DARKNX — Controls

Policies for information security 5 — Organizational Controls

Acceptable use of information and other associated assets 5 — Organizational Controls

Return of assets 5 — Organizational Controls

Classification of information 5 — Organizational Controls

Labelling of information 5 — Organizational Controls

Information transfer 5 — Organizational Controls

Access control 5 — Organizational Controls

Identity management 5 — Organizational Controls

Authentication information 5 — Organizational Controls

Access rights 5 — Organizational Controls

Information security in supplier relationships 5 — Organizational Controls

Information security roles and responsibilities 5 — Organizational Controls

Addressing information security within supplier agreements 5 — Organizational Controls

Managing information security in the ICT supply chain 5 — Organizational Controls

Monitoring, review and change management of supplier services 5 — Organizational Controls

Information security for use of cloud services 5 — Organizational Controls

Information security incident management planning and preparation 5 — Organizational Controls

Assessment and decision on information security events 5 — Organizational Controls

Response to information security incidents 5 — Organizational Controls

Learning from information security incidents 5 — Organizational Controls

Collection of evidence 5 — Organizational Controls

Information security during disruption 5 — Organizational Controls

Segregation of duties 5 — Organizational Controls

ICT readiness for business continuity 5 — Organizational Controls

Legal, statutory, regulatory, and contractual requirements 5 — Organizational Controls

Intellectual property rights 5 — Organizational Controls

Protection of records 5 — Organizational Controls

Privacy and protection of personal information 5 — Organizational Controls

Independent review of information security 5 — Organizational Controls

Compliance with policies, rules, and standards for information security 5 — Organizational Controls

Documented operating procedures 5 — Organizational Controls

Management responsibilities 5 — Organizational Controls

Contact with authorities 5 — Organizational Controls

Contact with special interest groups 5 — Organizational Controls

Threat intelligence 5 — Organizational Controls

Information security in project management 5 — Organizational Controls

Inventory of information and other associated assets 5 — Organizational Controls

Screening 6 — People Controls

Terms and conditions of employment 6 — People Controls

Information security awareness, education, and training 6 — People Controls

Disciplinary process 6 — People Controls

Responsibilities after termination or change of employment 6 — People Controls

Confidentiality or non-disclosure agreements 6 — People Controls

Remote working 6 — People Controls

Information security event reporting 6 — People Controls

Physical security perimeters 7 — Physical Controls

Storage media 7 — Physical Controls

Supporting utilities 7 — Physical Controls

Cabling security 7 — Physical Controls

Equipment maintenance 7 — Physical Controls

Secure disposal or re-use of equipment 7 — Physical Controls

Physical entry 7 — Physical Controls

Securing offices, rooms, and facilities 7 — Physical Controls

Physical security monitoring 7 — Physical Controls

Protecting against physical and environmental threats 7 — Physical Controls

Working in secure areas 7 — Physical Controls

Clear desk and clear screen 7 — Physical Controls

Equipment siting and protection 7 — Physical Controls

Security of assets off-premises 7 — Physical Controls

User end point devices 8 — Technological Controls

Information deletion 8 — Technological Controls

Data masking 8 — Technological Controls

Data leakage prevention 8 — Technological Controls

Information backup 8 — Technological Controls

Redundancy of information processing facilities 8 — Technological Controls

Logging 8 — Technological Controls

Monitoring activities 8 — Technological Controls

Clock synchronisation 8 — Technological Controls

Use of privileged utility programs 8 — Technological Controls

Installation of software on operational systems 8 — Technological Controls

Privileged access rights 8 — Technological Controls

Networks security 8 — Technological Controls

Security of network services 8 — Technological Controls

Segregation of networks 8 — Technological Controls

Web filtering 8 — Technological Controls

Use of cryptography 8 — Technological Controls

Secure development life cycle 8 — Technological Controls

Application security requirements 8 — Technological Controls

Secure system architecture and engineering principles 8 — Technological Controls

Secure coding 8 — Technological Controls

Security testing in development and acceptance 8 — Technological Controls

Information access restriction 8 — Technological Controls

Outsourced development 8 — Technological Controls

Separation of development, test, and production environments 8 — Technological Controls

Change management 8 — Technological Controls

Test information 8 — Technological Controls

Protection of information systems during audit testing 8 — Technological Controls

Access to source code 8 — Technological Controls

Secure authentication 8 — Technological Controls

Capacity management 8 — Technological Controls

Protection against malware 8 — Technological Controls

Management of technical vulnerabilities 8 — Technological Controls

Configuration management 8 — Technological Controls

Capacity Management A1 — Availability

Environmental Threats A1 — Availability

Recovery Plan Testing A1 — Availability

Identifies and Maintains Confidential Information C1 — Confidentiality

Disposes of Confidential Information C1 — Confidentiality

Demonstrates Commitment to Integrity and Ethical Values CC1 — Control Environment

Exercises Oversight Responsibility CC1 — Control Environment

Establishes Structure, Authority, and Responsibility CC1 — Control Environment

Demonstrates Commitment to Competence CC1 — Control Environment

Enforces Accountability CC1 — Control Environment

Uses Relevant Information CC2 — Communication and Information

Communicates Internally CC2 — Communication and Information

Communicates Externally CC2 — Communication and Information

Specifies Suitable Objectives CC3 — Risk Assessment

Identifies and Analyzes Risk CC3 — Risk Assessment

Assesses Fraud Risk CC3 — Risk Assessment

Identifies and Analyzes Significant Change CC3 — Risk Assessment

Conducts Ongoing and/or Separate Evaluations CC4 — Monitoring Activities

Evaluates and Communicates Deficiencies CC4 — Monitoring Activities

Selects and Develops Control Activities CC5 — Control Activities

Selects and Develops General Controls Over Technology CC5 — Control Activities

Deploys Through Policies and Procedures CC5 — Control Activities

Logical Access Security Software, Infrastructure, and Architectures CC6 — Logical and Physical Access Controls

New Internal and External Users Provisioning CC6 — Logical and Physical Access Controls

Role-Based Access Control CC6 — Logical and Physical Access Controls

Physical Access Restrictions CC6 — Logical and Physical Access Controls

Cessation of Access CC6 — Logical and Physical Access Controls

Security Measures Against External Threats CC6 — Logical and Physical Access Controls

Transmission and Movement of Information CC6 — Logical and Physical Access Controls

Prevention or Detection of Unauthorized Software CC6 — Logical and Physical Access Controls

Detection and Monitoring Procedures CC7 — System Operations

Monitors System Components for Anomalous Behavior CC7 — System Operations

Evaluates Security Events CC7 — System Operations

Responds to Security Incidents CC7 — System Operations

Identifies, Develops, and Implements Activities to Recover CC7 — System Operations

Authorizes, Designs, Develops or Acquires, Configures, Documents, Tests, Approves, and Implements Changes CC8 — Change Management

Identifies, Selects, and Develops Risk Mitigation Activities CC9 — Risk Mitigation

Assesses and Manages Risks from Vendors and Business Partners CC9 — Risk Mitigation