_evidence: "1. Provide documented description of the systems, environment\
        \ and boundaries of the product in scope\n2. Provide evidence of communication\
        \ of product description to authorized internal and external stakeholders.\
        \ This could be via an internal and external public facing webpage or more.\
        \ \n3. For BSI C5, instructions and details on how to operate and manage the\
        \ product shall be included."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-343
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 343
      name: External Communication Requirements
      description: "The organization defines external communication requirements for\
        \ incidents, including:\n\u2022 information about external party dependencies\n\
        \u2022 criteria for notification to external parties as required by [the organization]\
        \ policy in the event of a security breach\n\u2022 contact information for\
        \ authorities (e.g., law enforcement, regulatory bodies, etc.)"
      annotation: "1. Document and maintain a communication policy that includes information\
        \ for notifying incidents to external parties including following aspects:\n\
        \u2022 information about external party dependencies/ affected external parties\n\
        \u2022 criteria for notification to external parties as required by [the organization]\
        \ policy in the event of a security breach\n\u2022 contact information for\
        \ authorities (e.g., law enforcement, regulatory bodies, etc.)\n\u2022 provisions\
        \ for updating and communicating external communication requirement changes\n\
        \n2. Ensure notifications have been sent to external parties in case of any\
        \ security breach and maintain corresponding records.\n3. Ensure if required\
        \ relevant authorities are contacted in case of any security incident and\
        \ maintain corresponding records.\n4. Ensure review is conducted periodically\
        \ and maintain corresponding records.\n5. Ensure all incident communication\
        \ is performed as per defined communication policy and maintain corresponding\
        \ records.\n6. Maintain a tracker of all the incidents/ breaches and corresponding\
        \ action including external communication details.\n\nNote: Corporate inherits\
        \ responsibility if BU follows PSIRT incident management process. Otherwise,\
        \ BU's are responsible."
      typical_evidence: "1. Provide an Incident Management policy / Communication\
        \ policy / crisis communication plan that includes information for notifying\
        \ incidents to external parties including following aspects:\n\u2022 Information\
        \ about external party dependencies/ affected external parties.\n\u2022 Criteria\
        \ for notification to external parties as required by [the organization] policy\
        \ in the event of a security breach.\n\u2022 Contact information for authorities\
        \ (e.g., law enforcement, regulatory bodies, etc.)\n\u2022 Provisions for\
        \ updating and communicating external communication requirement changes\n\n\
        2. Records demonstrating following:\n\u2022 Notifications have been sent to\
        \ external parties in case of any security incident/breach.\n\u2022 Relevant\
        \ authorities are contacted in case of any security incident/breach.\n\u2022\
        \ Review is conducted periodically of the corresponding governing documentation\
        \ and updated as required.\n\u2022 All incident communication is performed\
        \ as per Defined communication policy.\n\n3.Tracker of all the incidents/\
        \ breaches and corresponding action including external communication details.\n\
        \nNote: Corporate inherits responsibility if BU follows PSIRT incident management\
        \ process. Otherwise, BU's are responsible."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-344
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 344
      name: Cloud Authorities
      description: The cloud service customer identifies authorities relevant to the
        combined operation of the cloud service customer and cloud service provider.
      annotation: "1. If the business unit is a cloud service customer, they should\
        \ validate all the locations/areas the provider's services are provided. If\
        \ there are multiple locations, the customer should identify which areas specific\
        \ to their instances and services are provided. \n2. Once identified, the\
        \ customer should identify relevant authorities and local authorities governing\
        \ the cloud service provider instance, and ensure they can be reached in case\
        \ of any incidents that may arise between the service provider and customer."
      typical_evidence: 1. Provide list of authorities from business unit/ product
        and CSP that have been identified and their specific roles and responsibilities
        have been established. Relevant authorities should be relevant to the area/location
        the service is being provided.
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-345
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 345
      name: License maintenance and usage
      description: The organization maintains software license contracts and monitors
        its compliance with usage restrictions.
      annotation: "1. Identify and document the inventory of software license contracts\
        \ corresponding to different software. \n2. Ensure that management approved\
        \ procedures for license maintenance and usage (such software can include\
        \ any anti-malware software, Microsoft Office, Code 42, etc.) are in place\
        \ and maintained\n3. Ensure that monitoring is in place to check the compliance\
        \ effectiveness with usage restrictions defined as part of software license\
        \ maintenance as well as usage contracts.\n4. Ensure monitoring records of\
        \ period review/audits are maintained to ensure adherence to the requirements\
        \ of the software license contracts and usage restrictions.\n5. Licenses and\
        \ contracts are reviewed as needed, and increased supply of licenses and contracts\
        \ are obtained if needed to meet use/demand."
      typical_evidence: "1. Inventory of software license contracts corresponding\
        \ to different software. \n2. Procedures for license maintenance and usage\
        \ (such software can include any anti-malware software, Microsoft Office,\
        \ Code 42, etc.) are in place and maintained\n3.Ensure monitoring records\
        \ of period review/audits are maintained to ensure adherence to the requirements\
        \ of the software license contracts and usage restrictions. Licenses are increased\
        \ if needed, and should not be surpassed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-346
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 346
      name: Access Notification
      description: The organization informs its cloud service customers within 72
        hrs. whenever organization's internal or external staff read or write to cloud
        customers' data during processing, storage or transmission. The information
        regarding the access is sufficiently detailed to enable the client to assess
        the risks of the access.
      annotation: "1. BU/BE should never write into customer's data unless for legal\
        \ or emergency situations. \n2. Should a BU/BE read or write cloud customer's\
        \ data, they should verify if communication strategies are in place to inform\
        \ the cloud service customer within 72 hours whenever internal or external\
        \ staff read or write to cloud customers' data during processing, storage\
        \ or transmission.\n3. Check if information regarding the access is sufficiently\
        \ detailed to enable the client to assess the risks of the access.\n4. If\
        \ any deadline (end date) for access is included in access request, provide\
        \ evidence that the access for such users were removed on time\n5. All access\
        \ to customer data needs to be sufficiently logged and recorded in a system\
        \ of record."
      typical_evidence: "1. Provide documented communication plan to inform the cloud\
        \ service customer within 72 hours whenever internal or external staff read\
        \ or write to cloud customers' data during processing, storage or transmission.\
        \ \n2. List of users that have access to customer data\n3. List of user account\
        \ access to customer data that was requested during the audit period\n4. Validate\
        \ if an audit log/trail exists of access to customer data. Validate if any\
        \ instances of access to customer data exist\n5. If any deadline (end date)\
        \ for access is included in access request, provide evidence that the access\
        \ for such users were removed on time\n6. Validate for any instances of access\
        \ to customer data exist, customers were notified within 72 hrs."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-347
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 347
      name: Legal Assessments
      description: Investigation requests from government agencies are subjected to
        legal assessments by subject matter experts to determine if the requests have
        applicable and legal basis, and if organization is required to comply with
        the requests.
      annotation: '1. Maintain the records of investigation requests from government
        agencies and corresponding response.

        2. Identify and maintain details of the subject matter expert to perform legal
        assessment and provide guidance on response to the request.

        3. Ensure analysis performed to identify legal/ applicability basis of the
        requirements in order to decide response.

        4. No customer information, PII, or Systems details shall be provided to the
        government agencies until the government agency investigation request is confirmed
        and approved by legal, and subject matter experts at organization.

        5. Shall information be provided to government agencies, relevant teams and
        customers are notified of the investigation request and information provided.'
      typical_evidence: '1. Validate if there have been any investigation requests
        from government agencies.

        2. Validate if an analysis was performed for each investigation request.

        3. Validate information was only provided upon approval from legal and subject
        matter experts at organization.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-348
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 348
      name: Trusted Connections
      description: "All trusted connections are documented and approved by authorized\
        \ personnel; management ensures the following documentation is in place prior\
        \ to approval:\n\u2022 agreement with supplier\n\u2022 security requirements\n\
        \u2022 nature of transmitted information"
      annotation: "1. Identify all trusted connections between a supplier and the\
        \ Systems. This can include any supplier handling sensitive customer information,\
        \ and/or can affect the availability, confidentiality, and security of a product.\n\
        2. Validate prior to using the trusted connection and supplier, the following\
        \ documentation is in place:\n\u2022 agreement with supplier\n\u2022 security\
        \ requirements with supplier\n\u2022 nature of transmitted information\n3.\
        \ Legal shall be involved in these conversations and agreements with the supplier.\n\
        4. the Systems shall validate the supplier is adhering to the agreement and\
        \ maintaining their security posture."
      typical_evidence: '1. Obtain a list of suppliers that the Systems uses.

        2. For all suppliers that handle sensitive customer information, and/or can
        affect the availability, confidentiality, and security of a product, validate
        a corresponding approval was obtained prior to using the supplier.

        3. Validate the agreement includes security requirements and nature of the
        transmitted information between the Systems and supplier.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-349
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 349
      name: Publishing Information Publicly
      description: 'The organization protects its public information system presence
        with the following processes: only authorized and trained individuals may
        post public information, content is reviewed prior to publishing, information
        on public systems is reviewed periodically, and non-public information is
        removed from public systems upon discovery.'
      annotation: "1. Maintain the list of authorized and trained individuals who\
        \ are allowed to post public information. Those who manage organization owned\
        \ public facing websites and sharepoints should be restricted.\n2. Ensure\
        \ public information is posted only by authorized and trained individuals\
        \ and maintain the corresponding records. \n3. Ensure review of content is\
        \ performed and approval of content is obtained prior to publishing and maintain\
        \ the corresponding records.\n4. Ensure periodic reviews are performed for\
        \ information on public systems for nonpublic information, and is removed\
        \ upon identification and corresponding records of review as well as action\
        \ performed is maintained. \n5. Corresponding personnel are notified should\
        \ non-public or private information appears publicly depending on the gravity\
        \ of the information (i.e. application code, financials, customer details,\
        \ etc.)."
      typical_evidence: "1. List of authorized and trained individuals who are allowed\
        \ to post public information.\n2. Records of public information posted during\
        \ the control review period are posted only by authorized and trained individuals\
        \ post review. \n3. Records of periodic reviews performed for information\
        \ on public systems for nonpublic information, same is removed upon identification.\n\
        4. If any inappropriate or non-public information is identified on public\
        \ systems, validate corresponding personnel are notified and the material\
        \ is removed immediately.\n\nTX-RAMP Level 2 - The following attribute should\
        \ be validated for CCF-TVM-02.18: Review the content on the publicly accessible\
        \ system for nonpublic information at least quarterly"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-350
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 350
      name: Cloud Service Legal Jurisdictions
      description: The cloud service provider informs the cloud service customer of
        the legal jurisdictions governing the cloud service.
      annotation: '1. Cloud service providers shall identify any legal jurisdictions
        that govern the cloud service, such as GDPR.

        2. Such jurisdictions are provided to cloud service customers. They can be
        provided through multiple venues via a public page, email, etc.'
      typical_evidence: 1. Validate the cloud service provider informs cloud service
        customers of legal jurisdictions governing the cloud service.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-351
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 351
      name: KSA Penetration Tests
      description: The organization services operating in Saudi (KSA) must conduct
        penetration tests on their environments at least semi-annually.
      annotation: '1. Obtain penetration testing calendar  and reports prepared for
        organization services operating in Saudi (KSA)

        2. Ensure that penetration tests are conducted on a semi-annual basis for
        in-scope environments

        3. Ensure timely closure of vulnerabilities identified in penetration testing
        reports'
      typical_evidence: '1. Provide penetration testing calendar prepared for organization
        services operating in Saudi (KSA)

        2. Provide penetration testing reports for tests conducted on organization
        services operating in Saudi (KSA)

        3. Provide evidence of penetration tests conducted on semiannual basis'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-352
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 352
      name: Cardholder Data Penetration Tests
      description: "The organization conducts penetration tests against cardholder\
        \ data environments (CDE) and includes the following requirements:\n\u2022\
        \ testing covers the entire (CDE) perimeter and critical data systems\n\u2022\
        \ testing verifies that CDE perimeter segmentation is operational\n\u2022\
        \ testing is performed from both inside and outside the CDE network\n\u2022\
        \ testing validates segmentation and scope reduction controls (e.g., tokenization\
        \ processes)\n\u2022 network layer penetration tests include components that\
        \ support network functions as well as operating systems\n\u2022 testing is\
        \ performed with consideration of threats verified on an on-going basis from\
        \ external alerts, directives, and advisories.\n\u2022 testing is performed\
        \ with consideration of vulnerabilities reported through organization's PSIRT\
        \ process on an on-going basis\n\u2022 risk ratings are assigned to discovered\
        \ vulnerabilities, which are tracked through remediation"
      annotation: "1. Obtain penetration testing calendar\n2. Ensure that penetration\
        \ testing covers the following requirement : \n \u2022 Entire (CDE) perimeter\
        \ and critical data systems must be in scope of testing\n \u2022 Testing verifies\
        \ that CDE perimeter segmentation is operational\n \u2022 Testing is performed\
        \ from both inside and outside the CDE network\n \u2022 Testing validates\
        \ segmentation and scope reduction controls (e.g., tokenization processes)\n\
        \ \u2022 Network layer penetration tests must include components that support\
        \ network functions as well as operating systems\n \u2022 Testing is performed\
        \ with consideration of threats verified on an on-going basis from external\
        \ alerts, directives, and advisories\n \u2022 Testing is performed with consideration\
        \ of vulnerabilities reported through organization's PSIRT process on an on-going\
        \ basis\n \u2022 Risk ratings are assigned to discovered vulnerabilities,\
        \ which are tracked through remediation\n3. Review penetration testing reports\
        \ and ensure timely closure of identified vulnerabilities \n\nNote: For BU's\
        \ who act as service providers such a pen test needs to be performed every\
        \ 6 months."
      typical_evidence: '1. Provide penetration testing calendar prepared for tests
        performed against cardholder data environments (CDE)

        2. Provide penetration testing reports for tests conducted on cardholder data
        environments (CDE)

        3. Provide scope and requirements documentation for penetration testing on
        cardholder data environments (CDE)


        Note: For BU''s who act as service providers such a pen test needs to be performed
        every 6 months.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-353
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 353
      name: Monitor of Installed Software
      description: The organization monitors all user installed software, and validates
        whether or not the software is appropriate. Any inappropriate software installed
        is immediately removed.
      annotation: '1. Organization monitors all user installed software on workstations
        and mobile devices that have access to the organization network/applications.

        2. Any user installed software that is deemed not appropriate is immediately
        removed.

        3. This can be via automated process via having a list of unapproved software
        that is continuously maintained, or reviewing each software users install.'
      typical_evidence: "1. Validate organization has monitoring procedures in place\
        \ that monitor workstations for user installed software.\n2. Validate any\
        \ inappropriate software is immediately removed either via automated process\
        \ or manual review.\n\nTX-RAMP Level 1 & 2 - The following attribute should\
        \ be validated for CCF-TVM-02.22: Monitor installed software policy compliance\
        \ monthly\n\nFedRAMP Moderate & High - The following attribute should be validated\
        \ for CCF-TVM-02.22: \n- TrendMicro are used here to prevent the execution\
        \ of any unauthorized software. Review and updates the list of authorized\
        \ software programs quarterly or after major changes.\n- Organization policies\
        \ standards should include the possible use of open source software and policies/procedures\
        \ around use of it.\n- There should be alerts in place when user downloads\
        \ inappropriate software.\n\nFedRAMP High - The following attribute should\
        \ be validated for CCF-TVM-02.22: all open-source software is validated and\
        \ checked for security flaws before use, and there should be a level of software\
        \ whitelisting in place / prohibition of use of certain software/software\
        \ restrictions.\n\nCCCS medium cloud profile specific requirement:\nTrendMicro\
        \ are used to prevent the execution of any unauthorized software. The list\
        \ of authorized software programs must be reviewed and updated annually."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-354
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 354
      name: Restrict Use of Nonessential Functions and Services
      description: The organization identifies and restricts the use of nonessential
        functions, ports, protocols, and services.
      annotation: '1. If applicable, organization identifies and labels all functions,
        ports, protocols, and services being used.

        2. Once each function, port, protocol, and service is identified, they are
        categorized and labelled as to whether or not they are essential or non-essential.

        3. All nonessential functions, ports, protocols, and services identified are
        monitored and use of them is restricted. Any inappropriate use of the nonessential
        functions, ports, protocols and services are followed up upon and assessed.'
      typical_evidence: '1. Validate organization labels and identifies nonessential
        functions, ports, protocols, and services.

        2. Validate that the nonessential functions, ports, protocols and services
        are monitored for use, restricted, and any inappropriate use is followed up
        upon and resolved/assessed.


        TX-RAMP Level 2 - The following attribute should be validated for CCF-TVM-02.23:
        Review the system quarterly to identify unnecessary and/or nonsecure functions,
        ports, protocols, software, and services


        FedRAMP Moderate & High - The following attribute should be validated for
        CCF-TVM-02.23:  look for a "deny all, permit by exception" standard.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-355
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 355
      name: Security Plans
      description: The organization develops, documents, and periodically updates
        system security plans that describe system boundaries, system environments
        of operation, and how security requirements are implemented, and the relationships
        with or connections to other systems.
      annotation: '1. Each Systems is responsible for documenting system security
        plans that describe a system''s boundaries, system environments of operation,
        how security requirements have been implemented in the system, and relationships
        with or connections to other systems.

        2. Each Systems is responsible for maintaining this document and ensuring
        it is updated at least annually to accurately reflect the system/ecosystem.'
      typical_evidence: "1. Obtain the system security plan and validate that it describes\
        \ system boundaries, system environments of operation, and how security requirements\
        \ are implemented, and the relationships with or connections to other systems.\n\
        2. Validate the plan is updated at least annually. \n\nTX-RAMP Level 1 & 2\
        \ - The following attribute should be validated for CCF-TVM-02.24: Review\
        \ and update the information exchange security agreements at least annually"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-356
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 356
      name: Third-party Software Management
      description: "The CSP shall document and implement policies for the use of third-party\
        \ and open source software\n\nThe policy should cover the following aspects:\n\
        \uF0B7 Restrictions on component age;\n\uF0B7 Restrictions on outdated and\
        \ EOL/EOS components;\n\uF0B7 Restrictions on components with known vulnerabilities;\n\
        \uF0B7 Restrictions on public repository usage;\n\uF0B7 Restrictions on acceptable\
        \ licenses;\n\uF0B7 Component update requirements;\n\uF0B7 Deny list of prohibited\
        \ components and versions; and\n\uF0B7 Acceptable community contribution guidelines."
      annotation: "1. Ensure third-party and open source software policy is established/enforced\
        \ and includes the following requirements:\n\u2022 Restrictions on component\
        \ age\n\u2022 Restrictions on outdated and EOL/EOS components depending on\
        \ information sensitivity\n\u2022 Restrictions on components with known vulnerabilities\n\
        \u2022 Restrictions on public repository usage\n\u2022 Restrictions on acceptable\
        \ licenses\n\u2022 Component update requirements\n\u2022 Deny list of prohibited\
        \ components and versions\n\u2022 Acceptable community contribution guidelines."
      typical_evidence: "1. Provide third-party and open source software policy.\n\
        2. Within the third-party and open source software policy, provide evidence\
        \ that the following components are covered:\n\u2022 Restrictions on component\
        \ age\n\u2022 Restrictions on outdated and EOL/EOS components depending on\
        \ information sensitivity\n\u2022 Restrictions on components with known vulnerabilities\n\
        \u2022 Restrictions on public repository usage\n\u2022 Restrictions on acceptable\
        \ licenses\n\u2022 Component update requirements\n\u2022 Deny list of prohibited\
        \ components and versions\n\u2022 Acceptable community contribution guidelines."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-357
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 357
      name: EUCS Nonconformity Notification
      description: The organization notifies and informs customers who operate an
        EUCS-certified cloud service of any organization nonconformities related to
        EUCS requirements.
      annotation: "1. Obtain EUCS compliance assessment and observe nonconformities\
        \ related to EUCS requirements (if applicable).\n2. Obtain snapshots of communications\
        \ to customers regarding nonconformities related to EUCS requirements. \n\
        3. Ensure all customers were informed of nonconformities related to EUCS requirements."
      typical_evidence: '1. Provide EUCS compliance assessment and the corresponding
        list of nonconformities related to EUCS requirements (if applicable).

        2. Provide evidence of communication to customers regarding nonconformities
        related to EUCS requirements.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-358
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 358
      name: Log Data Storage
      description: 'Log data is stored on a physical machine separate from the one

        that generated them.'
      annotation: '1. Obtain log management procedures.

        2. Ensure log management procedure includes the need to store log data on
        a physically separate machine from the one that generated it.

        3. Ensure log data is stored on a physical machine separate from the one that
        generated it.'
      typical_evidence: "1. Provide log management procedure \n2. Provide evidence\
        \ of log data being stored on a physical machine separate from the one that\
        \ generated them"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-359
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 359
      name: New Vulnerabilities Workflow
      description: Newly discovered software vulnerabilities are fixed according to
        organization Policy. The reintroduction of similar or previously resolved
        vulnerabilities is prevented.
      annotation: '1. Obtain and observe documented policies and procedures in place
        corresponding to software vulnerability remediation.

        2. Obtain vulnerability tracker and/or tickets corresponding to vulnerability
        remediation.

        3. Verify on a sample basis vulnerabilities are fixed accordingly to organization
        Policy per CSDL guidance.

        4. Ensure the reintroduction of similar or previously resolved vulnerabilities
        is prevented.

        5. Ensure that organization records lessons learned through root cause analysis
        in a wiki that developers can access and search.'
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to software vulnerability remediation.\n2. Sample a select number of vulnerabilities\
        \ for the audit period and validate they were remediated according to organization\
        \ policy\n3. Validate the reintroduction of previously resolved vulnerabilities\
        \ was prevented \n\nAgID (Critical) - The following attribute should be validated\
        \ for CCF-TVM-02.40: Organization Vulnerability Management Policy Document\
        \ must be updated every 6 months\n\nFedRAMP Moderate & High - The following\
        \ attribute should be validated for CCF-TVM-02.40: \n- entire environment\
        \ is being scanned (OS, webapps, DB and containers) and the BU must adhere\
        \ to FedRAMP SLA's for remediation (30 days for high, 90 days for moderate,\
        \ 180 days for low).  Critical vulnerabilities per the CVE rating will be\
        \ treated as high for FedRAMP.\n- scanner is updated upon identifying new\
        \ vulnerabilities as well (playbook of vulnerabilities to be scanned) prior\
        \ to a new scan\n- SLA for remediating vulnerabilities is 30 days for high\
        \ 90 days for moderate, 180 for low. In addition, BU needs to define process\
        \ for identifying flaws in systems and how they remediate them. \n- how BU's\
        \ respond to false positives needs to be documented.\n\nCCCS medium cloud\
        \ profile specific requirement:\nEntire environment is scanned (OS, webapps,\
        \ DB and containers) and the BU must adhere to CCCS SLA's for remediation\
        \ (30 days for high, 90 days for moderate).  Critical vulnerabilities per\
        \ the CVE rating will be treated as high for CCCS"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-360
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:vulnerability-detection
      ref_id: CCF 360
      name: Security Organization Communication
      description: The cloud service provider maintains regular contact with the Conformity
        Assessment Body (CAB) and National Cybersecurity Certification Authority (NCCA)
        to stay informed about current threats and vulnerabilities.
      annotation: 1. Ensure the CSP maintains regular contact with the Conformity
        Assessment Body (CAB) and National Cybersecurity Certification Authority (NCCA).
      typical_evidence: 1. Provide evidence of regular contact with the Conformity
        Assessment Body (CAB) and National Cybersecurity Certification Authority (NCCA).
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      assessable: false
      depth: 1
      name: IRAP Unique Controls
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Application Security
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-361
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:1
      ref_id: CCF 361
      name: Legal and regulatory advice
      description: Legal and regulatory advice is sought regarding the development
        and implementation of a trusted insider program.
      annotation: '1. Develop and implement a trusted insider program and review the
        program periodically. A trusted insider program is a policy/procedure/method
        defining roles and responsibilities to anyone who has been given access to
        business systems and physical premises, and each user''s security responsibilities.

        2. Obtain legal and regulatory advice when developing and implementing a trusted
        insider program'
      typical_evidence: '1. Provide evidence of the insider threat program in place

        2. Provide evidence that the program is being reviewed periodically

        3. Provide evidence that legal and regulatory advice is sought regarding the
        development and implementation of a trusted insider program'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Governance, Risk and Compliance
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-362
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:2
      ref_id: CCF 362
      name: Chief Information Security Officer
      description: The organization has a dedicated Chief Information Security Officer
        (CISO) who is responsible for providing guidance and overseeing the cyber
        security program at organization. The CISO coordinates cyber security and
        business alignment through a cyber security steering committee or advisory
        board, and meets formally on a regular basis.
      annotation: "1. Verify if a Chief Information Security Officer has been formally\
        \ appointed i.e. appointment letter, communication mail, organizational chart,\
        \ any charter document(s) etc.\n2 Verify if roles and responsibilities of\
        \ the CISO have been formally documented, established and communicated to\
        \ the CISO.\n3 Verify if management review meetings are conducted and involve\
        \ CISO to guide and oversee the cyber security program. \n4. CISO's and their\
        \ steering committee should meet on a regularly basis at least annually."
      typical_evidence: '1. Provide proof of appointment that may include i.e. appointment
        letter, communication mails, organizational chart, any charter document(s)
        etc.

        2. Provide governance roles and responsibility document highlighting roles
        and responsibilities of the CISO.

        3. Provide evidence of management review meetings conducted by CISO for cyber
        security program that may be in the form of Minutes of meetings (MoMs) etc.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-363
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:2
      ref_id: CCF 363
      name: Compromised cryptographic equipment
      description: If applicable, the compromise or suspected compromise of cryptographic
        equipment or associated keying material is reported to an organization's Chief
        Information Security Officer, or one of their delegates, as soon as possible
        after it occurs. Keying material is changed when compromised or suspected
        of being compromised.
      annotation: '1. Establish a reporting process (including timelines, delegates
        and reporting channel) to report any compromise or suspected compromise of
        cryptographic equipment or associated keying material to the Chief Information
        Security Officer or one of their delegates

        2. Change keying material in case it is compromised or suspected of being
        compromised'
      typical_evidence: '1. Provide evidence of communication of compromise or suspected
        compromise of Cryptographic Equipment or associated keying material to the
        Chief Information Security Officer or one of their delegates as soon as it
        occurs

        2. Provide evidence of keying material being changed when compromised or suspected
        of being compromised'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-364
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:2
      ref_id: CCF 364
      name: IRAP Sponsor
      description: Systemss pursuing IRAP are responsible for identifying a sponsor.
      annotation: 1. All Systemss pursuing IRAP are responsible for identifying a
        sponsor.
      typical_evidence: 1. Validate the Systems has identified a sponsor if they are
        pursuing IRAP.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Privacy
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-365
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:3
      ref_id: CCF 365
      name: Data Spillage
      description: Customer and Personal Information is monitored for data spillage.
        In the event of a data spill, the event is assessed for impact and the data
        is immediately removed, or access to the data is restricted.
      annotation: '1. Identify areas (IT assets) where customer and personal information
        is stored

        2. Validate various monitoring processes and security solutions and in place
        for monitoring of Customer and Personal Information for data spillage

        3. Validate whether security solutions such as Data Leakage Prevention (DLP)
        is implemented and is monitored periodically for movement of customer and
        personal information

        4. Verify if a post incident process/ guidance document exists for handling
        the event of data spillage.

        5. For best practice, test the monitoring method/solution at least once a
        year to ensure the monitoring of data spillage is working as intended'
      typical_evidence: '1. Identify areas where customer and personal information
        is stored and provide evidence of this determination

        2. List of tools/applications/services/methods that are used to perform the
        monitoring of data spillage

        3. Validate whether security solutions such as Data Leakage Prevention (DLP)
        is implemented to monitor movement of customer and personal information

        4. Provide evidence of monitoring of Customer and Personal Information for
        data spillage

        5. Provide process/ guidance document highlighting post incident guidelines
        in the event of data spillage

        6. As applicable, provide a sample data spill that happened recently - provide
        evidence showing all necessary steps (like removing of data/access) were taken'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Infrastructure Operations
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-366
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 366
      name: Video Conferencing Authentication
      description: "Authentication and authorization for use of IP Phones and video\
        \ conferencing must follow the following;\n\n\u2022 Video conferencing or\
        \ IP telephone traffic have encrypted and non-replayable authentication scheme.\
        \ \n\u2022 Authentication and authorization is in place for all call related\
        \ activities such as individual logins for IP Phones, call setup, changing\
        \ settings, and accessing voicemail.\n\u2022 IP phones are configured to authenticate\
        \ to call controller upon registration. Auto-registration, along with all\
        \ other unused and prohibited functionalities are disabled.\n\u2022 Unauthorized\
        \ devices are blocked by default."
      annotation: "1. Verify whether following requirements have been implemented\
        \ for video and calling infrastructure:\n\u2022 Video conferencing or IP telephone\
        \ traffic have encrypted and non-replayable authentication scheme. \n\u2022\
        \ Authentication and authorization is in place for all call related activities\
        \ such as individual logins for IP Phones, call setup, changing settings,\
        \ and accessing voicemail.\n\u2022 IP phones are configured to authenticate\
        \ to call controller upon registration. Auto-registration, along with all\
        \ other unused and prohibited functionalities are disabled.\n\u2022 Unauthorized\
        \ devices are blocked by default.\n\n2. Validate whether requirements are\
        \ documented, reviewed and approved on a set cadence (at least annually) for\
        \ accuracy and relevance."
      typical_evidence: "1. Provide hardening guidelines for video and calling infrastructure\n\
        2. Provide evidences of hardening performed for video and calling infrastructure\n\
        3. Provide following hardening evidences if available:\n\u2022 Video conferencing\
        \ or IP telephone traffic have encrypted and non-replayable authentication\
        \ scheme. \n\u2022 Authentication and authorization is in place for all call\
        \ related activities such as individual logins for IP Phones, call setup,\
        \ changing settings, and accessing voicemail.\n\u2022 IP phones are configured\
        \ to authenticate to call controller upon registration. Auto-registration,\
        \ along with all other unused and prohibited functionalities are disabled.\n\
        \u2022 Unauthorized devices are blocked by default."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-367
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 367
      name: IP Phone Login
      description: Individual logins are implemented for IP phones used for SECRET
        or TOP SECRET conversations.
      annotation: 1. Verify whether authentication and authorization mechanism is
        implemented for individual logins of IP Phones used for SECRET or TOP SECRET
        conversations.
      typical_evidence: 1. Provide evidences (configuration + a sample of one) to
        validate authentication and authorization is in place for individual logins
        of IP Phones used for SECRET or TOP SECRET conversations..
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-368
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 368
      name: Fax Machine Policy
      description: "A fax machine and multi-function device (MFD) policy is in implemented\
        \ and includes the following requirements:\n\n\u2022 Separate fax machines\
        \ and MFDs are used for sending classified information.\n\u2022 Messages are\
        \ encrypted to  an appropriate level depending on information sensitivity.\n\
        \u2022 The sender of a fax message makes arrangements for the receiver to\
        \ collect the fax message as soon as possible after it is sent and for the\
        \ receiver to notify the sender if the fax message does not arrive in an agreed\
        \ amount of time.\n\u2022 A direct connection from an MFD to a digital telephone\
        \ system is not enabled unless the digital telephone system is authorized\
        \ to operate at the same sensitivity or classification as the network to which\
        \ the MFD is connected.\n\u2022 MFDs connected to networks are not used to\
        \ copy documents above the sensitivity or classification of the connected\
        \ network.\n\u2022 Fax machines and MFDs are located in areas where their\
        \ use can be observed."
      annotation: "1. Verify if fax machine and multi-function device (MFD) policy\
        \ is established/enforced and includes the following requirements:\n\u2022\
        \ Separate fax machines and MFDs are used for sending classified information.\n\
        \u2022 Messages are encrypted to  an appropriate level depending on information\
        \ sensitivity.\n\u2022 The sender of a fax message makes arrangements for\
        \ the receiver to collect the fax message as soon as possible after it is\
        \ sent and for the receiver to notify the sender if the fax message does not\
        \ arrive in an agreed amount of time.\n\u2022 A direct connection from an\
        \ MFD to a digital telephone system is not enabled unless the digital telephone\
        \ system is authorized to operate at the same sensitivity or classification\
        \ as the network to which the MFD is connected.\n\u2022 MFDs connected to\
        \ networks are not used to copy documents above the sensitivity or classification\
        \ of the connected network.\n\u2022 Fax machines and MFDs are located in areas\
        \ where their use can be observed."
      typical_evidence: "1. Provide fax machine and multi-function device (MFD) policy.\n\
        2. Within the MFD policy, provide evidence that the following components are\
        \ covered:\n\u2022 Separate fax machines and MFDs are used for sending classified\
        \ information.\n\u2022 Messages are encrypted to  an appropriate level depending\
        \ on information sensitivity.\n\u2022 The sender of a fax message makes arrangements\
        \ for the receiver to collect the fax message as soon as possible after it\
        \ is sent and for the receiver to notify the sender if the fax message does\
        \ not arrive in an agreed amount of time.\n\u2022 A direct connection from\
        \ an MFD to a digital telephone system is not enabled unless the digital telephone\
        \ system is authorized to operate at the same sensitivity or classification\
        \ as the network to which the MFD is connected.\n\u2022 MFDs connected to\
        \ networks are not used to copy documents above the sensitivity or classification\
        \ of the connected network.\n\u2022 Fax machines and MFDs are located in areas\
        \ where their use can be observed."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-369
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 369
      name: Mobile Device Storage
      description: Mobile devices do not process, store or communicate SECRET or TOP
        SECRET data unless explicitly approved by the ACSC to do so.
      annotation: "1. Validate if Secret or Top Secret data is authorized to be stored,\
        \ processed or communicated via mobile devices.\n2. Validate if mobile device\
        \ management/teleworking/ trusted device policy includes controls implemented\
        \ to ensure mobile devices do not store, process and communicate Secret or\
        \ Top Secret data. In case of exception, prior approvals must be taken from\
        \ ACSC. \n3. For mobile devices with such exception, validate whether prior\
        \ approval was taken from ACSC."
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Within MDM policy, provide evidence that mobile devices are not permitted
        to process, store, or communicate SECRET or TOP SECRET data and policy clearly
        articulates approval workflow if SECRET or TOP SECRET data is to be process/stored/communicated.

        3. Sample exceptions/ approvals taken from ACSC'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-370
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 370
      name: ACSC Mobile Phone Platform
      description: If applicable, personnel accessing OFFICIAL and PROTECTED systems
        or data using a privately-owned mobile device use an ACSC approved platform,
        a security configuration in accordance with ACSC guidance, and have enforced
        separation of work data from any personal data.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy and verify if following controls for privately-owned mobile devices\
        \ having access to official or classified systems or data have been implemented:\n\
        \u2022 ACSC approved platform for MDM is in use, \n\u2022 All security configuration\
        \ in accordance with ACSC guidance\n\u2022 Separation of official and classified\
        \ data from any personal data is enforced (e.g. containerization)"
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Evidence of MDM policy configured for privately-owned mobile devices.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-371
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 371
      name: Mobile Phone Access
      description: Privately-owned mobile devices are prohibited from accessing systems
        or data before being configured with the appropriate security standards. Privately-owned
        mobile devices do not access SECRET and TOP SECRET systems or data.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n2. Validate if Privately-owned mobile devices are prohibited from\
        \ accessing SECRET or TOP SECRET systems or data via. mobile device management\
        \ configurations"
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Within MDM policy, provide evidence that mobile devices are prohibited
        from accessing classified, or highly classified systems or data

        3. Evidence of MDM policy configured for privately-owned mobile devices.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-372
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 372
      name: ACSC Approved Mobile Platform
      description: Personnel accessing systems or data using an organization-owned
        mobile device use an ACSC approved platform with a security configuration
        in accordance with ACSC guidance.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy and verify if following controls for organization-owned mobile devices\
        \ having access to official or classified systems or data have been implemented:\n\
        \u2022 ACSC approved platform for MDM is in use, \n\u2022 All security configuration\
        \ in accordance with ACSC guidance"
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Evidence of MDM policy configured for organization-owned mobile devices.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-373
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 373
      name: Mobile Device Encryption
      description: All data on mobile devices is encrypted using at least an Australian
        Signals Directorate Approved Cryptographic Algorithm.
      annotation: '1. Obtain Mobile device management/ teleworking/ trusted device
        policy and verify if encryption of mobile devices are in line with Australian
        Signals Directorate Approved Cryptographic Algorithm.

        2. For sample mobile devices, verify if the cryptographic algorithm in use
        is in line with Australian Signals Directorate Approved Cryptographic Algorithm.
        More information: https://www.cyber.gov.au/acsc/view-all-content/advice/guidelines-cryptography'
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Within MDM policy, provide evidence that mobile devices are required to
        encrypt using at least an ASD approved cryptographic algorithm (More information:
        https://www.cyber.gov.au/acsc/view-all-content/advice/guidelines-cryptography)

        3. Evidence of cryptographic algorithm implemented for mobile devices.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-374
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 374
      name: Mobile Bluetooth Communication
      description: The range of Bluetooth communications between mobile devices and
        other Bluetooth devices is restricted to less than 10 meters by using class
        2 or class 3 Bluetooth devices.
      annotation: 1. Obtain Mobile device management/ teleworking/ trusted device
        policy and verify if controls are in place to restrict the range of Bluetooth
        communications between mobile devices and other Bluetooth devices to less
        than 10 meters by using class 2 or class 3 Bluetooth devices.
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Evidence of Bluetooth device restriction implemented for mobile devices.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-375
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 375
      name: Highly classified mobile Bluetooth functionality
      description: Bluetooth functionality is not enabled on SECRET and TOP SECRET
        mobile devices.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n2. Validate in the MDM tool, if controls are in place to disable/block\
        \ Bluetooth functionality on highly classified mobile devices."
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Provide MDM configuration showing Bluetooth functionality is not enabled
        on highly classified mobile devices'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-376
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 376
      name: Mobile Device Bluetooth Pairing
      description: Mobile devices are configured to remain undiscoverable to other
        Bluetooth devices except during Bluetooth pairing.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n2. Validate in the MDM tool, if mobile devices are configured to\
        \ remain undiscoverable to other Bluetooth devices except during Bluetooth\
        \ pairing."
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Provide MDM configuration showing mobile devices are configured to remain
        undiscoverable to other Bluetooth devices except during Bluetooth pairing.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-377
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 377
      name: Bluetooth Pairing Version
      description: If applicable, Bluetooth pairing is performed using Secure Connections,
        preferably with Numeric Comparison if supported.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n2. Validate in the MDM tool, if Bluetooth pairing is performed\
        \ using Bluetooth version \u20221 or later (as applicable)"
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Provide MDM configuration showing Bluetooth pairing is performed using
        Bluetooth version 2.1 or later.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-378
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 378
      name: Bluetooth Pairing
      description: If applicable, Bluetooth pairing is performed in a manner such
        that connections are only made between intended Bluetooth devices.
      annotation: '1. Obtain Mobile device management/ teleworking/ trusted device
        policy

        2. Validate in the MDM tool, if conditions for Bluetooth use are documented
        and enforced (as applicable) i.e. Bluetooth pairing is performed in a manner
        such that connections are only made between intended Bluetooth devices.'
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Provide MDM configuration showing Bluetooth pairing is performed in a manner
        such that connections are only made between intended Bluetooth devices.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-379
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 379
      name: Bluetooth Pairing Removal
      description: If applicable, Bluetooth pairings are removed from mobile devices
        when there is no longer a requirement for their use.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n2. Validate in the MDM tool, if conditions for Bluetooth use are\
        \ documented and enforced (as applicable) i.e. Bluetooth pairings are removed\
        \ from mobile devices when there is no longer a requirement for their use."
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Provide MDM configuration showing Bluetooth pairings are removed from mobile
        devices when there is no longer a requirement for their use.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-380
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 380
      name: Sensitive Data Communication
      description: Paging, Multimedia Message Service, Short Message Service and messaging
        apps are prohibited to communicate sensitive or classified data.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n2. Validate in the MDM tool, if controls are in place to prohibit\
        \ Paging, Multimedia Message Service, Short Message Service and messaging\
        \ apps to communicate sensitive or classified data."
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Provide MDM configuration showing Paging, Multimedia Message Service, Short
        Message Service and messaging apps are prohibited to communicate sensitive
        or classified data.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-381
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 381
      name: Sensitive Data Viewing
      description: Sensitive or classified data is not viewed or communicated in public
        locations unless care is taken to reduce the chance of the screen of a mobile
        device being observed.
      annotation: 1. Obtain Mobile device management/ teleworking/ trusted device
        policy and verify conditions for mobile device use in public locations are
        documented and enforced (as applicable) i.e. Sensitive or classified data
        is not viewed or communicated in public locations unless care is taken to
        reduce the chance of the screen of a mobile device being observed.
      typical_evidence: '1. Provide Mobile device management/ teleworking/ trusted
        device policy

        2. Evidence of communication of this policy to personnel

        3. Within the policy, evidence of requirements around protection of mobile
        screen (like a privacy screen) for mobile devices issued by company'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-382
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 382
      name: Privacy Filters
      description: Privacy filters are applied to the screens of SECRET and TOP SECRET
        mobile devices.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n\n2. Validate if requirements to for application of privacy filter\
        \ to the screens of SECRET and TOP SECRET mobile devices are implemented."
      typical_evidence: '1. Provide Mobile device management policy requiring the
        privacy filter applications on mobile devices

        2. Using a sample mobile device, demonstrate that privacy filters are applied
        on the mobile devices'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-383
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 383
      name: Sensitive Phone Calls
      description: Sensitive or classified phone calls are not conducted in public
        locations unless care is taken to reduce the chance of conversations being
        overheard.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n\n2. Validate that conditions for mobile device use in public locations\
        \ are documented and enforced (as applicable) i.e. Sensitive or classified\
        \ phone calls are not conducted in public locations unless care is taken to\
        \ reduce the chance of conversations being overheard."
      typical_evidence: 1. Provide Mobile device management/ teleworking/ trusted
        device policy stating best practices to attend phone calls to ensure that
        confidential conversations are not being overheard
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-384
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 384
      name: Mobile Device Supervision
      description: Mobile devices are kept under continual direct supervision when
        being actively used.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n\n2. Validate that conditions for mobile device use are documented\
        \ and enforced (as applicable) i.e. Mobile devices are kept under continual\
        \ direct supervision when being actively used."
      typical_evidence: 1. Provide Mobile device management/ teleworking/ trusted
        device policy stating best practices to attend phone calls to ensure that
        mobile devices are kept under direct supervision when being used.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-385
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 385
      name: Mobile Device Storage
      description: Mobile devices are carried or stored in a secured state when not
        being actively used.
      annotation: "1. Obtain Mobile device management/ teleworking/ trusted device\
        \ policy \n\n2. Validate that conditions for mobile device use are documented\
        \ and enforced (as applicable) i.e. Mobile devices are carried or stored in\
        \ a secured state when not being actively used."
      typical_evidence: 1. Provide Mobile device management/ teleworking/ trusted
        device policy stating best practices to attend phone calls to ensure that
        mobile devices are carried and/or stored in a secured state when not being
        used.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-386
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 386
      name: Mobile Sanitization
      description: A mobile device emergency sanitization process, and supporting
        mobile device emergency sanitization procedures, is developed and implemented.
      annotation: '1. Verify if process for mobile device emergency sanitization is
        documented and enforced.

        2. Validate controls implemented for mobile device emergency sanitization
        (e.g. remote wiping)'
      typical_evidence: 1. Provide Mobile device management or documentation containing
        mobile device emergency sanitization process, and supporting mobile device
        emergency sanitization procedures
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-387
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 387
      name: Traveling Security risks
      description: Personnel are advised of privacy and security risks when travelling
        overseas with mobile devices.
      annotation: 1. Obtain Teleworking/ trusted device policy/ Code of conduct and
        verify if personnel are advised of privacy and security risks when travelling
        overseas with mobile devices.
      typical_evidence: 1. Provide Teleworking/ trusted device policy/ Code of conduct
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-388
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 388
      name: Traveling with Mobile Devices
      description: "If travelling overseas with mobile devices to high/extreme risk\
        \ countries, personnel are:\n\u2022 issued with newly provisioned accounts\
        \ and devices from a pool of dedicated travel devices which are used solely\
        \ for work-related activities\n\u2022 advised on how to apply and inspect\
        \ tamper seals to key areas of devices\n\u2022 advised to avoid taking any\
        \ personal devices, especially if rooted or jailbroken."
      annotation: "1. Obtain Teleworking/ trusted device policy/ Code of conduct and\
        \ verify if following requirements for travelling overseas with mobile devices\
        \ to high/extreme risk countries are implemented:\n\u2022 personnel are issued\
        \ with newly provisioned accounts and devices from a pool of dedicated travel\
        \ devices which are used solely for work-related activities\n\u2022 personnel\
        \ are advised on how to apply and inspect tamper seals to key areas of devices\n\
        \u2022 personnel are advised to avoid taking any personal devices, especially\
        \ if rooted or jailbroken."
      typical_evidence: "1. Provide Teleworking/ trusted device policy/ Code of conduct\
        \ to ensure that following conditions are included in the policy(ies):\n\u2022\
        \ issued with newly provisioned accounts and devices from a pool of dedicated\
        \ travel devices which are used solely for work-related activities\n\u2022\
        \ advised on how to apply and inspect tamper seals to key areas of devices\n\
        \u2022 advised to avoid taking any personal devices, especially if rooted\
        \ or jailbroken."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-389
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 389
      name: Pre Travel Checklist
      description: "Before travelling overseas with mobile devices, personnel take\
        \ the following actions:\n\u2022 record all details of the devices being taken,\
        \ such as product types, serial numbers and International Mobile Equipment\
        \ Identity numbers\n\u2022 update all applications and operating systems\n\
        \u2022 remove all non-essential accounts, applications and data\n\u2022 apply\
        \ security configuration settings, such as lock screens\n\u2022 configure\
        \ remote locate and wipe functionality\n\u2022 enable encryption, including\
        \ for any media used\n\u2022 backup all important data and configuration settings."
      annotation: "1. Obtain Teleworking/ trusted device policy/ Code of conduct and\
        \ verify if following requirements for travelling overseas are implemented:\n\
        \u2022 record all details of the devices being taken, such as product types,\
        \ serial numbers and International Mobile Equipment Identity numbers\n\u2022\
        \ update all applications and operating systems\n\u2022 remove all non-essential\
        \ accounts, applications and data\n\u2022 apply security configuration settings,\
        \ such as lock screens\n\u2022 configure remote locate and wipe functionality\n\
        \u2022 enable encryption, including for any media used\n\u2022 backup all\
        \ important data and configuration settings."
      typical_evidence: "1. Provide Teleworking/ trusted device policy/ Code of conduct\
        \ to ensure that following conditions are included in the policy(ies):\n\u2022\
        \ record all details of the devices being taken, such as product types, serial\
        \ numbers and International Mobile Equipment Identity numbers\n\u2022 update\
        \ all applications and operating systems\n\u2022 remove all non-essential\
        \ accounts, applications and data\n\u2022 apply security configuration settings,\
        \ such as lock screens\n\u2022 configure remote locate and wipe functionality\n\
        \u2022 enable encryption, including for any media used\n\u2022 backup all\
        \ important data and configuration settings."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-390
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 390
      name: Travel Precautions
      description: "Personnel take the following precautions when travelling overseas\
        \ with mobile devices:\n\u2022 never leaving devices or media unattended for\
        \ any period of time, including by placing them in checked-in luggage or leaving\
        \ them in hotel safes\n\u2022 never storing credentials with devices that\
        \ they grant access to, such as in laptop bags\n\u2022 never lending devices\
        \ to untrusted people, even if briefly\n\u2022 never allowing untrusted people\
        \ to connect other devices or media to their devices, including for charging\n\
        \u2022 never using designated charging stations, wall outlet charging ports\
        \ or chargers supplied by untrusted people\n\u2022 avoiding connecting devices\
        \ to open or untrusted Wi-Fi networks\n\u2022 using an approved Virtual Private\
        \ Network to encrypt all device communications\n\u2022 using encrypted mobile\
        \ applications for communications instead of using foreign telecommunication\
        \ networks\n\u2022 disabling any communications capabilities of devices when\
        \ not in use, such as cellular data, wireless, Bluetooth and Near Field Communication\n\
        \u2022 avoiding reuse of media once used with other parties\u2019 devices\
        \ or systems\n\u2022 ensuring any media used for data transfers are thoroughly\
        \ checked for malicious code beforehand\n\u2022 never using any gifted devices,\
        \ especially media, when travelling or upon returning from travelling."
      annotation: "1. Obtain Teleworking/ trusted device policy/ Code of conduct and\
        \ verify if following precautions for travelling overseas are documented:\n\
        \u2022 never leaving devices or media unattended for any period of time, including\
        \ by placing them in checked-in luggage or leaving them in hotel safes\n\u2022\
        \ never storing credentials with devices that they grant access to, such as\
        \ in laptop bags\n\u2022 never lending devices to untrusted people, even if\
        \ briefly\n\u2022 never allowing untrusted people to connect other devices\
        \ or media to their devices, including for charging\n\u2022 never using designated\
        \ charging stations, wall outlet charging ports or chargers supplied by untrusted\
        \ people\n\u2022 avoiding connecting devices to open or untrusted Wi-Fi networks\n\
        \u2022 using an approved Virtual Private Network to encrypt all device communications\n\
        \u2022 using encrypted mobile applications for communications instead of using\
        \ foreign telecommunication networks\n\u2022 disabling any communications\
        \ capabilities of devices when not in use, such as cellular data, wireless,\
        \ Bluetooth and Near Field Communication\n\u2022 avoiding reuse of media once\
        \ used with other parties\u2019 devices or systems\n\u2022 ensuring any media\
        \ used for data transfers are thoroughly checked for malicious code beforehand\n\
        \u2022 never using any gifted devices, especially media, when travelling or\
        \ upon returning from travelling."
      typical_evidence: "1. Provide Teleworking/ trusted device policy/ Code of conduct\
        \ to ensure that following conditions are included in the policy(ies):\n\u2022\
        \ never leaving devices or media unattended for any period of time, including\
        \ by placing them in checked-in luggage or leaving them in hotel safes\n\u2022\
        \ never storing credentials with devices that they grant access to, such as\
        \ in laptop bags\n\u2022 never lending devices to untrusted people, even if\
        \ briefly\n\u2022 never allowing untrusted people to connect other devices\
        \ or media to their devices, including for charging\n\u2022 never using designated\
        \ charging stations, wall outlet charging ports or chargers supplied by untrusted\
        \ people\n\u2022 avoiding connecting devices to open or untrusted Wi-Fi networks\n\
        \u2022 using an approved Virtual Private Network to encrypt all device communications\n\
        \u2022 using encrypted mobile applications for communications instead of using\
        \ foreign telecommunication networks\n\u2022 disabling any communications\
        \ capabilities of devices when not in use, such as cellular data, wireless,\
        \ Bluetooth and Near Field Communication\n\u2022 avoiding reuse of media once\
        \ used with other parties\u2019 devices or systems\n\u2022 ensuring any media\
        \ used for data transfers are thoroughly checked for malicious code beforehand\n\
        \u2022 never using any gifted devices, especially media, when travelling or\
        \ upon returning from travelling."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-391
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 391
      name: Compromised Mobile Devices
      description: "Personnel report the potential compromise of mobile devices, media\
        \ or credentials to their organization as soon as possible, especially if\
        \ they:\n\u2022 provide credentials, decrypt devices or have devices taken\
        \ out of sight by foreign government officials\n\u2022 have devices or media\
        \ stolen that are later returned\n\u2022 lose devices or media that are later\
        \ found\n\u2022 observe unusual behavior of devices."
      annotation: "1. Obtain Teleworking/ trusted device policy/ Code of conduct/\
        \ incident management policy and verify if following requirements are documented\
        \ for personnel reporting of potential compromise of mobile devices, media\
        \ or credentials to their organization as soon as possible, especially if\
        \ they -\n\u2022 provide credentials, decrypt devices or have devices taken\
        \ out of sight by foreign government officials\n\u2022 have devices or media\
        \ stolen that are later returned\n\u2022 lose devices or media that are later\
        \ found\n\u2022 observe unusual behavior of devices."
      typical_evidence: "1. Provide Teleworking/ trusted device policy/ Code of conduct/\
        \ incident management policy to ensure that the following conditions are included\
        \ in the policy(ies):\n\u2022 provide credentials, decrypt devices or have\
        \ devices taken out of sight by foreign government officials\n\u2022 have\
        \ devices or media stolen that are later returned\n\u2022 lose devices or\
        \ media that are later found\n\u2022 observe unusual behavior of devices."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-392
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 392
      name: Mobile Device Sanitization
      description: "Upon returning from travelling overseas with mobile devices, personnel\
        \ take the following actions:\n\u2022 sanitize and reset devices, including\
        \ all media used with them\n\u2022 decommission any physical credentials that\
        \ left their possession during their travel\n\u2022 report if significant\
        \ doubt exists as to the integrity of any devices following their travel."
      annotation: "1. Obtain Teleworking/ trusted device policy/ Code of conduct and\
        \ verify if following conditions for returning from overseas are documented:\n\
        \u2022 sanities and reset devices, including all media used with them\n\u2022\
        \ decommission any physical credentials that left their possession during\
        \ their travel\n\u2022 report if significant doubt exists as to the integrity\
        \ of any devices following their travel."
      typical_evidence: "1. Provide Teleworking/ trusted device policy/ Code of conduct\
        \ policy to ensure that the following conditions are included in the policy(ies):\n\
        \u2022 sanities and reset devices, including all media used with them\n\u2022\
        \ decommission any physical credentials that left their possession during\
        \ their travel\n\u2022 report if significant doubt exists as to the integrity\
        \ of any devices following their travel."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-393
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 393
      name: Mobile Device Monitoring
      description: "If returning from travelling overseas with mobile devices to high/extreme\
        \ risk countries, personnel take the following additional actions:\n\u2022\
        \ reset user credentials used with devices, including those used for remote\
        \ access to their organization's systems\n\u2022 monitor accounts for any\
        \ indicators of compromise, such as failed login attempts."
      annotation: "1. Obtain Teleworking/ trusted device policy/ Code of conduct and\
        \ verify if following conditions for returning from high/extreme risk countries\
        \ are documented:\n\u2022 reset user credentials used with devices, including\
        \ those used for remote access to their organization's systems\n\u2022 monitor\
        \ accounts for any indicators of compromise, such as failed login attempts."
      typical_evidence: "1. Provide Teleworking/ trusted device policy/ Code of conduct\
        \ policy to ensure that the following conditions are included in the policy(ies):\n\
        \u2022 reset user credentials used with devices, including those used for\
        \ remote access to their organization's systems\n\u2022 monitor accounts for\
        \ any indicators of compromise, such as failed login attempts."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-394
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 394
      name: Administrator Workstation
      description: Administrator workstations are placed into a separate network zone
        to user workstations.
      annotation: '1. Review network zoning policy and verify if controls are in place
        to ensure administrator workstations are placed into a separate network zone
        to user workstations.

        2. Validate that network is segmented to ensure that administrator workstations
        are connected to a separate network than that of regular user workstation
        network'
      typical_evidence: '1. Provide network zoning policy

        2. Within the network zoning policy, provide evidence that administrator workstations
        are required to be placed into a separate network zone to user workstations
        (network segmentation)

        3. Provide evidence of separation of these networks using firewall rules,
        etc.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-395
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 395
      name: Management Traffic
      description: Management traffic is only allowed to originate from network zones
        that are used to administer systems and applications.
      annotation: '1. Review network zoning policy and verify if controls are in place
        to ensure management traffic is only allowed to originate from network zones
        that are used to administer systems and applications.

        2. Validate that the management traffic is required and configured (respectively)
        to originate from network areas that are dedicated to administer systems/applications'
      typical_evidence: '1. Provide network zoning policy

        2. Within the network zoning policy and through configuration, provide evidence
        that the management traffic is required and configured (respectively) to originate
        from network areas that are dedicated to administer systems/applications'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-396
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 396
      name: Jump Server
      description: If applicable, jump servers are used for administrative activities
        and are prevented from communicating to assets and traffic not related to
        the administrative activities.
      annotation: '1. Review network security/ wireless/ remote access policy and
        validate how administrative access are undertaken

        2. Verify if jump servers are used for administrative activities and are prevented
        from communicating to assets and traffic not related to the administrative
        activities.'
      typical_evidence: '1. Provide network security/ wireless/ remote access policy

        2. Provide configuration based evidence showing jump servers/boxes are only
        used manage access for administrative related access and activities.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-397
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 397
      name: Extreme Risk Application Security Vulnerability Patching
      description: Security vulnerabilities in applications and drivers assessed as
        extreme risk are patched, updated or mitigated within 48 hours of the security
        vulnerabilities being identified by vendors, independent third parties, system
        managers or users.
      annotation: "1. Obtain vulnerability assessment and patch management policy\n\
        2. Verify timelines for treatment/ patching of high risk vulnerabilities\n\
        3. Validate that a proper process is in place to triage identified extreme\
        \ risk vulnerabilities \n4. Validate if there is a process to periodically\
        \ identify and review vendor supplied patches\n5. Obtain audit log tracker\
        \ for patches updated for applications and drivers\n6. Obtain and verify VA/PT\
        \ tracker capturing records, history and status of all vulnerabilities identified.\
        \ \n7. Validate if high risk vulnerability treatment/ patching is performed\
        \ within specified time frame (within 48 hours)."
      typical_evidence: "1. Provide vulnerability assessment and patch management\
        \ policy\n2. Provide last VA scan reports\n3. Provide audit log tracker for\
        \ patches updated for applications and drivers\n4. Provide sample change tickets\
        \ for last patching performed based on review.\n5. Provide VA/PT tracker capturing\
        \ records, history and status of all vulnerabilities identified. \n6. Provide\
        \ sample extreme risk vulnerability treatment ticket for vulnerabilities identified\
        \ in last VA scan to show if it was patched, updated, or mitigated within\
        \ 48 hours."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-398
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 398
      name: High Risk Application Security Vulnerability Patching
      description: Security vulnerabilities in applications and drivers assessed as
        high risk are patched, updated or mitigated within two weeks of the security
        vulnerability being identified by vendors, independent third parties, system
        managers or users.
      annotation: "1. Obtain vulnerability assessment and patch management policy\n\
        2. Verify timelines for treatment/ patching of high risk vulnerabilities\n\
        3. Validate that a proper process is in place to triage identified high risk\
        \ vulnerabilities \n4. Validate if there is a process to periodically identify\
        \ and review vendor supplied patches\n5. Obtain audit log tracker for patches\
        \ updated for applications and drivers\n6. Obtain and verify VA/PT tracker\
        \ capturing records, history and status of all vulnerabilities identified.\
        \ \n7. Validate if high risk vulnerability treatment/ patching is performed\
        \ within specified time frame (within two weeks)."
      typical_evidence: "1. Provide vulnerability assessment and patch management\
        \ policy\n2. Provide last VA scan reports\n3. Provide audit log tracker for\
        \ patches updated for applications and drivers\n4. Provide sample change tickets\
        \ for last patching performed based on review.\n5. Provide VA/PT tracker capturing\
        \ records, history and status of all vulnerabilities identified. \n6. Provide\
        \ sample high risk vulnerability treatment ticket for vulnerabilities identified\
        \ in last VA scan to show if it was patched, updated, or mitigated within\
        \ two weeks."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-399
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 399
      name: Moderate/Low Application Security Vulnerability Patching
      description: Security vulnerabilities in applications and drivers assessed as
        moderate or low risk are patched, updated or mitigated within one month of
        the security vulnerability being identified by vendors, independent third
        parties, system managers or users.
      annotation: "1. Obtain vulnerability assessment and patch management policy\n\
        2. Verify timelines for treatment/ patching of low risk vulnerabilities\n\
        3. Validate that a proper process is in place to triage identified high risk\
        \ vulnerabilities \n4. Validate if there is a process to periodically identify\
        \ and review vendor supplied patches\n5. Obtain audit log tracker for patches\
        \ updated for applications and drivers\n6. Obtain and verify VA/PT tracker\
        \ capturing records, history and status of all vulnerabilities identified.\
        \ \n7. Validate if high risk vulnerability treatment/ patching is performed\
        \ within specified time frame (within a month)."
      typical_evidence: "1. Provide vulnerability assessment and patch management\
        \ policy\n2. Provide last VA scan reports\n3. Provide audit log tracker for\
        \ patches updated for applications and drivers\n4. Provide sample change tickets\
        \ for last patching performed based on review.\n5. Provide VA/PT tracker capturing\
        \ records, history and status of all vulnerabilities identified. \n6. Provide\
        \ sample low risk vulnerability treatment ticket for vulnerabilities identified\
        \ in last VA scan to show if it was patched, updated, or mitigated within\
        \ a month."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-400
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 400
      name: Extreme Risk Operating System Security Vulnerability Patching
      description: Security vulnerabilities in operating systems and firmware assessed
        as extreme risk are patched, updated or mitigated within 48 hours of the security
        vulnerabilities being identified by vendors, independent third parties, system
        managers or users.
      annotation: "1. Obtain vulnerability assessment and patch management policy\n\
        2. Verify timelines for treatment/ patching of extreme high risk vulnerabilities\n\
        3. Validate that a proper process is in place to triage identified extreme\
        \ high risk vulnerabilities \n4. Validate if there is a process to periodically\
        \ identify and review vendor supplied patches\n5. Obtain audit log tracker\
        \ for patches updated for operating systems and firmware\n6. Obtain and verify\
        \ VA/PT tracker capturing records, history and status of all vulnerabilities\
        \ identified. \n7. Validate if high risk vulnerability treatment/ patching\
        \ is performed within specified time frame (within 48 hours)."
      typical_evidence: "1. Provide vulnerability assessment and patch management\
        \ policy\n2. Provide last VA scan reports\n3. Provide audit log tracker for\
        \ patches updated for operating systems and firmware\n4. Provide sample change\
        \ tickets for last patching performed based on review.\n5. Provide VA/PT tracker\
        \ capturing records, history and status of all vulnerabilities identified.\
        \ \n6. Provide sample extreme high risk vulnerability treatment ticket for\
        \ vulnerabilities identified in last VA scan to show if it was patched, updated,\
        \ or mitigated within 48 hours."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-401
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 401
      name: High Risk Operating System Security Vulnerability Patching
      description: Security vulnerabilities in operating systems and firmware assessed
        as high risk are patched, updated or mitigated within two weeks of the security
        vulnerability being identified by vendors, independent third parties, system
        managers or users.
      annotation: "1. Obtain vulnerability assessment and patch management policy\n\
        2. Verify timelines for treatment/ patching of  high risk vulnerabilities\n\
        3. Validate that a proper process is in place to triage identified  high risk\
        \ vulnerabilities \n4. Validate if there is a process to periodically identify\
        \ and review vendor supplied patches\n5. Obtain audit log tracker for patches\
        \ updated for operating systems and firmware\n6. Obtain and verify VA/PT tracker\
        \ capturing records, history and status of all vulnerabilities identified.\
        \ \n7. Validate if high risk vulnerability treatment/ patching is performed\
        \ within specified time frame (within two weeks)."
      typical_evidence: "1. Provide vulnerability assessment and patch management\
        \ policy\n2. Provide last VA scan reports\n3. Provide audit log tracker for\
        \ patches updated for operating systems and firmware\n4. Provide sample change\
        \ tickets for last patching performed based on review.\n5. Provide VA/PT tracker\
        \ capturing records, history and status of all vulnerabilities identified.\
        \ \n6. Provide sample high risk vulnerability treatment ticket for vulnerabilities\
        \ identified in last VA scan to show if it was patched, updated, or mitigated\
        \ within two weeks."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-402
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 402
      name: Moderate/Low Operating System Security Vulnerability Patching
      description: Security vulnerabilities in operating systems and firmware assessed
        as moderate or low risk are patched, updated or mitigated within one month
        of the security vulnerability being identified by vendors, independent third
        parties, system managers or users.
      annotation: "1. Obtain vulnerability assessment and patch management policy\n\
        2. Verify timelines for treatment/ patching of  low risk vulnerabilities\n\
        3. Validate that a proper process is in place to triage identified low risk\
        \ vulnerabilities \n4. Validate if there is a process to periodically identify\
        \ and review vendor supplied patches\n5. Obtain audit log tracker for patches\
        \ updated for operating systems and firmware\n6. Obtain and verify VA/PT tracker\
        \ capturing records, history and status of all vulnerabilities identified.\
        \ \n7. Validate if low risk vulnerability treatment/ patching is performed\
        \ within specified time frame (within a month)."
      typical_evidence: "1. Provide vulnerability assessment and patch management\
        \ policy\n2. Provide last VA scan reports\n3. Provide audit log tracker for\
        \ patches updated for operating systems and firmware\n4. Provide sample change\
        \ tickets for last patching performed based on review.\n5. Provide VA/PT tracker\
        \ capturing records, history and status of all vulnerabilities identified.\
        \ \n6. Provide sample low risk vulnerability treatment ticket for vulnerabilities\
        \ identified in last VA scan to show if it was patched, updated, or mitigated\
        \ within a month."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-403
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 403
      name: ICT Equipment Patching
      description: If applicable, high assurance ICT equipment is only patched with
        patches approved by the ACSC using methods and timeframes prescribed by the
        ACSC.
      annotation: '1. Obtain vulnerability assessment and patch management policy

        2. Verify patching timelines for high assurance ICT equipment

        3. Verify patching performed for high assurance ICT equipment is performed
        as per approved methods and timeframes prescribed by the ACSC.


        More information: https://www.cyber.gov.au/acsc/view-all-content/advice/guidelines-ict-equipment'
      typical_evidence: '1. Provide vulnerability assessment and patch management
        policy covering Information and Computer Technology (ICT) assets.


        2. Provide evidence that the policies'' requirements are in alignment with
        ACSC methods and timeframes in the context of classifying, labelling, handling,
        patching of ICT equipment.


        More information: https://www.cyber.gov.au/acsc/view-all-content/advice/guidelines-ict-equipment'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-404
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 404
      name: Web Application Header
      description: If applicable, web applications implement Content-Security-Policy,
        HSTS and X-Frame-Options response headers.
      annotation: '1. Verify if web applications have implemented Content-security-policy,
        HSTS and X-frame-options response headers.


        More information: https://www.cyber.gov.au/acsc/view-all-content/publications/protecting-web-applications-and-users'
      typical_evidence: 1. Provide screenshots from the server of Content-security-policy,
        HSTS and X-frame-options response headers implemented in web application.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-405
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 405
      name: Web Application Standard
      description: If applicable, the OWASP Application Security Verification Standard
        is followed when developing web applications.
      annotation: 1. Review SDLC, MBSS, and/or Application Security Verification Standard
        (ASVS) guidelines and validate if development of web applications follow OWASP
        Application Security Verification Standard.
      typical_evidence: 1. Provide Software development life cycle (SDLC), and/or
        MBSS (Minimum baseline security Standard), and/or Application Security Verification
        Standard (ASVS) guidelines that are being followed while developing web applications.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-406
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 406
      name: Database Web Server Separation
      description: Database servers and web servers are functionally separated, physically
        or virtually.
      annotation: '1. Verify if database servers and web servers are functionally
        separated, physically or virtually.

        2. Configure routers, firewall configurations to ensure that database, web
        servers are functionally separated'
      typical_evidence: '1. Provide Network architecture diagram

        2. Demonstrate through Routers and Firewall configurations that database,
        and web servers are functionally separated'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-407
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 407
      name: Database Server Network Connectivity
      description: "If applicable, database servers that require network connectivity\
        \ are placed on a different network segment to an organization\u2019s workstations."
      annotation: 1. Verify if database servers that require network connectivity
        are placed on a different network segment to an organization's workstations.
      typical_evidence: '1. Provide Network architecture diagram

        2. Demonstrate through Routers and Firewall configurations that database servers
        are placed on a different network segment to an organization''s workstations'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-408
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 408
      name: Network Functionality of Database Management System
      description: If only local access to a database is required, networking functionality
        of database management system (DBMS) software is disabled or directed to listen
        solely to the localhost interface.
      annotation: 1. Validate If only local access to a database is required, networking
        functionality of database management system (DBMS) software is disabled or
        directed to listen solely to the localhost interface.
      typical_evidence: 1. Provide screenshot of config showing disabled functionality
        of database management system (DBMS) if applicable
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-409
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 409
      name: Database Management System Software
      description: If applicable, a Database Management System (DBMS) software is
        installed and configured according to vendor guidance. All temporary files
        for installation are removed after installation complete, and all unneeded
        features are disabled.
      annotation: "1. Obtain Vendor provided guidance for installing the DMBS \n\n\
        2. Validate if Database Management System (DBMS) software is installed and\
        \ configured according to vendor guidance. All temporary files for installation\
        \ are removed after installation complete, and all unneeded features are disabled."
      typical_evidence: "1. Provide configuration based evidence from the Database\
        \ Management System (DBMS) software is installed and configured according\
        \ to vendor guidance. \n\n2. Provide a mapping or through inquiry walkthrough\
        \ how all the installation steps from vendor provided guide was followed to\
        \ ensure that all temporary files for installation were removed and other\
        \ features that weren't required were disabled"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-410
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 410
      name: Database Management System access rights
      description: If applicable, DBMS software runs as a separate account that follows
        least privileges concept for access rights. The DBMS software should not have
        to ability to read local files from the server.
      annotation: "1. Obtain Vendor provided guidance for installing the DMBS \n\n\
        2. Validate if DBMS software runs as a separate account that follows least\
        \ privileges concept for access rights. The DBMS software should not have\
        \ to ability to read local files from the server."
      typical_evidence: "1. Provide configuration based evidence from the Database\
        \ Management System (DBMS) software is installed and configured according\
        \ to vendor guidance. \n\n2. Provide access properties screenshot of the DBMS\
        \ software to demonstrate that it follows the least privileges concept and\
        \ does not have the ability to read local files from the server"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-411
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 411
      name: Database Query syntax
      description: All queries to databases from web applications are filtered for
        legitimate content and correct syntax.
      annotation: 1. Validate if all queries to databases from web applications are
        filtered for legitimate content and correct syntax.
      typical_evidence: 1. Validate that all queries to databases from web applications
        are filtered for legitimate content, and have correct syntax.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-412
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 412
      name: Stored Procedure Queries
      description: Parameterized queries or stored procedures are used for database
        interaction instead of dynamically generated queries.
      annotation: 1. Validate if parameterized queries or stored procedures are used
        for database interaction instead of dynamically generated queries.
      typical_evidence: 1. Provide evidence that parameterized queries or stored procedures
        are required and are used instead of dynamically generated queries
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-413
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 413
      name: Database Schema
      description: Web applications are designed to provide as little error information
        as possible to users about database schemas.
      annotation: 1. Validate if web applications are designed to provide as little
        error information as possible to users about database schemas.
      typical_evidence: 1. Provide evidence that web applications are designed to
        provide as little error information as possible to users about database schemas.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-414
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 414
      name: Webmail Service Access
      description: Access to non-approved webmail services is blocked.
      annotation: "1. When users access non-approved webmail services they are effectively\
        \ bypassing email content filtering controls as well as other security controls\
        \ that may have been implemented on email gateways and servers. \n\n2. While\
        \ web content filtering controls may mitigate some security risks (e.g. some\
        \ forms of malicious attachments), they are unlikely to address specific security\
        \ risks relating to emails (e.g. spoofed email contents).\n\n3. As such, no\
        \ users should have access to non-approved webmail services."
      typical_evidence: 1. Provide evidence that Access to non-approved webmail services
        is blocked.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-415
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 415
      name: Email Protective Markings
      description: Protective markings are applied to all emails containing highly
        sensitive information. Protective markings must be applied manually and not
        through and automatic tool.
      annotation: "1. On a sample basis, validate if protective markings are applied\
        \ to emails containing highly sensitive information. \n2. Verify if protective\
        \ markings were applied manually and not through and automatic tool\n3. It\
        \ is important that protective markings reflect the highest sensitivity or\
        \ classification of the subject, body and attachments of emails."
      typical_evidence: '1. Provide sample screenshot showing protective markings
        on emails containing highly sensitive information

        2. Provide email manager configuration settings to demonstrate that the protective
        markings are not being applied manually and not through an automatic tool

        3. Provide best/secure email practices document demonstrating this requirement'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-416
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 416
      name: Authorized Email Protective Markings
      description: Protective marking tools do not allow users to select protective
        markings that a system has not been authorized to process, store or communicate.
      annotation: 1. Protective markings are disabled for users on systems that are
        not authorized to process, store or communicate said markings.
      typical_evidence: 1. Provide evidence of protective markings being disabled
        on systems that are not authorized to process, store or communicate said markings.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-417
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 417
      name: Maintaining Email Protective Markings
      description: Protective marking tools do not allow users replying to or forwarding
        an email to select a protective marking that is lower than previously used
        for the email.
      annotation: 1. Protective marking tools do not allow users replying to or forwarding
        an email to select a protective marking that is lower than previously used
        for the email.
      typical_evidence: 1. Validate that protective marking tools do not allow users
        replying to or forwarding an email to select a protective marking that is
        lower than previously used for the email.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-418
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 418
      name: Inappropriate Protective Markings
      description: Email servers are configured to block, log and report emails with
        inappropriate protective markings. The sender and recipient of blocked emails
        are notified.
      annotation: "1. Email servers must have the following requirements configured/designed:\
        \ \n\u2022 Configuration/ policy implemented on email servers to block inappropriate\
        \ protective markings. \n\u2022 Emails blocked by email server that involve\
        \ inappropriate protective markings. \n\u2022 Notification is provided to\
        \ sender and recipient of blocked emails."
      typical_evidence: "1. Validate email servers have the following requirements\
        \ and meet them: \n\u2022 Configuration/ policy implemented on email servers\
        \ to block inappropriate protective markings. \n\u2022 Emails blocked by email\
        \ server that involve inappropriate protective markings. \n\u2022 Notification\
        \ is provided to sender and recipient of blocked emails."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-419
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 419
      name: Distribution of emails
      description: If applicable, emails containing AUSTEO, AGAO or REL data are only
        sent to named recipients and not to groups or distribution lists unless the
        nationality of all members of the distribution lists can be confirmed.
      annotation: 1. Where applicable, emails containing AUSTEO, AGAO or REL data
        are only sent to named recipients and not to groups or distribution lists
        unless the nationality of all members of the distribution lists can be confirmed.
      typical_evidence: 1. Validate recipient nationality using (Active Directory)
        prior to message transmission.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-420
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 420
      name: Email Gateway
      description: Email is routed through a centralized email gateway. When users
        send email from outside their network, an authenticated and encrypted channel
        is configured to allow email to be routed via a centralized email gateway.
      annotation: 1. An authenticated and encrypted channel is configured to allow
        email to be routed via a centralized email gateway.
      typical_evidence: 1. Validate Email is routed through a centralized email gateway
        by configuring an authenticated and encrypted channel.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-421
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 421
      name: Backup Email Gateway
      description: Where backup or alternative email gateways are in place, they are
        maintained at the same standard as the primary email gateway.
      annotation: 1. Where backup or alternative email gateways are in place, they
        are maintained at the same standard as the primary email gateway.
      typical_evidence: 1. Validate  backup or alternative email gateways are maintained
        at the same standard as the primary email gateway.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-422
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 422
      name: Email Server Relay
      description: Email servers only relay emails destined for or originating from
        their domains.
      annotation: 1. Email servers only relay emails destined for or originating from
        their domains.
      typical_evidence: 1. Validate email servers only relay emails destined for or
        originating from their domains.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-423
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 423
      name: Email TLS Encryption
      description: Opportunistic TLS encryption, as defined in IETF RFC 3207, is enabled
        on email servers that make incoming or outgoing email connections over public
        network infrastructure.
      annotation: 1. opportunistic TLS encryption is enabled on email servers that
        make incoming or outgoing email connections over public network infrastructure.
      typical_evidence: 1. Provide evidence showing opportunistic TLS encryption is
        enabled on email servers that make incoming or outgoing email connections
        over public network infrastructure.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-424
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 424
      name: Unencrypted email transfer
      description: MTA-STS, as defined in IETF RFC 8461, is enabled to prevent the
        transfer of unencrypted emails between complying servers.
      annotation: 1. MTA-STS is enabled to prevent the transfer of unencrypted emails
        between complying servers.
      typical_evidence: 1. Evidence showcasing enablement of MTA-STS to prevent the
        transfer of unencrypted emails between complying servers.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-425
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 425
      name: Authorized Email Services
      description: SPF (Sender Policy Framework) is used to specify authorized email
        services (or lack thereof) for all domains.
      annotation: 1. SPF is used to specify authorized email services (or lack thereof)
        for all domains. If an email server is not in the SPF record for a domain,
        SPF verification will fail.
      typical_evidence: 1. Validate that SPF is used to specify authorized email services
        (or lack thereof) for all domains. If an email server is not in the SPF record
        for a domain, SPF verification will fail.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-426
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 426
      name: Hard Fail SPF
      description: A hard fail SPF record is used when specifying email servers.
      annotation: 1. When specifying email servers, hard fail SPF record must be used.
        If an email server is not in the SPF record for a domain, SPF verification
        will fail.
      typical_evidence: 1. Validate that hard fail SPF record is used when specifying
        email servers. If an email server is not in the SPF record for a domain, SPF
        verification will fail.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-427
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 427
      name: Authenticity of Emails
      description: SPF is used to verify the authenticity of incoming emails.
      annotation: 1. SPF is used to verify the authenticity of incoming emails. If
        an email server is not in the SPF record for a domain, SPF verification will
        fail.
      typical_evidence: 1. Validate that SPF is used to verify the authenticity of
        incoming emails. If an email server is not in the SPF record for a domain,
        SPF verification will fail.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-428
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 428
      name: Failed SPF checks
      description: Incoming emails that fail SPF checks are blocked or marked in a
        manner that is visible to the recipients.
      annotation: 1. Incoming emails that fail SPF checks are blocked or marked in
        a manner that is visible to the recipients.
      typical_evidence: 1. Evidence showcasing  incoming emails that fail SPF checks
        are blocked or marked in a manner that is visible to the recipients..
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-429
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 429
      name: DKIM Signatures
      description: "DKIM (Domain Keys Identified Mail) signatures are enabled on emails\
        \ originating from an organization's domains and received emails are verified.\
        \ Email distribution list software used by external senders is configured\
        \ such that it does not break the validity of the sender\u2019s DKIM signature.\
        \ DMARC (Domain-based Message Authentication, Reporting and Conformance) records\
        \ are configured for all domains such that emails are rejected if they fail\
        \ SPF or DKIM checks."
      annotation: "1. Email services must have the following requirements configured/designed:\
        \ \n\u2022 DKIM signatures are enabled on emails originating from an organization's\
        \ domains and received emails are verified\n\u2022 Email distribution list\
        \ software used by external senders is configured such that it does not break\
        \ the validity of the sender\u2019s DKIM signature.\n\u2022 DMARC records\
        \ are configured for all domains such that emails are rejected if they fail\
        \ SPF or DKIM checks."
      typical_evidence: "1. Validate email servers have the following requirements\
        \ and meet them: \n\u2022 DKIM signatures are enabled on emails originating\
        \ from an organization's domains and received emails are verified\n\u2022\
        \ DMARC records are configured for all domains such that emails are rejected\
        \ if they fail SPF or DKIM checks."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-430
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 430
      name: Email Filtering
      description: Email content filtering controls are implemented for email bodies
        and attachments.
      annotation: 1. Email content filtering controls are enabled for email bodies
        and attachments.
      typical_evidence: 1. Provide evidence showcasing  email content filtering controls
        are enabled for email bodies and attachments.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-431
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 431
      name: Email Gateway Filtering
      description: Emails arriving via an external connection where the source address
        uses an internal domain name are blocked at the email gateway.
      annotation: 1. Configuration is in place for emails arriving via an external
        connection where the source address uses an internal domain name are blocked
        at the email gateway.
      typical_evidence: 1. Provide evidence of configuration in place for emails arriving
        via an external connection where the source address uses an internal domain
        name are blocked at the email gateway.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-432
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 432
      name: VLAN Network Separation
      description: VLANs (Virtual Local Area Networks) are not used to separate network
        traffic between organizations' networks and public network infrastructure,
        or networks belonging to different security domains.
      annotation: 1. VLANs are not used to separate network traffic between organizations'
        networks and public network infrastructure, or networks belonging to different
        security domains.
      typical_evidence: 1. Provide approved network architecture diagrams showcasing
        VLANs are not used to separate network traffic between organizations' networks
        and public network infrastructure, or networks belonging to different security
        domains.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-433
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 433
      name: VLAN Security Domain
      description: If applicable, Network devices managing VLANs terminate VLANs belonging
        to different security domains on separate physical network interfaces.
      annotation: 1. VLANs belonging to different security domains are terminated
        on separate physical network interfaces.
      typical_evidence: 1. Provide approved network architecture diagrams showcasing
        VLANs belonging to different security domains are terminated on separate physical
        network interfaces.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-434
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 434
      name: VLAN Trunk Sharing
      description: If applicable, Network devices managing VLANs belonging to different
        security domains do not share VLAN trunks.
      annotation: 1. VLANs belonging to different security domains, or networks of
        different classifications, do not share VLAN trunks.
      typical_evidence: 1. Provide approved network architecture diagrams showcasing
        VLANs belonging to different security domains, do not share VLAN trunks.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-435
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 435
      name: VLAN management
      description: Network devices managing VLANs are administered from the most trusted
        security domain.
      annotation: 1. Network devices implementing VLANs are managed from the most
        trusted security. domain.
      typical_evidence: 1. Provide approved network architecture diagrams showcasing
        Network devices implementing VLANs are managed from the most trusted security
        domain.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-436
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 436
      name: IPv6 Functionality
      description: If applicable, IPv6 functionality is disabled for dual stack-network
        devices and ICT equipment unless it is being used. Network security devices
        that support IPv6 are used on Dual-stack networks.
      annotation: '1. IPv6 tunnelling is disabled  for dual stack-network devices
        and Information and Computer Technology (ICT) equipment.

        2. Network security devices that support IPv6 are used on Dual-stack networks.'
      typical_evidence: "1. Provide evidence showcasing :\n\u2022 IPv6 tunnelling\
        \ is disabled for dual stack-network devices and Information and Computer\
        \ Technology (ICT) equipment.\n\u2022  Network security devices that support\
        \ IPv6 are used on Dual-stack networks."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-437
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 437
      name: IPv6 tunneling
      description: If applicable, unless explicitly required, IPv6 tunneling is disabled
        on all network devices and ICT equipment. IPv6 tunneling is blocked by network
        security devices at externally-connected network boundaries.
      annotation: '1. IPv6 tunnelling is disabled on all network devices and Information
        Computer Technology (ICT) equipment.

        2. IPv6 tunnelling is blocked by network security devices at externally-connected
        network boundaries.'
      typical_evidence: "1. Provide evidence showcasing :\n\u2022 IPv6 tunnelling\
        \ is disabled on all network devices and Information Computer Technology (ICT)\
        \ equipment.\n\u2022  IPv6 tunnelling is blocked by network security devices\
        \ at externally-connected network boundaries."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-438
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 438
      name: IPv6 addressing
      description: If applicable, dynamically assigned IPv6 addresses are configured
        with Dynamic Host Configuration Protocol version 6 in a stateful manner with
        lease data stored in a centralized logging facility.
      annotation: 1. Dynamically assigned IPv6 addresses are configured with Dynamic
        Host Configuration Protocol version 6 in a stateful manner with lease data
        stored in a centralized logging facility.
      typical_evidence: 1. Validate Dynamically assigned IPv6 addresses are configured
        with Dynamic Host Configuration Protocol version 6 with lease data stored
        in a centralized logging facility.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-439
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 439
      name: Server Separation
      description: Servers maintain effective functional separation with other servers
        allowing them to operate independently.
      annotation: 1. Servers maintain effective functional separation with other servers
        allowing them to operate independently.
      typical_evidence: 1. Provide evidence showcasing servers operating independently
        by maintaining effective functional separation with other servers.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-440
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 440
      name: Server Communication
      description: Servers minimize communications with other servers at both the
        network and file system level.
      annotation: 1. Servers minimize communications with other servers at both the
        network and file system level.
      typical_evidence: 1. Validate that servers minimize communications with other
        servers at both the network and file system level.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-441
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 441
      name: Anonymity Network Connection
      description: Inbound network connections and outbound network connections to
        anonymity networks are blocked.
      annotation: 1. Inbound network connections and outbound network connections
        to anonymity networks are blocked.
      typical_evidence: 1. Validate that Inbound network connections and outbound
        network connections to anonymity networks are blocked.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-442
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 442
      name: Wireless network connections
      description: The administrative interface on wireless access points is disabled
        for wireless network connections.
      annotation: 1. The administrative interface on wireless access points is disabled
        for wireless network connections.
      typical_evidence: 1. Provide evidence showcasing administrative interface is
        disabled for wireless network connections on wireless access points.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-443
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 443
      name: SSID change
      description: If applicable, default SSID (Service Set Identifiers) of wireless
        access points are changed and are enabled on all wireless networks. The SSID
        of a non-public network must not be associated with the organization.
      annotation: '1. Default SSID of wireless access points are changed and are enabled
        on all wireless networks.

        2. The SSID of a non-public network must not be associated with the organization.'
      typical_evidence: "1. Provide evidence showcasing:\n\u2022 Checks are performed\
        \ to ensure SSID of a non-public network must not be associated with the organization.\n\
        \u2022 Default SSID of wireless access points are changed and are enabled\
        \ on all wireless networks."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-444
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 444
      name: Static Addressing
      description: Static addressing is not used for assigning IP addresses on wireless
        networks.
      annotation: "1. Static addressing is not used for assigning IP addresses on\
        \ wireless networks. \n2. Only dynamic IP address must be assigned for wireless\
        \ networks."
      typical_evidence: 1. Provide evidence that dynamic IP range of addresses are
        assigned for wireless networks to confirm static addressing is not used for
        assigning IP addresses on wireless networks.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-445
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 445
      name: MAC address filtering
      description: MAC (Media Access Control) address filtering is not used to restrict
        which devices can connect to wireless networks.
      annotation: 1. MAC address filtering is not used to restrict which devices can
        connect to wireless networks.
      typical_evidence: 1. Validate that MAC address filtering is not used to restrict
        which devices can connect to wireless networks.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-446
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 446
      name: Authentication of Wireless Networks
      description: 802.1X authentication with EAP-TLS, using X.509 certificates, is
        used for mutual authentication; with all other EAP methods disabled on supplications
        and authentication servers.
      annotation: 1. 802.1x authentication with EAP-TLS, using X.509 certificates
        is used to perform mutual authentication for wireless networks. All other
        EAP methods disabled on supplications and authentication servers.
      typical_evidence: 1. Provide evidence showcasing 802.1x authentication with
        EAP-TLS implemented to perform mutual authentication for wireless networks
        and all other EAP methods disabled on supplications and authentication servers.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-447
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 447
      name: Device and user certificates
      description: Both device and user certificates are required for accessing wireless
        networks. Device and user certificates are not stored on the same device and
        are issued on smart cards with access PINs. User or device certificates are
        protected by encryption.
      annotation: "1. Device and user certificates must have the following requirements\
        \ configured/designed: \n\u2022 Both device and user certificates are required\
        \ for accessing wireless networks.\n\u2022 Device and user certificates are\
        \ not stored on the same device and are issued on smart cards with access\
        \ PINs. \n\u2022 User or device certificates are protected by encryption."
      typical_evidence: "1. Validate device and user certificates have the following\
        \ requirements and meet them: \n\u2022 Both device and user certificates are\
        \ required for accessing wireless networks.\n\u2022 Device and user certificates\
        \ are not stored on the same device and are issued on smart cards with access\
        \ PINs. \n\u2022 User or device certificates are protected by encryption."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-448
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 448
      name: PMK Caching Period
      description: If applicable, the PMK (Pairwise Master Key) caching period is
        not set to greater than 1440 minutes (24 hours).
      annotation: 1. If PMK caching is used, the PMK caching period should not be
        set to greater than 1440 minutes (24 hours).
      typical_evidence: 1. Where applicable, validate PMK caching period to ensure
        PMK caching period does not exceed 1440 minutes (24 hours)
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-449
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 449
      name: Wireless access point communication
      description: Communications between wireless access points and a RADIUS server
        are encapsulated with an additional layer of encryption.
      annotation: 1. Communications between wireless access points and a RADIUS server
        are encapsulated with an additional layer of encryption.
      typical_evidence: 1. Validate Communications between wireless access points
        and a RADIUS server are encapsulated with an additional approved layer of
        encryption.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-450
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 450
      name: ASD Cryptography
      description: ASD approved cryptography is used to protect the confidentiality
        and integrity of all wireless network traffic.
      annotation: 1. ASD approved cryptography is used to protect the confidentiality
        and integrity of all wireless network traffic.
      typical_evidence: 1. Provide evidence of ASD approved cryptography in use to
        protect the confidentiality and integrity of all wireless network traffic.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-451
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 451
      name: Wireless access point enablement
      description: Wireless access points enable the use of the 802.11w amendment
        to protect management frames.
      annotation: 1. Wireless access points enable the use of the IEEE 802.11w-2009
        amendment to protect management frames.
      typical_evidence: 1. Provide evidence that wireless access points have 802.11
        w enabled to protect management frames.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-452
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 452
      name: Wireless access points
      description: Instead of deploying a small number of wireless access points that
        broadcast on high power, a greater number of wireless access points that use
        less broadcast power are deployed to achieve the desired footprint.
      annotation: 1. Instead of deploying a small number of wireless access points
        that broadcast on high power, a greater number of wireless access points that
        use less broadcast power are deployed to achieve the desired footprint.
      typical_evidence: 1. Validate that a greater number of wireless access points
        that use less broadcast power are deployed to achieve the desired output.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-453
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 453
      name: RF Shielding
      description: The effective range of wireless communications outside an organization's
        area of control is limited by implementing RF shielding on facilities in which
        SECRET or TOP SECRET wireless networks are used.
      annotation: 1. The effective range of wireless communications outside an organization's
        area of control is limited by implementing RF shielding on facilities in which
        SECRET or TOP SECRET wireless networks are used.
      typical_evidence: 1. Validate that the effective range of wireless communications
        outside an organization's area of control is limited by implementing RF shielding
        on facilities in which SECRET or TOP SECRET wireless networks are used.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-454
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 454
      name: Wi-Fi Alliance Certification
      description: All wireless access points are Wi-Fi Alliance certified.
      annotation: 1. All wireless access points are Wi-Fi Alliance certified.
      typical_evidence: 1. Validate that all wireless access points are Wi-Fi Alliance
        certified.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-455
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 455
      name: Cloud Service Provider
      description: A cloud service provider is used for hosting online services.
      annotation: 1. A cloud service provider is used for hosting online services.
      typical_evidence: 1. Provide evidence of online services being hosted on cloud.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-456
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 456
      name: Content Delivery Networking
      description: When using environments that require high availability, Content
        Delivery Networks that cache websites are used and the IP address of the webserver
        under the organization's control is avoided. The origin server is restricted
        to the CDN and an authorized management network.
      annotation: "1. When using environments that require high availability, Content\
        \ Delivery Networks must have the following requirements configured/designed\n\
        \u2022 Content Delivery Networks that cache websites are used and the IP address\
        \ of the webserver under the organization's control is avoided. \n\u2022 The\
        \ origin server is restricted to the CDN and an authorized management network."
      typical_evidence: "1. When using environments that require high availability,\
        \ Content Delivery Networks have the following requirements and meet them:\n\
        \u2022 Content Delivery Networks that cache websites are used and the IP address\
        \ of the webserver under the organization's control is avoided. \n\u2022 The\
        \ origin server is restricted to the CDN and an authorized management network."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-457
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 457
      name: Online Service Domain Names
      description: Domain names for online services are protected via registrar locking
        and confirming domain registration details are correct.
      annotation: 1. Domain names for online services are protected via registrar
        locking and confirming domain registration details are correct.
      typical_evidence: 1. Provide screenshot of registrar lock status set for domain
        names for online services with registration details.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-458
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 458
      name: HACE communication
      description: HACE (High Assurance Cryptographic Equipment) is used to protect
        SECRET and TOP SECRET data when communicated over insufficiently secure networks,
        outside of appropriately secure areas or via public network infrastructure.
      annotation: 1. High Assurance Cryptographic Equipment (HACE) is used to protect
        SECRET and TOP SECRET data when communicated over insufficiently secure networks,
        outside of appropriately secure areas or via public network infrastructure.
      typical_evidence: 1. Validate that High Assurance Cryptographic Equipment (HACE)
        is used to protect SECRET and TOP SECRET data when communicated over insufficiently
        secure networks, outside of appropriately secure areas or via public network
        infrastructure.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-459
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 459
      name: Security Domain Connection
      description: All connections between security domains implement mechanisms to
        inspect and filter data flows for the transport and higher layers as defined
        in the OSI model.
      annotation: 1. All connections between security domains implement mechanisms
        to inspect and filter data flows for the transport and higher layers as defined
        in the OSI model.
      typical_evidence: 1. Validate that mechanisms are implemented for all connections
        between security domains to inspect and filter data flows for the transport
        and higher layers as defined in the OSI model.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-460
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 460
      name: Connecting Network Gateway
      description: "All gateways connecting networks in different security domains\
        \ are operated such that they:\n\u2022 log network traffic permitted through\
        \ the gateway\n\u2022 log network traffic attempting to leave the gateway\n\
        \u2022 are configured to save event logs to a secure logging facility\n\u2022\
        \ provide real-time alerts for any cyber security incidents, attempted intrusions\
        \ and unusual usage patterns."
      annotation: "1. All network gateways in different security domains must have\
        \ the following requirements configured/designed: \n\u2022 log network traffic\
        \ permitted through the gateway\n\u2022 log network traffic attempting to\
        \ leave the gateway \n\u2022 are configured to save event logs to a secure\
        \ logging facility\n\u2022 provide real-time alerts for any cyber security\
        \ incidents, attempted intrusions and unusual usage patterns."
      typical_evidence: "1. Validate device and user certificates have the following\
        \ requirements and meet them: \n\u2022 log network traffic permitted through\
        \ the gateway\n\u2022 log network traffic attempting to leave the gateway\
        \ \n\u2022 are configured to save event logs to a secure logging facility\n\
        \u2022 provide real-time alerts for any cyber security incidents, attempted\
        \ intrusions and unusual usage patterns."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-461
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 461
      name: Gateway testing
      description: Gateways are subject to rigorous testing, performed at irregular
        intervals no more than six months apart, to determine the strength of security
        controls.
      annotation: 1. Gateways are subject to rigorous testing, performed at irregular
        intervals no more than six months apart, to determine the strength of security
        controls.
      typical_evidence: 1. Provide evidence for the last 2 testing performed for gateways
        to determine testing is performed at regular intervals no more than six months
        apart.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-462
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 462
      name: Demilitarized Zone Usage
      description: Demilitarized zones are used to broker access to services accessed
        by external entities, and mechanisms are applied to mediate internal and external
        access to less-trusted services hosted in these demilitarized zones.
      annotation: "1. All Demilitarized zones in different security domains must have\
        \ the following requirements configured/designed: \n\u2022 Demilitarized zones\
        \ are used to broker access to services accessed by external entities\n\u2022\
        \ mechanisms are applied to mediate internal and external access to less-trusted\
        \ services hosted in these demilitarized zones."
      typical_evidence: "1. Validate approved architecture diagram showcasing:\n\u2022\
        \ Demilitarized zones are used to broker access to services accessed by external\
        \ entities\n\u2022 mechanisms are applied to mediate internal and external\
        \ access to less-trusted services hosted in these demilitarized zones."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-463
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 463
      name: Administrator Gateway Role
      description: 'System administrator roles for gateway administration are created.
        Gateway administrators must be formally trained to manage gateways.


        - All system administrators of gateways are cleared to access the highest
        level of data communicated or processed by the gateway.

        - All system administrators of gateways that process Australian Eyes Only
        (AUSTEO) or Australian Government Access Only (AGAO) data are Australian nationals.

        - Roles for the administration of gateways are separated.

        - For gateways between networks in different security domains, a formal arrangement
        exists whereby any shared components are managed by the system managers of
        the highest security domain or by a mutually agreed third party.'
      annotation: "1. System administrator roles for gateway administration must have\
        \ the following requirements met:\n\u2022 Gateway administrators must be formally\
        \ trained to manage gateways.\n\u2022 All system administrators of gateways\
        \ are cleared to access the highest level of data communicated or processed\
        \ by the gateway.\n\u2022 All system administrators of gateways that process\
        \ Australian Eyes Only (AUSTEO) or Australian Government Access Only (AGAO)\
        \ data are Australian nationals.\n\u2022 Roles for the administration of gateways\
        \ are separated.\n\n2. For gateways between networks in different security\
        \ domains, a formal arrangement exists whereby any shared components are managed\
        \ by the system managers of the highest security domain or by a mutually agreed\
        \ third party."
      typical_evidence: "1. System administrator roles for gateway administration\
        \ have the following requirements and meet them: \n\u2022 Gateway administrators\
        \ must be formally trained to manage gateways.\n\u2022 All system administrators\
        \ of gateways are cleared to access the highest level of data communicated\
        \ or processed by the gateway.\n\u2022 All system administrators of gateways\
        \ that process Australian Eyes Only (AUSTEO) or Australian Government Access\
        \ Only (AGAO) data are Australian nationals.\n\u2022 Roles for the administration\
        \ of gateways are separated.\n\n2. Provide evidence showcasing gateways between\
        \ networks in different security domains, a formal arrangement exists whereby\
        \ any shared components are managed by the system managers of the highest\
        \ security domain or by a mutually agreed third party."
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-464
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 464
      name: Security Domain Stakeholders
      description: Once connectivity is established, system owners become stakeholders,
        and are defined, for all connected security domains.
      annotation: 1. Once connectivity is established, system owners become stakeholders
        for all connected security domains.
      typical_evidence: 1. Provide evidence that system owners become stakeholders
        for all the connected security domains once connectivity is established.
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-465
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 465
      name: User Gateway Authentication
      description: Users and services that access the network through a gateway must
        be authenticated. Only authenticated users that are authorized can use the
        gateway. All ICT (Information and Computer Technology) equipment accessing
        networks through gateways are authenticated too. Multi-factor authentication
        is used to access gateways.
      annotation: '1. Only authenticated users and services including ICT equipment
        which are authorized can use the gateway.

        2. Multi-factor authentication is used to access gateways.'
      typical_evidence: "1. Provide evidence showcasing:\n\u2022 Only authenticated\
        \ users and services including ICT equipment which are authorized can use\
        \ the gateway.\n\u2022 Multi-factor authentication is used to access gateways."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-466
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 466
      name: Cross Domain Solution
      description: If applicable, when connecting a SECRET or TOP SECRET network to
        any other network from a different security domain, a cross domain solution
        (CDS) is implemented.
      annotation: 1. Cross domain solution (CDS) is implemented when connecting a
        SECRET or TOP SECRET network to any other network from a different security
        domain.
      typical_evidence: 1. Provide evidence of Cross domain solution (CDS) is implemented
        when a SECRET or TOP SECRET networks connected  to any other network from
        a different security domain.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-467
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 467
      name: ACSC Directions
      description: If applicable, when designing and deploying a CDS, the ACSC is
        notified and consulted; and directions provided by the ACSC (Australian Cyber
        Security Centre) are complied with.
      annotation: "1. While designing the cross domain section (CDS), following requirements\
        \ should be met: \n\u2022 there is a process in place to notify and consult\
        \ ACSC when designing and deploying a CDS. \n\u2022All directions provided\
        \ by the ACSC are complied with."
      typical_evidence: "1. Provide evidence showcasing : \n\u2022 A process is in\
        \ place to notify and consult ACSC when designing and deploying a CDS. \n\u2022\
        All directions provided by the ACSC are complied with."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-468
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 468
      name: ACSC Consultation
      description: If applicable, when introducing additional connectivity to a CDS,
        such as adding a new gateway to a common network, the ACSC is consulted on
        the impact to the security of the CDS; and directions provided by the ACSC
        are complied with.
      annotation: '1. There is a process in place to notify and consult ACSC when
        introducing additional connectivity to a CDS (such as adding a new gateway
        to a common network)

        2. ACSC is consulted on the impact to the security of the CDS.

        3. Directions provided by the ACSC are complied with'
      typical_evidence: "1. Provide evidence showcasing : \n\u2022 there is a process\
        \ in place to notify and consult ACSC when introducing additional connectivity\
        \ to a CDS \n\u2022ACSC is consulted on the impact to the security of the\
        \ CDS.\n\u2022Directions provided by the ACSC are complied with"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-469
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 469
      name: Cross Domain network path
      description: "If applicable, a CDS between a highly classified network and any\
        \ other network implements;\n- isolated upward and downward network paths\
        \ \n- protocol breaks at each layer of the OSI model\n- content filtering\
        \ and separate independent security-enforcing components for upward and downward\
        \ data flows"
      annotation: "1. CDS between a highly classified network and any other network\
        \  have the following requirements configured/designed: \n\u2022 protocol\
        \ breaks at each layer of the OSI model\n\u2022 content filtering and separate\
        \ independent security-enforcing components for upward and downward data flows"
      typical_evidence: "1. Validate CDS between a highly classified network and any\
        \ other network have the following requirements and meet them: \n- isolated\
        \ upward and downward network paths \n- protocol breaks at each layer of the\
        \ OSI model\n- content filtering and separate independent security-enforcing\
        \ components for upward and downward data flows"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-470
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 470
      name: CDS Training
      description: If applicable, Users are trained on the secure use of a CDS before
        access to the CDS is granted.
      annotation: '1. Verify if all users are trained on the secure use of CDS.

        2. Verify if only authorized parties are granted access to CDS.

        3. Evaluate if all personnel must receive necessary briefings before being
        granted access to systems.

        4. Verify if the logon banners and awareness messages were sent to the users
        to use a CDS securely.'
      typical_evidence: "1. Provide list of authorized personnel who are granted access\
        \ to CDS.\n2. For sampled users, provide evidence of the users who are trained\
        \ on the secure use of CDS. \n\u2022 Records/Documents Including the most\
        \ recent review and approval.\n\u2022 Sample of communication mail/documents"
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-471
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 471
      name: CDS security event log
      description: If applicable, a representative sample of security events generated
        by a CDS, relating to the enforcement of data transfer policies, is taken
        at least every 3 months and assessed against the security policies that the
        CDS is responsible for enforcing between security domains.
      annotation: '1. Verify if the event logging policy is established, defined and
        documented.

        2. Evaluate if the sample of security events generated by a CDS  is taken
        at least every 3 months  and assessed against the security policies.

        3. Check if CDS have comprehensive logging capabilities to establish accountability
        for all actions performed by users.'
      typical_evidence: "1. Provide the Event logging policy.\n2. For sampled security\
        \ events generated by CDS, provide evidence that it is done for at least every\
        \ 3 months and assessed.\n3. Share comprehensive logging capabilities established\
        \ in CDS. \n4. Sample of the log management dashboard showing security event\
        \ logging configurations \n5. Sample of Alert notifications"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-472
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 472
      name: Evaluated Firewall usage
      description: In addition to the firewall between networks of different security
        domains, an evaluated firewall is used between an AUSTEO or AGAO network and
        a foreign network.
      annotation: '1. Obtain evaluation report of firewall.

        2. Check if firewall is evaluated when used between an AUSTEO or AGAO network
        and a foreign network.'
      typical_evidence: '1. Provide Evaluation report of firewall.

        2. Evidence of firewall used between an AUSTEO network and a foreign network.

        3. Firewall configuration/ruleset for the in-scope networks'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-473
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 473
      name: Evaluated Firewall usage
      description: In addition to the firewall between networks of different security
        domains, an evaluated firewall is used between an AUSTEO or AGAO network and
        another Australian controlled network.
      annotation: '1. Obtain evaluation report of firewall.

        2. Check if firewall is evaluated when used between an AUSTEO or AGAO network
        and another Australian controlled network.'
      typical_evidence: '1.Provide Evaluation report of firewall.

        2. Evidence of firewall used between an AUSTEO network and another Australian
        controlled network.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-474
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 474
      name: Evaluated Diode
      description: If applicable, an evaluated diode is used for controlling the data
        flow of unidirectional gateways between an organizations' networks and public
        network infrastructure.
      annotation: "1. Obtain evaluation diode report for controlling the data flow.\
        \ \n2. Verify if evaluated diode is used for controlling the data flow of\
        \ unidirectional gateways between organizations' networks and public network\
        \ infrastructure."
      typical_evidence: '1. Provide evaluation diode report.

        2. Evidence of an evaluated diode used between organizations'' networks and
        public network infrastructure.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-475
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 475
      name: High Assurance Diode
      description: If applicable, an evaluated diode used for controlling the data
        flow of a unidirectional gateway between a SECRET or TOP SECRET network and
        public network infrastructure completes a high assurance evaluation.
      annotation: "1. Obtain high assurance diode report for controlling the data\
        \ flow. \n2. Verify if high assurance diode is used for controlling the data\
        \ flow of unidirectional gateways between SECRET and TOP SECRET networks and\
        \ public network infrastructure."
      typical_evidence: '1. Provide high assurance diode report.

        2. Evidence of an high assurance diode used between SECRET and TOP SECRET
        networks and public network infrastructure.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-476
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 476
      name: Evaluated Diode
      description: If applicable, an evaluated diode is used for controlling the data
        flow of unidirectional gateways between networks.
      annotation: "1. Obtain evaluation diode report for controlling the data flow.\
        \ \n2. Verify if evaluated diode is used for controlling the data flow of\
        \ unidirectional gateways between networks."
      typical_evidence: '1. Provide evaluation diode report.

        2. Evidence of an evaluated diode used between networks.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-477
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 477
      name: High Assurance Diode
      description: If applicable, an evaluated diode used for controlling the data
        flow of a unidirectional gateway between a SECRET or TOP SECRET network and
        any other network completes a high assurance evaluation.
      annotation: '1. Obtain high assurance diode report for controlling the data
        flow.

        2. Verify if high assurance diode is used for controlling the data flow of
        unidirectional gateways between SECRET or TOP SECRET networks and any other
        network.'
      typical_evidence: '1. Provide high assurance diode report.

        2. Evidence of an high assurance diode used between SECRET or TOP SECRET networks
        and any other network.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-478
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 478
      name: Evaluated Diode
      description: An evaluated diode is used between an AUSTEO or AGAO network and
        a foreign network at the same classification.
      annotation: '1. Obtain evaluation diode report.

        2. Verify if evaluated diode is used between an AUSTEO or AGAO network and
        a foreign network at the same classification.'
      typical_evidence: '1. Provide evaluation diode report.

        2. Evidence of an evaluated diode used between an AUSTEO or AGAO network and
        a foreign network.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-479
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 479
      name: Evaluated Diode
      description: An evaluated diode is used between an AUSTEO or AGAO network and
        another Australian controlled network at the same classification.
      annotation: "1. Obtain evaluation diode report for controlling the data flow.\
        \ \n2. Verify if evaluated diode is used between an AUSTEO or AGAO network\
        \ and another Australian controlled network at the same classification."
      typical_evidence: '1. Provide evaluation diode report.

        2. Evidence of an evaluated diode used between an AUSTEO or AGAO network and
        another Australian controlled network.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-480
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 480
      name: Server Connected Diode
      description: A diode (or server connected to the diode) deployed to control
        data flow in unidirectional gateways monitors the volume of the data being
        transferred.
      annotation: '1. Obtain monitoring report to monitor the  volume of data being
        transferred across a diode.

        2. Verify if a diode monitors the volume of the data being transferred to
        control data flow in unidirectional gateways.

        3. Verify if an alert is sent to an organization to potential malicious activity
        if the volume of data suddenly changes from the norm.'
      typical_evidence: '1. Provide monitoring report of a diode to monitor the volume
        of data being transferred.

        2. Evidence of alert being sent to an organization if the volume of data suddenly
        changes.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-481
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 481
      name: Web Proxy
      description: "All web access (including internal servers) is conducted through\
        \ a web proxy. Web proxies authenticates users and provides logging that includes:\n\
        \u2022 address (uniform resource locator)\n\u2022 time/date\n\u2022 user\n\
        \u2022 amount of data uploaded and downloaded\n\u2022 internal and external\
        \ IP addresses."
      annotation: "1. Verify if web usage policy is implemented and developed.\n2\
        \ Check if all web access (including internal servers) is conducted through\
        \ a web proxy.\n3. Evaluate if web proxies authenticates users and provides\
        \ logging that includes:\n\u2022 address (uniform resource locator)\n\u2022\
        \ time/date\n\u2022 user\n\u2022 amount of data uploaded and downloaded\n\u2022\
        \ internal and external IP addresses"
      typical_evidence: "1. Provide web usage policy.\n2. Evidence of all web access\
        \ (including internal servers) is conducted through a web proxy.\n3. Provide\
        \ web proxy logs report. \n4. Provide evidence of notification sent to customers\
        \ for critical changes that may affect their processing."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-482
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 482
      name: Web Content Filter
      description: A web content filter is used to filter potentially harmful web-based
        content. Web content filtering controls are applied to outbound web traffic
        where appropriate.
      annotation: '1. Verify if web content filtering is in place.

        2. Evaluate if web content filtering controls are applied to outbound web
        traffic where applicable.'
      typical_evidence: '1. Evidence of web content filter to reduces the likelihood
        of malicious code infection.

        2. Snapshot of web content filtering solution used to prevent an adversary
        from communicating with their malicious code if deployed on network.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-483
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 483
      name: Client-Side Active Content
      description: Client-side active content, such as Java, is restricted to a list
        of allowed websites.
      annotation: '1. Evaluate the list of allowed websites to restrict the client-side
        active content.

        2. Verify client-side active content, such as Java, is restricted to a list
        of allowed websites.'
      typical_evidence: "1. Provide web usage policy. \n2. List of allowed websites\
        \ to restrict the client-side active content.\n3. Evidence showcasing the\
        \ client-side active content such as Java, is restricted to a list of allowed\
        \ websites."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-484
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 484
      name: TLS Legal Advice
      description: Legal advice is sought regarding the inspection of TLS traffic
        by internet gateways.
      annotation: '1. Verify if legal advice is sought for the inspection of TLS traffic
        by internet gateways.

        2. Identify a solution that decrypts and inspects all TLS traffic as per content
        filtering security controls

        3. Obtain a list of websites to which encrypted connections are allowed, with
        all other TLS traffic decrypted and inspected as per content filtering security
        controls.'
      typical_evidence: '1. Evidence of a solution that decrypts and inspects all
        TLS traffic as per content filtering security controls.

        2. Provide a list of websites to which encrypted connections are allowed,
        with all other TLS traffic decrypted.

        3. Evidence for seeking legal advice for the inspection of TLS traffic by
        internet gateways.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-485
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 485
      name: Blacklisting and Whitelisting
      description: 'Blacklisting and whitelisting methods are used for web content
        filters. Methods include;

        - A list of allowed websites, using either domain name or IP address, is implemented
        for all Hypertext Transfer Protocol (HTTP) and HTTPS traffic communicated
        through internet gateways.

        - If a list of allowed websites is not implemented, a list of allowed website
        categories is implemented instead and a list of blocked websites is implemented
        instead.

        - If a list of blocked websites is implemented, the list is updated on a daily
        basis to ensure that it remains effective.

        - Attempts to access a website through its IP address instead of through its
        domain name are blocked.

        - Dynamic domains and other domains where domain names can be registered anonymously
        for free are blocked.'
      annotation: '1. Verify if a list of allowed websites, using either domain name
        or IP address, is implemented for all Hypertext Transfer Protocol (HTTP) and
        HTTPS traffic communicated through internet gateways.

        2. Validate if a list of allowed websites is not implemented, then a list
        of allowed website categories and a list of blocked websites must be implemented.

        3. Verify if the list of blocked websites is updated on a daily basis.

        4. Validate if dynamic domains where domain names can be registered anonymously
        for free are blocked.'
      typical_evidence: '1. Provide blacklisting and whitelisting methods used for
        web content filters.

        2. List of allowed websites, using either domain name or IP address for (HTTP)
        and HTTPS traffic communicated through internet gateways.

        3. List of blocked websites which cannot be used due to their content or hosting
        of malicious content.

        4. Evidence of blocked websites to ensure that they are updated on daily basis.

        5. Provide list of dynamic domains which can be registered anonymously for
        free.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-486
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 486
      name: Data Filtering
      description: If applicable, when importing data into a security domain, the
        data is filtered by a content filter designed for that purpose. Content filters
        deployed in a CDS are subject to rigorous security assessment to ensure they
        mitigate content-based threats and cannot be bypassed.
      annotation: '1. Evaluate if an effective content filter is implemented to reduce
        the likelihood of malicious content.

        2. Verify if the data imported into a security domain is filtered by a content
        filter.

        3. Verify if security assessment is performed of content filters to ensure
        they mitigate content-based threats and cannot be bypassed.'
      typical_evidence: '1. Evidence of an effective content filter.

        2. Provide security testing/assessment reports performed of content filters.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-487
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 487
      name: Content Blocking
      description: All suspicious, malicious and active content is blocked from entering
        a security domain. Suspicious content is blocked until reviewed and approved
        for transfer by a trusted source other than the originator.
      annotation: '1. Verify if all suspicious, malicious and active content is blocked
        from entering a security domain.

        2. Identify data by a content filtering process.

        3. Evaluate if suspicious content is blocked until reviewed and approved for
        transfer by a trusted source other than the originator.'
      typical_evidence: "1. Provide evidence that all suspicious, malicious and active\
        \ content is blocked from entering a security domain.\n2. Provide list of\
        \ data identified as suspicious by a content filtering process.\n3. Provide\
        \ review report by authorized personnel to check all suspicious content is\
        \ blocked. \n4. Are anti-malware tools updated routinely and/or automatically?\
        \ \n\u2022 How often are anti-malware definitions updated?\n\u2022 How often\
        \ are anti-malware nodes communicating with the master node (if this is how\
        \ the AM/AV tech works).\n\u2022 Are there logs for anti-malware tools that\
        \ cover update versions and security events?"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-488
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 488
      name: Dynamic Malware Analysis
      description: Email and web content entering a security domain is automatically
        run in a dynamic malware analysis sandbox to detect suspicious behavior.
      annotation: 1. Analyze email and web content in a sandbox to detect suspicious
        behavior including network traffic, new or modified files, or other configuration
        changes.
      typical_evidence: 1. Provide automated dynamic malware analysis report.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-489
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 489
      name: Content Validation
      description: Content validation is performed on all data passing through a content
        filter with content which fails content validation blocked.
      annotation: "1. Perform content validation on all data passing through a content\
        \ filter to identify malformed content.\n2. Verify if potentially malicious\
        \ content is blocked by using content validation.\n3. Examples of content\
        \ validation includes but not limited to:\n\u2022 ensuring numeric fields\
        \ only contain numeric numbers\n\u2022 ensuring content falls within acceptable\
        \ length boundaries\n\u2022 ensuring Extensible Markup Language (XML) documents\
        \ are compared to a strictly defined XML schema."
      typical_evidence: 1. Provide content validation report.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-490
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 490
      name: Content Conversion
      description: Content conversion is performed for all ingress or egress data
        transiting a security domain boundary.
      annotation: "1. Perform content conversation and transformation for all ingress\
        \ or egress data transiting a security domain boundary and to mitigate the\
        \ threat of content exploitation.\n2. Examples of content conversation includes\
        \ but not limited to:\n\u2022 converting a Microsoft Word document to a Portable\
        \ Document Format (PDF) file\n\u2022 converting a Microsoft PowerPoint presentation\
        \ to a series of image files\n\u2022 converting a Microsoft Excel spreadsheet\
        \ to a comma-separated values file\n\u2022 converting a PDF document to a\
        \ plain text file."
      typical_evidence: '1. Provide content conversation and transformation process
        to mitigate the threat of content exploitation.

        2. Evidence of content conversation and transformation performed.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-491
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 491
      name: Content Sanitization
      description: Content sanitization is performed on suitable file types if content
        conversion is not appropriate for data transiting a security domain boundary.
      annotation: "1. Verify if content sanitization is performed on suitable file\
        \ types if content conversion is not appropriate for data transiting a security\
        \ domain boundary.\n2. Examples of content sanitization includes but not limited\
        \ to:\n\u2022 removal of document properties in Microsoft Office documents\n\
        \u2022 removal or renaming of JavaScript sections from PDF files\n\u2022 removal\
        \ of metadata from within image files."
      typical_evidence: 1. Evidence of content sanitization process performed to mitigate
        the threat of content exploitation.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-492
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 492
      name: Content Filter Checks
      description: The contents from archive/container files are extracted and subjected
        to content filter checks.
      annotation: '1. Verify if the contents from archive/container files are extracted
        and are subjected to content filter checks.

        2. Verify if the content filtering process recognizes archived and container
        files will ensure the embedded files they contain are subject to the same
        content filtering measures as un-archived files.'
      typical_evidence: '1. Provide the evidence of contents that are extracted from
        archive/container files.

        2. Provide the extracted file.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-493
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 493
      name: Content Controlled Inspection
      description: Controlled inspection of archive/container files is performed to
        ensure that content filter performance or availability is not adversely affected.
      annotation: '1. Verify if controlled inspection of archive/container files is
        performed.

        2. Perform controlled inspection of archive/container files to ensure that
        content filter performance or availability is not adversely affected.

        3. Obtain Inspection report of archive/container files.'
      typical_evidence: '1. Provide Inspection report of archive/container files.

        2. Evidence of control inspection of archive/container files done to check
        the content filter performance.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-494
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 494
      name: File Inspection
      description: Files that cannot be inspected are blocked and generate an alert
        or notification.
      annotation: '1. Verify if notifications or alert are generated for the container
        files that cannot be inspected.

        2. Verify if files that cannot be inspected are blocked.'
      typical_evidence: "1. Provide evidence of how many files that cannot be inspected.\
        \ \n2.Evidence of notification sent for the files that cannot be inspected.\n\
        3. Provide evidence of the files which are blocked."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-495
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 495
      name: Targeted Cyber Intrusion
      description: If applicable, system owner consultation and legal advice is sought
        before allowing a targeted cyber intrusion activity to continue on a system
        for the purpose of collecting further data or evidence.
      annotation: '1. Verify if a process is in place where system owner consultation
        and legal advice is sought before allowing a targeted cyber intrusion activity
        to continue on a system for the purpose of collecting further data or evidence.

        2. Validate if such process is documented and appropriate approvals are obtained'
      typical_evidence: '1. Provide documentation (if applicable) to validate whether
        system owner consultation and legal advice was sought before allowing a targeted
        cyber intrusion activity to continue on a system for the purpose of collecting
        further data or evidence.

        2. Within the documentation, provide further evidence pointing to the scope
        of the intrusion activity, and all applicable approvals.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-496
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 496
      name: Intrusion Traffic Retention
      description: In the event of a successful targeted cyber intrusion, full network
        traffic is captured for at least seven days and analyzed to determine whether
        the adversary has been successfully removed from the system.
      annotation: '1. Verify network traffic logs generated by firewalls and intrusion
        detection and prevention systems (IDS and IPS)

        2. Verify whether full network traffic is stored and if network traffic of
        7 days post intrusion will be available.'
      typical_evidence: '1. Provide sample screenshots of network traffic logs generated
        by firewalls and intrusion detection and prevention systems (IDS and IPS).

        2. Provide evidence through logs that full network traffic was stored for
        at least 7 days after the intrusion'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-497
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:4
      ref_id: CCF 497
      name: Video Calling Hardening
      description: "Video and calling infrastructure must be hardened and abide by\
        \ the following requirements;\n\n\u2022 Video conferencing or IP telephone\
        \ traffic follow through a gateway with video-aware and/or voice-aware firewall\
        \ \n\u2022 Video conferencing and IP telephony calls are established using\
        \ a secure session initiation protocol.\n\u2022 Video conferencing and IP\
        \ telephony traffic is separated physically or logically from other data traffic.\
        \ Workstations that use video and IP phone traffic use VLANs or similar mechanisms\
        \ to maintain separation between video conferencing, IP telephony and other\
        \ data traffic.\n\u2022 If IP phones are used in public areas, their ability\
        \ to access data networks, voicemail and directory services are prevented.\n\
        \u2022 Video conferencing and IP telephony calls are conducted using a secure\
        \ real-time transport protocol."
      annotation: "1. Verify whether following hardening requirements have been implemented\
        \ for video and calling infrastructure:\n\u2022 Video conferencing or IP telephone\
        \ traffic follow through a gateway with video-aware and/or voice-aware firewall\
        \ \n\u2022 Video conferencing and IP telephony calls are established using\
        \ a secure session initiation protocol.\n\u2022 Video conferencing and IP\
        \ telephony traffic is separated physically or logically from other data traffic.\
        \ Workstations that use video and IP phone traffic use VLANs or similar mechanisms\
        \ to maintain separation between video conferencing, IP telephony and other\
        \ data traffic.\n\u2022 If IP phones are used in public areas, their ability\
        \ to access data networks, voicemail and directory services are prevented.\n\
        \u2022 Video conferencing and IP telephony calls are conducted using a secure\
        \ real-time transport protocol.\n\n2. Validate whether hardening guidelines\
        \ are reviewed and approved on a set cadence (at least annually) for accuracy\
        \ and relevance."
      typical_evidence: "1. Provide hardening guidelines for video and calling infrastructure\n\
        2. Provide evidences of hardening performed for video and calling infrastructure\n\
        3. Provide following hardening evidences if available:\n\u2022 Video conferencing\
        \ or IP telephone traffic follow through a gateway with video-aware and/or\
        \ voice-aware firewall \n\u2022 Video conferencing and IP telephony calls\
        \ are established using a secure session initiation protocol.\n\u2022 Video\
        \ conferencing and IP telephony traffic is separated physically or logically\
        \ from other data traffic. Workstations that use video and IP phone traffic\
        \ use VLANs or similar mechanisms to maintain separation between video conferencing,\
        \ IP telephony and other data traffic.\n\u2022 If IP phones are used in public\
        \ areas, their ability to access data networks, voicemail and directory services\
        \ are prevented.\n\u2022 Video conferencing and IP telephony calls are conducted\
        \ using a secure real-time transport protocol."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Global Procurement Services
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-498
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 498
      name: Evidence Integrity
      description: Investigators are responsible for maintaining the integrity of
        evidence gathered during an investigation.
      annotation: "1. Verify if the integrity of evidence gathered during an investigation\
        \ is maintained by investigators by the following processes;\n\u2022 recording\
        \ all of their actions\n\u2022 creating checksums for all evidence\n\u2022\
        \ copying evidence onto media for archiving\n\u2022 maintaining a proper chain\
        \ of custody."
      typical_evidence: "1. Provide evidence (recording) of all actions done by investigators.\n\
        2. Evidence of checksums created for all evidences.\n3. Provide evidence that\
        \ a proper chain of custody is maintained\n4. Provide list of users who can\
        \ access on evidence/records. \n5. How to maintain custody of records/evidence."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-499
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 499
      name: Cloud customer and service provider contact
      description: Cloud customers and service providers maintain 24x7 contact details
        for each other in order to report cyber security incidents. Contact details
        include additional out-of-band contact details for use when normal communication
        channels fail.
      annotation: '1. Verify if cloud customers and service providers maintain 24x7
        contact details for each other to report cyber security incidents.

        2. Validate if additional out-of-band contact details are in use by cloud
        customers and service providers when normal communication channels fail.'
      typical_evidence: '1. Provide list of contact details maintained 24x7 by cloud
        customers and service providers.

        2. Provide the list of additional out-of-band contact details when normal
        communication channels fail.

        3. Evidence of cyber security incidents reported.

        4. Provide evidence, how to communicate users for cyber security incidents
        reported.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-500
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 500
      name: ACSC Reporting
      description: All Cyber Security Incidents are reported to the Australian Cyber
        Security Centre (ACSC).
      annotation: 1. Verify if all cyber security incidents are reported to the Australian
        Cyber Security Centre (ACSC).
      typical_evidence: '1. Provide evidence that all cyber security incidents are
        reported to the ACSC.

        2. Provide cyber security incident tracker maintained by the team.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-501
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 501
      name: ACSC Security Assessment
      description: Commercial and government gateway services selected by the Australian
        Cyber Security Centre (ACSC) undergo a joint security assessment by ACSC and
        Infosec Registered Assessors Program (IRAP) assessors at least every 24 months.
      annotation: 1. Verify if commercial and government gateway services have undergone
        a joint security assessment by ACSC and Infosec Registered Assessors Program
        (IRAP) assessors at least every 24 months.
      typical_evidence: '1. Provide joint security assessment report of commercial
        and government gateway services selected by ACSC.

        2. Provide Infosec Registered Assessors Program (IRAP) assessors report.

        3. Evidence to review the assessment conducted at least every 24 months.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-502
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 502
      name: IRAP Security Assessment
      description: Cloud service providers and their cloud services undergo a security
        assessment by an IRAP assessor at least every 24 months.
      annotation: 1. Verify if cloud service providers and their cloud services have
        undergone a security assessment by an IRAP assessor at least every 24 months.
      typical_evidence: '1. Provide security assessment report of cloud service providers
        and their cloud services.

        2. Evidence to review the assessment conducted at least every 24 months.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-503
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 503
      name: Community or Private Cloud Usage
      description: Only community or private clouds are used for outsourced SECRET
        and TOP SECRET cloud services.
      annotation: 1. Evaluate if only community or private clouds are used for outsourced
        SECRET and TOP SECRET cloud services.
      typical_evidence: '1. Evidence of community and private clouds used for outsourced
        SECRET and TOP SECRET cloud services.

        2. Provide the outsourced cloud services register.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-504
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 504
      name: Australian system processing, storing, and communicating
      description: Systems processing, storing or communicating Australian, AUSTEO
        or AGAO data remain at all times in a data center residing in Australia, under
        the control of an Australian national working for or on behalf of the Australian
        Government.
      annotation: '1. Check if the process for control of Australian systems is documented
        and followed.

        2. Verify if the control of AUSTEO and AGAO systems for processing, storing
        or communicating data is maintained by the Australian citizens working for
        the Australian Government.'
      typical_evidence: '1. Provide documented process for the control of Australian
        systems.

        2. Provide report where AUSTEO and AGAO systems for processing, storing or
        communicating data is maintained.'
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-505
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 505
      name: AUSTEO or AGAO access
      description: Access to AUSTEO or AGAO data can only be accessed from systems
        under the sole control of the Australian Government that are located within
        facilities authorized by the Australian Government.
      annotation: '1. Check if the process for control of Australian systems is documented
        and followed.

        2. Verify if AUSTEO and AGAO systems is only accessed from facilities under
        the sole control of the Australian Government.'
      typical_evidence: '1. Provide documented process for the control of Australian
        systems.

        2. Provide evidence that AUSTEO and AGAO systems can only be accessed under
        the sole control of the Australian Government.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-506
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 506
      name: Procurement of PP-based products
      description: If procuring an evaluated product, a product that has completed
        a PP-based evaluation is selected in preference to one that has completed
        an EAL-based evaluation.
      annotation: '1. Verify if the Common Criteria  EAL requirements is in place.

        2. Verify if a complete PP-based evaluation product is selected in preference
        to EAL-based evaluation product for procuring an evaluated product.'
      typical_evidence: '1. Provide Common Criteria  EAL requirements.

        2. Provide evidence of Common Criteria evaluation which is traditionally conducted
        at a specified EAL.

        3. List of all evaluated products.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-507
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 507
      name: Microsoft Windows Usage
      description: When developing a Microsoft Windows SOE (Standard Operating Environment),
        the 64-bit version of the operating system is used.
      annotation: 1. Verify if 64-bit version of the operating system is used when
        developing a Microsoft Windows SOE to improve the security functionality over
        older releases.
      typical_evidence: 1. Provide snapshot of 64-bit version of the operating system
        while developing a Microsoft Windows SOE.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-508
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 508
      name: ACSC Hardening of Operating Systems
      description: ACSC and vendor guidance is implemented to assist in hardening
        the configuration of operating systems.
      annotation: 1. Verify if ACSC and vendor guidance is implemented to assist in
        securely configuring various operating systems.
      typical_evidence: 1. Provide hardening security guides produced by Australian
        Cyber Security Centre (ACSC) and vendors.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-509
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 509
      name: Microsoft Operating System Usage
      description: "The use of Microsoft operating systems and Microsoft supported\
        \ applications must abide by the following best practices;\n\n\u2022 If supported,\
        \ the latest version of Microsoft\u2019s EMET is implemented on workstations\
        \ and servers and configured with both operating system mitigation measures\
        \ and application-specific mitigation measures.\n\u2022 If supported, Microsoft\u2019\
        s exploit protection functionality is implemented on workstations and servers.\n\
        \u2022 PowerShell version must be higher than 2.0 and is configured to Constrained\
        \ Language Mode.\n\u2022 PowerShell is configured to use module logging, script\
        \ block logging and transcription functionality.\n\u2022 PowerShell script\
        \ block logs are protected by Protected Event Logging functionality.\n\u2022\
        \ If supported, Microsoft\u2019s Attack Surface Reduction rules are implemented."
      annotation: "1. Identify the best practices for the use of Microsoft operating\
        \ systems and Microsoft supported applications.\n2. Verify if the latest version\
        \ of Microsoft\u2019s EMET is implemented on workstations and servers and\
        \ configured with both operating system mitigation measures and application-specific\
        \ mitigation measures. (if applicable)\n3. Verify if Microsoft\u2019s exploit\
        \ protection functionality is implemented on workstations and servers, (if\
        \ applicable)\n4. Verify if PowerShell version is higher than 2.0 and is configured\
        \ to Constrained Language Mode.\n5. Verify if PowerShell is configured to\
        \ use module logging, script block logging and transcription functionality.\n\
        6. Verify if PowerShell script block logs are protected by Protected Event\
        \ Logging functionality.\n7. Verify if Microsoft\u2019s Attack Surface Reduction\
        \ rules are implemented. (if applicable)"
      typical_evidence: "1. Provide the methods for the use of Microsoft operating\
        \ systems and Microsoft supported applications.\n2. Evidence of PowerShell\
        \ version, configuration language mode. \n3. Provide PowerShell script block\
        \ logs."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-510
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 510
      name: ACSC Hardening of Microsoft Office
      description: ACSC and vendor guidance is implemented to assist in hardening
        the configuration of Microsoft Office, web browsers and PDF viewers.
      annotation: '1. Evaluate if the hardening application configurations is in place.

        2. Verify if ACSC and vendor guidance is implemented to assist in hardening
        the configuration of Microsoft Office, web browsers and PDF viewers.'
      typical_evidence: 1. Provide hardening security guides of Microsoft Office,
        web browsers and PDF viewers produced by Australian Cyber Security Centre
        (ACSC) and vendors.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-511
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 511
      name: Web Browser Blocking
      description: Web browsers are configured to block or disable Java, Flash, and
        web advertisements.
      annotation: '1. Evaluate if the hardening application configurations is in place.

        2. Verify if web browsers are configured to block or disable support for Flash
        content, Java and web advertisements from the internet.'
      typical_evidence: '1.Provide configuration guidelines of web browsers to block
        or disable Java, Flash, and web advertisements.

        2. Evidence of web browsers configuration used.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-512
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 512
      name: Unrequired Functionality Blocking
      description: Any unrequired functionality in Microsoft Office, web browsers
        and PDF viewers is disabled.
      annotation: '1. Evaluate if the hardening application configurations is in place.

        2. Verify if any unrequired functionality in Microsoft Office, web browsers
        and PDF viewers is disabled.'
      typical_evidence: 1. Snapshot for any unrequired functionality in Microsoft
        Office, web browsers and PDF viewers.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-513
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 513
      name: Add-On Restriction
      description: The use of Microsoft Office, web browser and PDF viewer add-ons
        is restricted to organization approved add-ons.
      annotation: '1. Evaluate if the hardening application configurations is in place.

        2. Verify if the use of Microsoft Office, web browser and PDF viewer add-ons
        is restricted to organization approved add-ons.'
      typical_evidence: 1. Snapshot for the use of Microsoft Office, web browser and
        PDF viewer add-ons.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-514
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 514
      name: Microsoft Office Usage
      description: "Microsoft Office products installed on workstation must follow\
        \ the following best practice configurations;\n\n\u2022 Microsoft Office is\
        \ configured to prevent activation of Object Linking, Embedding packages,\
        \ and is configured to disable Flash content.\n\u2022 Only privileged users\
        \ responsible for validating that Microsoft Office macros are free of malicious\
        \ code can write to and modify content within Trusted Locations.\n\u2022 Microsoft\
        \ Office macros in documents originating from the internet are blocked.\n\u2022\
        \ Microsoft Office macro security settings cannot be changed by users."
      annotation: "1. Evaluate if the application hardening process is in place.\n\
        2. Verify if Microsoft Office products installed on workstation is following\
        \ the best practice configurations at the minimum:\n\u2022 Microsoft Office\
        \ is configured to prevent activation of Object Linking, Embedding packages,\
        \ and is configured to disable Flash content.\n\u2022 Microsoft Office macros\
        \ are only allowed to execute in documents from Trusted Locations where write\
        \ access is limited to personnel whose role is to vet and approve macros.\n\
        \u2022 Microsoft Office macros in documents originating from the internet\
        \ are blocked.\n\u2022 Microsoft Office macro security settings cannot be\
        \ changed by users."
      typical_evidence: '1. Provide the application hardening process.

        2. Provide the configurations of the Microsoft office products installed on
        the workstations.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-515
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:5
      ref_id: CCF 515
      name: Out-dated applications and operating systems
      description: Applications and operating systems that are no longer supported
        are updated or replaced with vendor-supported versions.
      annotation: '1. Verify if applications that are no longer supported by vendors
        with patches or updates for security vulnerabilities are updated or replaced
        with vendor-supported versions.

        2. Check if operating systems for workstations, servers and ICT equipment
        that are no longer supported are updated or replaced with vendor-supported
        versions.'
      typical_evidence: "1. List the applications and operating systems that are no\
        \ longer supported by vendors. \n2. Provide latest application and operating\
        \ system patching reports with the updated vendor-supported versions.\n3.\
        \ Provide security vulnerability testing report for applications and operating\
        \ systems.\n4. Application vulnerability scan reports and evidence a remediation\
        \ plan for all critical and high vulnerabilities."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:6
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Data Security Management
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-516
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:6
      ref_id: CCF 516
      name: Radio Frequency Inventory
      description: If applicable, a formal inventory for authorized RF (radio frequency)
        and IR (Infrared) devices in SECRET and TOP SECRET areas is maintained and
        regularly audited.  Unauthorized RF devices are not allowed to be brought
        into SECRET and TOP SECRET areas.
      annotation: '1. Verify if a formal inventory process for authorized RF (Radio
        Frequency) and IR (Infrared) devices is established and in place.

        2. Evaluate if a formal inventory for authorized RF and IR devices in SECRET
        and TOP SECRET areas is maintained and regularly audited.

        3. Validate if unauthorized RF and IR devices are not allowed to be brought
        into SECRET and TOP SECRET areas.'
      typical_evidence: "1. Provide formal inventory process for authorized RF and\
        \ IR devices.\n2. List of authorized RF devices in SECRET and TOP SECRET areas.\n\
        3. Provide the RF device register/tracker maintained for authorized RF devices\
        \ in SECRET and TOP SECRET areas.\n4. Provide list of Authorized users can\
        \ access in SECRET and TOP SECRET areas. \n5. Confirm duration and the report\
        \ of review access."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-517
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:6
      ref_id: CCF 517
      name: Unauthorized RF Devices
      description: If applicable, Security measures are used to detect and respond
        to unauthorized RF devices in SECRET and TOP SECRET areas.
      annotation: '1. Identify the unauthorized RF devices which are not allowed to
        be brought into SECRET and TOP SECRET areas.

        2. Verify if security measures are implemented to detect and respond to unauthorized
        RF devices in SECRET and TOP SECRET areas.

        3. Obtain a security register for unauthorized RF devices to understand the
        security risks associated with the introduction of such devices.'
      typical_evidence: '1. List of unauthorized RF devices in SECRET and TOP SECRET
        areas.

        2. Provide evidence of security measures that are used to identify and respond
        to unauthorized RF devices.

        3. Provide the security register maintained for unauthorized RF devices to
        understand the security risks associated with the introduction of such devices.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Physical Security
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-518
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 518
      name: Bluetooth and Wireless Keyboard Usage
      description: If applicable, Bluetooth and wireless keyboards are not used unless
        in an RF screened building.
      annotation: '1. Verify if wireless keyboards and wireless mice meet the security
        requirements.

        2. Check if Bluetooth and wireless keyboards should not be used for confidential
        systems, secret systems, and top secret systems, unless it is in a RF screened
        building.'
      typical_evidence: '1. Provide wireless keyboards and wireless security requirements.

        2. Provide evidence that Bluetooth and wireless keyboards are not used unless
        in an RF screened building.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-519
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 519
      name: Infrared Keyboards and Ports
      description: "If applicable, when using infrared keyboards, the following activities\
        \ are prevented:\n\u2022 infrared ports are positioned to prevent line of\
        \ sight and reflected communications travelling into an unsecured space.\n\
        \u2022 multiple infrared keyboards for different systems being used in the\
        \ same area\n\u2022 other infrared devices being used in the same area\n\u2022\
        \ infrared keyboards operating in areas with unprotected windows."
      annotation: "1. Verify if wireless keyboards and wireless mice meet the security\
        \ requirements.\n2. Check if infrared ports are positioned in a way when using\
        \ infrared keyboards to prevent line of sight and reflected communications\
        \ from travelling into an unsecured space.\n3. Validate if the following activities\
        \ are prevented when using infrared keyboards:\n\u2022 multiple infrared keyboards\
        \ for different systems being used in the same area\n\u2022 other infrared\
        \ devices being used in the same area\n\u2022 infrared keyboards operating\
        \ in areas with unprotected windows."
      typical_evidence: "1. Provide wireless keyboards and wireless security requirements.\n\
        2. Provide evidence that the following requirements should be prevented when\
        \ using infrared keyboards:\n\u2022 line of sight and reflected communications\
        \ travelling into unsecured spaces\n\u2022 multiple infrared keyboards for\
        \ different systems being used in the same area\n\u2022 other infrared devices\
        \ being used in the same area\n\u2022 infrared keyboards operating in areas\
        \ with unprotected windows."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-520
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 520
      name: Cabling Infrastructure
      description: If applicable, cabling infrastructure is installed in accordance
        with relevant Australian Standards, as directed by the Australian Communications
        and Media Authority.
      annotation: 1. Verify if cabling infrastructure is installed by an endorsed
        cable installer to the relevant Australian Standards to ensure personnel safety
        and system availability.
      typical_evidence: 1. Provide evidence of Cabling infrastructure installation.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-521
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 521
      name: Fiber-Optic Cables
      description: If applicable, fiber-optic cables are used for cabling infrastructure
        instead of copper cables.
      annotation: 1. Verify if Fiber-optic cables are used for cabling infrastructure
        instead of copper cables to offer the highest degree of protection from electromagnetic
        emanation effects.
      typical_evidence: 1. Evidence of fiber-optic cables used for cabling infrastructure.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-522
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 522
      name: Cable Register
      description: "If applicable, a cable register is maintained and regularly audited.\
        \  The register contains the following for each cable:\n\u2022 cable identifier\n\
        \u2022 cable color\n\u2022 sensitivity/classification\n\u2022 source\n\u2022\
        \ destination\n\u2022 location\n\u2022 seal numbers (if applicable).\n\nNote:\
        \ Building management cables must be labelled with their purpose in black\
        \ writing on a yellow background at least 2.5cm x 1cm large. These labels\
        \ must be attached every 5 meter interval."
      annotation: "1. Verify if a cable labelling process and supporting cable labelling\
        \ procedures are documented, developed and implemented.\n2. Validate if a\
        \ cable register is established, maintained and regularly audited.\n3. Check\
        \ if a cable register contains the following fields for each cable:\n\u2022\
        \ cable identifier\n\u2022 cable color\n\u2022 sensitivity/classification\n\
        \u2022 source\n\u2022 destination\n\u2022 location\n\u2022 seal numbers (if\
        \ applicable).\n4. Verify if cables are labelled at each end with sufficient\
        \ source and destination details to enable the physical identification and\
        \ inspection of the cable.\n5. Verify if building management cables are labelled\
        \ with a minimum size of 2.5 cm x 1 cm, and attached at five-meter intervals."
      typical_evidence: '1. Provide cable labelling process and supporting cable labelling
        procedures.

        2. Provide the cable register.

        3. Snapshot of labelling on building management cables.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-523
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 523
      name: Floor Plan Diagram
      description: "If applicable, floor plan diagrams are maintained and regularly\
        \ audited.  Floor plan diagrams contain the following:\n\u2022 cable paths\
        \ (including ingress and egress points between floors)\n\u2022 cable reticulation\
        \ system and conduit paths\n\u2022 floor concentration boxes\n\u2022 wall\
        \ outlet boxes\n\u2022 network cabinets."
      annotation: "1. Validate if floor plan diagrams is established, maintained and\
        \ regularly audited.\n2. Check if floor plan diagrams contains the following\
        \ fields for each cable:\n\u2022 cable paths (including ingress and egress\
        \ points between floors)\n\u2022 cable reticulation system and conduit paths\n\
        \u2022 floor concentration boxes\n\u2022 wall outlet boxes\n\u2022 network\
        \ cabinets.\n3. Verify if floor plan diagrams are tracking all cabling infrastructure\
        \ changes throughout the life of a system."
      typical_evidence: 1. Provide Floor plan diagrams.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-524
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 524
      name: Cable Labeling
      description: "If applicable, Cables are labelled at inspection points with the\
        \ following requirements:\n\n\u2022 Foreign system's cables installed in Australian\
        \ facilities are labelled.\n\u2022 Top Secret level information system's cables\
        \ are Red and are fully inspectable for their entire length. Labels for TOP\
        \ SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-meter\
        \ intervals and marked as \u2018TS RUN\u2019.\n\u2022 Secret level information\
        \ system's cables are Salmon Pink and are fully inspectable for their entire\
        \ length.\n\u2022 All other information system's cables (Official level and\
        \ Protected level Information Systems) are color coated using any color other\
        \ than Red (Top Secret) and Salmon Pink (Secret).\n\u2022 Non-conforming cable\
        \ colors are banded with appropriate cable colors and are labeled at inspection\
        \ points.\n\u2022 Building management cables must be labelled with their purpose\
        \ in black writing on a yellow background at least 2.5cm x 1cm large. These\
        \ labels must be attached every 5 meter interval.\n\u2022 Cables are inspectable\
        \ at a minimum of five-meter intervals.\n\u2022 Cables in TOP SECRET areas\
        \ are fully inspectable for their entire length.\n\u2022 SECRET and TOP SECRET\
        \ systems belong exclusively to their own cable groups."
      annotation: "1. Verify if cables for foreign systems installed in Australian\
        \ facilities are labelled at inspection points.\n2. Check if cable colors\
        \ are used as following:\n\u2022 Top Secret level information system cables\
        \ are Red and are fully inspectable for their entire length. Labels for TOP\
        \ SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-meter\
        \ intervals and marked as \u2018TS RUN\u2019.\n\u2022 Secret level information\
        \ system's cables are Salmon Pink and are fully inspectable for their entire\
        \ length.\n\u2022 All other information system's cables (Official level and\
        \ Protected level Information Systems) are color coated using any color other\
        \ than Red (Top Secret) and Salmon Pink (Secret).\n3. Verify if non-conforming\
        \ cable colors are banded with appropriate cable colors and are labelled at\
        \ inspection points.\n4. Check if building management cables are labelled\
        \ with their purpose in black writing on a yellow background at least 2.5cm\
        \ x 1cm large. These labels should be attached every 5 meter interval.\n5.\
        \ Verify if cables are inspectable at a minimum of five-meter intervals in\
        \ non-shared government facilities."
      typical_evidence: '1. List of cables colors used at inspection points.

        2. Evidence of cable colors that are labelled at inspection points.

        3. Provide evidence of cable inspect ability in non-shared government facilities.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-525
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 525
      name: Fiber-Optic Cable Requirements
      description: "If applicable, fiber optic cables abide by the following requirements;\n\
        \u2022 Fibers in the sheath only carry a single cable group based on the information\
        \ protection level of the information system. (Top Secret, Secret, Official,\
        \ and Protected)\n\u2022 For Fiber cables containing subunits, each subunit\
        \ only carries cables from a single cable group."
      annotation: "1. Validate if fiber optic cables is in place.\n2. Verify if fiber\
        \ optic cables comply by the following requirements:\n\u2022 Fibers in the\
        \ sheath only carry a single cable group based on the information protection\
        \ level of the information system. (Top Secret, Secret, Official, and Protected)\n\
        \u2022 For Fiber cables containing subunits, each subunit only carries cables\
        \ from a single cable group."
      typical_evidence: '1. Evidence of fiber-optic cables used in the cabling infrastructure.

        2. Evidence of fiber-optic cables complying the security requirements.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-526
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 526
      name: Cable Dividing Partition
      description: If applicable, cable groups sharing a common cable reticulation
        system have a dividing partition or a visible gap between the cable groups.
      annotation: 1. Verify if cable groups sharing a common cable reticulation system
        have a dividing partition or a visible gap between the cable groups.
      typical_evidence: 1. Provide evidence of cable groups sharing a common cable
        reticulation system have a partition between the cable groups.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-527
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 527
      name: Cable Reticulation System
      description: If applicable, in shared facilities, cables are run in an enclosed
        cable reticulation system.
      annotation: 1. Verify if cables are run in an sealed cable reticulation system
        in shared facilities to prevent access and enhance cable management.
      typical_evidence: 1. Provide evidence of cables running in a sealed cable reticulation
        system in shared facilities.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-528
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 528
      name: Conduit Usage
      description: If applicable, in shared facilities, conduits or the front covers
        of ducts, cable trays in floors and ceilings, and associated fittings are
        clear plastic.
      annotation: "1. In shared facilities, the following items must be fitted with\
        \ clear plastic:\n\u2022 Conduits\n\u2022 Front Covers of Ducts\n\u2022 Cable\
        \ Trays in Floors and Ceilings\n\u2022 Any other type of associate fittings\
        \ for ducts, and cable trays"
      typical_evidence: 1. Validate in any facilities, conduits or front covers of
        ducts, cable trays in floors and ceilings, and any other associated fittings
        are clear plastic.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-529
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 529
      name: Tamper-Evident Seal Usage
      description: If applicable, in shared facilities, uniquely identifiable SCEC
        endorsed tamper-evident seals are used to seal all removable covers on TOP
        SECRET cable reticulation systems.
      annotation: 1. In shared facilities, unique and identifiable SCEC endorsed tamper-evident
        seals must be used to seal all removable covers on all TOP SECRET cable reticulation
        systems.
      typical_evidence: 1. Validate in any facilities, unique and identifiable SCEC
        endorsed tamper-evident seals were used to seal removable covers on TOP SECRET
        cable reticulation systems.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-530
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 530
      name: Conduit Glue
      description: If applicable, in shared facilities, a visible smear of conduit
        glue is used to seal all plastic conduit joints and TOP SECRET conduit runs
        connected by threaded lock nuts.
      annotation: 1. In shared facilities, all plastic conduit joints are sealed via
        a visible smear of conduit glue, and all TOP SECRET conduit runs are connected
        by threaded lock nuts.
      typical_evidence: 1. Validate in any facilities, all plastic conduit joints
        are sealed via conduit glue and TOP SECRET conduit runs are connected by threaded
        lock nuts.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-531
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 531
      name: Cable Configuration
      description: If applicable, in shared facilities, TOP SECRET cables are not
        run in party walls.
      annotation: 1. In shared facilities, TOP SECRET cables shall not be allowed
        to run in party walls.
      typical_evidence: 1. Validate that TOP SECRET cables do not run in party walls
        in shared facilities.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-532
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 532
      name: Cable Encasement
      description: If applicable, in shared government facilities, where wall penetrations
        exit a TOP SECRET area into a lower classified space, TOP SECRET cables are
        encased in conduit with all gaps between the TOP SECRET conduit and the wall
        filled with an appropriate sealing compound.
      annotation: 1. In shared government facilities, where wall penetrations exit
        a TOP SECRET area into a lower classified space, TOP SECRET cables that flow
        through these wall penetrations are encased in conduit with all gaps between
        the TOP SECRET conduit and wall filled with an appropriate sealing compound.
      typical_evidence: 1. Validate that TOP SECRET cables are encased in conduit
        with all gaps between the conduit and wall filled with appropriate sealing
        compound in shared government facilities where wall penetrations exit a TOP
        SECRET area into a lower classified space.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-533
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 533
      name: Cable Encasement
      description: If applicable, in shared non-government facilities, where wall
        penetrations exit into a lower classified space, cables are encased in conduit
        with all gaps between the conduit and the wall filled with an appropriate
        sealing compound.
      annotation: 1. In shared non-government facilities, where wall penetrations
        exit into a lower classified space, cables that flow through these wall penetrations
        are encased in conduit with all gaps between the conduit and wall filled with
        an appropriate sealing compound.
      typical_evidence: 1. Validate that cables are encased in conduit with all gaps
        between the conduit and wall filled with appropriate sealing compound in shared
        non-government facilities where wall penetrations exit into a lower classified
        space.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-534
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 534
      name: Flexible or Plastic Conduit Usage
      description: If applicable, cables from cable trays to wall outlet boxes are
        run in flexible or plastic conduit.
      annotation: 1. Cables from cable trays to wall outlet boxes must be run in flexible
        or plastic conduit
      typical_evidence: 1. Validate cables from cable trays to wall outlet boxes are
        run in flexible or plastic conduit
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-535
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 535
      name: Wall outlet Box Connectors
      description: If applicable, wall outlet boxes have connectors on opposite sides
        of the wall outlet box if the cable group contains cables belonging to different
        systems.
      annotation: 1. If a cable group contains cables belonging to different systems,
        wall outlet boxes have connectors on opposite sides of the wall outlet box.
      typical_evidence: 1. Validate wall outlet boxes have connectors on opposite
        sides of the wall outlet box if the cable group contains cables belonging
        to different systems.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-536
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 536
      name: Cabling Box Requirements
      description: "If applicable, cabling boxes must follow the following requirements;\n\
        \n\u2022 Different cables groups do not share a wall outlet box.\n\u2022 Wall\
        \ outlet boxes denote the systems, cable identifiers and wall outlet box identifier.\n\
        \u2022 OFFICIAL and PROTECTED wall outlet boxes are colored neither salmon\
        \ pink nor red. \n\u2022 Wall outlet box covers are clear plastic.\n\u2022\
        \ SECRET wall outlet boxes are colored salmon pink.\n\u2022 TOP SECRET wall\
        \ outlet boxes are colored red."
      annotation: "1. Cabling boxes must have the following requirements configured/designed:\
        \ \n\u2022 Different cables groups do not share a wall outlet box.\n\u2022\
        \ Wall outlet boxes denote the systems, cable identifiers and wall outlet\
        \ box identifier.\n\u2022 OFFICIAL and PROTECTED wall outlet boxes are colored\
        \ neither salmon pink nor red. \n\u2022 Wall outlet box covers are clear plastic.\n\
        \u2022 SECRET wall outlet boxes are colored salmon pink.\n\u2022 TOP SECRET\
        \ wall outlet boxes are colored red."
      typical_evidence: "1. Validate Cabling boxes have the following requirements\
        \ and meet them: \n\u2022 Different cables groups do not share a wall outlet\
        \ box.\n\u2022 Wall outlet boxes denote the systems, cable identifiers and\
        \ wall outlet box identifier.\n\u2022 OFFICIAL and PROTECTED wall outlet boxes\
        \ are colored neither salmon pink nor red. \n\u2022 Wall outlet box covers\
        \ are clear plastic.\n\u2022 SECRET wall outlet boxes are colored salmon pink.\n\
        \u2022 TOP SECRET wall outlet boxes are colored red."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-537
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 537
      name: Fiber-Optic Fly Leads
      description: "If TOP SECRET fiber-optic fly leads exceeding five meters in length\
        \ are used to connect wall outlet boxes to ICT equipment, they are run in\
        \ a protective and easily inspected pathway that is clearly labelled at the\
        \ ICT equipment end with the wall outlet box\u2019s identifier."
      annotation: 1. If TOP SECRET fiber-optic fly leads exceeding 5 meters in length
        are used to connect wall outlet boxes to ICT equipment, they are run in a
        protective and easily inspected pathway that is clearly labeled at the ICT
        equipment end with the wall outlet box's identifier as well.
      typical_evidence: 1. Validate TOP SECRET fiber-optic fly leads exceeding 5 meters
        in length that are used to connect to wall outlet boxes to ICT equipment,
        they are run in a protective and easily inspected pathway that is clearly
        labelled at the ICT equipment end with the wall outlet box's identifier.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-538
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 538
      name: Cable Reticulation Termination
      description: If applicable, cable reticulation systems leading into cabinets
        are terminated as close as possible to the cabinet.
      annotation: 1. Cable reticulation systems leading into cabinets are terminated
        as close as possible to the cabinet.
      typical_evidence: 1. Validate cable reticulation systems leading into cabinets
        are terminated as close as possible to the cabinet.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-539
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 539
      name: Cable Reticulation Termination
      description: If applicable, in TOP SECRET areas, cable reticulation systems
        leading into cabinets in a secure communications or server room are terminated
        as close as possible to the cabinet.
      annotation: 1. In TOP-SECRET areas, cable reticulation systems leading into
        cabinets in a secure communications or server room are terminated as close
        as possible to the cabinet.
      typical_evidence: 1. Validate in top secret areas, cable reticulation systems
        leading into cabinets in a secure communications or server room are terminated
        as close as possible to the cabinet.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-540
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 540
      name: Cable Reticulation Termination
      description: If applicable, in TOP SECRET areas, cable reticulation systems
        leading into cabinets not in a secure communications or server room are terminated
        at the boundary of the cabinet.
      annotation: 1. In TOP-SECRET areas, cable reticulation systems leading into
        cabinets not in a secure communications or server room are terminated as close
        as possible to the cabinet.
      typical_evidence: 1. Validate in top secret areas, cable reticulation systems
        leading into cabinets not in a secure communications or server room are terminated
        as close as possible to the cabinet.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-541
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 541
      name: Cable Termination
      description: If applicable, cables are terminated in individual cabinets; or
        for small systems, one cabinet with a division plate to delineate cable groups.
      annotation: 1. Cables are terminated in individual cabinets to prevent accidental
        or deliberate cross-patching and makes inspection of cables easier. Alternatively,
        for small systems, they can be terminated in one cabinet with a division plate
        to delineate cable groups.
      typical_evidence: 1. Obtain evidence of cables terminating in individual cabinets,
        or for small systems, one cabinet with a division plate to delineate cable
        groups.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-542
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 542
      name: Cable Termination
      description: If applicable, TOP SECRET cables are terminated in an individual
        TOP SECRET cabinet.
      annotation: 1. TOP SECRET cables are terminated in an individual TOP SECRET
        cabinet.
      typical_evidence: 1. Provide evidence of TOP SECRECT cables terminating in an
        individual TOP SECRET cabinet.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-543
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 543
      name: Cable Termination
      description: If applicable, different cable groups do not terminate on the same
        patch panel.
      annotation: 1. Different cable groups are not terminated on the same patch panel.
      typical_evidence: 1. Provide evidence of different cable groups terminating
        on the different patch panels.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-544
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 544
      name: Cabinet Gap
      description: If applicable, there is a visible gap between TOP SECRET cabinets
        and cabinets of lower classifications.
      annotation: 1. There is a visible physical separation between TOP SECRET cabinets
        and cabinets of lower classifications for reducing the chance of cross-patching.
      typical_evidence: 1. Provide evidence of visible gap between TOP SECRET cabinets
        and cabinets of lower classifications.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-545
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 545
      name: Patch Panel Separation
      description: If applicable, TOP SECRET and non-TOP SECRET patch panels are physically
        separated by installing them in separate cabinets.
      annotation: 1. TOP SECRET and non-TOP SECRET patch panels are physically separated
        by installing the panels in separate cabinets.
      typical_evidence: 1. Provide evidence of installing TOP SECRET and non-TOP SECRET
        patch panels in separate cabinets.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-546
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 546
      name: Patch Panel Configuration
      description: "Where spatial constraints demand patch panels of lower classifications\
        \ than TOP SECRET be located in the same cabinet as a TOP SECRET patch panel:\n\
        \u2022 a physical barrier in the cabinet is provided to separate patch panels\n\
        \u2022 only personnel holding a Positive Vetting security clearance have access\
        \ to the cabinet\n\u2022 approval from the TOP SECRET system\u2019s authorizing\
        \ officer is obtained prior to installation."
      annotation: "1. Due to spatial constraints where lower classification than TOP\
        \ SECRET patch panels be located in the same cabinet as a TOP SECRET patch\
        \ panel:\n\u2022 a physical barrier in the cabinet is to be provided to separate\
        \ patch panels\n\u2022 only personnel holding a Positive Vetting security\
        \ clearance should have access to the cabinet\n\u2022 approval from the TOP\
        \ SECRET system\u2019s authorizing officer is obtained prior to installation."
      typical_evidence: "1. Evidence to separate patch panels.\n2. List of personnel\
        \ who have access to the cabinet.\n3. If a lower classification than TOP SECRET\
        \ patch panels be located in the same cabinet as a TOP SECRET patch panel:\n\
        \u2022 a physical barrier in the cabinet is to be provided to separate patch\
        \ panels\n\u2022 only personnel holding a Positive Vetting security clearance\
        \ should have access to the cabinet\n\u2022 approval from the TOP SECRET system\u2019\
        s authorizing officer is obtained prior to installation."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-547
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 547
      name: Penetration of Audio Secured Space
      description: When penetrating an audio secured space, ASIO is consulted and
        all directions provided are complied with.
      annotation: 1. The Australian Security Intelligence Organization (ASIO) is consulted
        prior to penetrating an audio secured space. All ASIO recommendations are
        complied with.
      typical_evidence: 1. If applicable, validate ASIO was consulted prior to penetrating
        an audio secured space, and all ASIO recommendations were complied with.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-548
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 548
      name: Power Distribution Board
      description: If applicable, a power distribution board with a feed from an Uninterruptible
        Power Supply is used to power all TOP SECRET ICT equipment.
      annotation: 1. A power distribution board with a feed from an Uninterruptible
        Power Supply is used to power all TOP SECRET Information and Computer Technology
        (ICT) equipment.
      typical_evidence: 1. Validate in a power distribution board with a feed from
        an Uninterruptible Power Supply is used to power all TOP SECRET ICT equipment.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-549
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 549
      name: Power Distribution Board
      description: If applicable, in TOP SECRET areas of shared non-government facilities,
        a power distribution board with a feed from an Uninterruptible Power Supply
        is used to power all TOP SECRET ICT equipment.
      annotation: 1. In TOP SECRET areas of shared non-government facilities, a power
        distribution board with a feed from an Uninterruptible Power Supply is used
        to power all TOP SECRET Information and Computer Technology (ICT) equipment.
      typical_evidence: 1. Validate in TOP SECRET areas of shared non-government facilities,
        a power distribution board with a feed from an Uninterruptible Power Supply
        is used to power all TOP SECRET ICT equipment.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-550
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 550
      name: Radio Frequency Transmitters
      description: If applicable, system owners deploying SECRET or TOP SECRET systems
        with Radio Frequency (RF) transmitters inside or co-located with their facility
        contact the ACSC for an emanation security threat assessment and implement
        any additional installation criteria derived from the emanation security threat
        assessment.
      annotation: '1. System owners deploying SECRET or TOP SECRET systems with Radio
        Frequency (RF) transmitters inside or co-located with their facility contact
        the ACSC for an emanation security threat assessment, and perform the following.

        2. Perform emanation security threat assessment.

        3. Identify emanation security threats.

        4. Verify if any additional installation criteria is implemented derived from
        the emanation security threat assessment.'
      typical_evidence: "1. Validate system owners deploying SECRET or TOP SECRET\
        \ systems with RF transmitters inside or co-located with their facility must:\n\
        \u2022 Contact ACSC \n\u2022 Provide emanation security threat assessment\
        \ report.\n\u2022 Provide additional installation criteria derived from the\
        \ emanation security threat assessment."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-551
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 551
      name: Radio Frequency Transmitters
      description: If applicable, system owners deploying OFFICIAL or PROTECTED systems
        with RF transmitters that will be co-located with SECRET or TOP SECRET systems
        contact the ACSC for an emanation security threat assessment and implement
        any additional installation criteria derived from the emanation security threat
        assessment.
      annotation: '1. System owners deploying OFFICIAL or PROTECTED systems with Radio
        Frequency (RF) transmitters that will be co-located with SECRET or TOP SECRET
        systems of a higher classification contact the ACSC for an emanation security
        threat assessment, and perform the following.

        2. Perform emanation security threat assessment.

        3. Identify emanation security threats.

        4. Verify if any additional installation criteria is implemented derived from
        the emanation security threat assessment.'
      typical_evidence: "1. Validate system owners deploying OFFICIAL or PROTECTED\
        \ systems with RF transmitters that will be co-located with SECRET or TOP\
        \ SECRET systems:\n\u2022 Contact ACSC \n\u2022 Provide emanation security\
        \ threat assessment report.\n\u2022 Provide additional installation criteria\
        \ derived from the emanation security threat assessment."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-552
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 552
      name: System Deployment in Shared Facilities
      description: If applicable, system owners deploying SECRET or TOP SECRET systems
        in shared facilities with contact the ACSC for an emanation security threat
        assessment and implement any additional installation criteria derived from
        the emanation security threat assessment.
      annotation: '1. System owners deploying SECRET or TOP SECRET systems in shared
        facilities must:

        2. Perform emanation security threat assessment.

        3. Identify emanation security threats.

        4. Verify if any additional installation criteria is implemented derived from
        the emanation security threat assessment.'
      typical_evidence: "1. Validate system owners deploying SECRET or TOP SECRET\
        \ systems in shared facilities must:\n\u2022 Contact ACSC \n\u2022 Provide\
        \ emanation security threat assessment report.\n\u2022 Provide additional\
        \ installation criteria derived from the emanation security threat assessment."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-553
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 553
      name: System Deployment Overseas
      description: If applicable, system owners deploying systems overseas contact
        the ACSC for emanation security threat advice and implement any additional
        installation criteria derived from the emanation security threat advice.
      annotation: '1. If system owners are deploying systems overseas, they must contact
        the Australian Cyber Security Centre (ACSC) for emanation security threat
        advice.

        2. Any additional installation criteria from the emanation security threat
        advice is implemented.'
      typical_evidence: '1. If system owners deployed systems overseas, provide evidence
        of emanation security threat advice when contacting the ACSC.

        2. Provide additional installation criteria derived from the emanation security
        threat advice.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-554
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 554
      name: System Deployment Overseas
      description: If applicable, System owners deploying systems or military platforms  overseas
        contact the ACSC for an emanation security threat assessment and implement
        any additional installation criteria derived from the emanation security threat
        assessment.
      annotation: '1. If system owners are deploying systems or military platforms
        overseas, they must contact the Australian Cyber Security Centre (ACSC) for
        emanation security threat assessment.

        2. Any additional installation criteria from the emanation security threat
        assessment is implemented.'
      typical_evidence: '1. If system owners deployed systems or military platforms  overseas,
        provide evidence of emanation security threat assessment when contacting the
        ACSC.

        2. Provide additional installation criteria derived from the emanation security
        threat assessment.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-555
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 555
      name: Emanation Security Threat Assessment
      description: "An emanation security threat assessment is sought as early as\
        \ possible in a project\u2019s life cycle as emanation security controls can\
        \ have significant cost implications."
      annotation: '1. As part of a project''s life cycle, an emanation security threat
        assessment must be sought as soon as possible.

        2. Identify emanation security issues.

        3. Implement controls to address the risks identified as part of the emanation
        security threat assessment.'
      typical_evidence: '1. Evidence of emanation security issues identified.

        2. Provide emanation security threat assessment report, and mitigation strategies'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-556
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 556
      name: ICT Equipment Standards
      description: If applicable, ICT (Information and Computer Technology) equipment
        meets industry and government standards relating to electromagnetic interference/electromagnetic
        compatibility.
      annotation: '1. ICT equipment must meet industry and government standards relating
        to electromagnetic interference/electromagnetic compatibility.

        2. Validate the industry standards relating to electromagnetic interference/electromagnetic
        compatibility and adhere to these standards.'
      typical_evidence: '1. Provide ICT equipment guidelines.

        2. Evidence that ICT equipment meets industry and government standards relating
        to electromagnetic interference.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-557
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 557
      name: Telephone Systems Policy
      description: "A Telephone Systems policy exists and covers the following requirements;\n\
        \n\u2022 Personnel are made aware of the sensitivity of information that they\
        \ may discuss, along with their classification levels.\n\u2022 Personnel are\
        \ made aware of security risks of non-secure lines.\n\u2022 Telephone lines\
        \ that permit different levels of conversation have a visual indicator.\n\u2022\
        \ Telephone systems used for sensitive or classified conversations encrypt\
        \ all traffic that passes over external systems.\n\u2022 Cordless telephone\
        \ systems are not used for sensitive or classified conversations.\n\u2022\
        \ Traditional analog phones are used in public areas."
      annotation: "1. A Telephone Systems policy is established, documented and maintained\
        \ that documents the following:\nEvaluate if the Telephone Systems policy\
        \ meets the following requirements:\n\u2022 Personnel are made aware of the\
        \ sensitivity of information that they may discuss, along with their classification\
        \ levels.\n\u2022 Personnel are made aware of security risks of non-secure\
        \ lines.\n\u2022 Telephone lines that permit different levels of conversation\
        \ have a visual indicator.\n\u2022 Telephone systems used for sensitive or\
        \ classified conversations encrypt all traffic that passes over external systems.\n\
        \u2022 Cordless telephone systems are not used for sensitive or classified\
        \ conversations.\n\u2022 Traditional analog phones are used in public areas."
      typical_evidence: '1. Provide Telephone Systems policy.

        2. Provide evidence of providing awareness of sensitivity of information and
        security risks of non-secure lines.

        3. Evidence of encryption the sensitive conversations.

        4. Provide evidence of telephone systems used for sensitive or classified
        conversations.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-558
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 558
      name: Telephone Systems Configuration
      description: "Telephone systems are configured to meet the following requirements\
        \ based on the classification of information able to discuss;\n\n\u2022 Speakerphones\
        \ are not used in Top Secret unless the telephone system is located in a room\
        \ rated as audio secure only personnel involved in discussions are present\
        \ in the room.\n\u2022 In TOP SECRET areas, push-to-talk handsets or push-to-talk\
        \ headsets are used on all telephones that are not authorized for the transmission\
        \ of TOP SECRET information.\n\u2022 In SECRET and TOP SECRET areas, push-to-talk\
        \ handsets or push-to-talk headsets are used to meet any off-hook audio protection\
        \ requirements.\n\u2022 Off-hook audio protection features are used on telephone\
        \ systems in areas where background conversations may exceed the sensitivity\
        \ or classification that the telephone system is authorized for communicating.\n\
        \u2022 IP phone and video conferencing workstations must match the data classification\
        \ level of their area.\n\u2022 Microphones (including headsets and USB handsets)\
        \ and webcams are not used with non-SECRET workstations in SECRET areas or\
        \ non-TOP SECRET workstations in TOP SECRET areas."
      annotation: "1. Telephone Systems are configured to meet the following requirements:\
        \ \n\u2022 Speakerphones are not used in Top Secret unless the telephone system\
        \ is located in a room rated as audio secure only personnel involved in discussions\
        \ are present in the room.\n\u2022 In TOP SECRET areas, push-to-talk handsets\
        \ or push-to-talk headsets are used on all telephones that are not authorized\
        \ for the transmission of TOP SECRET information.\n\u2022 In SECRET and TOP\
        \ SECRET areas, push-to-talk handsets or push-to-talk headsets are used to\
        \ meet any off-hook audio protection requirements.\n\u2022 Off-hook audio\
        \ protection features are used on telephone systems in areas where background\
        \ conversations may exceed the sensitivity or classification that the telephone\
        \ system is authorized for communicating.\n\u2022 IP phone and video conferencing\
        \ workstations must match the data classification level of their area.\n\u2022\
        \ Microphones (including headsets and USB handsets) and webcams are not used\
        \ with non-SECRET workstations in SECRET areas or non-TOP SECRET workstations\
        \ in TOP SECRET areas."
      typical_evidence: "1. Validate that telephone systems are configured to: \n\u2022\
        \ Speakerphones are not used in Top Secret unless the telephone system is\
        \ located in a room rated as audio secure only personnel involved in discussions\
        \ are present in the room.\n\u2022 In TOP SECRET areas, push-to-talk handsets\
        \ or push-to-talk headsets are used on all telephones that are not authorized\
        \ for the transmission of TOP SECRET information.\n\u2022 In SECRET and TOP\
        \ SECRET areas, push-to-talk handsets or push-to-talk headsets are used to\
        \ meet any off-hook audio protection requirements.\n\u2022 Off-hook audio\
        \ protection features are used on telephone systems in areas where background\
        \ conversations may exceed the sensitivity or classification that the telephone\
        \ system is authorized for communicating.\n\u2022 IP phone and video conferencing\
        \ workstations must match the data classification level of their area.\n\u2022\
        \ Microphones (including headsets and USB handsets) and webcams are not used\
        \ with non-SECRET workstations in SECRET areas or non-TOP SECRET workstations\
        \ in TOP SECRET areas."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-559
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 559
      name: High Assurance ICT Equipment
      description: When procuring high assurance ICT equipment, the ACSC is contacted
        for any equipment-specific delivery procedures.
      annotation: '1. If the Systems is procuring high assurance ICT equipment, it
        must contact the Australian Cyber Security Centre (ACSC) for any equipment-specific
        delivery procedures.

        2. The Systems must adhere to these procedures.'
      typical_evidence: 1. Evidence of delivery procedure for procuring high assurance
        ICT equipment guided by ACSC.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-560
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 560
      name: High Assurance ICT Equipment
      description: High assurance ICT equipment is installed, configured, administered
        and operated in accordance with guidance produced by the ACSC. High assurance
        ICT is only operated in an evaluated configuration.
      annotation: '1. High assurance ICT equipment is installed, configured, administered
        and operated in accordance with guidance produced by the ACSC.

        2. Obtain the ACSC guidelines and ensure they are adhered to.'
      typical_evidence: '1. Provide evidence of High assurance ICT equipment installed.

        2. Provide configurations of High assurance ICT equipment and adhere to the
        ACSC guidelines.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-561
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 561
      name: ICT Equipment Policy
      description: An ICT equipment management policy is developed and implemented.
      annotation: 1. An ICT equipment management policy is developed and implemented
        detailing how to install, configure, administer, handle, classify and label
        ICT equipment.
      typical_evidence: 1. Provide ICT equipment management policy.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-562
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 562
      name: ICT Equipment Classification
      description: ICT equipment is classified based on the highest sensitivity or
        classification of data that it is approved for processing, storing or communicating.
      annotation: '1. ICT equipment is classified based on the highest sensitivity
        or classification of data that it is approved for processing, storing or communicating.

        2. ICT equipment is classification must be updated accordingly and evaluated
        on a periodic basis to validate it is up-to-date.'
      typical_evidence: '1. Evidence of classifying the ICT equipment.

        2. Provide an ICT equipment register.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-563
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 563
      name: ICT Equipment Labeling
      description: ICT Equipment, and media, must be labelled with protective markings
        reflecting its sensitivity or classification.
      annotation: '1. ICT equipment and media must be labelled with protective markings
        reflecting its sensitivity or classification.

        2. ICT equipment and media labels are updated accordingly and evaluated on
        a periodic basis to validate it is up-to-date.'
      typical_evidence: '1. Provide marking scheme process for labelling ICT equipment.

        2. Provide evidence of protective markings used for labelling ICT equipment.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-564
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 564
      name: ACSC Approval for Labeling
      description: "The Australian Cyber Security Centre (ACSC)\u2019s approval is\
        \ sought before applying labels to external surfaces of high assurance ICT\
        \ equipment."
      annotation: '1. Before applying labels to external surfaces of high assurance
        ICT equipment, the Australian Cyber Security Centre (ACSC)''s approval is
        obtained.

        2. Approvals are retained in a repository, and ICT equipment is labeled according
        to the approval provided.'
      typical_evidence: 1. Provide evidence of approval taken from ASAC before applying
        labels to external surfaces of high assurance ICT equipment.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-565
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 565
      name: ICT Equipment Handling
      description: ICT equipment is handled in a manner suitable for its sensitivity
        or classification.
      annotation: '1. The ICT equipment management policy will detail how ICT equipment
        is handled.

        2. ICT equipment handling shall adhere to this policy, and any transfers,
        changes to equipment shall be documented, and appropriately sanitized if needed.'
      typical_evidence: '1. Obtain the ICT equipment management policy.

        2. Obtain samples of ICT equipment handling and validate it adheres to the
        policy.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-566
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 566
      name: ICT Equipment Repair
      description: "The ACSC\u2019s approval is sought before undertaking any repairs\
        \ to high assurance ICT equipment."
      annotation: "1. All high assurance ICT equipment repairs must be documented\
        \ and retained. \n2. Prior to any repairs occurring, ACSC's approval is obtained\
        \ first, and their guidance is followed."
      typical_evidence: '1. Obtain instances where high assurance ICT equipment was
        repaired.

        2. Validate ACSC approval was obtained prior to the repair occurring.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-567
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 567
      name: Technician Escorting
      description: "If an uncleared technician is used to undertake maintenance or\
        \ repairs of ICT equipment, the technician is escorted by someone who:\n\u2022\
        \ is appropriately cleared and briefed\n\u2022 takes due care to ensure that\
        \ data is not disclosed\n\u2022 takes all responsible measures to ensure the\
        \ integrity of the ICT equipment\n\u2022 has the authority to direct the technician\n\
        \u2022 is sufficiently familiar with the ICT equipment to understand the work\
        \ being performed."
      annotation: "1. A process is documented and followed for cleared personnel to\
        \ escort uncleared technicians during maintenance or repair activities.\n\
        2. If an uncleared technician is used to undertake maintenance or repairs\
        \ of ICT equipment, the technician is escorted by someone who:\n\u2022 is\
        \ appropriately cleared and briefed\n\u2022 takes due care to ensure that\
        \ data is not disclosed\n\u2022 takes all responsible measures to ensure the\
        \ integrity of the ICT equipment\n\u2022 has the authority to direct the technician\n\
        \u2022 is sufficiently familiar with the ICT equipment to understand the work\
        \ being performed."
      typical_evidence: 1. Provide documented process for cleared personnel to escort
        uncleared technicians during maintenance or repair activities.
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-568
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 568
      name: ICT Equipment Inspection
      description: Following maintenance or repair activities for ICT equipment, the
        ICT equipment is inspected to confirm it retains its approved software configuration
        and that no unauthorized modifications have taken place.
      annotation: '1. All maintenance and repair activities for ICT equipment shall
        be document and retained.

        2. After a maintenance and repair activity has been completed, documentation
        showing the ICT equipment was inspected to confirm it retains its approved
        software configuration is documented.

        3. All unauthorized modifications to the ICT equipment must be reversed immediately.'
      typical_evidence: 1. Provide Inspection report of ICT equipment and validate
        no inappropriate changes have been made to the equipment as part of maintenance
        or repair activities.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-569
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 569
      name: ICT Equipment Labeling
      description: Labels and markings indicating the owner, sensitivity, classification
        or any other marking that can associate the ICT equipment with its original
        use, are removed prior to disposal.
      annotation: '1. ICT equipment sanitization and disposal processes and procedures
        are established, documented and maintained.

        2. Labels and markings that can associate the ICT equipment with its original
        use, are removed prior to disposal.

        3. All ICT equipment that is disposed of shall be documented and evidence
        provided that any owner, sensitivity, classification and other markings were
        disposed of prior to disposal.'
      typical_evidence: '1. Provide ICT equipment sanitization and disposal processes
        and procedures.

        2. Evidence that labels and marking are removed prior to disposal.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-570
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 570
      name: ICT Equipment Disposing
      description: When disposing of ICT equipment that has been designed or modified
        to meet emanation security standards, the ACSC is contacted for requirements
        relating to its secure disposal.
      annotation: '1. ICT equipment sanitization and disposal processes and procedures
        are established, documented and maintained.

        2. When disposing of ICT equipment that was specifically designed or modified
        to meet emanation security standards, ACSC must be contacted for requirements
        relating to secure disposal.

        3. ACSC instructions are adhered to, and documentation of the disposal is
        recorded.'
      typical_evidence: 1. Validate ICT equipment designed to meet emanation security
        standards was disposed of appropriately via ACSC guidance.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-571
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 571
      name: ICT Equipment Sanitization
      description: ICT equipment, including associated media, that is located overseas
        and has processed or stored AUSTEO or AGAO data is sanitized in situ.
      annotation: "1. ICT equipment, including associated media, that is located overseas,\
        \ and has processed or stored AUSTEO or AGAO data must be sanitized in situ.\
        \ \n2. Documentation of the ICT equipment being sanitized in situ must be\
        \ retained."
      typical_evidence: 1. Validate ICT equipment is sanitized in situ if it is located
        overseas and processed/stored AUSTEO or AGAO data.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-572
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 572
      name: ICT Equipment Sanitization
      description: ICT equipment, including associated media, that is located overseas
        and has processed, stored, or communicated AUSTEO or AGAO data that cannot
        be sanitized in situ is returned to Australia for destruction.
      annotation: '1. ICT equipment, including associated media, that is located overseas,
        and has processed, stored, or communicated AUSTEO or AGAO data that cannot
        be sanitized in situ is returned to Australia for destruction.

        2. Records of ICT equipment returned to Australia for destruction must be
        retained.'
      typical_evidence: 1. Validate ICT equipment that cannot be sanitized in situ
        if it is located overseas and processed, stored, or communicated  AUSTEO or
        AGAO data is returned to Australia for destruction.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-573
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 573
      name: Color Printer Cartridge
      description: At least three pages of random text with no blank areas are printed
        on each color printer cartridge or MFD print drum.
      annotation: '1. Sanitization and disposal procedures of printers and multifunction
        devices is established, documented and maintained.

        2. At least three pages of random text with no blank areas are printed on
        each color printer cartridge or MFD print drum in order to sanitize or removal
        of any media.'
      typical_evidence: '1. Provide sanitization and disposal procedures of printers
        and multifunction devices.

        2. Evidence of sanitization of the printer cartridge or MFD print drum.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-574
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 574
      name: MFD Print Drum
      description: MFD print drums and image transfer rollers are inspected and destroyed
        if there is remnant toner which cannot be removed or if a print is visible
        on the image transfer roller.
      annotation: '1. Sanitization and disposal procedures of printers and multifunction
        devices is established, documented and maintained.

        2. MFD print drums and image transfer rollers are inspected and destroyed
        if there is remnant toner which cannot be removed or if a print is visible
        on the image transfer roller.'
      typical_evidence: '1. Provide sanitization and disposal procedures of printers
        and multifunction devices.

        2. Evidence that MFD print drum is destroyed if a print is visible on the
        image transfer roller.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-575
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 575
      name: MFD Platen Destruction
      description: Printer and MFD platens are inspected and destroyed if any images
        are retained on the platen.
      annotation: 1. Printer and MFD platens are inspected and destroyed if any images
        are retained on the platen.
      typical_evidence: 1. Provide evidence of destruction of Printer and MFD platens
        if any images are retained on the platen.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-576
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 576
      name: Printer Jam Check
      description: Printers, MFDs, and fax machines are checked to ensure no pages
        are trapped in the paper path due to a paper jam.
      annotation: 1. Printers, MFDs, and fax machines are periodically evaluated and
        checked to ensure no pages are trapped in the paper path due to a paper jam.
      typical_evidence: 1. Validate Printers, MFDs, and fax machines have no pages
        that are trapped in the paper path.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-577
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 577
      name: Printer Cartridge Destruction
      description: When unable to sanitize printer cartridges or MFD print drums,
        they are destroyed as per electrostatic memory devices.
      annotation: 1. Printer cartridges or MFD print drums are destroyed when unable
        to sanitize as per electrostatic memory devices.
      typical_evidence: 1. Validate printer cartridges or MFD print drums which cannot
        be sanitized are appropriately destroyed.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-578
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 578
      name: Printer Ribbon Removal
      description: Printer ribbons in printers and MFDs are removed and destroyed.
      annotation: 1. Printer ribbons in printers and MFDs are removed and destroyed.
      typical_evidence: 1. Validate printer ribbons removed and destroyed in printers
        and MFDs.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-579
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 579
      name: Monitor Burn-In
      description: Televisions and computer monitors with minor burn-in or image persistence
        are sanitized by displaying a solid white image on the screen for an extended
        period of time.
      annotation: '1. Sanitization process and procedures of Televisions and computer
        monitors is established, documented and maintained.

        2. Televisions and computer monitors with minor burn-in or image persistence
        are sanitized by displaying a solid white image on the screen for an extended
        period of time.'
      typical_evidence: '1. Provide sanitization process and procedures of Televisions
        and computer monitors.

        2. Evidence of sanitization of televisions and computer monitors.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-580
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 580
      name: Monitor Destruction
      description: Televisions and computer monitors that cannot be sanitized are
        destroyed.
      annotation: 1. Televisions and computer monitors are destroyed that cannot be
        sanitized.
      typical_evidence: 1. Validate televisions and computer monitors which cannot
        be sanitized are destroyed.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-581
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 581
      name: Network Device Memory Sanitization
      description: "Memory in network devices is sanitized using the following processes,\
        \ in order of preference:\n\u2022 following device-specific guidance provided\
        \ in evaluation documentation by the ACSC\n\u2022 following vendor sanitization\
        \ guidance\n\u2022 loading a dummy configuration file, performing a factory\
        \ reset and then reinstalling firmware."
      annotation: "1. Sanitization process and procedures of Network devices is established,\
        \ documented and maintained.\n2. Memory in network devices is sanitized using\
        \ the following processes, in order of preference:\n\u2022 following device-specific\
        \ guidance provided by the ACSC\n\u2022 following vendor sanitization guidance\n\
        \u2022 loading a dummy configuration file, performing a factory reset and\
        \ then reinstalling firmware."
      typical_evidence: "1. Provide sanitization process and procedures of Network\
        \ devices.\n2. Validate memory in network devices is sanitized using the following\
        \ processes, in order of preference:\n\u2022 following device-specific guidance\
        \ provided by the ACSC\n\u2022 following vendor sanitization guidance\n\u2022\
        \ loading a dummy configuration file, performing a factory reset and then\
        \ reinstalling firmware."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-582
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 582
      name: Paper Tray Removal
      description: The paper tray of the fax machine is removed, and a fax message
        with a minimum length of four pages is transmitted, before the paper tray
        is re-installed to allow a fax summary page to be printed.
      annotation: 1. If the paper tray of the fax machine is removed,  prior to the
        paper tray being re-installed, a fax message with a minimum length of four
        pages must be transmitted first, to allow a fax summary page to be printed.
      typical_evidence: 1. Verify a fax message with a minimum length of four pages
        is transmitted prior to re-installation, if a paper tray of a fax machine
        is removed.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-583
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 583
      name: Rewritable Media Sanitization
      description: When transferring data manually between two systems belonging to
        different security domains, rewritable media is sanitized after each data
        transfer.
      annotation: '1. Rewritable media is sanitized after each data transfer when
        transferring data manually between two systems belonging to different security
        domains.

        2. Evidence of the sanitization is documented and retained.'
      typical_evidence: 1. Verify the sanitization of rewritable media after each
        data transfer between two systems belonging to different security domains.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-584
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 584
      name: Volatile Media Sanitization
      description: If applicable, volatile media is sanitized by removing power from
        the media for at least 10 minutes.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for volatile media sanitization highlighting that:-\n\u2022 Records are\
        \ maintained for the volatile media sanitized\n\u2022 Volatile media is sanitized\
        \ either by removing power from the media for 10 minutes.\n\u2022 Read back\
        \ verification is done post sanitization\n\n2. Ensure following and corresponding\
        \ evidences/ artefacts are maintained:-\n\u2022 Records of the volatile media\
        \ sanitized.\n\u2022 Volatile media is sanitized either by removing power\
        \ from the media for 10 minutes.\n\u2022 Read back verification is done post\
        \ sanitization"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to volatile media sanitization highlighting that:-\n\u2022 Records are maintained\
        \ for the volatile media sanitized\n\u2022 Volatile media is sanitized either\
        \ by removing power from the media for 10 minutes.\n\u2022 Read back verification\
        \ is done post sanitization\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 Records of the volatile media sanitized during the\
        \ review period.\n\u2022 Volatile media is sanitized either by removing power\
        \ from the media for 10 minutes.\n\u2022 Read back verification is done post\
        \ sanitization."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-585
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 585
      name: Volatile Media Sanitization
      description: SECRET and TOP SECRET volatile media is sanitized by overwriting
        it at least once in its entirety with a random pattern followed by a read
        back for verification.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for volatile media sanitization highlighting that:-\n\u2022 Records are\
        \ maintained for the volatile media sanitized\n\u2022 SECRET and TOP SECRET\
        \ volatile media is sanitized by overwriting it at least once in its entirety\
        \ with a random pattern followed by a read back for verification.\n\n2. Ensure\
        \ following and corresponding evidences/ artefacts are maintained:-\n\u2022\
        \ Records of the volatile media sanitized.\n\u2022 SECRET and TOP SECRET volatile\
        \ media is sanitized by overwriting it at least once in its entirety with\
        \ a random pattern followed by a read back for verification."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to volatile media sanitization highlighting that:-\n\u2022 Records are maintained\
        \ for the volatile media sanitized\n\u2022 SECRET and TOP SECRET volatile\
        \ media is sanitized by overwriting it at least once in its entirety with\
        \ a random pattern followed by a read back for verification.\n\n2. Provide\
        \ artefacts corresponding to implementation as follows:-\n\u2022 Records of\
        \ the volatile media sanitized during the review period.\n\u2022 SECRET and\
        \ TOP SECRET volatile media is sanitized by overwriting it at least once in\
        \ its entirety with a random pattern followed by a read back for verification."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-586
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 586
      name: Device Configuration Reset
      description: If applicable, the host-protected area and device configuration
        overlay table of non-volatile magnetic media is reset prior to sanitization.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for volatile media sanitization highlighting that:-\n\u2022 Records are\
        \ maintained for the volatile media sanitized\n\u2022 The host-protected area\
        \ and device configuration overlay table of non-volatile magnetic media is\
        \ reset prior to sanitization\n\n2. Ensure following and corresponding evidences/\
        \ artefacts are maintained:\n\u2022 Records of the volatile media sanitized\n\
        \u2022 The host-protected area and device configuration overlay table of non-volatile\
        \ magnetic media is reset prior to sanitization"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to volatile media sanitization highlighting that:-\n\u2022 Records are maintained\
        \ for the volatile media sanitized\n\u2022 The host-protected area and device\
        \ configuration overlay table of non-volatile magnetic media is reset prior\
        \ to sanitization\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 Records of the volatile media sanitized during the\
        \ review period\n\u2022 The host-protected area and device configuration overlay\
        \ table of non-volatile magnetic media is reset prior to sanitization"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-587
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 587
      name: Non-Volatile magnetic media sanitization
      description: If applicable, non-volatile magnetic media is sanitized by then
        overwriting the media at least once (or three times if pre-2001 or under 15
        Gigabytes) in its entirety with a random pattern followed by a read back for
        verification.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for volatile media sanitization highlighting that:-\n\u2022 Records are\
        \ maintained for the volatile media sanitized\n\u2022 Non-volatile magnetic\
        \ media is sanitized by overwriting the media at least once (or three times\
        \ if pre-2001 or under 15 Gigabytes) in its entirety with a random pattern\
        \ followed by a read back for verification.\n\n2. Ensure following and corresponding\
        \ evidences/ artefacts are maintained:-\n\u2022 Records of the volatile media\
        \ sanitized\n\u2022 Non-volatile magnetic media is sanitized by overwriting\
        \ the media at least once (or three times if pre-2001 or under 15 Gigabytes)\
        \ in its entirety with a random pattern followed by a read back for verification."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to volatile media sanitization highlighting that:-\n\u2022 Records are maintained\
        \ for the volatile media sanitized\n\u2022 Non-volatile magnetic media is\
        \ sanitized by overwriting the media at least once (or three times if pre-2001\
        \ or under 15 Gigabytes) in its entirety with a random pattern followed by\
        \ a read back for verification.\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 Records of the volatile media sanitized during the\
        \ review period\n\u2022 Non-volatile magnetic media is sanitized by overwriting\
        \ the media at least once (or three times if pre-2001 or under 15 Gigabytes)\
        \ in its entirety with a random pattern followed by a read back for verification."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-588
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 588
      name: ATA Secure Erase Command
      description: The ATA secure erase command is used, in addition to block overwriting
        software, to ensure the growth defects table of non-volatile magnetic hard
        drives is overwritten.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for volatile media sanitization highlighting that:-\n\u2022 Records are\
        \ maintained for the volatile media sanitized\n\u2022The ATA secure erase\
        \ command is used, in addition to using block overwriting software, to ensure\
        \ the growth defects table (g-list) is overwritten\n\n2. Ensure following\
        \ and corresponding evidences/ artefacts are maintained:-\n\u2022 Records\
        \ of the volatile media sanitized\n\u2022 The ATA secure erase command is\
        \ used, in addition to using block overwriting software, to ensure the growth\
        \ defects table (g-list) is overwritten"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to volatile media sanitization highlighting that:-\n\u2022 Records are maintained\
        \ for the volatile media sanitized\n\u2022 The ATA secure erase command is\
        \ used, in addition to using block overwriting software, to ensure the growth\
        \ defects table (g-list) is overwritten\n\n2. Provide artefacts corresponding\
        \ to implementation as follows:-\n\u2022 Records of the volatile media sanitized\
        \ during the review period\n\u2022 The ATA secure erase command is used, in\
        \ addition to using block overwriting software, to ensure the growth defects\
        \ table (g-list) is overwritten"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-589
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 589
      name: EPROM media sanitization
      description: "If applicable, non-volatile EPROM media is sanitized by applying\
        \ three times the manufacturer\u2019s specified ultraviolet erasure time and\
        \ then overwriting it at least once in its entirety with a random pattern\
        \ followed by a read back for verification. Non-volatile EEPROM media is sanitized\
        \ by overwriting it at least once in its entirety with a random pattern followed\
        \ by a read back for verification."
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for Non-volatile media sanitization highlighting that:-\n\u2022 Records\
        \ are maintained for the Non-volatile EPROM media sanitized\n\u2022 Non-volatile\
        \ EPROM media is sanitized by applying three times the manufacturer\u2019\
        s specified ultraviolet erasure time and then overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification.\n\
        \u2022 Non-volatile EEPROM media is sanitized by overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification.\n\
        \n2. Ensure following and corresponding evidences/ artefacts are maintained:-\n\
        \u2022 Records of the Non-volatile EPROM media sanitized \n\u2022 Non-volatile\
        \ EPROM media is sanitized by applying three times the manufacturer\u2019\
        s specified ultraviolet erasure time and then overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification.\n\
        \u2022 Non-volatile EEPROM media is sanitized by overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to Non-volatile media sanitization highlighting that:-\n\u2022 Records are\
        \ maintained for the Non-volatile EPROM media sanitized\n\u2022 Non-volatile\
        \ EPROM media is sanitized by applying three times the manufacturer\u2019\
        s specified ultraviolet erasure time and then overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification.\n\
        \u2022 Non-volatile EEPROM media is sanitized by overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification.\n\
        \n2. Provide artefacts corresponding to implementation as follows:-\n\u2022\
        \ Records of the Non-volatile EPROM media sanitized during the review period\n\
        \u2022 Non-volatile EPROM media is sanitized by applying three times the manufacturer\u2019\
        s specified ultraviolet erasure time and then overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification.\n\
        \u2022 Non-volatile EEPROM media is sanitized by overwriting it at least once\
        \ in its entirety with a random pattern followed by a read back for verification."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-590
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 590
      name: Non-Volatile flash memory sanitization
      description: Non-volatile flash memory media is sanitized by overwriting the
        media at least twice in its entirety with a random pattern followed by a read
        back for verification.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for Non-volatile media sanitization  highlighting that:-\n\u2022 Records\
        \ are maintained for the Non-volatile flash memory media sanitized\n\u2022\
        \ Media is sanitized by overwriting the media at least twice in its entirety\
        \ with a random pattern followed by a read back for verification.\n\n2. Ensure\
        \ following and corresponding evidences/ artefacts are maintained:-\n\u2022\
        \ Records of the Non-volatile flash memory media sanitized\n\u2022 Non-volatile\
        \ flash memory media is sanitized by overwriting the media at least twice\
        \ in its entirety with a random pattern followed by a read back for verification."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to Non-volatile media sanitization highlighting that:-\n\u2022 Records are\
        \ maintained for the Non-volatile flash memory media sanitized\n\u2022 Non-volatile\
        \ flash memory media is sanitized by overwriting the media at least twice\
        \ in its entirety with a random pattern followed by a read back for verification\n\
        \n2.Provide artefacts corresponding to implementation as follows:-\n\u2022\
        \ Records of the Non-volatile flash memory media sanitized during the review\
        \ period\n\u2022 Non-volatile flash memory media is sanitized by overwriting\
        \ the media at least twice in its entirety with a random pattern followed\
        \ by a read back for verification."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-591
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 591
      name: Media Disposal
      description: "The following media types are destroyed prior to disposal:\n\u2022\
        \ microfiche and microfilm\n\u2022 optical discs/semiconductor memory (using\
        \ either furnace/incinerator, hammer mill, disintegrator, grinder/sander or\
        \ cutting destruction methods.)\n\u2022 programmable read-only memory\n\u2022\
        \ read-only memory\n\u2022 other types of media that cannot be sanitized\n\
        \u2022 faulty media that cannot be successfully sanitized."
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Destruction of the media types listed below prior\
        \ to disposal:\n- microfiche and microfilm\n- optical discs/semiconductor\
        \ memory (using either furnace/incinerator, hammer mill, disintegrator, grinder/sander\
        \ or cutting destruction methods.)\n- programmable read-only memory\n- read-only\
        \ memory\n- other types of media that cannot be sanitized\n- faulty media\
        \ that cannot be successfully sanitized\n\n\n2. Ensure following and corresponding\
        \ evidences/ artefacts are maintained:-\n\u2022 Records of the media disposal\n\
        \u2022 Destruction of the media types listed below prior to disposal :\n-\
        \ microfiche and microfilm\n- optical discs/semiconductor memory (using either\
        \ furnace/incinerator, hammer mill, disintegrator, grinder/sander or cutting\
        \ destruction methods.)\n- programmable read-only memory\n- read-only memory\n\
        - other types of media that cannot be sanitized\n- faulty media that cannot\
        \ be successfully sanitized"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Destruction of the media types listed below prior\
        \ to disposal:\n- microfiche and microfilm\n- optical discs/semiconductor\
        \ memory (using either furnace/incinerator, hammer mill, disintegrator, grinder/sander\
        \ or cutting destruction methods.)\n- programmable read-only memory\n- read-only\
        \ memory\n- other types of media that cannot be sanitized\n- faulty media\
        \ that cannot be successfully sanitized\n\n2. Provide artefacts corresponding\
        \ to implementation as follows:-\n\u2022 Records of the media disposal during\
        \ the review period\n\u2022 Destruction of the media types listed below prior\
        \ to disposal :\n- microfiche and microfilm\n- optical discs/semiconductor\
        \ memory (using either furnace/incinerator, hammer mill, disintegrator, grinder/sander\
        \ or cutting destruction methods.)\n- programmable read-only memory\n- read-only\
        \ memory\n- other types of media that cannot be sanitized\n- faulty media\
        \ that cannot be successfully sanitized"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-592
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 592
      name: Media Disposal
      description: SCEC or ASIO approved equipment is used when destroying media.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022Records are maintained for\
        \ the media disposal\n\u2022SCEC or ASIO approved equipment is used when destroying\
        \ media prior to disposal.\n\n2. Ensure following and corresponding evidences/\
        \ artefacts are maintained:-\n\u2022Records of the media disposal\n\u2022\
        SCEC or ASIO approved equipment is used when destroying media prior to disposal."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 SCEC or ASIO approved equipment is used when\
        \ destroying media prior to disposal.\n\n2. Provide artefacts corresponding\
        \ to implementation as follows:-\n\u2022 Records of the media disposal during\
        \ the review period\n\u2022 SCEC or ASIO approved equipment is used when destroying\
        \ media prior to disposal."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-593
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 593
      name: Degausser Evaluation
      description: "If using degaussers to destroy media, degaussers evaluated by\
        \ the United States\u2019 National Security Agency are used."
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 If using degaussers to destroy media prior to\
        \ disposal, degaussers evaluated by the United States\u2019 National Security\
        \ Agency are used.\n\n2. Ensure following and corresponding evidences/ artefacts\
        \ are maintained:-\n\u2022 Records of the media disposal\n\u2022 If degaussers\
        \ are used to destroy media prior to disposal, then degaussers are evaluated\
        \ by the United States\u2019 National Security Agency are used"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 If using degaussers to destroy media prior to\
        \ disposal, degaussers evaluated by the United States\u2019 National Security\
        \ Agency are used\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 Records of the media disposal during the review period\n\
        \u2022 If degaussers are used to destroy media prior to disposal, then degaussers\
        \ are evaluated by the United States\u2019 National Security Agency are used"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-594
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 594
      name: Microfilm Destruction
      description: If applicable, equipment that is capable of reducing microform
        to a fine powder, with resultant particles not showing more than five consecutive
        characters per particle upon microscopic inspection, is used to destroy microfiche
        and microfilm.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Equipment used to destroy microfiche and microfilm\
        \ prior to disposal is capable of reducing microform to a fine powder, with\
        \ resultant particles not showing more than five consecutive characters per\
        \ particle upon microscopic inspection\n\n2. Ensure following and corresponding\
        \ evidences/ artefacts are maintained:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Equipment used to destroy microfiche and microfilm\
        \ prior to disposal is capable of reducing microform to a fine powder, with\
        \ resultant particles not showing more than five consecutive characters per\
        \ particle upon microscopic inspection"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Equipment used to destroy microfiche and microfilm\
        \ prior to disposal is capable of reducing microform to a fine powder, with\
        \ resultant particles not showing more than five consecutive characters per\
        \ particle upon microscopic inspection\n\n2. Provide artefacts corresponding\
        \ to implementation as follows:-\n\u2022 Records of the media disposal during\
        \ the review period\n\u2022 Equipment used to destroy microfiche and microfilm\
        \ prior to disposal is capable of reducing microform to a fine powder, with\
        \ resultant particles not showing more than five consecutive characters per\
        \ particle upon microscopic inspection"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-595
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 595
      name: Waste Storage
      description: Media destroyed using either a hammer mill, disintegrator, grinder/sander
        or cutting destruction method result in media waste particles no larger than
        9 mm.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The resulting waste for all destruction methods,\
        \ except for furnace/incinerator and degausser, is stored and handled appropriately.\
        \ \n\u2022 cutting destruction method result in media waste particles no larger\
        \ than 9 mm.\n\n2. Ensure following and corresponding evidences/ artefacts\
        \ are maintained:-\n\u2022 Records are maintained for the media disposal\n\
        \u2022 The resulting waste for all destruction methods prior to disposal,\
        \ except for furnace/incinerator and degausser, is stored and handled appropriately.\n\
        \u2022 cutting destruction method result in media waste particles no larger\
        \ than 9 mm."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The resulting waste for all destruction methods,\
        \ except for furnace/incinerator and degausser, is stored and handled appropriately.\
        \ \n\u2022 cutting destruction method result in media waste particles no larger\
        \ than 9 mm.\n\n2. Provide artefacts corresponding to implementation as follows:-\n\
        \u2022 Records of the media disposal during the review period\n\u2022The resulting\
        \ waste for all destruction methods prior to disposal, except for furnace/incinerator\
        \ and degausser, is stored and handled appropriately. \n\u2022 cutting destruction\
        \ method result in media waste particles no larger than 9 mm."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-596
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 596
      name: Degausser Evaluation
      description: Magnetic media is destroyed using a degausser with a suitable magnetic
        field strength and magnetic orientation.
      annotation: '1. Ensure policies and procedures are documented and maintained
        highlighting that a degausser of sufficient field strength for the coercivity
        of the magnetic media is used prior to disposal.


        2. Ensure that a degausser of sufficient field strength for the coercivity
        of the magnetic media is used prior to disposal, and corresponding evidences/artefacts
        are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place highlighting
        that a degausser of sufficient field strength for the coercivity of the magnetic
        media is used prior to disposal.


        2. Provide artefacts highlighting that a degausser of sufficient field strength
        for the coercivity of the magnetic media is used prior to disposal.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-597
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 597
      name: Degausser Evaluation
      description: A degausser capable of the magnetic orientation (longitudinal or
        perpendicular) of the magnetic media is used.
      annotation: '1. Ensure policies and procedures are documented and maintained
        highlighting that a degausser capable of the magnetic orientation (longitudinal
        or perpendicular) of the magnetic media is used prior to disposal.


        2. Ensure that a degausser capable of the magnetic orientation (longitudinal
        or perpendicular) of the magnetic media is used prior to disposal and corresponding
        evidences/artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place highlighting
        that a degausser capable of the magnetic orientation (longitudinal or perpendicular)
        of the magnetic media is used prior to disposal.


        2. Provide artefacts highlighting that a degausser capable of the magnetic
        orientation (longitudinal or perpendicular) of the magnetic media is used
        prior to disposal.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-598
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 598
      name: Degausser directions
      description: Any product-specific directions provided by degausser manufacturers
        are followed.
      annotation: '1. Ensure policies and procedures are documented and maintained
        highlighting that any product-specific directions provided by degausser manufacturers
        are followed prior to disposal.


        2. Ensure that any product-specific directions provided by degausser manufacturers
        are followed prior to disposal and corresponding evidences/artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place highlighting
        that any product-specific directions provided by degausser manufacturers are
        followed prior to disposal.


        2. Provide artefacts highlighting that any product-specific directions provided
        by degausser manufacturers are followed prior to disposal.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-599
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 599
      name: Magnetic Media Destruction
      description: If applicable, following destruction of magnetic media (floppy
        disks, hard disks, tapes) using degausser destruction methods, the magnetic
        media is physically damaged by deforming the internal platters by any means
        prior to disposal using either furnace/incinerator, hammer mill, disintegrator,
        or cutting destruction methods.
      annotation: '1. Ensure policies and procedures are documented and maintained
        highlighting that following destruction of magnetic media using a degausser,
        the magnetic media is physically damaged by deforming the internal platters
        by any means prior to disposal.


        2. Ensure that following destruction of magnetic media using a degausser,
        the magnetic media is physically damaged by deforming the internal platters
        by any means prior to disposal and corresponding evidences/artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place highlighting
        that following destruction of magnetic media using a degausser, the magnetic
        media is physically damaged by deforming the internal platters by any means
        prior to disposal.


        2. Provide artefacts highlighting that following destruction of magnetic media
        using a degausser, the magnetic media is physically damaged by deforming the
        internal platters by any means prior to disposal.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-600
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 600
      name: Media Destruction
      description: If applicable, the destruction of media is performed under the
        supervision of at least one person cleared to the sensitivity or classification
        of the media being destroyed.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The destruction of media is performed under the\
        \ supervision of at least one person cleared to the sensitivity or classification\
        \ of the media being destroyed.\n\n2. Ensure following and corresponding evidences/\
        \ artefacts are maintained:-\n\u2022 Records are maintained for the media\
        \ disposal\n\u2022 The destruction of media is performed under the supervision\
        \ of at least one person cleared to the sensitivity or classification of the\
        \ media being destroyed."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The destruction of media is performed under the\
        \ supervision of at least one person cleared to the sensitivity or classification\
        \ of the media being destroyed.\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 Records of the media disposal during the review period\n\
        \u2022 The destruction of media is performed under the supervision of at least\
        \ one person cleared to the sensitivity or classification of the media being\
        \ destroyed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-601
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 601
      name: Accountable Material Destruction
      description: If applicable, the destruction of accountable material is performed
        under the supervision of at least two personnel cleared to the sensitivity
        or classification of the media being destroyed.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The destruction of accountable material is performed\
        \ under the supervision of at least two personnel cleared to the sensitivity\
        \ or classification of the media being destroyed.\n\n2. Ensure following and\
        \ corresponding evidences/ artefacts are maintained:-\n\u2022 Records are\
        \ maintained for the media disposal\n\u2022 The destruction of accountable\
        \ material is performed under the supervision of at least two personnel cleared\
        \ to the sensitivity or classification of the media being destroyed."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The destruction of accountable material is performed\
        \ under the supervision of at least two personnel cleared to the sensitivity\
        \ or classification of the media being destroyed.\n\n2. Provide artefacts\
        \ corresponding to implementation as follows:-\n\u2022 Records of the media\
        \ disposal during the review period\n\u2022 The destruction of accountable\
        \ material is performed under the supervision of at least two personnel cleared\
        \ to the sensitivity or classification of the media being destroyed."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-602
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 602
      name: Destruction Outsourcing
      description: "If applicable, when outsourcing the destruction of media to an\
        \ external destruction service, a National Association for Information Destruction\
        \ AAA certified destruction service with endorsements, as specified in ASIO\u2019\
        s PSC-167, is used."
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ highlighting that when outsourcing the destruction of media to an external\
        \ destruction service, a National Association for Information Destruction\
        \ AAA certified destruction service with endorsements, as specified in ASIO\u2019\
        s PSC-167, is used.\n\n2. Ensure that when outsourcing the destruction of\
        \ media to an external destruction service, a National Association for Information\
        \ Destruction AAA certified destruction service with endorsements, as specified\
        \ in ASIO\u2019s PSC-167, is used  and corresponding evidences/artefacts are\
        \ maintained."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that when outsourcing the destruction of\
        \ media to an external destruction service, a National Association for Information\
        \ Destruction AAA certified destruction service with endorsements, as specified\
        \ in ASIO\u2019s PSC-167, is used.\n\n2. Provide artefacts highlighting that\
        \ in case of outsourcing the destruction of media to an external destruction\
        \ service, a National Association for Information Destruction AAA certified\
        \ destruction service with endorsements, as specified in ASIO\u2019s PSC-167,\
        \ is used."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-603
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 603
      name: Top Secret Media Destruction
      description: The destruction of media storing accountable material is not outsourced.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The destruction of media storing accountable\
        \ material is not outsourced.\n\n2. Ensure following and corresponding evidences/\
        \ artefacts are maintained:-\n\u2022 Records of the media disposal \n\u2022\
        \ The destruction of media storing accountable material is not outsourced"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 The destruction of media storing accountable\
        \ material is not outsourced.\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 Records of the media disposal during the review period\n\
        \u2022 The destruction of media storing accountable material is not outsourced"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-604
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 604
      name: Media Destruction
      description: Following sanitization, destruction or declassification, a formal
        administrative decision is made to release media, or its waste, into the public
        domain.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Following sanitization, destruction or declassification,\
        \ a formal administrative decision is made to release media, or its waste,\
        \ into the public domain.\n\n2. Ensure following and corresponding evidences/\
        \ artefacts are maintained:-\n\u2022 Records of the media disposal \n\u2022\
        \ Post sanitization, destruction or declassification, a formal administrative\
        \ decision is made to release media, or its waste, into the public domain."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Following sanitization, destruction or declassification,\
        \ a formal administrative decision is made to release media, or its waste,\
        \ into the public domain.\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 Records of the media disposal during the review period\n\
        \u2022 Post sanitization, destruction or declassification, a formal administrative\
        \ decision is made to release media, or its waste, into the public domain."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-605
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 605
      name: Classification Removal
      description: Labels and markings indicating the sensitivity, classification,
        owner or any other marking that can associate media with its original use,
        are removed prior to disposal.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Labels and markings indicating the sensitivity,\
        \ classification, owner or any other marking that can associate media with\
        \ its original use, are removed prior to disposal.\n\n2. Ensure following\
        \ and corresponding evidences/ artefacts are maintained:-\n\u2022 Records\
        \ of the media disposal \n\u2022 Labels and markings indicating the sensitivity,\
        \ classification, owner or any other marking that can associate media with\
        \ its original use, are removed prior to disposal."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that:-\n\u2022 Records are maintained for\
        \ the media disposal\n\u2022 Labels and markings indicating the sensitivity,\
        \ classification, owner or any other marking that can associate media with\
        \ its original use, are removed prior to disposal.\n\n2. Provide artefacts\
        \ corresponding to Provide artefacts corresponding to implementation as follows:-\n\
        \u2022 Records of the media disposal during the review period\n\u2022 Labels\
        \ and markings indicating the sensitivity, classification, owner or any other\
        \ marking that can associate media with its original use, are removed prior\
        \ to disposal."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-606
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:7
      ref_id: CCF 606
      name: Workstation Scanning
      description: Standard operating environments are used for all workstations and
        are scanned for malicious content and configurations before use. These environments
        are reviewed and updated at least annually.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ pertaining to standard operating environments(SOEs) highlighting following:-\n\
        \u2022 List of standard operating environments (SOEs) and corresponding details\
        \ used for all workstations is maintained \n\u2022 Scans are performed on\
        \ SOEs for malicious content and configurations prior to usage. \n\u2022 Annual\
        \ reviews and corresponding updates done on SOEs\n\n2. Ensure following and\
        \ corresponding evidences/ artefacts are maintained:-\n\u2022 List of standard\
        \ operating environments (SOEs) and corresponding details used for all workstations\
        \ is maintained \n\u2022 Scans are performed on SOEs for malicious content\
        \ and configurations prior to usage. \n\u2022 Annual reviews and corresponding\
        \ updates done on SOEs"
      typical_evidence: "1. Provide documented policies and procedures in place pertaining\
        \ to standard operating environments(SOEs) highlighting following:-\n\u2022\
        \ List of standard operating environments (SOEs) and corresponding details\
        \ used for all workstations is maintained \n\u2022 Scans are performed on\
        \ SOEs for malicious content and configurations prior to usage. \n\u2022 Annual\
        \ reviews and corresponding updates done on SOEs\n\n2. Provide artefacts corresponding\
        \ to Provide artefacts corresponding to implementation as follows:-\n\u2022\
        \ List of standard operating environments (SOEs) and corresponding details\
        \ used for all workstations is maintained \n\u2022 Scans are performed on\
        \ SOEs for malicious content and configurations prior to usage. \n\u2022 Annual\
        \ reviews and corresponding updates done on SOEs"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:8
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: People and Communities
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-607
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:8
      ref_id: CCF 607
      name: Contractor Identification
      description: Personnel who are contractors are identified as such.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ such that personnel who are contractors are identified as such. \n\n2. Ensure\
        \ personnel who are contractors are identified as such and corresponding artefacts\
        \ are maintained."
      typical_evidence: "1. Provide documented policies and procedures in place highlighting\
        \ that personnel who are contractors are identified as such. \n\n2. Provide\
        \ artefacts demonstrating that personnel who are contractors are identified\
        \ as such."
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-608
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:8
      ref_id: CCF 608
      name: Foreign National Identification
      description: Where a system processes, stores or communicates AUSTEO, AGAO or
        REL data, personnel who are foreign nationals are identified as such, including
        by their specific nationality.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ such that personnel who are  foreign nationals are identified as such, including\
        \ by their specific nationality. \n\n2. Ensure personnel who are foreign nationals\
        \ are identified as such, including by their specific nationality are identified\
        \ as such and corresponding artefacts are maintained."
      typical_evidence: "1. Provide documented policies and procedures in place highlighting\
        \ that personnel who are  foreign nationals are identified as such, including\
        \ by their specific nationality. \n\n2. Provide artefacts demonstrating that\
        \ personnel who are  foreign nationals are identified as such, including by\
        \ their specific nationality."
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-609
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:8
      ref_id: CCF 609
      name: Foreign National Access
      description: Foreign nationals, including seconded foreign nationals, do not
        have access to systems that process, store or communicate AUSTEO or REL data
        unless effective security controls are in place to ensure such data is not
        accessible to them.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to access management  highlighting that foreign nationals,\
        \ including seconded foreign nationals, do not have access to systems that\
        \ process, store or communicate AUSTEO or REL data unless effective security\
        \ controls are in place to ensure such data is not accessible to them.\n\n\
        2. Ensure following and corresponding artefacts are maintained:-\n\n\n\u2022\
        \ List of foreign nationals including seconded foreign nationals and list\
        \ of systems that process, store or communicate AUSTEO or REL data as well\
        \ as corresponding implemented security controls testing results for effectiveness.\n\
        \n\u2022 Periodic review of users with the access to the systems in the above\
        \ list in order to ensure that access is only provisioned for foreign nationals\
        \ including seconded foreign nationals if effective security controls are\
        \ in place."
      typical_evidence: "1. Provide documented policies and procedures in place as\
        \ a part of access management highlighting that foreign nationals, including\
        \ seconded foreign nationals, do not have access to systems that process,\
        \ store or communicate AUSTEO or REL data unless effective security controls\
        \ are in place to ensure such data is not accessible to them.\n\n2. Provide\
        \ artefacts highlighting following in review period :-\n\n\u2022 List of foreign\
        \ nationals including seconded foreign nationals and list of systems that\
        \ process, store or communicate AUSTEO or REL data as well as corresponding\
        \ implemented security controls testing results for effectiveness.\n\n\u2022\
        \ List of users with the access to the systems in the above list in order\
        \ to validate that access is only provisioned for foreign nationals including\
        \ seconded foreign nationals if effective security controls are in place."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-610
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:8
      ref_id: CCF 610
      name: Foreign National Access
      description: Foreign nationals, excluding seconded foreign nationals, do not
        have access to systems that process, store or communicate AGAO data unless
        effective security controls are in place to ensure such data is not accessible
        to them.
      annotation: "1..Ensure policies and procedures are documented and maintained\
        \ corresponding to access management  highlighting that  foreign nationals,\
        \ excluding seconded foreign nationals, do not have access to systems that\
        \ process, store or communicate AGAO data unless effective security controls\
        \ are in place to ensure such data is not accessible to them.\n\n2. Ensure\
        \ following and corresponding artefacts are maintained:-\n\n\n\u2022 List\
        \ of foreign nationals excluding seconded foreign nationals and list of systems\
        \ that process, store or communicate AGAO data as well as corresponding implemented\
        \ security controls testing results for effectiveness.\n\n\u2022 Periodic\
        \ review of users with the access to the systems in the above list in order\
        \ to ensure that access is only provisioned for foreign nationals excluding\
        \ seconded foreign nationals if effective security controls are in place."
      typical_evidence: "1. Provide documented policies and procedures in place as\
        \ a part of access management highlighting that foreign nationals, excluding\
        \ seconded foreign nationals, do not have access to systems that process,\
        \ store or communicate AGAO data unless effective security controls are in\
        \ place to ensure such data is not accessible to them.\n\n2. Provide artefacts\
        \ highlighting following in review period :-\n\n\u2022 List of foreign nationals\
        \ excluding seconded foreign nationals and list of systems that process, store\
        \ or communicate AGAO data as well as corresponding implemented security controls\
        \ testing results for effectiveness.\n\n\u2022 List of users with the access\
        \ to the systems in the above list in order to validate that access is only\
        \ provisioned for foreign nationals excluding seconded foreign nationals if\
        \ effective security controls are in place."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Access Management
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-611
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 611
      name: Foreign National Access
      description: Foreign nationals, excluding seconded foreign nationals, do not
        have privileged access to systems, applications and data repositories.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to access management  highlighting that foreign nationals,\
        \ excluding seconded foreign nationals, do not have privileged access to systems,\
        \ applications and data repositories.\n\n2. Ensure following and corresponding\
        \ artefacts are maintained:-\n\n\u2022 List of foreign nationals excluding\
        \ seconded foreign nationals and list of systems, applications and data repositories.\n\
        \n\u2022 Periodic review of users with the access to the systems, applications\
        \ and data repositories in the above list in order to ensure that no match\
        \ with the list of  foreign nationals excluding seconded foreign nationals"
      typical_evidence: "1. Provide documented policies and procedures in place as\
        \ a part of access management highlighting that foreign nationals, excluding\
        \ seconded foreign nationals, do not have privileged access to systems, applications\
        \ and data repositories.\n\n2. Provide artefacts highlighting  corresponding\
        \ to following in review period :-\n\n\u2022 List of foreign nationals excluding\
        \ seconded foreign nationals and list of systems, applications and data repositories.\n\
        \n\u2022 List of users with the access to the systems, applications and data\
        \ repositories in the above list in order to validate that no foreign nationals,\
        \ excluding seconded foreign nationals, do not have access to those system\
        \ data unless effective security controls are in place to ensure such data\
        \ is not accessible to them"
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-612
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 612
      name: Foreign National Access
      description: Foreign nationals, including seconded foreign nationals, do not
        have privileged access to systems that process, store or communicate AUSTEO
        or REL data.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to access management  highlighting that foreign nationals,\
        \ including seconded foreign nationals, do not have privileged access to systems\
        \ that process, store or communicate AUSTEO or REL data.\n\n2. Ensure following\
        \ and corresponding artefacts are maintained:-\n\n\u2022 List of foreign nationals\
        \ including seconded foreign nationals and list of systems that systems that\
        \ process, store or communicate AUSTEO or REL data.\n\n\u2022 Periodic review\
        \ of the users with the privileged access to the systems in the above list\
        \ to ensure no match with the users in the list of foreign nationals including\
        \ seconded foreign nationals"
      typical_evidence: "1. Provide documented policies and procedures in place as\
        \ a part of access management highlighting that foreign nationals, including\
        \ seconded foreign nationals, do not have privileged access to systems that\
        \ process, store or communicate AUSTEO or REL data.\n\n2. Provide artefacts\
        \ corresponding to following in review period :-\n\n\u2022 List of foreign\
        \ nationals including seconded foreign nationals and list of systems that\
        \ systems that process, store or communicate AUSTEO or REL data.\n\n\u2022\
        \ List of U=users with the privileged access to the systems in the above list\
        \ in order to validate that no match with the list of  foreign nationals including\
        \ seconded foreign nationals"
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-613
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 613
      name: Foreign National Access
      description: Foreign nationals, excluding seconded foreign nationals, do not
        have privileged access to systems that process, store or communicate AGAO
        data.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to access management highlighting that foreign nationals,\
        \ excluding seconded foreign nationals, do not have privileged access to systems\
        \ that process, store or communicate AGAO data.\n\n2. Ensure following and\
        \ corresponding artefacts are maintained:-\n\n\u2022 List of foreign nationals\
        \ excluding seconded foreign nationals and list of systems that process, store\
        \ or communicate AGAO data is maintained.\n\n\u2022 Periodic review of the\
        \ users with the privileged access to the systems in the above list to ensure\
        \ no match with the users in the list of foreign nationals excluding seconded\
        \ foreign nationals"
      typical_evidence: "1. Provide documented policies and procedures in place as\
        \ a part of access management highlighting that foreign nationals, excluding\
        \ seconded foreign nationals, do not have privileged access to systems that\
        \ process, store or communicate AGAO data.\n\n2. Provide artefacts corresponding\
        \ to following in review period :-\n\n\u2022 List of foreign nationals excluding\
        \ seconded foreign nationals and list of systems that process, store or communicate\
        \ AGAO data.\n\u2022 Users with the privileged access to the systems in the\
        \ above list in order to validate that no match with the list of foreign nationals\
        \ excluding seconded foreign nationals"
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-614
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 614
      name: Malicious Activity Response
      description: Upon identifying malicious activities, access to systems, applications
        and data repositories are removed or suspended within 24 hours.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to access management highlighting that upon identifying malicious\
        \ activities, access to systems, applications and data repositories are removed\
        \ or suspended within 24 hours.\n\n2. Ensure following and corresponding artefacts\
        \ are maintained:-\n\n\u2022 Malicious activities monitoring as well as identification\
        \ (alerting) is in place in terms of records/logs/reports \n\u2022 Periodic\
        \ review to ensure access to systems, applications and data repositories is\
        \ removed or suspended within 24 hrs. upon identifying malicious activities\
        \ in terms of records/logs/reports"
      typical_evidence: "1. Provide documented policies and procedures in place as\
        \ a part of access management highlighting that upon identifying malicious\
        \ activities, access to systems, applications and data repositories are removed\
        \ or suspended within 24 hours.\n\n2. Provide artefacts corresponding to following\
        \ in review period :-\n\n\u2022 Malicious activities monitoring as well as\
        \ identification (alerting) is in place in terms of records/logs/reports \n\
        \u2022 Access to systems, applications and data repositories is removed or\
        \ suspended within 24 hrs. upon identifying malicious activities in terms\
        \ of records/logs/reports"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-615
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 615
      name: Access Log
      description: "A secure record is maintained for the life of each system covering:\n\
        \u2022 all personnel authorized to access the system, and their user identification\n\
        \u2022 who provided authorization for access\n\u2022 when access was granted\n\
        \u2022 the level of access that was granted\n\u2022 when access, and the level\
        \ of access, was last reviewed\n\u2022 when the level of access was changed,\
        \ and to what extent (if applicable)\n\u2022 when access was withdrawn (if\
        \ applicable)."
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to access management on the  maintenance of records which\
        \ are secured for the lifetime of each system covering following:- \n\n\u2022\
        \ All personnel authorized to access the system, and their user identification\n\
        \u2022 Who provided authorization for access\n\u2022 When access was granted\n\
        \u2022 The level of access that was granted\n\u2022 When access, and the level\
        \ of access, was last reviewed\n\u2022 When the level of access was changed,\
        \ and to what extent (if applicable)\n\u2022 When access was withdrawn (if\
        \ applicable).\n\n\n2. Ensure for all the live systems in the environment\
        \ as part of implementation of access management documentation records are\
        \ maintained and secured throughout the lifetime of system covering following:-\n\
        \n\u2022 All personnel authorized to access the system, and their user identification\n\
        \u2022 Who provided authorization for access\n\u2022 When access was granted\n\
        \u2022 The level of access that was granted\n\u2022 When access, and the level\
        \ of access, was last reviewed\n\u2022 When the level of access was changed,\
        \ and to what extent (if applicable)\n\u2022 When access was withdrawn (if\
        \ applicable)."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to access management on the  maintenance of records which are secured for\
        \ the lifetime of each system covering following:- \n\n\u2022 All personnel\
        \ authorized to access the system, and their user identification\n\u2022 Who\
        \ provided authorization for access\n\u2022 When access was granted\n\u2022\
        \ The level of access that was granted\n\u2022 When access, and the level\
        \ of access, was last reviewed\n\u2022 When the level of access was changed,\
        \ and to what extent (if applicable)\n\u2022 When access was withdrawn (if\
        \ applicable).\n\n\n2. Provide list of all the live systems in the environment\
        \ during the review period in order to validate that as part of implementation\
        \ of access management documentation records are maintained and secured throughout\
        \ the lifetime of system covering following:-\n\n\u2022 All personnel authorized\
        \ to access the system, and their user identification\n\u2022 Who provided\
        \ authorization for access\n\u2022 When access was granted\n\u2022 The level\
        \ of access that was granted\n\u2022 When access, and the level of access,\
        \ was last reviewed\n\u2022 When the level of access was changed, and to what\
        \ extent (if applicable)\n\u2022 When access was withdrawn (if applicable)."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-616
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 616
      name: Access Restriction
      description: When personnel are granted temporary access to a system, effective
        security controls are put in place to restrict their access to only data required
        for them to undertake their duties.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to  access management with regards to temporary access highlighting
        that  personnel are granted temporary access to a system, effective security
        controls are put in place to restrict their access to only data required for
        them to undertake their duties.


        2. Ensure when personnel are granted temporary access to a system, effective
        security controls are put in place to restrict their access to only data required
        for them to undertake their duties and corresponding artefacts are maintained
        in terms of the periodic review effectiveness of the effectiveness of security
        controls put in place for restricting access as per the responsibilities/
        duties.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to access management with regards to temporary access highlighting that  personnel
        are granted temporary access to a system, effective security controls are
        put in place to restrict their access to only data required for them to undertake
        their duties.


        2. Provide following in place corresponding to implementation of access management
        documentation in terms of list of personnel in the review period who have
        been provided temporary access and access review of the users to validate
        effectiveness of security controls put in place for restricting access as
        per the responsibilities/ duties.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-617
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 617
      name: Temporary Access
      description: Temporary access is not granted to systems that process, store
        or communicate caveated or sensitive compartmented information.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to access management highlighting that temporary access is not
        granted to systems that process, store or communicate caveated or sensitive
        compartmented information.


        2. Ensure that as a part of implementation of the access management documentation
        and corresponding controls temporary access is not granted to systems that
        process, store or communicate caveated or sensitive compartmented information
        and corresponding artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to access management highlighting that temporary access is not granted to
        systems that process, store or communicate caveated or sensitive compartmented
        information.


        2. Provide artefacts in place corresponding to implementation of access management
        documentation in terms of list of systems during review period that process,
        store or communicate caveated or sensitive compartmented information to validate
        that no temporary access is granted to the systems in the list within the
        review period.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-618
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 618
      name: Emergency Access
      description: If applicable, a method of emergency access to systems is documented
        and tested at least once when initially implemented, and each time fundamental
        information technology infrastructure changes occur.
      annotation: "1. Ensure policies and procedures policies and procedures are documented\
        \ and maintained corresponding to access management on the usage of emergency\
        \ access to systems highlighting that tested at least once when initially\
        \ implemented, and each time fundamental information technology infrastructure\
        \ changes occur.\n\n \n2. Ensure that emergency access to systems tested at\
        \ least once when initially implemented, and each time fundamental information\
        \ technology infrastructure changes occur. Additionally corresponding artefacts\
        \ are maintained."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to access management on the usage of emergency access to systems highlighting\
        \ that tested at least once when initially implemented, and each time fundamental\
        \ information technology infrastructure changes occur.\n\n \n2. Provide artefacts\
        \ in place corresponding to implementation of access management documentation\
        \ in terms of :-\n\u2022 Records of usage of all emergency access to systems\
        \ in the review period \n\u2022 Records of testing at least once when initially\
        \ implemented, and each time fundamental information technology infrastructure\
        \ changes occur during the review period with regards to emergency access."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-619
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 619
      name: Break Glass Accounts
      description: Break glass accounts are only used when normal authentication processes
        cannot be used and only for specific authorized activities.  Use of the break
        glass account is monitored and audited to confirm that access was appropriate.  Once
        access is no longer required, the access credentials for the break glass account
        are updated to prevent unauthorized access.  Once credentials are changed,
        the break glass account access is tested.
      annotation: "1. Ensure policies and procedures policies and procedures are documented\
        \ and maintained corresponding to access management on the usage of break\
        \ glass accounts highlighting following:- \n\u2022 Break glass accounts are\
        \ only used when normal authentication processes cannot be used and only for\
        \ specific authorized activities.  \n\u2022 Usage of the break glass account\
        \ is monitored and audited to confirm that access as well usage was appropriate.\
        \  \n\u2022 Once access is no longer required, the access credentials for\
        \ the break glass account are updated to prevent unauthorized access.\n\u2022\
        \ Once credentials are changed, the break glass account access is tested again.\
        \ \n\n2. Ensure following and corresponding evidences/ artefacts are maintained:-\n\
        \u2022 Break glass accounts are only used when normal authentication processes\
        \ cannot be used, only for specific authorized activities.\n\u2022 Logging\
        \ as well as monitoring of break glass accounts while usage in order to ensure\
        \ usage as well as access was appropriate.  \n\u2022 When access is no longer\
        \ required, the access credentials for the break glass account are updated\
        \ to prevent unauthorized access.\n\u2022 Once credentials are changed, the\
        \ break glass account access is tested again."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to access management on the usage of break glass accounts highlighting following:-\
        \ \n\u2022 Break glass accounts are only used when normal authentication processes\
        \ cannot be used and only for specific authorized activities.  \n\u2022 Usage\
        \ of the break glass account is monitored and audited to confirm that access\
        \ as well usage was appropriate.  \n\u2022 Once access is no longer required,\
        \ the access credentials for the break glass account are updated to prevent\
        \ unauthorized access.\n\u2022 Once credentials are changed, the break glass\
        \ account access is tested again.\n\n2. Provide following in place corresponding\
        \ to access management on the usage of break glass accounts in the review\
        \ period:-\n\u2022 Records on the usage of break glass accounts to validate\
        \ that only used when normal authentication processes cannot be used, only\
        \ for specific authorized activities.\n\u2022 Corresponding records of logging\
        \ as well as monitoring while usage in order to ensure usage as well as access\
        \ was appropriate.  \n\u2022 Corresponding artefacts highlighting that when\
        \ access is no longer required, the access credentials for the break glass\
        \ account are updated to prevent unauthorized access.\n\u2022 Corresponding\
        \ artefacts highlighting that once credentials are changed, the break glass\
        \ account access is tested again."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-620
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 620
      name: Password Characteristics
      description: Passwords used for multi-factor authentication on TOP SECRET systems
        are a minimum of 10 characters.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to password management highlighting that minimum password requirements
        for multi-factor authentication is of 10 characters on TOP SECRET systems.


        2. Ensure that as a part of implementation of the password management documentation
        within the configuration settings minimum password requirements for multi-factor
        authentication is of 10 characters  on TOP SECRET systems. Additionally, corresponding
        artefacts/ evidences are also maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to password management highlighting that minimum password requirements for
        multi-factor authentication is of 10 characters on TOP SECRET systems.


        2. Provide artefacts in place in terms of password configuration screenshots
        highlighting that minimum password requirements for multi-factor authentication
        is of 10 characters on TOP SECRET systems.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-621
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 621
      name: Service Account Creation
      description: Service accounts are created as group Managed Service Accounts.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to service account creation  highlighting that service accounts
        are created as group managed service accounts.


        2. Ensure that as a part of implementation all service accounts are   created
        as group managed service accounts, same is validated by periodically reviewing
        the list of service accounts and comparing the same with the list of managed
        service account. Additionally corresponding artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to service account creation  highlighting that service accounts are created
        as group managed service accounts.


        2. Provide the list of service accounts created as well as the list of group
        managed service accounts in the review period as a part of implementation
        in order to validate that service accounts are created as group managed service
        Accounts.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-622
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 622
      name: Authentication Methods
      description: Authentication methods susceptible to replay attacks are disabled.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to authentication highlighting that authentication methods susceptible
        to replay attacks are disabled.


        2. Ensure that as a part of implementation of the authentication documentation
        and corresponding controls, authentication methods implemented are not susceptible
        to replay attacks and corresponding artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to authentication highlighting that authentication methods susceptible to
        replay attacks are disabled.


        2. Provide artefacts in place highlighting that authentication methods implemented
        are not susceptible to replay attacks.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-623
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 623
      name: LAN Manager Authentication
      description: LAN Manager and NT LAN Manager authentication methods are disabled.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to authentication highlighting that LAN manager and NT LAN manager
        authentication methods are disabled.


        2. Ensure that as a part of implementation of the authentication documentation
        and corresponding controls, LAN manager and NT LAN manager authentication
        methods are disabled and corresponding artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to authentication highlighting that LAN manager and NT LAN manager authentication
        methods are disabled..


        2. Provide configuration setting screenshot / evidence in review period that
        depicts the LAN Manager and NT LAN Manager authentication methods are disabled'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-624
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 624
      name: Privileged Access Group
      description: Privileged accounts are members of the Protected Users security
        group.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to privileged access management highlighting that users associated\
        \ with privileged accounts are members of the protected users security group.\n\
        \n2. Ensure that  as a part of implementation of the policies and procedures\
        \ corresponding to privileged access management:-\n\u2022 Users having privileged\
        \ accounts are members of the protected users security group\n\n\u2022 Periodic\
        \ validation between privilege account users and protected user security group\
        \ members is done and corresponding artefacts are maintained."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to privileged access management highlighting that users having privileged\
        \ account are members of the protected users security group.\n\n2. Provide\
        \ following artefacts in terms of implementation of the privileged access\
        \ management:-\n\u2022 List of privileged accounts and corresponding users\
        \ who are assigned privileged accounts in the review period.\n\n\u2022 List\
        \ of the users in the protected user security groups and corresponding results\
        \ of validation with users associated with privileged accounts in the review\
        \ period."
      implementation_groups:
      - people
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-625
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 625
      name: Credential Storage
      description: Credentials are stored separately from systems to which they grant
        access.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to password management highlighting that credentials are stored
        separately from systems to which they grant access.


        2. Ensure that as a part of implementation of the password management documentation
        credentials are stored separately from systems to which they grant access
        and corresponding artefacts/ evidences are also maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to password management highlighting that credentials are stored separately
        from systems to which they grant access.


        2. Provide artefacts in terms of implementation of the password management
        highlighting that credentials are stored separately from systems to which
        they grant access.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-626
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 626
      name: Hashed Passwords
      description: Stored passwords/passphrases are protected by ensuring they are
        hashed, salted and stretched.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to password management highlighting stored passwords/passphrases
        are secured by ensuring they are hashed, salted and stretched.


        2. Ensure that as a part of implementation of the password management documentation
        stored passwords/passphrases are secured by ensuring they are hashed, salted
        and stretched. Additionally, corresponding artefacts/ evidences are also maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to password management highlighting that stored passwords/passphrases are
        secured by ensuring they are hashed, salted and stretched.


        2. Provide artefacts in terms of implementation of the password management
        documentation highlighting that stored passwords/passphrases are secured by
        ensuring they are hashed, salted and stretched.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-627
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 627
      name: Password Change
      description: "Passwords/passphrases are changed if:\n\u2022 they are directly\
        \ compromised\n\u2022 they are suspected of being compromised\n\u2022 they\
        \ appear in online data breach databases\n\u2022 they are discovered stored\
        \ in the clear on a network\n\u2022 they are discovered being transferred\
        \ in the clear across a network\n\u2022 membership of a shared account changes\n\
        \u2022 they have not been changed in the past 12 months."
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to  password management highlighting that passwords/passphrases\
        \ are changed if:-\n\u2022 they are directly compromised\n\u2022 they are\
        \ suspected of being compromised\n\u2022 they appear in online data breach\
        \ databases\n\u2022 they are discovered stored in the clear on a network\n\
        \u2022 they are discovered being transferred in the clear across a network\n\
        \u2022 membership of a shared account changes\n\u2022 they have not been changed\
        \ in the past 12 months.\n\n2. Ensure following and corresponding evidences/\
        \ artefacts are maintained:-\n\u2022 List of privileged users and allocated\
        \ dedicated administrator workstation\n\u2022 Privileged users via allocated\
        \ dedicated sampled administrator workstation cannot communicate to assets\
        \ not related to the administrative activities"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to password management highlighting that passwords/passphrases are changed\
        \ if:-\n\u2022 they are directly compromised\n\u2022 they are suspected of\
        \ being compromised\n\u2022 they appear in online data breach databases\n\u2022\
        \ they are discovered stored in the clear on a network\n\u2022 they are discovered\
        \ being transferred in the clear across a network\n\u2022 membership of a\
        \ shared account changes\n\u2022 they have not been changed in the past 12\
        \ months.\n\n2. Provide artefacts in terms of implementation of the password\
        \ management policy demonstrating awareness amongst users and in terms of\
        \ configuration settings highlighting passwords/passphrases are changed in\
        \ any of the below listed scenarios:-\n\u2022 they are directly compromised\n\
        \u2022 they are suspected of being compromised\n\u2022 they appear in online\
        \ data breach databases\n\u2022 they are discovered stored in the clear on\
        \ a network\n\u2022 they are discovered being transferred in the clear across\
        \ a network\n\u2022 membership of a shared account changes\n\u2022 they have\
        \ not been changed in the past 12 months."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-628
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 628
      name: System Administration Process
      description: A system administration process, with supporting system administration
        procedures, is developed and implemented.
      annotation: 1. Ensure that a system administration process, with supporting
        system administration procedures, is developed/ documented, maintained(regular
        review & approval) and implemented.
      typical_evidence: 1. Provide documentation and artefacts demonstrating that
        a system administration process, with supporting system administration procedures,
        is developed/ documented, maintained(regular review & approval) and  implemented.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-629
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 629
      name: Privileged user workstation
      description: Privileged users use separate privileged and unprivileged operating
        environments for performing tasks.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to access management highlighting that privileged users use
        a dedicated administrator workstation which cannot communicate to assets not
        related to the administrative activities, or use separate privileged and unprivileged
        operating environments when performing certain tasks


        2. Privileged users should only use privileged operating environments for
        performing privileged tasks, and all other activity should use the unprivileged
        operating environments.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to access management highlighting that privileged users use a dedicated administrator
        workstation which cannot communicate to assets not related to the administrative
        activities, or use separate privileged and unprivileged operating environments
        when performing certain tasks


        2. Validate privileged users should only use privileged operating environments
        for performing privileged tasks, and all other activity should use the unprivileged
        operating environments.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-630
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 630
      name: Privileged User workstation access
      description: Privileged users are assigned an unprivileged administration account
        for authenticating to their dedicated administrator workstations.
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to access management highlighting that privileged users are\
        \ assigned an unprivileged administration account for authenticating to their\
        \ dedicated administrator workstation.\n\n2. Ensure following and corresponding\
        \ evidences/ artefacts are maintained:-\n\u2022 List of privileged users and\
        \ corresponding assigned unprivileged administration account \n\u2022 Unprivileged\
        \ administration account is assigned to privileged users for authenticating\
        \ to their dedicated administrator workstation."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to access management highlighting that privileged users are assigned an\
        \ unprivileged administration account for authenticating to their dedicated\
        \ administrator workstation.\n\n2. Provide artefacts corresponding to implementation\
        \ as follows:-\n\u2022 List of privileged users in the review period\n\u2022\
        \ Sampled unprivileged administration accounts in order to validate that unprivileged\
        \ administration account is assigned to privileged users for authenticating\
        \ to their dedicated administrator workstation."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-631
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 631
      name: File-Based Access
      description: File-based access controls are applied to database files.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to access management highlighting that file-based access controls
        are applied to database files and periodic review as well as update of the
        corresponding access privileges/ rights is also conducted.


        2. Ensure that file-based access controls are applied to database files, periodic
        review as well as update of the corresponding access privileges/ rights is
        also conducted and corresponding evidences/artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to access management highlighting that file-based access controls are applied
        to database files and periodic review as well as update of the corresponding
        access privileges/ rights is also conducted.


        2. Provide artefacts corresponding to access management demonstrating that
        file-based access controls are applied to database files and periodic review
        as well as update of the corresponding access privileges/ rights is also conducted.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-632
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 632
      name: Passphrase Storage
      description: Passphrases stored in databases are hashed with a uniquely salted
        Australian Signals Directorate Approved Cryptographic Algorithm.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to password/passphrases management for authentication highlighting
        that passphrases stored in databases are hashed with a uniquely salted Australian
        Signals Directorate Approved Cryptographic Algorithm..


        2. Ensure that for secure password/passphrases storage, passphrases stored
        in databases are hashed with a uniquely salted Australian Signals Directorate
        Approved Cryptographic Algorithm and corresponding evidences/artefacts are
        maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to password/passphrases management for authentication highlighting that passphrases
        stored in databases are hashed with a uniquely salted Australian Signals Directorate
        Approved Cryptographic Algorithm.


        2. Provide artefacts corresponding to secure password/passphrases storage
        demonstrating that  passphrases stored in databases are hashed with a uniquely
        salted Australian Signals Directorate Approved Cryptographic Algorithm.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-633
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 633
      name: Privileged User Account access
      description: Privileged users are assigned a dedicated privileged account to
        be used solely for tasks requiring privileged access.
      annotation: 1. Assign privileged users with a dedicated privileged account,
        to be used solely for tasks requiring privileged access
      typical_evidence: 1. Provide evidence that privileged users are assigned a dedicated
        privileged account to be used solely for tasks requiring privileged access
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-634
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 634
      name: Access to Systems
      description: Access to systems, data repositories,  and applications is automatically
        disabled after 45 days of inactivity.
      annotation: "1. Obtain Identity & Access Management process and policy\n2. Systems,\
        \ applications, and data repositories should be configured such that:  \n\u2022\
        \ Access to data repositories, and privileged/unprivileged access to systems\
        \ and applications is disabled after they have not been used for an period\
        \ of 45 days."
      typical_evidence: "1. Identity & Access Management process and policy\n2. Snapshots\
        \ for the following: \n\u2022 Access to data repositories, and privileged/unprivileged\
        \ access to systems and applications is configured to be automatically disabled\
        \ after they have not been used for an period of 45 days."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-635
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 635
      name: VPN Connection
      description: When accessing an organization's network via a VPN connection,
        split tunnelling is disabled.
      annotation: 1. Verify split tunnelling is disabled on all network devices when
        accessing an organization's network via a VPN connection
      typical_evidence: 1. Provide evidence showcasing split tunnelling is disabled
        on all network devices when accessing an organization's network via a VPN
        connection.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-636
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 636
      name: Account Backup Access
      description: Unprivileged accounts, and privileged accounts (excluding backup
        administrators) cannot modify, delete, or access other account or their own
        account's backups.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to account permissions highlighting that privileged and unprivileged
        accounts (excluding backup administrators) do not have permissions in place
        to modify, delete, or access other accounts or their own account''s backups.

        2. Verify privileged and unprivileged accounts (excluding backup administrators)
        do not have the ability to modify, delete, or access other accounts or their
        own account''s backups.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to account permissions highlighting that privileged and unprivileged accounts
        (excluding backup administrators) do not have permissions in place to modify,
        delete, or access other accounts or their own account''s backups.

        2. Provide evidence of account permissions demonstrating privileged and unprivileged
        accounts (excluding backup administrators) do not have the ability to modify,
        delete, or access other accounts or their own account''s backups.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-637
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 637
      name: Chief Information Security Officer
      description: Trusted sources for SECRET and TOP SECRET systems are limited to
        people and services that have been authorized as such by an organization's
        Chief Information Security Officer.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ highlighting that trusted sources for SECRET and TOP SECRET systems are\
        \ limited to people and services that have been authorized as such by an organization's\
        \ Chief Information Security Officer. \n2. Validate all sources with access\
        \ to SECRET and TOP SECRET systems were approved by the CISO prior to gaining\
        \ access"
      typical_evidence: "1. Provide policies and procedures in place corresponding\
        \ to trusted sources for SECRET and TOP SECRET systems.\n2. Provide a list\
        \ of all accounts with access to SECRET and TOP SECRET systems which includes:\n\
        \u2022 Approver\n\u2022 Approval date\n\u2022 Date system access was granted"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-638
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 638
      name: Access Log
      description: Access changes and changes to privileged accounts and groups are
        logged.
      annotation: '1. Obtain Log management procedure

        2. Ensure changes to privileged accounts and groups are logged

        3. Retain logs and ensure it''s available for review whenever required'
      typical_evidence: "1. Provide log management procedure \n2. Provide evidence\
        \ of logs being maintained for changes to privileged accounts and groups\n\
        3. Provide evidence of  logs being retained for review"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-639
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 639
      name: Backup Access
      description: Backup administrators (excluding backup break glass accounts),
        are prevented from modifying or deleting backups.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to account permissions highlighting that backup administrator
        accounts (excluding backup break glass accounts) do not have permissions in
        place for modifying or deleting backups.

        2. Verify backup administrator accounts (excluding backup break glass accounts)
        do not have the ability to modify or delete backups.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to account permissions highlighting that backup administrator accounts (excluding
        backup break glass accounts) do not have permissions in place for modifying
        or deleting backups.

        2. Provide evidence of account permissions demonstrating backup administrator
        accounts (excluding backup break glass accounts) do not have the ability to
        modify or delete backups.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-640
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 640
      name: Internet Facing services
      description: Privileged service accounts are prevented from accessing the internet,
        email and web services.
      annotation: '1. Access to privileged accounts should be limited. Privileged
        accounts can be defined as any account with direct access to production, or
        ability to make direct changes.

        2. Such Privileged accounts shall not be used to  access the internet, email,
        and web services.

        3. Accounts used to  access the internet, email, and web services should have
        limited access (i.e. no direct edit access), and dedicated accounts for them.
        These accounts shall be closely monitored to validate no inappropriate changes
        are made.'
      typical_evidence: '1. Validate that access to privileged accounts are limited
        (i.e. any accounts with direct edit access).

        2. Validate privileged accounts are not used to access the internet, email,
        and web services.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-641
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 641
      name: Environment Virtualization
      description: Privileged operating environments are not virtualized within unprivileged
        operating environments.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to access management highlighting that privileged operating
        environments cannot be virtualized within unprivileged operating environments


        2. Verify privileged operating environments cannot be virtualized within unprivileged
        operating environments'
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to access management highlighting that  privileged operating environments\
        \ cannot be virtualized within unprivileged operating environments. \n\n2.\
        \ Provide evidence that privileged operating environments cannot be virtualized\
        \ within unprivileged operating environments"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-642
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 642
      name: Account Disablement
      description: Privileged access to systems, data repositories, and applications
        is automatically disabled after 12 months unless revalidated.
      annotation: '1. Obtain Identity & Access Management process and policy

        2. Systems, applications, and data repositories should be configured such
        that privileged access to systems, applications, and data repositories is
        automatically disabled after a period of twelve months unless revalidated.'
      typical_evidence: "1. Provide Identity & Access Management process and policy\n\
        2. Snapshots for the following: \n\u2022 Privileged access to systems, applications,\
        \ and data repositories is automatically disabled after a period of twelve\
        \ months unless revalidated."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-643
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:9
      ref_id: CCF 643
      name: Password Characteristics
      description: "Passphrases used for single-factor authentication have the following\
        \ requirements: \n- minimum of 14 characters with complexity, ideally as 4\
        \ random words.\n- on SECRET systems are at least 5 random words with a total\
        \ minimum length of 17 characters.\n- on TOP SECRET systems are at least 6\
        \ random words with a total minimum length of 20 characters."
      annotation: "1. Ensure policies and procedures are documented and maintained\
        \ corresponding to password management highlighting that:\n\u2022 Passphrases\
        \ used for single-factor authentication are at least 4 random words with a\
        \ total minimum length of 14 characters, unless more stringent requirements\
        \ apply.\n\u2022 Passphrases used for single-factor authentication on SECRET\
        \ systems are at least 5 random words with a total minimum length of 17 characters.\n\
        \u2022 Passphrases used for single-factor authentication on TOP SECRET systems\
        \ are at least 6 random words with a total minimum length of 20 characters.\n\
        \n2. Ensure that as a part of implementation of the password management documentation\
        \ within the configuration settings minimum password requirements include:\n\
        \u2022 Passphrases used for single-factor authentication are at least 4 random\
        \ words with a total minimum length of 14 characters, unless more stringent\
        \ requirements apply.\n\u2022 Passphrases used for single-factor authentication\
        \ on SECRET systems are at least 5 random words with a total minimum length\
        \ of 17 characters.\n\u2022 Passphrases used for single-factor authentication\
        \ on TOP SECRET systems are at least 6 random words with a total minimum length\
        \ of 20 characters.\n Additionally, corresponding artefacts/ evidences are\
        \ also maintained."
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to password management highlighting that: \n\u2022 Passphrases used for\
        \ single-factor authentication are at least 4 random words with a total minimum\
        \ length of 14 characters, unless more stringent requirements apply.\n\u2022\
        \ Passphrases used for single-factor authentication on SECRET systems are\
        \ at least 5 random words with a total minimum length of 17 characters.\n\u2022\
        \ Passphrases used for single-factor authentication on TOP SECRET systems\
        \ are at least 6 random words with a total minimum length of 20 characters.\n\
        2. Provide artefacts in place in terms of password configuration screenshots\
        \ highlighting that: \n\u2022 Passphrases used for single-factor authentication\
        \ are at least 4 random words with a total minimum length of 14 characters,\
        \ unless more stringent requirements apply.\n\u2022 Passphrases used for single-factor\
        \ authentication on SECRET systems are at least 5 random words with a total\
        \ minimum length of 17 characters.\n\u2022 Passphrases used for single-factor\
        \ authentication on TOP SECRET systems are at least 6 random words with a\
        \ total minimum length of 20 characters."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Cryptography Management
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-644
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 644
      name: Media Management Policy
      description: A media management policy is developed and implemented.
      annotation: 1. Ensure media management policy is documented, maintained(regular
        review & approval), implemented and corresponding records/ artefacts are also
        maintained.
      typical_evidence: 1. Provide documentation and artefacts demonstrating that
        media management policy is documented, maintained(regular review & approval)
        and  implemented.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-645
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 645
      name: Media Classification
      description: Any media connected to a system with a higher sensitivity or classification
        than the media is reclassified to the higher sensitivity or classification,
        unless the media is read-only or the system has a mechanism through which
        read-only access can be ensured.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to media management and removable media usage highlighting that
        any media connected to a system with a higher sensitivity or classification,
        then media is reclassified to the higher sensitivity or classification, unless
        the media  is read-only or the system has a mechanism through which read-only
        access can be ensured


        2. Ensure that any media connected to a system with a higher sensitivity or
        classification, then media is reclassified to the higher sensitivity or classification,
        unless the media  is read-only or the system has a mechanism through which
        read-only access can be ensured and corresponding evidences/artefacts are
        maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to media management and removable media usage highlighting that any media
        connected to a system with a higher sensitivity or classification, then media
        is reclassified to the higher sensitivity or classification, unless the media  is
        read-only or the system has a mechanism through which read-only access can
        be ensured.


        2. Provide sample records of the media connected to systems and corresponding
        classification of the media as well as systems in order to validate  that
        any media connected to a system with a higher sensitivity or classification,
        then media is reclassified to the higher sensitivity or classification, unless
        the media  is read-only or the system has a mechanism through which read-only
        access can be ensured.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-646
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 646
      name: Media Classification
      description: In order to reclassify media to a lower sensitivity or classification,
        the media is sanitized (unless the media is read-only) and a formal administrative
        decision (in consultation with data owners) is made to reclassify the media.
      annotation: '1. Ensure policies and procedures are documented and maintained  corresponding
        to media management and removable media usage highlighting that to reclassify
        media to a lower sensitivity or classification, the media is sanitized (unless
        the media is read-only) and a formal administrative decision (in consultation
        with data owners) is made to reclassify the media.


        2. Ensure that to reclassify media to a lower sensitivity or classification,
        the media is sanitized (unless the media is read-only) and a formal administrative
        decision (in consultation with data owners) is made to reclassify the media.
        Additionally, corresponding evidences/artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to media management and removable media usage highlighting that to reclassify
        media to a lower sensitivity or classification, the media is sanitized (unless
        the media is read-only) and a formal administrative decision (in consultation
        with data owners) is made to reclassify the media.


        2. Provide sample records of the instances in which reclassification of media
        is done in order to validate that to reclassify media to a lower sensitivity
        or classification, the media is sanitized (unless the media is read-only)
        and a formal administrative decision (in consultation with data owners) is
        made to reclassify the media.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-647
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 647
      name: Media Encryption
      description: All data stored on media is encrypted.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to media management and removable media usage highlighting that
        media is encrypted.


        2. Ensure that media is encrypted and corresponding evidences/artefacts are
        maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to media management and removable media usage highlighting that media is encrypted.


        2. Provide artefacts corresponding to media encryption demonstrating that
        that media is encrypted.'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-648
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 648
      name: Media Usage
      description: Media is only used with systems that are authorized to process,
        store or communicate the sensitivity or classification of the media.
      annotation: '1. Ensure policies and procedures are documented and maintained
        corresponding to media management and removable media usage highlighting that
        media is only used with systems that are authorized to process, store or communicate
        based on the sensitivity or classification of the media.


        2. Ensure that media is only used with systems which are authorized to process,
        store or communicate based on the sensitivity or classification of the media
        and corresponding evidences/artefacts are maintained.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to media management and removable media usage highlighting that media is only
        used with systems that are authorized to process, store or communicate based
        on the sensitivity or classification of the media.


        2. Provide sample records of media usage as well as corresponding authorized
        systems in order to validate media is only used with systems which are authorized
        to process, store or communicate based on the sensitivity or classification
        of the media.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-649
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 649
      name: Automatic Execution Features
      description: Any automatic execution features for media are disabled in the
        operating system of systems.
      annotation: '1. The media management and removable media usage policy documentation
        covers disabling of automatic execution features for media in the operating
        system of systems

        2. The system''s operating system is configured to disable any automatic execution
        features for media'
      typical_evidence: '1. Validate the media management and removable media usage
        policy documentation for coverage on disabling automatic execution features
        for media in the operating system of systems

        2. Verify the operating system configuration to check whether automatic execution
        features for media are disabled'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-650
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 650
      name: Media Writing
      description: Removable media is prevented from being written to via the use
        of device access control software if there is no business requirement for
        its use.
      annotation: '1. The media management and removable media usage policy documentation
        covers no-write permissions to media without a valid and approved business
        requirement for its use

        2. Write permissions to media is disabled via device access control software
        unless an approved business justification is in place for its use

        3. Review business requirement for writing to media on a periodic basis to
        ensure media is prevented from being written to if the business requirement
        is no longer valid or if there is no business requirement for its use'
      typical_evidence: '1. Validate the media management and removable media usage
        policy documentation for restriction on writing to media without an approved
        business justification for its use

        2. Evidence of documented and approved business justification to write to
        media

        3. Validate that media is prevented from being written to if there is no business
        requirement for its use, or if the business requirement is no longer valid'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-651
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 651
      name: Manual Data Transfer
      description: When transferring data manually between two systems belonging to
        different security domains, write-once media is used unless the destination
        system has a mechanism through which read-only access can be ensured.
      annotation: "1. The media management and removable media usage policy documentation\
        \ covers transferring of data manually between two systems belonging to different\
        \ security domains\n2. When transferring data manually between two systems\
        \ of different security domains, either of the below is considered:\n\u2022\
        \ write-once media is used\n\u2022 the destination system is configured to\
        \ ensure read-only access"
      typical_evidence: '1. Validate the media management and removable media usage
        policy documentation for coverage on transferring of data manually between
        two systems belonging to different security domains

        2. Walkthrough of the process to transfer data manually between two systems
        belonging to different security domains

        3. Evidence of destination system having a mechanism to ensure read-only access
        to the system; alternatively, evidence that write-once media is used to transfer
        data manually between systems of different security domains'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-652
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 652
      name: Encryption Software Consumer Guide
      description: Where a consumer guide for evaluated encryption software exists,
        the sanitization and post-sanitization requirements stated in the consumer
        guide are followed.
      annotation: '1. Obtain the consumer guide (if it exists) for evaluated encryption
        software in use

        2. If it exists, follow the sanitization and post-sanitization requirements
        stated in the consumer guide'
      typical_evidence: '1. Where it exists, provide consumer guide for evaluated
        encryption software in use

        2. Evidence of implementation of sanitization and post-sanitization requirements
        as stated in the consumer guide'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-653
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 653
      name: Operating System Hardening
      description: "Operating system hardening practices are performed on workstations\
        \ and internet-facing servers. Practices include;\n\n\u2022 Unused operating\
        \ system accounts are disabled.\n\u2022 Standard user roles do not have elevated\
        \ privileges to modify security functionality or execute PowerShell and other\
        \ scripting tools.\n\u2022 Scripting tools and code execution is disabled\
        \ for applications installed on all workstations and servers unless authorized.\
        \ \n\u2022 Local administrator accounts are disabled.\n\u2022 Unique domain\
        \ accounts with local administrator access are used to make workstation and\
        \ server changes."
      annotation: "1. Operating system hardening guidelines and documentation is established\
        \ and maintained\n2. Operating system hardening reports are maintained for\
        \ successful hardening\n3. Operating system configuration gap assessments\
        \ reports are created and gaps are closed in time\n4. Deviations/exceptions\
        \ to the established system hardening guidelines are documented and approved\n\
        5. Operating system hardening guidelines include the below:\n\u2022 Unused\
        \ operating system accounts, software, components, services and functionality\
        \ are removed or disabled\n\u2022 Standard users are prevented from bypassing,\
        \ disabling or modifying security functionality of operating systems\n\u2022\
        \ Standard users are prevented from running script execution engines, including:\n\
        - Windows Script Host (cscript.exe and wscript.exe)\n- PowerShell (powershell.exe,\
        \ powershell_ise.exe and pwsh.exe)\n- Command Prompt (cmd.exe)\n- Windows\
        \ Management Instrumentation (wmic.exe)\n- Microsoft HTML Application Host\
        \ (mshta.exe)\n\u2022 Local administrator accounts are disabled\n\u2022 Application\
        \ control is implemented on all workstations to restrict the execution of\
        \ executables, software libraries, scripts and installers to an approved set\n\
        \u2022 Application control is implemented on all servers to restrict the execution\
        \ of executables, software libraries, scripts and installers to an approved\
        \ set\n\u2022 Unique domain accounts with local administrative privileges,\
        \ but without domain administrative privileges, are used for workstation and\
        \ server management"
      typical_evidence: '1. Provide operating system hardening guidelines and documentation

        2. Validate that the operating system hardening guidelines were followed via
        documented reports, checklists, etc.

        3. Evidence for documented exceptions to the established system hardening
        guidelines

        4. Evidence of operating system configuration gap assessments reports'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-654
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 654
      name: Application Control Usage
      description: "If applicable, application controls are implemented and follow\
        \ the following best practices;\n\n\u2022 Application controls are implemented\
        \ using cryptographic hash rules, publisher certificate rules or path rules\
        \ and are validated at least annually.\n\u2022 Users (other than privileged\
        \ users) are not exempt and cannot change or remove  application controls.\n\
        \u2022 Web browsers, Microsoft Office and PDF software security settings cannot\
        \ be changed by users."
      annotation: "1. Where applicable, application security best practices are documented\
        \ and maintained, and the following are covered:\n\u2022 Application controls\
        \ are implemented using cryptographic hash rules, publisher certificate rules\
        \ or path rules\n\u2022 Validate cryptographic hash rules, publisher certificate\
        \ rules and path rules used for application control at least annually\n\u2022\
        \ When implementing application control using path rules, file system permissions\
        \ are configured to prevent unauthorized modification of folder and file permissions,\
        \ folder contents (including adding new files) and individual files that are\
        \ approved to execute\n\u2022 All users (with the exception of privileged\
        \ users when performing specific administrative activities) cannot disable,\
        \ bypass or be exempted from application controls\n\u2022 Standard users are\
        \ prevented from bypassing, disabling or modifying security functionality\
        \ of applications"
      typical_evidence: "Where applicable,\n1. Provide evidence of documented application\
        \ security best practices\n2. Provide evidence of implementation of application\
        \ security guidelines\n3. Validate that the following is covered:\n\u2022\
        \ implementation of application controls using cryptographic hash rules, publisher\
        \ certificate rules or path rules and validation at least annually\n\u2022\
        \ restriction on all users except privileged users to change or remove application\
        \ controls"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-655
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 655
      name: Application Control Rules
      description: If applicable, when implementing application control using publisher
        certificate rules, both publisher names and product names are used.
      annotation: 1. Where applicable, implement application control using publisher
        certificate rules such that both publisher names as well as product names
        are used
      typical_evidence: 'Where applicable,

        1. Provide evidence that both publisher names and product names are used when
        implementing application control using publisher certificate rules'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-656
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 656
      name: Application Control log configuration
      description: If applicable, application control is configured to generate event
        logs for failed execution attempts, including the name of the blocked file,
        the date/time stamp and the username of the user attempting to execute the
        file.
      annotation: "1. Where applicable, configure application control to generate\
        \ event logs\n2. Where applicable, event logs for failed execution attempts\
        \ include the following at minimum:\n\u2022 name of the blocked file\n\u2022\
        \ date/time stamp\n\u2022 username of the user attempting to execute the file"
      typical_evidence: "Where applicable,\n1. Provide evidence that application control\
        \ is configured to generate event logs\n2. Provide sample event logs generated\
        \ by application\n3. Verify if the event logs capture the following for failed\
        \ execution attempts:\n\u2022 name of the blocked file\n\u2022 date/time stamp\n\
        \u2022 username of the user attempting to execute the file"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-657
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 657
      name: Host-based Intrusion Prevention System
      description: A Host-based Intrusion Prevention System is installed on all workstations
        and high value servers such as authentication servers, Domain Name System
        (DNS) servers, web servers, file servers and email servers.
      annotation: "1. HIPS is installed on all workstations and high value servers,\
        \ such as:\n\u2022 authentication servers\n\u2022 Domain Name System (DNS)\
        \ servers\n\u2022 web servers\n\u2022 file servers\n\u2022 email servers\n\
        2. The network architecture diagram depicts host-based intrusion prevention\
        \ system implemented within the infrastructure"
      typical_evidence: "1. Validate the network architecture diagram to check host-based\
        \ intrusion prevention system implementation\n2. Evidence of HIPS installation\
        \ on all workstations and high value servers including:\n\u2022 DNS servers\n\
        \u2022 web servers\n\u2022 file servers\n\u2022 email servers\n\u2022 authentication\
        \ servers"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-658
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 658
      name: DMA Disabling
      description: External communication interfaces that allow DMA are disabled.
      annotation: '1. Disable communication interfaces of workstations and servers
        that allow DMA (Direct Memory Access)

        2. Where not required, remove or prevent physical connections to ports allowing
        high speed access (that permit direct memory access) to prevent external devices
        from being connected'
      typical_evidence: 1. Provide External communication interfaces that allow DMA
        are disabled.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-659
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 659
      name: Software Isolation
      description: "If applicable, when using a software-based isolation mechanism\
        \ to share a physical server\u2019s hardware, the configuration of the isolation\
        \ mechanism is hardened by removing unneeded functionality and restricting\
        \ access to the administrative interface used to manage the isolation mechanism."
      annotation: "1. Where applicable, the configuration of the software-based isolation\
        \ mechanism is hardened by taking into consideration the following:\n\u2022\
        \ removing unneeded functionality\n\u2022 restricting access to the administrative\
        \ interface used to manage the isolation mechanism\n\u2022 applying timely\
        \ patches to the isolation mechanism and underlying operating system\n\u2022\
        \ ensuring the isolation mechanism is from a vendor that applies secure coding\
        \ practices"
      typical_evidence: "Where applicable,\n1. Provide process walkthrough of software-based\
        \ isolation mechanism used to share a physical server's hardware\n2. Provide\
        \ evidence that the configuration of the isolation mechanism is hardened by\
        \ removing unneeded functionality \n3. Provide evidence that access to the\
        \ administrative interface used to manage the isolation mechanism is restricted"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-660
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 660
      name: Software Isolation Classification
      description: "If applicable, when using a software-based isolation mechanism\
        \ to share a physical server\u2019s hardware for SECRET or TOP SECRET workloads,\
        \ the physical server and all computing environments running on the physical\
        \ server are of the same classification and within the same security domain."
      annotation: 'Where applicable,

        1. The physical server and all computing environments running on the physical
        server are of the same classification for SECRET or TOP SECRET workloads

        2. The physical server and all computing environments running on the physical
        server are within the same security domain'
      typical_evidence: 'Where applicable,

        1. Provide process walkthrough of software-based isolation mechanism used
        to share a physical server''s hardware for SECRET or TOP SECRET workloads

        2. Provide evidence that the physical server and all computing environments
        running on the physical server are of the same classification

        3. Provide configuration snapshots that the physical server and all computing
        environments running on the physical server are within the same security domain'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-661
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 661
      name: Encryption Software AACA
      description: If applicable, encryption software that implements an ASD Approved
        Cryptographic Algorithm (AACA) is used if an organization wishes to reduce
        the physical storage or handling requirements for ICT equipment or media that
        contains sensitive data.
      annotation: "1. Approved algorithms (Australian Signals Directorate Approved\
        \ Cryptographic Algorithm) are used for encryption software when the organization\
        \ wishes to reduce the physical storage or handling requirements for ICT equipment\
        \ or media containing sensitive data. \nThere are 3 categories of AACAs -\
        \ asymmetric algorithms, hashing algorithms, and symmetric encryption algorithms:\n\
        \u2022 Approved asymmetric algorithms include the below, however ECDH and\
        \ ECDSA is recommended in preference to DH and DSA:\n- Diffie-Hellman (DH)\
        \ for agreeing on encryption session keys\n- Digital Signature Algorithm (DSA)\
        \ for digital signatures\n- Elliptic Curve Diffie-Hellman (ECDH) for key exchange\n\
        - Elliptic Curve Digital Signature Algorithm (ECDSA) for digital signatures\n\
        - Rivest-Shamir-Adleman (RSA) for digital signatures and passing encryption\
        \ session keys or similar keys\n\u2022 Approved hashing algorithm is SHA-2\
        \ (SHA-224, SHA-256, SHA-384, SHA-512)\n\u2022 Approved symmetric encryption\
        \ algorithms include:\n- AES 128, 192 and 256 bits\n- 3DES using 3 distinct\
        \ keys"
      typical_evidence: '1. Validate the media management and removable media usage
        policy documentation for coverage on encryption software that implements an
        ASD Approved Cryptographic Algorithm (AACA) if an organization wishes to reduce
        the physical storage or handling requirements for ICT equipment or media containing
        sensitive data

        2. Provide evidence that encryption software that implements an Australian
        Signals Directorate Approved Cryptographic Algorithm is used for encryption
        if an organization wishes to reduce the physical storage or handling requirements
        for ICT equipment or media that contains sensitive data'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-662
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 662
      name: Encryption Software ACE
      description: Encryption software that has completed a Common Criteria evaluation
        against a Protection Profile is used when encrypting media that contains OFFICIAL,
        Sensitive or PROTECTED data.
      annotation: 1. Encryption software that has completed a Common Criteria evaluation
        against a Protection Profile is used when encrypting media that contains OFFICIAL,
        Sensitive or PROTECTED data. No other methods of encryption shall be used.
      typical_evidence: 1. Validate encryption software that has completed a Common
        Criteria evaluation against a Protection Profile is used when encrypting media
        that contains OFFICIAL, Sensitive or PROTECTED data.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-663
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 663
      name: HACE Usage
      description: HACE (High Assurance Cryptographic Equipment) is used when encrypting
        media that contains SECRET or TOP SECRET data.
      annotation: 1. HACE (High Assurance Cryptographic Equipment) is used when encrypting
        media that contains SECRET or TOP SECRET data. No other equipment shall be
        used for encrypting media that contains SECRET or TOP SECRET data.
      typical_evidence: 1. Validate HACE (High Assurance Cryptographic Equipment)
        is used when encrypting media that contains SECRET or TOP SECRET data.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-664
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 664
      name: HACE Encryption
      description: HACE used for data at rest implements full disk encryption, or
        partial encryption where access controls will only allow writing to the encrypted
        partition.
      annotation: 1. For data at rest, HACE is configured to implement full disk encryption,
        or partial encryption where access controls will only allow writing to the
        encrypted partition
      typical_evidence: '1. Provide High Assurance Cryptographic Equipment (HACE)
        usage process for data at rest

        2. Provide evidence/configuration snapshots that depicts HACE used for data
        at rest implements full disk encryption, or partial encryption where access
        controls will only allow writing to the encrypted partition'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-665
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 665
      name: AACA Encryption
      description: In addition to any encryption already in place, an AACA is used
        to encrypt AUSTEO and AGAO data when at rest on a system.
      annotation: "1. AACA (Australian Signals Directorate Approved Cryptographic\
        \ Algorithm) is used for encryption of AUSTEO (Australian Eyes Only) and AGAO\
        \ (Australian Government Access Only) data at rest, in addition to any other\
        \ encryption already in place\nThere are 3 categories of AACAs - asymmetric\
        \ algorithms, hashing algorithms, and symmetric encryption algorithms:\n\u2022\
        \ Approved asymmetric algorithms include the below, however ECDH and ECDSA\
        \ is recommended in preference to DH and DSA:\n- Diffie-Hellman (DH) for agreeing\
        \ on encryption session keys\n- Digital Signature Algorithm (DSA) for digital\
        \ signatures\n- Elliptic Curve Diffie-Hellman (ECDH) for key exchange\n- Elliptic\
        \ Curve Digital Signature Algorithm (ECDSA) for digital signatures\n- Rivest-Shamir-Adleman\
        \ (RSA) for digital signatures and passing encryption session keys or similar\
        \ keys\n\u2022 Approved hashing algorithm is SHA-2 (SHA-224, SHA-256, SHA-384,\
        \ SHA-512)\n\u2022 Approved symmetric encryption algorithms include:\n- AES\
        \ 128, 192 and 256 bits\n- 3DES using 3 distinct keys"
      typical_evidence: '1. Provide encryption process in place to encrypt AUSTEO
        (Australian Eyes Only) and AGAO (Australian Government Access Only) data at
        rest

        2. Provide evidence that an ASD Approved Cryptographic Algorithm (AACA) is
        used to encrypt AUSTEO and AGAO data when at rest on a system, in addition
        to any encryption already in place'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-666
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 666
      name: AACP Encryption Communication
      description: Cryptographic equipment or encryption software that implements
        an ASD Approved Cryptographic Protocol (AACP) is used to communicate sensitive
        data over public network infrastructure and through unsecured spaces.
      annotation: "1. Sensitive data is communicated over public network infrastructure\
        \ and through unsecured spaces through cryptographic equipment or encryption\
        \ software that implements an ASD Approved Cryptographic Protocol (AACP).\
        \ The AACPs are:\n\u2022 Transport Layer Security (TLS)\n\u2022 Secure Shell\
        \ (SSH)\n\u2022 Secure/ Multipurpose Internet Mail Extension (S/MIME)\n\u2022\
        \ OpenPGP Message Format\n\u2022 Internet Protocol Security (IPsec)\n\u2022\
        \ Wi-Fi Protected Access 2 (WPA2)\n\u2022 Wi-Fi Protected Access 3 (WPA3)"
      typical_evidence: '1. Provide documented encryption process for communicating
        classified data over official networks, public network infrastructure and
        through unsecured spaces

        2. Provide evidence that cryptographic equipment or encryption software that
        implements an ASD Approved Cryptographic Protocol (AACP) is used to communicate
        sensitive data over public network infrastructure and through unsecured spaces'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-667
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 667
      name: ACE Cryptographic Equipment
      description: 'Cryptographic equipment or encryption software that has completed
        a Common Criteria evaluation against a Protection Profile is used to protect
        OFFICIA,: Sensitive or PROTECTED data when communicated over insufficiently
        secure networks, outside of appropriately secure areas or via public network
        infrastructure.'
      annotation: 1. Classified data is communicated over official networks, public
        network infrastructure and through unsecured spaces via cryptographic equipment
        or encryption software that has completed an Common Criteria evaluation against
        a Protection Profile
      typical_evidence: '1. Provide documented encryption process for communicating
        classified data over official networks, public network infrastructure and
        through unsecured spaces

        2. Provide evidence that cryptographic equipment or encryption software that
        has completed a Common Criteria evaluation against a Protection Profile is
        used to communicate sensitive data over public network infrastructure and
        through unsecured spaces'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-668
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 668
      name: AACP Encryption
      description: In addition to any encryption already in place, an AACP is used
        to protect AUSTEO and AGAO data when communicated across network infrastructure.
      annotation: "1. AUSTEO (Australian Eyes Only) and AGAO (Australian Government\
        \ Access Only) data is protected via an ASD Approved Cryptographic Protocol\
        \ (AACP) when communicated across the network infrastructure. The AACPs are:\n\
        \u2022 Transport Layer Security (TLS)\n\u2022 Secure Shell (SSH)\n\u2022 Secure/\
        \ Multipurpose Internet Mail Extension (S/MIME)\n\u2022 OpenPGP Message Format\n\
        \u2022 Internet Protocol Security (IPsec)\n\u2022 Wi-Fi Protected Access 2\
        \ (WPA2)\n\u2022 Wi-Fi Protected Access 3 (WPA3)"
      typical_evidence: '1. Provide encryption process in place to protect AUSTEO
        (Australian Eyes Only) and AGAO (Australian Government Access Only) data when
        communicated across the network infrastructure

        2. Provide evidence that an ASD Approved Cryptographic Protocol (AACP) is
        used to protect AUSTEO and AGAO data when communicated across the network
        infrastructure, in addition to any encryption already in place'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-669
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 669
      name: AACA Encryption
      description: Only AACAs (ASD Approved Cryptographic Algorithm) or high assurance
        cryptographic algorithms are used by cryptographic equipment and software.
      annotation: "1. Cryptographic equipment and software use only ASD Approved Cryptographic\
        \ Algorithms (AACA) or high assurance cryptographic algorithms \nThere are\
        \ 3 categories of AACAs - asymmetric algorithms, hashing algorithms, and symmetric\
        \ encryption algorithms:\n\u2022 Approved asymmetric algorithms include the\
        \ below, however ECDH and ECDSA is recommended in preference to DH and DSA:\n\
        - Diffie-Hellman (DH) for agreeing on encryption session keys\n- Digital Signature\
        \ Algorithm (DSA) for digital signatures\n- Elliptic Curve Diffie-Hellman\
        \ (ECDH) for key exchange\n- Elliptic Curve Digital Signature Algorithm (ECDSA)\
        \ for digital signatures\n- Rivest-Shamir-Adleman (RSA) for digital signatures\
        \ and passing encryption session keys or similar keys\n\u2022 Approved hashing\
        \ algorithm is SHA-2 (SHA-224, SHA-256, SHA-384, SHA-512)\n\u2022 Approved\
        \ symmetric encryption algorithms include:\n- AES 128, 192 and 256 bits\n\
        - 3DES using 3 distinct keys"
      typical_evidence: 1. Provide evidence that only ASD Approved Cryptographic Algorithms
        (AACA) or high assurance cryptographic algorithms are used by cryptographic
        equipment and software
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-670
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 670
      name: ECDH & ECDSA Usage
      description: If applicable, ECDH and ECDSA are used in preference to DH and
        DSA.
      annotation: "1. When using asymmetric public key algorithms, use Elliptic-curve\
        \ Diffie\u2013Hellman (ECDH) and Elliptic Curve Digital Signature Algorithm\
        \ (ECDSA) where possible, instead of Diffie Hellman (DH) and Digital Signature\
        \ Algorithm (DSA)"
      typical_evidence: "1. Provide evidence that Elliptic-curve Diffie\u2013Hellman\
        \ (ECDH) and Elliptic Curve Digital Signature Algorithm (ECDSA) is used where\
        \ possible in preference to Diffie Hellman (DH) and Digital Signature Algorithm\
        \ (DSA)"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-671
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 671
      name: DH Encryption
      description: 'If applicable, when using DH for agreeing on encryption session
        keys;

        - a modulus of at least 2048 bits is used.

        - a modulus and associated parameters are selected according to NIST SP 800-56A
        Rev. 3.'
      annotation: "1. Ensure the below when using Diffie Hellman (DH) for agreeing\
        \ on encryption session keys:\n\u2022 A modulus of at least 2048 bits is used\n\
        \u2022 Modulus and associated parameters are selected according to NIST SP\
        \ 800-56A Rev. 3"
      typical_evidence: "1. Provide documentation on usage of Diffie Hellman (DH)\
        \ for agreeing on encryption session keys\n2. Provide evidence of using:\n\
        \u2022 at least 2048 bits modulus when using DH for agreeing on encryption\
        \ session\n\u2022 modulus and associated parameters selected according to\
        \ NIST SP 800-56A Rev. 3, when using DH for agreeing on encryption session"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-672
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 672
      name: DSA Configuration
      description: 'If applicable, when using DSA for digital signatures;

        - a modulus of at least 2048 bits is used.

        - a modulus and associated parameters are generated according to FIPS 186-4.'
      annotation: "1. Ensure the below when using Digital Signature Algorithm (DSA)\
        \ for digital signatures:\n\u2022 A modulus of at least 2048 bits is used\n\
        \u2022 Modulus and associated parameters are generated according to Federal\
        \ Information Processing Standard (FIPS) 186-4 (Digital Signature Standard)"
      typical_evidence: "1. Provide documentation on usage of Digital Signature Algorithm\
        \ (DSA) for digital signatures\n2. Provide evidence of using:\n\u2022 at least\
        \ 2048 bits modulus when using DSA for digital signatures\n\u2022 modulus\
        \ and associated parameters generated according to FIPS 186-4, when using\
        \ DSA for digital signatures"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-673
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 673
      name: Elliptic Curve Cryptography
      description: If applicable, when using elliptic curve cryptography, a curve
        from FIPS 186-4 is used.
      annotation: 1. When using elliptic curve cryptography, use a curve from Federal
        Information Processing Standard (FIPS) 186-4 (Digital Signature Standard)
        NIST recommended elliptic curves
      typical_evidence: '1. Provide documentation for using elliptic curve cryptography

        2. Provide evidence of using curve from FIPS 186-4, when using elliptic curve
        cryptography'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-674
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 674
      name: ECDH Base Point Order
      description: If appliable, when using ECDH for agreeing on encryption session
        keys, a base point order and key size of at least 224 bits is used.
      annotation: "1. Use a base point order and key size of at least 224 bits  when\
        \ using Elliptic-curve Diffie\u2013Hellman (ECDH) key agreement protocol for\
        \ agreeing on encryption session keys"
      typical_evidence: "1. Provide evidence that a base point order and key size\
        \ of at least 224 bits is used, when using Elliptic-curve Diffie\u2013Hellman\
        \ (ECDH) key agreement protocol for agreeing on encryption session keys"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-675
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 675
      name: ECDSA Digital Signature Order
      description: If applicable, when using ECDSA for digital signatures, a base
        point order and key size of at least 224 bits is used.
      annotation: 1. Use a base point order and key size of at least 224 bits when
        using Elliptic Curve Digital Signature Algorithm (ECDSA) for digital signatures
      typical_evidence: 1. Provide evidence that a base point order and key size of
        at least 224 bits is used, when using Elliptic Curve Digital Signature Algorithm
        (ECDSA) for digital signatures
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-676
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 676
      name: RSA Configuration
      description: When using RSA for digital signatures and session keys, a module
        of at least 2048 buts is used and a key pair for passing encrypted session
        keys that is different from the key pair used for digital signatures is used.
      annotation: '1. Use a modulus of at least 2048 bits when using RSA for digital
        signatures, and passing encryption session keys or similar keys

        2. Use a key pair for passing encrypted session keys that is different from
        the key pair used for digital signatures when using RSA for digital signatures,
        and passing encryption session keys or similar keys'
      typical_evidence: "1. Provide documentation for using RSA for digital signatures\
        \ and session keys\n2. Provide evidence that:\n\u2022 a modulus of at least\
        \ 2048 bits is used, when using RSA for digital signatures, and passing encryption\
        \ session keys or similar keys\n\u2022 a key pair for passing encrypted session\
        \ keys that is different from the key pair used for digital signatures is\
        \ used, when using RSA for digital signatures, and passing encryption session\
        \ keys or similar keys"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-677
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 677
      name: Symmetric Cryptographic Algorithm Use
      description: Symmetric cryptographic algorithms are not used in Electronic Codebook
        Mode.
      annotation: 1. Ensure symmetric cryptographic algorithms such as DES or AES
        are not used in Electronic Codebook (ECB) mode
      typical_evidence: '1. Provide evidence of documentation/ communication that
        prohibits usage of symmetric cryptographic algorithms in Electronic Codebook
        Mode

        2. Provide evidence that symmetric cryptographic algorithms are not used in
        Electronic Codebook Mode'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-678
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 678
      name: 3DES Configuration
      description: If applicable, 3DES is used with three distinct keys.
      annotation: 1. Where Triple Data Encryption Standard (3DES) is used, use 3 separate
        keys (i.e., ensure the DES algorithm is run 3 times with 3 independent and
        distinct keys)
      typical_evidence: 1. Verify that 3DES is used with three distinct keys
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-679
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 679
      name: AACA use
      description: If applicable, AACAs used by HACE are implemented in an ASD approved
        configuration, with preference given to CNSA Suite algorithms and key sizes.
      annotation: '1. Use ASD approved cryptographic algorithms (AACAs) for protection
        of highly classified data when used in an evaluated implementation

        2. Algorithms are given preference in line with the Commercial National Security
        Algorithm (CNSA) suite (see CCF-CEK-09.38)'
      typical_evidence: '1. Provide documentation available for using AACAs used by
        HACE are implemented in an ASD approved configuration, with preference given
        to CNSA Suite algorithms and key sizes.

        2. Provide evidence that ASD approved cryptographic algorithms (AACAs) are
        used in an evaluated implementation'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-680
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 680
      name: CNSA Suite algorithms and key size
      description: If applicable, preference is given to using the CNSA Suite algorithms
        and key sizes.
      annotation: "1 Algorithms are chosen with preference to the Commercial National\
        \ Security Algorithm (CNSA) Suite algorithms and key sizes. This includes:\n\
        \u2022 AES with 256 bit keys\n\u2022 ECDH with Curve P-384\n\u2022 ECDSA with\
        \ Curve P-384\n\u2022 SHA with 384 bits\n\u2022 DH with minimum 3072 bit modulus\n\
        \u2022 RSA with minimum 3072 bit modulus"
      typical_evidence: 1. Verify that Commercial National Security Algorithm (CNSA)
        Suite algorithms and key sizes are preferred
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-681
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 681
      name: AACP Usage
      description: Only AACPs or high assurance cryptographic protocols are used by
        cryptographic equipment and software.
      annotation: "1. Cryptographic equipment and software use only ASD Approved Cryptographic\
        \ Protocols (AACPs) or high assurance cryptographic protocols.\nThe AACPs\
        \ are:\n\u2022 Transport Layer Security (TLS)\n\u2022 Secure Shell (SSH)\n\
        \u2022 Secure/ Multipurpose Internet Mail Extension (S/MIME)\n\u2022 OpenPGP\
        \ Message Format\n\u2022 Internet Protocol Security (IPsec)\n\u2022 Wi-Fi\
        \ Protected Access 2 (WPA2)\n\u2022 Wi-Fi Protected Access 3 (WPA3)\n2. Disable\
        \ the use of unapproved protocols, or alternatively maintain usage policies\
        \ advising users not to use unapproved protocols"
      typical_evidence: 1. Provide evidence that only ASD Approved Cryptographic Protocols
        (AACPs) or high assurance cryptographic protocols are used by cryptographic
        equipment and software
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-682
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 682
      name: Transport Layer Security Communication
      description: "If applicable, when using Transport Layer Security, communication\
        \ systems must follow the following requirements;\n\n- The latest version\
        \ of TLS is used. \n- AES in Galois Counter Mode is used for symmetric encryption.\n\
        - Only server-initiated secure renegotiation is used.\n- DH or ECDH is used\
        \ for key establishment. The ephemeral variant is used and anonymous DH is\
        \ not used.\n- SHA-2-based certificates are used.\n- Cipher suites are configured\
        \ to use SHA-2 as part of the Message Authentication Code and Pseudo-Random\
        \ Function.\n- PFS is used for TLS connections. TLS compression is disabled."
      annotation: "1. Establish and maintain documentation for usage of Transport\
        \ Layer Security in communication systems\n2. Ensure that communication systems\
        \ follow the below requirements:\n\u2022 The latest version of TLS is used\n\
        \u2022 AES in Galois Counter Mode is used for symmetric encryption\n\u2022\
        \ Only server-initiated secure renegotiation is used\n\u2022 DH or ECDH is\
        \ used for key establishment\n\u2022 The ephemeral variant is used and anonymous\
        \ DH is not used\n\u2022 SHA-2-based certificates are used\n\u2022 Cipher\
        \ suites are configured to use SHA-2 as part of the Message Authentication\
        \ Code and Pseudo-Random Function\n\u2022 PFS is used for TLS connections\n\
        \u2022 TLS compression is disabled"
      typical_evidence: "1. Provide documentation and guidelines in place for using\
        \ Transport Layer Security in communication systems\n2. Provide evidence that\
        \ communication systems are following the below requirements:\n\u2022 The\
        \ latest version of TLS is used\n\u2022 AES in Galois Counter Mode is used\
        \ for symmetric encryption\n\u2022 Only server-initiated secure renegotiation\
        \ is used\n\u2022 DH or ECDH is used for key establishment\n\u2022 The ephemeral\
        \ variant is used and anonymous DH is not used\n\u2022 SHA-2-based certificates\
        \ are used\n\u2022 Cipher suites are configured to use SHA-2 as part of the\
        \ Message Authentication Code and Pseudo-Random Function\n\u2022 PFS is used\
        \ for TLS connections\n\u2022 TLS compression is disabled"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-683
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 683
      name: SSH Configuration
      description: The use of SSH must have SSH version 1 disabled and have public
        key-based authentication for connections. When SSH-agent or other similar
        key caching programs are used, it is only on workstations and servers with
        screen locks, key caches are set to expire within four hours of inactivity,
        and agent credential forwarding is enabled only when SSH traversal is required.
      annotation: "1. The use of SSH version 1 is disabled\n2. Public key-based authentication\
        \ is used for SSH connections\n3. When SSH-agent or other similar key caching\
        \ programs are used:\n\u2022 it is only on workstations and servers with screen\
        \ locks\n\u2022 key caches are set to expire within four hours of inactivity,\
        \ and \n\u2022 agent credential forwarding is enabled only when SSH traversal\
        \ is required"
      typical_evidence: '1. Provide evidence that the use of SSH version 1 is disabled

        2. Provide evidence that public key-based authentication is used for SSH connections

        3. Provide evidence that when SSH-agent or other similar key caching programs
        are used, it is only on workstations and servers with screen locks, key caches
        are set to expire within four hours of inactivity, and agent credential forwarding
        is enabled only when SSH traversal is required'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-684
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 684
      name: SSH Daemon Configuration
      description: "If applicable, the configuration settings in the following table\
        \ are implemented for the SSH daemon:\n\u2022 only listen on the required\
        \ interfaces (ListenAddress xxx.xxx.xxx.xxx)\n\u2022 have a suitable login\
        \ banner (Banner x)\n\u2022 have a login authentication timeout of no more\
        \ than 60 seconds (LoginGraceTime 60)\n\u2022 disable host-based authentication\
        \ (HostbasedAuthentication no)\n\u2022 disable rhosts-based authentication\
        \ (IgnoreRhosts yes)\n\u2022 disable the ability to login directly as root\
        \ (PermitRootLogin no)\n\u2022 disable empty passwords (PermitEmptyPasswords\
        \ no)\n\u2022 disable connection forwarding (AllowTCPForwarding no)\n\u2022\
        \ disable gateway ports (GatewayPorts no)\n\u2022 disable X11 forwarding (X11Forwarding\
        \ no)."
      annotation: "1. Where applicable, implement the following configuration settings\
        \ for the SSH daemon:\n\u2022 only listen on the required interfaces (ListenAddress\
        \ xxx.xxx.xxx.xxx)\n\u2022 have a suitable login banner (Banner x)\n\u2022\
        \ have a login authentication timeout of no more than 60 seconds (LoginGraceTime\
        \ 60)\n\u2022 disable host-based authentication (HostbasedAuthentication no)\n\
        \u2022 disable rhosts-based authentication (IgnoreRhosts yes)\n\u2022 disable\
        \ the ability to login directly as root (PermitRootLogin no)\n\u2022 disable\
        \ empty passwords (PermitEmptyPasswords no)\n\u2022 disable connection forwarding\
        \ (AllowTCPForwarding no)\n\u2022 disable gateway ports (GatewayPorts no)\n\
        \u2022 disable X11 forwarding (X11Forwarding no)."
      typical_evidence: "1. Where applicable, provide evidence of the following configuration\
        \ settings for the SSH daemon:\n\u2022 only listen on the required interfaces\
        \ (ListenAddress xxx.xxx.xxx.xxx)\n\u2022 have a suitable login banner (Banner\
        \ x)\n\u2022 have a login authentication timeout of no more than 60 seconds\
        \ (LoginGraceTime 60)\n\u2022 disable host-based authentication (HostbasedAuthentication\
        \ no)\n\u2022 disable rhosts-based authentication (IgnoreRhosts yes)\n\u2022\
        \ disable the ability to login directly as root (PermitRootLogin no)\n\u2022\
        \ disable empty passwords (PermitEmptyPasswords no)\n\u2022 disable connection\
        \ forwarding (AllowTCPForwarding no)\n\u2022 disable gateway ports (GatewayPorts\
        \ no)\n\u2022 disable X11 forwarding (X11Forwarding no)."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-685
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 685
      name: S/MIME configuration
      description: If applicable, versions of Secure/Multipurpose Internet Mail Extension
        (S/MIME) earlier than 3.0 are not used.
      annotation: 1. Do not use versions earlier than 3.0 of Secure/Multipurpose Internet
        Mail Extension (S/MIME)
      typical_evidence: 1. Provide snapshots/evidence depicting that versions of Secure/Multipurpose
        Internet Mail Extension (S/MIME) earlier than 3.0 are not used
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-686
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 686
      name: IPsec Configuration
      description: "If applicable, IPsec configuration and usage must abide by these\
        \ requirements;\n\n- Tunnel mode is used for IPsec connections; however, if\
        \ using transport mode, an IP tunnel is used. PFS is used for all IPsec connections.\n\
        -\_The ESP protocol is used for IPsec connections.\n- IKE is used for key\
        \ exchange when establishing an IPsec connection. If using ISAKMP in IKE version\
        \ 1, aggressive mode is disabled.\n- A security association lifetime of less\
        \ than four hours, or 14400 seconds, is used.\n- HMAC-SHA256, HMAC-SHA384\
        \ or HMAC-SHA512 is used as a HMAC algorithm.\n- The largest modulus size\
        \ possible for all relevant components in the network is used when conducting\
        \ a key exchange.\n- The use of XAuth is disabled for IPsec connections using\
        \ IKE version 1."
      annotation: "1. IPsec configuration and usage abide by the following requirements:\n\
        \u2022 Tunnel mode is used for IPsec connections; however, if using transport\
        \ mode, an IP tunnel is used. PFS is used for all IPsec connections\n\u2022\
        \_The ESP protocol is used for IPsec connections\n\u2022 IKE is used for key\
        \ exchange when establishing an IPsec connection\n\u2022 If using ISAKMP in\
        \ IKE version 1, aggressive mode is disabled\n\u2022 A security association\
        \ lifetime of less than four hours, or 14400 seconds, is used\n\u2022 HMAC-SHA256,\
        \ HMAC-SHA384 or HMAC-SHA512 is used as a HMAC algorithm\n\u2022 The largest\
        \ modulus size possible for all relevant components in the network is used\
        \ when conducting a key exchange\n\u2022 The use of XAuth is disabled for\
        \ IPsec connections using IKE version 1"
      typical_evidence: "1. Provide requirements documented for IPsec configuration\
        \ and usage\n2. Validate that IPsec configuration and usage abide by these\
        \ requirements:\n\u2022  Tunnel mode is used for IPsec connections; however,\
        \ if using transport mode, an IP tunnel is used. PFS is used for all IPsec\
        \ connections\n\u2022\_The ESP protocol is used for IPsec connections\n\u2022\
        \ IKE is used for key exchange when establishing an IPsec connection.\n\u2022\
        \ If using ISAKMP in IKE version 1, aggressive mode is disabled\n\u2022 A\
        \ security association lifetime of less than four hours, or 14400 seconds,\
        \ is used\n\u2022 HMAC-SHA256, HMAC-SHA384 or HMAC-SHA512 is used as a HMAC\
        \ algorithm\n\u2022 The largest modulus size possible for all relevant components\
        \ in the network is used when conducting a key exchange\n\u2022 The use of\
        \ XAuth is disabled for IPsec connections using IKE version 1"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-687
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 687
      name: ACSC Compliance
      description: All communications security and equipment-specific doctrine produced
        by the ACSC for the management and use of HACE is complied with.
      annotation: 1. Due to the sensitive nature of High Assurance Cryptographic Equipment
        (HACE), when using HACE, communications security and equipment-specific doctrine
        produced by the Australian Cyber Security Centre (ACSC) for the management
        and use of HACE is complied with
      typical_evidence: 1. Provide evidence of all communications security and equipment-specific
        doctrine produced by the Australian Cyber Security Centre (ACSC) for the management
        and use of High Assurance Cryptographic Equipment (HACE)
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-688
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 688
      name: Cryptographic Equipment Storage
      description: If applicable, cryptographic equipment is stored in a room that
        meets the requirements for a server room based on the sensitivity or classification
        of the data the cryptographic equipment processes.
      annotation: 1. Store cryptographic equipment in a room that meets the requirements
        for a server room based on the sensitivity or classification of the data the
        cryptographic equipment processes
      typical_evidence: '1. Provide security requirements set forth for the room where
        cryptographic equipment is stored and verify if it is done based on the classification
        of data that the cryptographic equipment processes

        2. Provide classification or sensitivity of the data that the cryptographic
        equipment processes'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-689
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 689
      name: Area Separation
      description: Areas in which HACE is used are separated from other areas and
        designated as a cryptographic controlled area.
      annotation: 1. Separate areas in which High Assurance Cryptographic Equipment
        (HACE) is used from other areas and designate the area as a cryptographic
        controlled area
      typical_evidence: 1. Provide snapshot/evidence that depicts areas in which High
        Assurance Cryptographic Equipment (HACE) is used are designated as a cryptographic
        controlled area
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-690
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 690
      name: Content Filtering
      description: A list of allowed content types is implemented. The integrity of
        content is verified where applicable and blocked if verification fails. If
        data is signed, the signature is validated before the data is exported.
      annotation: '1. Maintain and implement a list of allowed content types

        2. Verify integrity check on content (where applicable) and block content
        if verification fails

        3. If data is signed, validate the signature before the data is exported'
      typical_evidence: "1. Provide the list of allowed content types\n2. Provide\
        \ evidence of integrity check (where applicable) \n3. Provide sample logs/alerts\
        \ for blocking content if integrity verification fails\n4. Provide evidence\
        \ of validation performed on signature before the data is exported (if data\
        \ is signed)"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-691
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 691
      name: Decryption of Data
      description: All encrypted content, traffic and data is decrypted and inspected
        to allow content filtering.
      annotation: 1. Ensure all encrypted content, traffic and data is decrypted and
        inspected to allow content filtering
      typical_evidence: '1. Provide evidence of requirements in place for content
        filtering

        2. Verify that all encrypted content, traffic and data is decrypted and inspected
        to allow content filtering'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-692
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 692
      name: Peripheral Switch
      description: If applicable, an evaluated peripheral switch is used when sharing
        peripherals between systems.
      annotation: 1. When sharing peripherals between systems, make use of an evaluated
        peripheral switch
      typical_evidence: 1. Provide evidence such as evaluation reports and approvals
        obtained for using peripheral switch when sharing peripherals between systems
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-693
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 693
      name: High Assurance Peripheral Switch
      description: If applicable, an evaluated peripheral switch used for sharing
        peripherals between SECRET or TOP SECRET systems and any non-SECRET or TOP
        SECRET systems completes a high assurance evaluation.
      annotation: 1. Use of an evaluated peripheral switch used for sharing peripherals
        between SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems
        must complete a high assurance evaluation.
      typical_evidence: 1. Provide evidence such as evaluation reports and approvals
        for using, an evaluated peripheral switch used for sharing peripherals between
        SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-694
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 694
      name: High Assurance Peripheral Switch
      description: If applicable, an evaluated peripheral switch used for sharing
        peripherals between SECRET and TOP SECRET systems, or between SECRET or TOP
        SECRET systems belonging to different security domains, preferably completes
        a high assurance evaluation.
      annotation: 1. When an evaluated peripheral switch is used for sharing peripherals
        between SECRET and TOP SECRET systems, or between SECRET or TOP SECRET systems
        belonging to different security domains, ensure it completes a high assurance
        evaluation.
      typical_evidence: 1. Provide evidence such as evaluation reports and approvals
        obtained for using an evaluated peripheral switch used for sharing peripherals
        between SECRET and TOP SECRET systems, or between SECRET or TOP SECRET systems
        belonging to different security domains.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-695
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 695
      name: Peripheral Switch
      description: If applicable, an evaluated peripheral switch is used when sharing
        peripherals between official systems, or classified systems at the same classification,
        that belong to different security domains.
      annotation: 1. When sharing peripherals between official systems, or classified
        systems at the same classification, that belong to different security domains,
        make use of an evaluated peripheral switch
      typical_evidence: 1. Provide evidence such as evaluation reports and approvals
        obtained for using peripheral switch when sharing peripherals between official
        or classified systems at the same classification, that belong to different
        security domains
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-696
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 696
      name: Peripheral Switch
      description: If applicable, an evaluated peripheral switch is used when accessing
        a system containing AUSTEO or AGAO data and a system of the same classification
        that is not authorized to process the same caveat.
      annotation: 1. Use an evaluated peripheral switch when accessing a system containing
        AUSTEO or AGAO data and a system of the same classification that is not authorized
        to process the same caveat
      typical_evidence: 1. Provide evidence such as evaluation reports and approvals
        obtained for using peripheral switch when accessing a system containing AUSTEO
        or AGAO data and a system of the same classification that is not authorized
        to process the same caveat
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-697
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 697
      name: Exporting Data Procedures
      description: "When exporting data from a SECRET or TOP SECRET system, the following\
        \ activities are undertaken:\n\u2022 data format checks and logging\n\u2022\
        \ monitoring to detect overuse/unusual usage patterns\n\u2022 limitations\
        \ on data types and sizes\n\u2022 keyword searches on all textual data."
      annotation: "1. Perform the following activities when exporting data from a\
        \ SECRET or TOP SECRET system:\n\u2022 data format checks and logging\n\u2022\
        \ monitoring to detect overuse/unusual usage patterns\n\u2022 limitations\
        \ on data types and sizes\n\u2022 keyword searches on all textual data."
      typical_evidence: "1. Provide the requirements documented/communicated for exporting\
        \ data\n2. Provide evidence that the following activities are done when exporting\
        \ data from a SECRET or TOP SECRET system:\n\u2022 data format checks and\
        \ logging\n\u2022 monitoring to detect overuse/unusual usage patterns\n\u2022\
        \ limitations on data types and sizes\n\u2022 keyword searches on all textual\
        \ data."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-698
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 698
      name: AUSTEO and AGAO Data export
      description: A process, and supporting procedures, is developed and implemented
        to prevent AUSTEO and AGAO data in both textual and non-textual formats from
        being exported to foreign systems.
      annotation: '1. Develop, maintain and implement a documented process and supporting
        procedures to manage exporting AUSTEO and AGAO data

        2. Prevent exporting of AUSTEO and AGAO data in both textual and non-textual
        formats to foreign systems'
      typical_evidence: 1. Provide the documented process and supporting procedures
        developed and implemented to manage exporting AUSTEO and AGAO data
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-699
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 699
      name: Keyword Searches
      description: When exporting data from an AUSTEO or AGAO system, keyword searches
        are undertaken on all textual data and any identified data is quarantined
        until reviewed and approved for release by a trusted source other than the
        originator.
      annotation: "1. When exporting data from an AUSTEO or AGAO system:\n\u2022 Undertake\
        \ keyword searches on all textual data\n\u2022 Quarantine any identified data\
        \ until reviewed and approved for release by a trusted source other than the\
        \ originator"
      typical_evidence: '1. Provide the documented process and supporting procedures
        developed and implemented to manage exporting AUSTEO and AGAO data

        2. Provide evidence of keyword searches being undertaken on all textual data

        3. Provide evidence that any identified data is quarantined until reviewed
        and approved for release by a trusted source other than the originator'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-700
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:10
      ref_id: CCF 700
      name: Data Transfer Logs
      description: Data transfer logs are used to record all data imports and exports
        from systems. Transfer logs are fully and partially audited at least monthly.
      annotation: '1. Enable data transfer logs to record all data imports and exports
        from systems

        2. Partially audit data transfer logs at least monthly

        3. Fully audit data transfer logs at least monthly

        4. Maintain evidence for full and partial audit of data transfer logs'
      typical_evidence: '1. Provide sample data transfer logs recorded for all data
        imports and exports from systems

        2. Provide evidence that transfer logs are fully and partially audited at
        least monthly'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:11
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Business Continuity & Resilience
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-701
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:11
      ref_id: CCF 701
      name: Backup Restoration
      description: Partial restoration of backups are tested on a quarterly basis,
        and full restoration of backups are tested initially, and each time a fundamental
        information technology infrastructure change occurs.
      annotation: "1. Perform testing for partial restoration of backups on a quarterly\
        \ or more frequent basis\n2. Perform testing for full restoration of backups:\n\
        \u2022 at least once when initially implemented, and \n\u2022 each time fundamental\
        \ information technology infrastructure changes occur"
      typical_evidence: '1. Provide policies and procedures in place for backup and
        restoration

        2. Provide reports/evidence that partial restoration of backups is tested
        at least on a quarterly basis

        3. Provide reports/evidence that full restoration of backups is tested at
        least once when initially implemented and each time fundamental information
        technology infrastructure changes occur'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-702
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:11
      ref_id: CCF 702
      name: Event Log retention
      description: "Event logs are retained for a minimum of 7 years in accordance\
        \ with the National Archives of Australia\u2019s Administrative Functions\
        \ Disposal Authority Express Version 2 publication."
      annotation: "1. Ensure time period for retaining event logs are documented via\
        \ appropriate monitoring and logging policies\n2. Retain event logs for a\
        \ minimum of 7 years in accordance with the National Archives of Australia\u2019\
        s Administrative Functions Disposal Authority Express Version 2 publication"
      typical_evidence: '1. Provide evidence of policies governing time period for
        retaining of event logs

        2. Provide configuration setting snapshot depicting time-period set for retaining
        event logs'
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-703
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:11
      ref_id: CCF 703
      name: DNS Log retention
      description: DNS and proxy logs are retained for at least 18 months.
      annotation: '1. Ensure time period for retaining DNS and proxy logs are documented
        via appropriate monitoring and logging policies

        2. Retain DNS and proxy logs for at least 18 months'
      typical_evidence: "1. Provide evidence of policies governing time period for\
        \ retaining of DNS and proxy logs \n2. Provide configuration setting snapshot\
        \ depicting time-period set for retaining DNS and proxy logs"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:12
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Security Incident
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-704
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:12
      ref_id: CCF 704
      name: Event Log Policy
      description: Policies governing event logs are communicated and reviewed periodically.
        Revision histories and review periods are defined within the policies themselves
        and the organization Policy Governance Policy.
      annotation: '1. Obtain relevant organizational policy/standard

        2. Ensure that the policy is implemented appropriately

        3. Ensure that the log management policy is reviewed at least annually and
        updated as necessary or on any major changes

        4. Ensure revision histories and review periods are defined appropriately
        within the log management policy

        5. Event log auditing processes, and supporting event log auditing procedures,
        are developed and implemented covering the scope and schedule of audits, what
        constitutes a violation of security policy, and actions to be taken when violations
        are detected, including reporting requirements.'
      typical_evidence: "1. Provide relevant log management policy documentation\n\
        2. Provide evidence of periodic log management policy review \n3. Provide\
        \ evidence of log management policy communication to relevant personnel's\n\
        4. Provide evidence of revision histories maintained for log management policy"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls
      name: Vulnerability Detection
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-705
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 705
      name: Vulnerability scanner
      description: A vulnerability scanner is used at least fortnightly to identify
        missing patches or updates for security vulnerabilities in other applications.
      annotation: '1.Policy and procedure document(s) corresponding to vulnerability
        management should be documented and maintained.

        2.Vulnerability scanning should be done at a regular frequency (at least biweekly)
        in order to ensure closure of vulnerabilities identified in past as well as
        identification of new vulnerabilities in the environment.

        3.Tracker of vulnerabilities identified in the scans should be maintained
        to identify missing patches/updates for applications.'
      typical_evidence: '1.Policy and procedure document(s) corresponding to vulnerability
        management.

        2. Validate scans are performed at least biweekly to identify missing patches/updates
        for applications.

        3. Tracker of vulnerabilities identified in the last scan'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-706
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 706
      name: Vulnerability scanner
      description: A vulnerability scanner is used at least weekly to identify missing
        patches or updates for security vulnerabilities in office productivity suites,
        web browsers and their extensions, email clients, PDF software, operating
        systems of workstations and servers and network devices, and security products.
      annotation: '1.Policy and procedure document(s) corresponding to vulnerability
        management should be documented and maintained.

        2.Vulnerability scanning should be done at a regular frequency (at least weekly)  in
        order to ensure closure of vulnerabilities identified in past as well as identification
        of new vulnerabilities in the environment.

        3.Tracker of vulnerabilities identified in the scans should be maintained
        to identify missing patches/updates for security vulnerabilities in office
        productivity suites, web browsers and their extensions, email clients, PDF
        software, drivers, firmware, and operating systems of workstations and servers
        and network devices, and security products.'
      typical_evidence: '1.Policy and procedure document(s) corresponding to vulnerability
        management.

        2. Validate scans are performed at least weekly to identify missing patches/updates
        for missing patches or updates for security vulnerabilities in office productivity
        suites, web browsers and their extensions, email clients, PDF software, drivers,
        firmware, and operating systems of workstations and servers and network devices,
        and security products.

        3. Tracker of vulnerabilities identified in the last scan'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-707
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 707
      name: Intrusion Remediation
      description: When identified, all intrusion remediation activities are conducted
        in a coordinated manner during the same planned outage.
      annotation: '1. Obtain policy and procedure document(s) corresponding to intrusion
        remediation activities.

        2. Validate intrusion remediation activities are conducted in a coordinated
        manner during the same planned outage'
      typical_evidence: '1. Provide policy and procedure document(s) corresponding
        to intrusion remediation activities.

        2. Provide evidence intrusion remediation activities are conducted in a coordinated
        manner during the same planned outage'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-708
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 708
      name: Removable Media
      description: Unauthorized removable media and devices are prevented from being
        connected to workstations and servers via the use of device access control
        software or by disabling external communication interfaces in operating systems.
      annotation: '1. The device management and removable media usage policy documentation
        covers a restriction on unauthorized removable media and devices connecting
        to workstations and servers.

        2. Verify unauthorized removable media and devices are prevented from being
        connected to workstations and servers via the use of device access control
        software or by disabling external communication interfaces in operating systems.'
      typical_evidence: '1. Validate the media management and removable media usage
        policy documentation covers a restriction on unauthorized removable media
        and devices connecting to workstations and servers.

        2. Validate that removable media and devices are prevented from being connected
        to workstations and servers via the use of device access control software
        or by disabling external communication interfaces in operating systems.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-709
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 709
      name: Media Waste
      description: The resulting media waste particles from the destruction of TOP
        SECRET media is stored and handled as OFFICIAL if less than or equal to 3
        mm, or SECRET if greater than 3 mm and less than or equal to 9 mm.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that the resulting media waste particles\
        \ from the destruction of TOP SECRET media is stored and handled as: \n\u2022\
        \ OFFICIAL if less than or equal to 3 mm\n\u2022 SECRET if greater than 3\
        \ mm and less than or equal to 9 mm"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that the resulting media waste particles\
        \ from the destruction of TOP SECRET media is stored and handled as: \n\u2022\
        \ OFFICIAL if less than or equal to 3 mm\n\u2022 SECRET if greater than 3\
        \ mm and less than or equal to 9 mm"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-710
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 710
      name: Windows Defender
      description: Windows Defender Credential Guard and Windows Defender Remote Credential
        Guard are enabled.
      annotation: 1. Ensure Windows Defender Credential Guard and Windows Defender
        Remote Credential Guard are enabled.
      typical_evidence: 1. Provide evidence showing Windows Defender Credential Guard
        and Windows Defender Remote Credential Guard are enabled.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-711
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 711
      name: Internet Facing services
      description: Where applicable, internet-facing services, office productivity
        suites, web browsers and their extensions, email clients, PDF software, Adobe
        Flash Player, and security products that are no longer supported by vendors
        are removed.
      annotation: '1. Organization monitors all Internet-facing services, office productivity
        suites, web browsers and their extensions, email clients, PDF software, Adobe
        Flash Player, and security products that are on workstations and mobile devices
        that have access to the organization network/applications.

        2. Any Internet-facing services, office productivity suites, web browsers
        and their extensions, email clients, PDF software, Adobe Flash Player, and
        security products that are no longer supported by vendors are immediately
        removed.

        3. Review and removal is done via automated process via having a list of unapproved
        software that is continuously maintained.'
      typical_evidence: '1. Validate organization has monitoring procedures in place
        that monitor workstations for Internet-facing services, office productivity
        suites, web browsers and their extensions, email clients, PDF software, Adobe
        Flash Player, and security products that are no longer supported by vendors.

        2. Validate any inappropriate Internet-facing services, office productivity
        suites, web browsers and their extensions, email clients, PDF software, Adobe
        Flash Player, and security products that are no longer supported by vendors
        are immediately removed via automated process.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-712
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 712
      name: Intrusion Remediation
      description: When identified, planning and coordination of intrusion remediation
        activities are conducted on a separate system to that which has been compromised.
      annotation: '1. Ensure policies and procedures are in place corresponding to
        planning and coordination of intrusion remediation activities.

        2. Verify that previous planning and coordination of intrusion remediation
        activities was conducted on a separate system to that which had been compromised.'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to planning and coordination of intrusion remediation activities.

        2. Provide evidence that previous planning and coordination of intrusion remediation
        activities was conducted on a separate system to that which had been compromised.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-713
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 713
      name: 802.11 use
      description: The use of FT (802.11r) is disabled unless authenticator-to-authenticator
        communications are secured by an ASD Approved Cryptographic Protocol.
      annotation: 1. Ensure FT (802.11r) is disabled unless authenticator-to-authenticator
        communications are secured by an ASD Approved Cryptographic Protocol.
      typical_evidence: 1. Provide evidence showing FT (802.11r) is disabled unless
        authenticator-to-authenticator communications are secured by an ASD Approved
        Cryptographic Protocol.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-714
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 714
      name: Media Waste
      description: The resulting media waste particles from the destruction of SECRET
        media is stored and handled as OFFICIAL if less than or equal to 3 mm, PROTECTED
        if greater than 3 mm and less than or equal to 6 mm, or SECRET if greater
        than 6 mm and less than or equal to 9 mm.
      annotation: "1. Ensure policies and procedures are documented as well as maintained\
        \ for media disposal highlighting that the resulting media waste particles\
        \ from the destruction of SECRET media is stored and handled as:\n\u2022 OFFICIAL\
        \ if less than or equal to 3 mm\n\u2022 PROTECTED if greater than 3 mm and\
        \ less than or equal to 6 mm \n\u2022 SECRET if greater than 6 mm and less\
        \ than or equal to 9 mm"
      typical_evidence: "1. Provide documented policies and procedures in place corresponding\
        \ to media disposal highlighting that the resulting media waste particles\
        \ from the destruction of SECRET media is stored and handled as:\n\u2022 OFFICIAL\
        \ if less than or equal to 3 mm\n\u2022 PROTECTED if greater than 3 mm and\
        \ less than or equal to 6 mm \n\u2022 SECRET if greater than 6 mm and less\
        \ than or equal to 9 mm"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-715
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 715
      name: PDF Software
      description: PDF software is blocked from creating child processes.
      annotation: 1. Verify if creating child processes in PDF viewers is disabled.
      typical_evidence: 1. Provide a snapshot of the configuration for PDF viewers.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-716
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 716
      name: Patching and Updates
      description: Patches, updates or vendor mitigations for security vulnerabilities
        in internet-facing services, office productivity suites, web browsers, extensions,
        email clients, PDF software, operating systems of workstations and internet
        facing services, and security products are applied within two weeks of release,
        or within 48 hours if an exploit exists. Patches, updates or vendor mitigations
        for security vulnerabilities in other applications are applied within one
        month.
      annotation: "1. Obtain vulnerability assessment and patch management policy\n\
        2. Verify timelines for treatment/ patching of high risk vulnerabilities\n\
        3. Validate that a proper process is in place to triage identified vulnerabilities\
        \ \n4. Validate if there is a process to periodically identify and review\
        \ vendor supplied patches\n5. Obtain audit log tracker for patches updated\
        \ for internet-facing services, office productivity suites, web browsers,\
        \ extensions, email clients, PDF software, operating systems of workstations\
        \ and internet facing services, security products, and all other applications.\n\
        6. Obtain and verify VA/PT tracker capturing records, history and status of\
        \ all vulnerabilities identified. \n7. Validate if vulnerability treatment/\
        \ patching is performed within specified time frame."
      typical_evidence: "1. Provide vulnerability assessment and patch management\
        \ policy\n2. Provide last VA scan reports\n3. Provide audit log tracker for\
        \ patches, updates, and vendor mitigations updated for internet-facing services,\
        \ office productivity suites, web browsers, extensions, email clients, PDF\
        \ software, operating systems of workstations and internet facing services,\
        \ and security products\n4. Provide sample change tickets for last patching\
        \ performed based on review.\n5. Provide VA/PT tracker capturing records,\
        \ history and status of all vulnerabilities identified. \n6. Provide sample\
        \ vulnerability treatment ticket for: \n\u2022 Vulnerabilities identified\
        \ for internet-facing services, office productivity suites, web browsers,\
        \ extensions, email clients, PDF software, operating systems of workstations\
        \ and internet facing services, and security products in last VA scan to show\
        \ if it was applied within two weeks.\n\u2022 Vulnerabilities identified with\
        \ an existing exploit in last VA scan to show if it was patched, updated,\
        \ or mitigated within 48 hours.\n\u2022 Vulnerabilities identified for all\
        \ other applications in last VA scan to show if it was applied within one\
        \ month."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-717
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 717
      name: Mobile Device Installation
      description: Mobile devices prevent personnel from installing or uninstalling
        non-approved applications once provisioned.
      annotation: '1. Obtain mobile and portable device management policy

        2. All provisioned mobile devices prevent personnel from installing or uninstalling
        non-approved applications once provisioned.'
      typical_evidence: '1. Mobile and portable device management policy

        2. Sample evidence (screenshot) of mobile device management solution installed
        in the mobile device

        3. Validate mobile devices prevent personnel from installing or uninstalling
        non-approved applications once provisioned.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-718
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 718
      name: Microsoft Drive Block Rules
      description: "Microsoft\u2019s \u2018recommended driver block rules\u2019 are\
        \ implemented."
      annotation: '1. Obtain documented policies and procedures in place corresponding
        to Microsoft''s ''recommended driver block rules''

        2. Verify configuration shows that Microsoft''s ''recommended driver block
        rules'' are in place'
      typical_evidence: '1. Provide documented policies and procedures in place corresponding
        to Microsoft''s ''recommended driver block rules''

        2. Provide configuration snapshots showing Microsoft''s ''recommended driver
        block rules'' are in place'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-719
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 719
      name: Microsoft Office Macros
      description: Microsoft Office macros digitally signed by an untrusted publisher
        cannot be enabled via the Message Bar or Backstage View.  A list of trusted
        publishers is validated on an annual basis.
      annotation: "1. Evaluate if the application hardening process is in place.\n\
        2. Verify if Microsoft Office products installed on workstation is following\
        \ the best practice configurations at the minimum:\n\u2022 Microsoft Office\
        \ macros digitally signed by an untrusted publisher cannot be enabled via\
        \ the Message Bar or Backstage View.\n\u2022 Microsoft Office macro security\
        \ settings cannot be changed by users.\n3. Verify Microsoft Office\u2019s\
        \ list of trusted publishers has been reviewed and validated on an annual\
        \ or more frequent basis."
      typical_evidence: "1. Provide the application hardening process.\n2. Provide\
        \ the configurations of the Microsoft office products installed on the workstations.\n\
        3. Provide evidence of review and validation of Microsoft Office\u2019s list\
        \ of trusted publishers on an annual or more frequent basis."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-720
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 720
      name: Microsoft Office Macros
      description: Microsoft Office macros can only be executed by authorized users
        with valid business requirement and only macros that are running from a trusted
        location and issued by a trusted publishers are allowed to execute.
      annotation: "1. Evaluate if the application hardening process is in place.\n\
        2. Verify if Microsoft Office products installed on workstation is following\
        \ the best practice configurations at the minimum:\n\u2022 Microsoft Office\
        \ macros are only allowed to execute in documents from Trusted Locations where\
        \ write access is limited to personnel whose role is to vet and approve macros,\
        \ within sandboxed environments, or that are digitally signed by a trusted\
        \ publisher.\n\u2022 Microsoft Office macro security settings cannot be changed\
        \ by users."
      typical_evidence: '1. Provide the application hardening process.

        2. Provide the configurations of the Microsoft office products installed on
        the workstations.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-721
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 721
      name: Microsoft Office Macros
      description: Microsoft Office macros are blocked from making Win32 API calls.
      annotation: "1. Evaluate if the application hardening process is in place.\n\
        2. Verify if Microsoft Office products installed on workstation is following\
        \ the best practice configurations at the minimum:\n\u2022 Microsoft Office\
        \ macros are blocked from making Win32 API calls.\n\u2022 Microsoft Office\
        \ macro security settings cannot be changed by users."
      typical_evidence: '1. Provide the application hardening process.

        2. Provide the configurations of the Microsoft office products installed on
        the workstations.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-722
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 722
      name: Microsoft Office Macros
      description: Microsoft Office macro event logs are logs are centrally stored
        and protected from unauthorized modification and deletion, monitored for signs
        of compromise, and actioned when cyber security events are detected.
      annotation: '1. Obtain Log management procedure

        2. Ensure Microsoft Office macro events are logged

        3. Retain event logs and ensure it''s available for review whenever required

        4. Ensure all macro event logs are replicated and stored on a centralized
        server.

        5. Ensure appropriate mechanisms are implemented for protecting integrity
        of logs and to prevent/detect logs modified/tampered at the storage location.'
      typical_evidence: "1. Provide log management procedure \n2. Provide evidence\
        \ of event logs being maintained for Microsoft Office macros\n3. Provide evidence\
        \ of event logs being retained for review\n4. Provide evidence that macro\
        \ event logs are replicated and stored on a centralized server.\n5. Provide\
        \ evidence that appropriate mechanisms are implemented for protecting integrity\
        \ of logs and to prevent/detect logs modified/tampered at the storage location."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-723
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 723
      name: Microsoft Office Macros
      description: Microsoft Office macro antivirus scanning is enabled.
      annotation: "1.Policy and procedure document(s) corresponding to vulnerability\
        \ management should be documented and maintained.\n2. Verify if Microsoft\
        \ Office products installed on workstation is following the best practice\
        \ configurations at the minimum:\n\u2022 Microsoft Office macro antivirus\
        \ scanning is enabled.\n\u2022 Microsoft Office macro security settings cannot\
        \ be changed by users."
      typical_evidence: '1.Policy and procedure document(s) corresponding to vulnerability
        management.

        2. Provide the configurations of the Microsoft office products installed on
        the workstations.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-724
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 724
      name: Microsoft Office
      description: Microsoft Office is blocked from creating child processes, creating
        executable content, and injecting code into other processes.
      annotation: "1. Evaluate if the application hardening process is in place.\n\
        2. Verify if Microsoft Office products installed on workstation is following\
        \ the best practice configurations at the minimum:\n\u2022 Microsoft Office\
        \ is configured to prevent the creation of child processes.\n\u2022 Microsoft\
        \ Office is configured to be blocked from creating executable content.\n\u2022\
        \ Microsoft Office is configured to be blocked from injecting code into other\
        \ processes.\n."
      typical_evidence: '1. Provide the application hardening process.

        2. Provide the configurations of the Microsoft office products installed on
        the workstations.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-725
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 725
      name: Internet Explorer
      description: Internet Explorer 11 is prohibited from being used.
      annotation: 1. Verify Internet Explorer 11 is disabled or removed across the
        organization via the configuration of group policy
      typical_evidence: 1. Provide configuration evidence that Internet Explorer 11
        is disabled or removed across the organization using group policy.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-726
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 726
      name: Mobile Device Storage
      description: If unable to carry or store mobile devices in a secured state,
        they are physically transferred in a security briefcase or an approved multi-use
        satchel, pouch or transit bag.
      annotation: "1. Obtain Teleworking/ trusted device policy/ Code of conduct and\
        \ verify if following precaution for travelling overseas is documented:\n\u2022\
        \ If unable to carry or store mobile devices in a secured state, they are\
        \ physically transferred in a security briefcase or an approved multi-use\
        \ satchel, pouch or transit bag."
      typical_evidence: "1. Provide Teleworking/ trusted device policy/ Code of conduct\
        \ to ensure that following conditions are included in the policy:\n\u2022\
        \ If unable to carry or store mobile devices in a secured state, they are\
        \ physically transferred in a security briefcase or an approved multi-use\
        \ satchel, pouch or transit bag."
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-727
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 727
      name: Execution of Drivers
      description: Execution of drivers, executables, software libraries, scripts,
        installers, compiled HTML, HTML applications and control panel applets is
        limited to an organization-approved set
      annotation: 1. Verify application control is configured to restrict the execution
        of executables, software libraries, scripts, installers, compiled HTML, HTML
        applications, drivers, and control panel applets to an organization-approved
        set.
      typical_evidence: '1. Provide an organization-approved set for execution of
        executables, software libraries, scripts, installers, compiled HTML, HTML
        applications and control panel applets, and drivers.

        2. Provide artefacts showing application control is configured to restrict
        the execution of executables, software libraries, scripts, installers, compiled
        HTML, HTML applications, drivers, and control panel applets to an organization-approved
        set.'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-728
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 728
      name: Electrostatic Memory Devices
      description: Electrostatic memory devices are destroyed using either furnace/incinerator,
        hammer mill, disintegrator or grinder/sander destruction methods.
      annotation: 1. Ensure policies and procedures are documented and maintained
        highlighting that electrostatic memory devices are destroyed using either
        furnace/incinerator, hammer mill, disintegrator or grinder/sander.
      typical_evidence: 1. Provide documented policies and procedures in place highlighting
        that electrostatic memory devices are destroyed using either furnace/incinerator,
        hammer mill, disintegrator or grinder/sander.
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-729
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 729
      name: PowerShell Script Executions
      description: Blocked PowerShell script executions are logged, and event logs
        are centrally stored and protected from unauthorized modification and deletion,
        monitored for signs of compromise, and actioned when cyber security events
        are detected.
      annotation: "1. Verify if PowerShell is configured to use module logging, script\
        \ block logging and transcription functionality.\n2. Verify if PowerShell\
        \ script block logs are protected by Protected Event Logging functionality.\n\
        3. Verify if Microsoft\u2019s Attack Surface Reduction rules are implemented.\
        \ (if applicable)\n4. Retain event logs and ensure it's available for review\
        \ whenever required\n5. Ensure all macro event logs are replicated and stored\
        \ on a centralized server with restricted access to only authorized personnel."
      typical_evidence: "1. Provide evidence of PowerShell configuration. \n2. Provide\
        \ PowerShell script block logs.\n3. Provide evidence of event logs being retained\
        \ for review\n4. Provide evidence that event logs are replicated and stored\
        \ on a centralized server with restricted access."
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-730
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 730
      name: Microsoft Office Macros
      description: Allowed and blocked Microsoft Office macro executions are logged.
      annotation: '1. Obtain Log management procedure

        2. Ensure allowed and blocked Microsoft Office macro executions are logged

        3. Retain event logs and ensure it''s available for review whenever required'
      typical_evidence: "1. Provide log management procedure \n2. Provide evidence\
        \ of logs being maintained for allowed and blocked Microsoft Office macro\
        \ executions\n3. Provide evidence of event logs being retained for review"
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-731
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 731
      name: Data Transfer
      description: All data transferred from a SECRET or TOP SECRET system to any
        other system is reviewed and approved by a trusted source.
      annotation: "1. Obtain and review the documented procedures for transfer of\
        \ data from SECRET or TOP SECRET systems \n2. Validate that the data is transferred\
        \ post obtaining approvals from the authorized sources\n3. Verify that the\
        \ list of approvers to authorize SECRET or TOP SECRET transfer is maintained\
        \ and communicated to relevant personnel\n4. Validate that the list of authorized\
        \ approvers is reviewed periodically, and only this list of authorized approvers\
        \ can approve data transfers."
      typical_evidence: "1. Provide documented policies/procedures in place for transfer\
        \ of data\n2. Provide evidence of approvals obtained from authorized sources,\
        \ prior to allowing the transfer of data from SECRET or TOP SECRET systems\n\
        3. Provide list of approvers authorized to allow data transfer from SECRET\
        \ or TOP SECRET systems \n4. Obtain evidence of review performed on the list\
        \ of authorized approvers"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-732
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 732
      name: Vulnerability scanner
      description: A vulnerability scanner is used at least daily to identify missing
        patches or updates for security vulnerabilities in internet-facing services
        and the corresponding operating systems.
      annotation: '1.Policy and procedure document(s) corresponding to vulnerability
        management should be documented and maintained.

        2.Vulnerability scanning should be done at a regular frequency (at least daily)  in
        order to ensure closure of vulnerabilities identified in past as well as identification
        of new vulnerabilities in the environment.

        3.Tracker of vulnerabilities identified in the scans should be maintained
        to identify missing patches/updates for internet-facing services and operating
        systems of internet-facing services.'
      typical_evidence: '1.Policy and procedure document(s) corresponding to vulnerability
        management.

        2. Validate scans are performed daily and real-time to identify missing patches/updates
        for internet-facing services and operating systems of internet-facing services.

        3. Tracker of vulnerabilities identified in the last scan'
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-733
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 733
      name: Bill of Materials
      description: A software bill of materials is produced and made available to
        consumers of software.
      annotation: 1. Verify a software bill of materials is produced and available
        for all softwares available to consumers
      typical_evidence: "1. Provide a list of softwares available to consumers \n\
        2. Provide a software bill of materials for each software"
      implementation_groups:
      - process
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-734
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 734
      name: Security Txt File
      description: "A \u2018security.txt\u2019 file is hosted for all internet-facing\
        \ organizational domains to assist in the responsible disclosure of security\
        \ vulnerabilities in organizations' products and services."
      annotation: 1. Validate a 'security.txt' file is hosted for all internet-facing
        organizational domains to assist in the responsible disclosure of security
        vulnerabilities in organizations' products and services.
      typical_evidence: 1. Provide a list of all internet-facing organizational domains.
      implementation_groups:
      - technology
    - urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:ccf-735
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cisco-ccf-v3.0:irap-unique-controls:13
      ref_id: CCF 735
      name: .NET Framework
      description: .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
      annotation: 1. Ensure .NET Framework 3.5 is disabled or removed.
      typical_evidence: 1. Provide evidence via group policy configuration details
        that .NET Framework 3.5 is disabled or removed.
      implementation_groups:
      - technology
