Agenda packet — Modesto City Council, June 4, 2024 (part 3 of 11)

8.1* (partial)
A.14.2.7
A.18.1.3
A.18.1.4
A18.2.1
A.15.1.2
A.12.1.4

8.1* (partial)

8.1* (partial)
A.15.2.1

8.1* (partial)
A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial)
A.14.2.2

8.1* (partial)
A.14.2.3

8.1* (partial)
A.14.2.4

8.1* (partial)
A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 84
#15..
- 415 -
CCC-03.1 Do you provide your tenants with documentation that describes your quality assurance process?
CCC-03.2 Is documentation describing known issues with certain products/services available?
CCC-03.3 Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?
CCC-03.4 Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?
Change Control &
Configuration
Management
Unauthorized Software
Installations
CCC-04 CCC-04.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?
A3.6.0
S3.5.0
S3.13.0
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.13.0) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

CC5.5
CC5.8
CC7.4
G.1
I.2
G.2.13,
G.20.2,G.20.4,
G.20.5, G.7,
G.7.1, G.12.11,
H.2.16,
I.2.22.1,
I.2.22.3,
I.2.22.6, I.2.23
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-05 APO13.01
BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
312.8 and 312.10 ITOS > Service
Support >
Configuration
Management ->
Software
Mangement
shared x None NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)

3.2.4 8.2.2
A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3
A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1

8.1* (partial)
A.14.2.4
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7
FTC Fair Information
Principles
Involves both managerial
and technical measures
to protect against loss
and the unauthorized
access, destruction, use,
or disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

14.1 1.3.3

2.1, 2.2.2

3.6 4.1

5.1, 5.2, 5.3, 5.4

6.2 7.1

9.1 9.1.1

9.1.2 9.1.3

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

10.1, 10.2, 10.3,

10.4, 10.5, 10.6,

10.7 11.1, 11.4, 11.5

12.3 Change Control &
Configuration
Management
Production Changes
CCC-05 CCC-05.1 Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant) impacting (physical and virtual) application and systemsystem interface (API) designs and configurations, as well as infrastructure network and systems components. Technical measures shall be implemented to provide assurance that, prior to deployment, all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA).

Do you provide tenants with documentation that describes your production change management procedures and their
roles/rights/responsibilities within it?
A3.16.0
S3.13.0
(A3.16.0, S3.13.0) Procedures exist to provide that
only authorized, tested, and documented changes
are made to the system.

CC7.4
CC7.4
I.2.17, I.2.20,
I.2.22
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-02 COBIT 4.1 A16.1,
A17.6
BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06
ITOS > Service
Support > Release
Management
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

1.2.6 45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.4
A.12.5.1
A.12.5.2
A.12.1.4

8.1* (partial)
A.14.2.2

8.1* (partial)
A.14.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment
#11
CIP-003-3 -
R6
CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7
AR- 4. Privacy Monitoring
and Auditing.

The organization Senior
Agency Official for
Privacy (SAOP)/Chief
Privacy Officer (CPO)
coordinates monitoring
and auditing efforts with
information security

12.1 12.4
PA14 SGP PCI DSS v2.0

1.1.1 PCI DSS v2.0

6.3.2 PCI DSS v2.0

6.4 PCI DSS v2.0

6.1 1.1.1

6.3.2 6.4.5
DSI-01.1 Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country)?
DSI-01.2 Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)? DSI-01.3 Do you have a capability to use system geographic location as an authentication factor?
DSI-01.4 Can you provide the physical location/geography of storage of a tenant’s data upon request?
DSI-01.5 Can you provide the physical location/geography of storage of a tenant's data in advance?
DSI-01.6 Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)? DSI-01.7 Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation?
DSI-02.1 Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?
DSI-02.2 Can you ensure that data does not migrate beyond a defined geographical residency?
DSI-03.1 Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?
DSI-03.2 Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?
DSI-04.1 Are policies and procedures established for labeling, handling and the security of data and objects that contain data?
DSI-04.2 Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?
Data Security &
Information Lifecycle
Management
Nonproduction Data
DSI-05 DSI-05.1 Production data shall not be replicated or used in non-production environments.

Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?
C3.5.0
S3.4.0
C3.21.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that
confidential information is protected during the
system development, testing, and change
processes in accordance with defined system
confidentiality and related security policies.

C1.3
CC5.6
C1.1
I.2.18 DG-06 APO01.06
BAI01.01
BAI03.07
BAI07.04
SRM > Policies
and Standards >
Technical
Standard (Data
Management
Security
Standard)
shared x Domain 5 6.03. (d) NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 45 CFR
164.308(a)(4)(ii)
(B)
A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1
A.8.1.3
A.12.1.4
A.14.3.1

8.1* (partial)
A.14.2.2.

Commandment #9
Commandment
#10
Commandment
#11
CIP-003-3 -
R6
SA-11
CM-04
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

INFORMATION

17.8 PCI DSS v2.0

6.4.3 6.4.3
Data Security &
Information Lifecycle
Management
Ownership /
Stewardship
DSI-06 DSI-06.1 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

Are the responsibilities regarding data stewardship defined, assigned, documented and communicated?
S2.2.0
S2.3.0
S3.8.0
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary
CC2.3
CC3.1
C.2.5.1,
C.2.5.2, D.1.3,
L.7
Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.1.3 DG-01 COBIT 4.1 DS5.1,
PO 2.3
APO01.06
APO03.02
APO13.01
APO13.03
312.4 BOSS > Data
Governance >
Data Ownership /
Stewardship
shared x Domain 5 Article 4 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2

6.2.1 45 CFR 164.308
(a)(2)
A.6.1.3
A.7.1.2
A.15.1.4
A.6.1.1
A.8.1.2
A.18.1.4
Commandment #6
Commandment
#10
Chapter IV
Article 30
CIP-007-3 -
R1.1 -
R1.2
CA-2
PM-5
PS-2
RA-2
SA-2
AP-1 AUTHORITY TO
COLLECT. AP-2 PURPOSE
SPECIFICATION.

3.4 3.7

12.5.5 12.10.4
DSI-07.1 Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant?
DSI-07.2 Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?
DCS-01.1 Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset?
DCS-01.2 Do you maintain a complete inventory of all of your critical supplier relationships?
Datacenter Security
Controlled Access
Points
DCS02DCS-02.1 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks and security patrols) implemented? A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

12.3 APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06
312.8 and 312.10 Infra Services >
Facility Security >
Controlled
Physical Access
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1 A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-7
PE-8
PE-18

8.1 8.2
PA4 BSGP PCI DSS v2.0

9.1 9.1

9.1.1 9.1.2, 9.1.3

9.2, 9.3, 9.4, 9.4.1,

9.4.2, 9.4.3, 9.4.4
Datacenter Security
Equipment
Identification
DCS03DCS-03.1 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location?
S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CC5.1 D.1 D.1.1, D.1.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-13 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
312.3, 312.8 and
312.10
> > Domain 8 6.05. (a) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
A.11.4.3 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8
IA-3
IA-4
PA22
PA33
GP
SGP
Datacenter Security
Offsite Authorization
DCS04DCS-04.1 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another? (e.g., offsite backups, business continuity failovers, replication) S3.2.f
C3.9.0
(S3.2.f) f. Restriction of access to offline storage,
backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access
to the defined system including, but not limited to:
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.1
CC5.5
F.2.18, F.2.19, Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-06 EDM05.02
APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01
312.8 and 312.10 SRM > Facility
Security > Asset
Handling
provider x Domain 8 6.08. (a)

12.5 19.1
PA4 BSGP PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 9.6.3
Datacenter Security
Offsite equipment
DCS05DCS-05.1 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premise. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full write of the drive to ensure that the erased drive is released to inventory for reuse and deployment or securely stored until it can be destroyed.

Can you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 D.1 D.1.1, D.2.1.

D.2.2,
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-07 APO09.03
APO10.04
APO10.05
APO13.01
DSS01.02
312.8 and 312.10 BOSS > Data
Governance >
Secure Disposal
of Data
provider x Domain 8 6.05. (a)

6.05. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30
45 CFR 164.310
(c )
45 CFR 164.310
(d)(1) (New)
45 CFR 164.310
(d)(2)(i) (New)
A.9.2.5
A.9.2.6
A.8.1.1
A.8.1.2
Commandment #6
Commandment #7
Commandment #8
CM-8 12.6 PA4 BSGP PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 PCI DSS v2.0

9.10 9.8, 9.8.1, 9.8.2

12.3 DCS-06.1 Can you provide evidence that policies, standards and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities and secure areas? DCS-06.2 Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards and procedures?
Datacenter Security
Secure Area
Authorization
DCS07DCS-07.1 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-04 DS 12.2, DS 12.3 APO13.01
APO13.02
DSS05.05
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1
A.9.1.2
A.11.1.6 Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4
PE-7
PE-16
PE-18

8.2 8.1
PA4 BSGP PCI DSS v2.0

9.1 PCI DSS v2.0

9.1.1 PCI DSS v2.0

9.1.2 PCI DSS v2.0

9.1.3 PCI DSS v2.0

9.2 9.1

9.1.1 9.1.3
Datacenter Security
Unauthorized Persons
Entry
DCS08DCS-08.1 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 G.21 F.2.18 Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-05 COBIT 4.1 DS

12.3 APO13.01
APO13.02
DSS05.05
DSS06.03
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16

99.31.a.1.ii 8.2.5

8.2.6 A.9.1.6 A.11.2.5

8.1* (partial)
A.12.1.2
Commandment #6
Commandment #7
MA-1
MA-2
PE-16

8.1 8.2

8.3 8.4
PA4 BSGP 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3 Datacenter Security
User Access
DCS09DCS-09.1 Physical access to information assets and functions by users and support personnel shall be restricted.

Do you restrict physical access to information assets and functions by users and support personnel?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B)
10 (B)
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-02 APO13.01
APO13.02
DSS05.04
DSS05.05
DSS06.03
312.8 and 312.10 Infra Services >
Facility Security >
Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 45 CFR
164.310(a)(1)
(New)
45 CFR
164.310(a)(2)(ii)
(New)
45 CFR
164.310(b)
(New)
45 CFR 164.310
( c) (New)
A.9.1.1
A.9.1.2
A.11.1.1 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Chapter II,
Article 19
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-18

8.1 8.2
PA4
PA13
PA24
BSGP
SGP
P
PCI DSS v2.0

9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

9.4.4 9.5

9.5.1 Encryption & Key
Management
Entitlement
EKM01EKM-01.1 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.

Do you have key management policies binding keys to identifiable owners?
APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
SRM >
Cryptographic
Services > Key
Management
Annex
A.10.1
A.10.1.1
A.10.1.2
PA36 3.5, 7.1.3

8.1 8.1.1

8.2.2 EKM-02.1 Do you have a capability to allow creation of unique encryption keys 8.5 per tenant?
EKM-02.2 Do you have a capability to manage encryption keys on behalf of tenants?
EKM-02.3 Do you maintain key management procedures?
EKM-02.4 Do you have documented ownership for each stage of the lifecycle of encryption keys?
EKM-02.5 Do you utilize any third party/open source/proprietary frameworks to manage encryption keys?
EKM-03.1 Do you encrypt tenant data at rest (on disk/storage) within your environment?
EKM-03.2 Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?
EKM-03.3 Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g. identity-based encryption)?
EKM-03.4 Do you have documentation establishing and defining your encryption management policies, procedures and guidelines? EKM-04.1 Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms?
EKM-04.2 Are your encryption keys maintained by the cloud consumer or a trusted key management provider?
EKM-04.3 Do you store encryption keys in the cloud?
EKM-04.4 Do you have separate key management and key usage duties? GRM01.1Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?
GRM01.2Do you have a capability to continuously monitor and report the compliance of your infrastructure against your information security baselines?
GRM01.3Do you allow your clients to provide their own trusted virtual machine image to ensure conformance to their own internal standards?
GRM02.1Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)?
GRM02.2Do you conduct risk assessments associated with data governance requirements at least once a year?
Governance and Risk
Management
Management
Oversight
GRM03GRM03.1Managers are responsible for maintaining awareness of, and complying with, security policies, procedures and standards that are relevant to their area of responsibility.

Are your technical, business, and executive managers responsible for maintaining awareness of and compliance with security policies, procedures, and standards for both themselves and their employees as they pertain to the manager and employees' area of
responsibility?
S1.2.f
S2.3.0
(S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.

CC3.2
E.1 E.4 5 (B)
65 (B)
Schedule 1
(Section 5) 4.1
Accountability; 4.7
Safeguards, Sub

4.7.4 IS-14 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
COBIT 4.1 DS5.5
APO01.03
APO01.04
APO01.08
DSS01.01
312.8 and 312.10 BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 3,
9 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)

1.1.2 8.2.1
Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1
Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2
Commandment #6
Commandment #7
Commandment #8
AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10
AR-1 Governance and
Privacy Program

3.2 PCI DSS v2.0

12.6.1 PCI DSS v2.0

12.6.2 12.6, 7.3, 8.8, 9.10

6.1 6.2

6.3 6.4

6.5 6.6

6.7 3.1

9.6.1, 9.7.1

9.10 12.3

1.1.3 12.3.3

2.1.1 3.1

4.1 4.1.1

4.2 9.5, 9.5.1

9.6 9.7

9.8 9.9

3.1.1 9.8, 9.8.1, 9.8.2,

3.1 9.7.1

9.9 9.9.1

9.1 9.1.1

9.1.2 9.2

9.3 9.4

9.4.1 9.4.2

9.4.3 9.4.4

3.4.1 3.5

3.5.1 3.5.2

3.6 3.6.1

3.6.2 3.6.3

3.6.4 3.6.5

3.6.6 3.6.7

3.6.8,

4.1 6.5.3

8.2.1 8.2.2

2.1.1 2.3

3.3 3.4

3.4.1 4.1

4.1.1 4.2

4.3 6.5.3

6.5.4 8.2.1

3.5.2, 3.5.3

3.6.1, 3.6.3

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4

12.2 PA4
PA8
PA37
PA38
BSGP
BSGP
SGP
SGP
PA4 BSGP
PA36
PA25 GP
PA10
PA18
BSGP
GP
PA10 SGP
PA25
PA21
PA5
GP
GP
BSGP
PA10
PA39
PA34
PA40
BSGP
SGP
SGP
SGP

12.1 14.1

14.2 13.1

13.4 13.5

12.3 4.2

8.1 16.2

16.1 4.4

5.1 3.3

4.3 8.4
AR-1 Governance and
Privacy Program. TR-1
PRIVACY NOTICE. TR-3

DISSEMINATION OF

PRIVACY PROGRAM

INFORMATION
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research.

TR-2 SYSTEM OF

RECORDS NOTICES AND

PRIVACY ACT

STATEMENTS
TR-2 SYSTEM OF

RECORDS NOTICES AND

PRIVACY ACT

STATEMENTS
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

INFORMATION
DM-2 DATA RETENTION

AND DISPOSAL

99.31.(a)(1)(ii)
ITOS > Service
Support >
Configuration
Management -
Physical
Inventory
provider x
SRM > Policies
and Standards >
Information
Security Policies
(Facility Security
Policy)
provider x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption,
Cryptographic
Services - Data-inTransit Encryption
shared x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM >
Governance Risk
& Compliance >
Technical
Standards
BOSS >
Operational Risk
Management >
Independent Risk
Management
shared x
ITOS > Service
Support > Release
Management
shared x
BOSS > Data
Governance >
Data
Classification
shared x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
shared x
shared x
312.3
312.8 and 312.10
312.2
312.3
312.8 and 312.10
312.8 and 312.10
312.1
APO11.01
APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05
APO01.06
APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO13.01
BAI09.03
DSS01.01
APO01.06
APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO13.01
DSS01.04
DSS01.05
DSS04.01
DSS04.03
APO13.01
APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03
APO13.01
DSS05.02
DSS05.03
DSS06.06
APO01.06
BAI09.02
BAI09.03
APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01
CC3.2
CC3.1
CC3.1
CC7.1
CC7.1
CC7.1
CC7.1
CC7.4
CC3.1
CC3.1
CC5.7
PI1.5
CC5.1
C1.3
CC5.6
CC3.1
CC3.1
Domain 5
CC5.5
CC5.7
CC5.6
CC5.7
CC5.6
CA-3
RA-2
RA-3
MP-8
PM-9
SI-12
PCI DSS v2.0

12.1 PCI DSS v2.0

12.1.2 EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01
AR-2 Privacy Impact and
Risk Assessment
A.12.1.1
A.15.2.2
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
Chapter II, Article 19 and
Chapter VI, Section I, Article
39 312.8 and 312.10 shared x CM-2
SA-2
SA-4
PCI DSS v1.2

1.1 PCI DSS v1.2

1.1.1 PCI DSS v1.2

1.1.2 PCI DSS v1.2

1.1.3 PCI DSS v1.2

1.1.4 PCI DSS v1.2

1.1.5 PCI DSS v1.2

1.1.6 PCI DSS v1.2

2.2 PCI DSS v1.2

2.2.1 PCI DSS v1.2

2.2.2 PCI DSS v1.2

2.2.3 PCI DSS v1.2

2.2.4 Governance and Risk
Management
Risk Assessments
GRM02Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
• Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.

L.4, L.5, L.6,
L.7
34 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
DG-08 COBIT 4.1 PO

9.1, PO 9.2, PO

9.4, DS 5.7
Domain 5 6.01. (d)

6.04.03. (a)
Article 6, Article 8, Article 17
(1)
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12

1.2.4 8.2.1
45 CFR
164.308(a)(1)(ii)
(A) (New)
45 CFR
164.308(a)(8)
(New)
Clause 4.2.1 c) &
g)
Clause 4.2.3 d)
Clause 4.3.1 &

4.3.3 Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4
EAR 15
CFR
§736.2 (b)
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
Commandment
#11
45 CFR 164.312
(a)(2)(iv)
45 CFR 164.312
(e)(1)
45 CFR 164.312
(e)(2)(ii)
A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
Encryption & Key
Management
Key Generation
EKM02Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over
implementation of the control.

CIP-003-3 -
R4.2
AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8
PCI-DSS v2.0

2.1.1 PCI-DSS v2.0

3.4 PCI-DSS v2.0

3.4.1 PCI-DSS v2.0

4.1 PCI-DSS v2.0

4.1.1 PCI DSS v2.0

4.2 Encryption & Key
Management
Storage and Access
EKM04Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required.

Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

Governance and Risk
Management
Baseline Requirements
GRM01Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use.

Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and established and authorized based on business need.

S1.1.0
S1.2.0(ai)
(S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include,
but may not be limited to, the following matters:

L.2 L.2, L.5, L.7
L.8, L.9, L.10
12 (B)
14 (B)
13 (B)
15 (B)
16 (C+,
A+)
21 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
IS-04 COBIT 4.1 AI2.1
COBIT 4.1 AI2.2
COBIT 4.1 AI3.3
COBIT 4.1 DS2.3
COBIT 4.1 DS11.6
Domain 2 6.03.01. (a)

6.03.04. (a)

6.03.04. (b)

6.03.04. (c)

6.03.04. (e)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SC-30

1.2.6 8.2.1

8.2.7 Encryption & Key
Management
Encryption
EKM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations) and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

C3.12.0
S3.6.0
S3.4
(C3.12.0, S3.6.0) Encryption or other equivalent
security techniques are used to protect
transmissions of user authentication and other
confidential information passed over the Internet
or other public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.4
G.15
I.3
G.10.4, G.11.1,
G.11.2, G.12.1,
G.12.2, G.12.4,
G.12.10,
G.14.18,
G.14.19,
G.16.2,
G.16.18,
G.16.19,
G.17.16,
G.17.17,
G.18.13,
G.18.14,
G.19.1.1,
G.20.14
23 (B)
24 (B)
25 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-18 COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
COBIT 4.1 DS5.11
Domain 2 6.04.05. (a)

6.04.05. (c)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-23
NIST SP 800-53 R3 SC-28
NIST SP 800-53 R3 SI-8

8.1.1 8.2.1

8.2.5 45 CFR 164.310
(a)(1)
45 CFR 164.310
(a)(2)(ii)
45 CFR
164.308(a)(3)(ii)
(A) (New)
45 CFR 164.310
(a)(2)(iii) (New)
A.5.1.1
A.9.1.3
A.9.1.5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -R2 -
R2.2
PE-2
PE-3
PE-4
PE-5
PE-6
PCI DSS v2.0

9.1 PCI DSS v2.0

9.2 PCI DSS v2.0

9.3 PCI DSS v2.0

9.4 (S3.6.0) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

L.6 38 (B)
39 (C+)
IS-19 COBIT 4.1 DS5.8 Domain 2 6.04.04. (a)

6.04.04. (b)

6.04.04. (c)

6.04.04. (d)

6.04.04. (e)

6.04.05. (d)

6.04.05. (e)

6.04.08.02. (b)
Article 17 NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-17

8.1.1 8.2.1

8.2.5 45 CFR 164.312
(a)(2)(iv)
45 CFR
164.312(e)(1)
(New)
Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6
Commandment #9
Commandment
#10
Commandment
#11
SC-12
SC-13
SC-17
SC-28
PCI-DSS v2.0

3.4.1 PCI-DSS v2.0

3.5 PCI-DSS v2.0

3.5.1 PCI-DSS v2.0

3.5.2 PCI-DSS v2.0

3.6 PCI-DSS v2.0

3.6.1 PCI-DSS v2.0

3.6.2 PCI-DSS v2.0

3.6.3 PCI-DSS v2.0

3.6.4 PCI-DSS v2.0

3.6.5 PCI-DSS v2.0

3.6.6 PCI-DSS v2.0

3.6.7 PCI-DSS v2.0

3.6.8 Datacenter Security 99.31.a.1.ii
Policy
DCS06Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas.

A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

H.6 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.4.2,
F1.4.6,
F.1.4.7, F.1.7,
F.1.8, F.2.13,
F.2.14, F.2.15,
F.2.16, F.2.17,
F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-01 COBIT 4.1 DS5.7,
DS 12.1, DS 12.4
DS 4.9
Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 PE-5
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)

8.2.1 8.2.2

8.2.3 CIP-007-3 -
R7 - R7.1 -
R7.2 R7.3
MP-6
PE-1
PCI DSS v2.0

3.1.1 PCI DSS v2.0

9.10 PCI DSS v2.0

9.10.1 PCI DSS v2.0

9.10.2 PCI DSS v2.0

3.1 Datacenter Security
Asset Management
DCS01Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership y defined roles and responsibilities.

S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.

Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-08 Domain 8 Article 17 45 CFR 164.310
(d)(2)(iii)
A.7.1.1
A.7.1.2
Data Security &
Information Lifecycle
Management
Secure Disposal
DSI-07 Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

PCI DSS v2.0

9.9.1 PCI DSS v2.0

12.3.3 PCI DSS v2.0

12.3.4 NIST SP800-53 R3 CM-8
BOSS > Data
Governance >
Secure Disposal
of Data
C3.5.0
S3.4.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.

D.2.2.10,
D.2.2.11,
D.2.2.14,
37 (B) Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.7.5 and 4.5.3
DG-05 COBIT 4.1 DS

11.4 Domain 5 6.03. (h) Article 16
Article 17
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1

5.1.0 5.2.3
AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9
PCI-DSS v2.0

2.1.1 PCI-DSS v2.0

4.1 PCI-DSS v2.0

4.1.1 PCI DSS v2.0

4.2 A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1
Commandment #8
Commandment #9
Commandment
#10
Chapter II
Article 8, 9, 11, 12, 14, 18, 19,
20, 21
CIP-003-3 -
R4 - R4.1
AC-16
MP-1
MP-3
PE-16
SI-12
SC-9
PCI DSS v2.0

9.5 PCI DSS v2.0

9.6 PCI DSS v2.0

9.7.1 PCI DSS v2.0

9.7.2 PCI DSS v2.0

9.10 SRM >
Cryptographic
Services > Data in
Transit Encryption
shared
45 CFR 164.310
(d)(2)(i)
45 CFR 164.310
(d)(2)(ii)
A.9.2.6
A.10.7.2
Commandment
#11
Data Security &
Information Lifecycle
Management
Handling / Labeling /
Security Policy
DSI-04 Policies and procedures shall be established for labeling, handling, and the security of data and objects which contain data.

Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

G.13 D.2.2 DG-03 COBIT 4.1 PO

2.3, DS 11.6
Domain 5 6.03.05. (b) Article 22
Article 23
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12

1.1.2 5.1.0

7.1.2 8.1.0

8.2.5 8.2.6
Data Security &
Information Lifecycle
Management
Data Inventory / Flows
DSI-02 Policies and procedures shall be established to inv entory , document, and maintain data f lows f or data that is resident (permanently or temporarily ) within the serv ice's applications and inf rastructure network and sy stems. In particular, prov iders shall ensure that data that is subject to geographic residency requirements not be migrated bey ond its def ined bounds.

Data Security &
Information Lifecycle
Management
eCommerce
Transactions
DSI-03 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

S3.6
I13.3.a-e
I3.4.0
(S3.6) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(I13.3.a-e) The procedues related to
completeness, accuracy, timeliness, and
authorization of system processing, including error
correction and database management, are
consistent with documented system processing
integrity policies.
(I3.4.0) The procedures related to completeness,
accuracy, timeliness, and authorization of outputs
are consistent with the documented system
processing integrity policies.

G.4
G.11
G.16
G.18
I.3
I.4
G.19.1.1,
G.19.1.2,
G.19.1.3,
G.10.8, G.9.11,
G.14, G.15.1
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-28 COBIT 4.1 DS

5.10 5.11
Domain 2 Article 17
PCI DSS v2.0

1.1.1 PCI DSS v2.0

6.1 PCI DSS v2.0

6.4 Data Security &
Information Lifecycle
Management
Classification
DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

S3.8.0
C3.14.0
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.

D.1.3, D.2.2 DG-02 COBIT 4.1 PO

2.3, DS 11.6
Domain 5 6.04.03. (a) Article 4 (1),
Article 12, Article 17
NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4

1.2.3 1.2.6

4.1.2 8.2.1

8.2.5 8.2.6
A.7.2.1 Commandment #9
Change Control &
Configuration
Management
Quality Testing
CCC-03 Organization shall follow a defined qualty change control and testing process (e.g. ITIL Service Management) with established baselines, testing and release standards which focus on system availability, confidentiality and integrity of systems and services
General Provisions, Article 3,
V. and VI.

CIP-003-3 -
R4 - R5
RA-2
AC-4
PCI DSS v2.0

9.7.1 PCI DSS v2.0

9.10 PCI DSS v2.0

12.3 None 6.03.01. (b)

6.03.01. (d)
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

9.1.0 9.1.1

9.2.1 9.2.2
A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
Commandment #1
Commandment #2
Commandment #3
Domain 11
A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* partial
A.14.2.2

8.1* partial
A.14.2.3

8.1* partial
A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3
A.8.2.1
Clause

4.2 5.2,

7.5,

8.1 A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4
A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1
A.11.2.7
A.8.3.2
Annex A.8
A.11.1.1
A.11.1.2
Clauses

5.2(c)

5.3(a)

5.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.3

9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5
A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4
Annex
A.10.1
A.10.1.1
A.10.1.2
A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13
(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design,
acquisition, implementation, configuration,
modification, and management of infrastructure
and software are consistent with defined system
availability, confidentiality of data, processing
integrity, systems security and related security
policies.
(S3.13) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

C.1.7, G.1, G.6,
I.1, I.4.5,
I.2.18, I.22.1,
I.22.3, I.22.6,
I.2.23,
I.2.22.2,
I.2.22.4,
I.2.22.7.

I.2.22.8,
I.2.22.9,
I.2.22.10,
I.2.22.11,
I.2.22.12,
I.2.22.13,
I.2.22.14,I.2.2
0, I.2.17,
I.2.7.1, I.3,
J.2.10, L.9
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-03 COBIT 4.1 PO 8.1
A.14.1.1
A.18.2.3
Clauses

5.2(c)

5.3(a)

5.3(b)

6.1.2 6.1.2(a)(2)

6.1.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.2

8.3 9.2(g)
A.18.1.1
A.18.1.3
A.18.1.4
A.8.2.2
CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)

3.2.4 4.2.3

7.1.2 7.2.1

7.2.2 8.2.1

8.2.5 45 CFR
164.312(e)(1)
45 CFR
164.312(e)(2)(i)
A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 85
#15..
- 416 -
GRM04.1
An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and maintenance Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
GRM04.2Do you review your Information Security Management Program (ISMP) least once a year?
Governance and Risk
Management
Management Support
/ Involvement
GRM05GRM05.1Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

Do you ensure your providers adhere to your information security and privacy policies?
S1.3.0 (S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.

The entity has prepared an objective description of
the system and its boundaries and communicated
such description to authorized users
The security obligations of users and the entity’s
security commitments to users are communicated
CC1.2 C.1 5 (B) Schedule 1
(Section 5), 4.1
Safeguards,
Subsec. 4.1.1
IS-02 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03
312.8 and 312.10 SRM >
Governance Risk
& Compliance >
Compliance
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-1 8.2.1 45 CFR 164.316 (b)(2)(ii)
45 CFR 164.316
(b)(2)(iii)
Clause 5
A.6.1.1
All in section 5
plus clauses

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 Commandment #3
Commandment #6
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 - R1.1
CM-1
PM-1
PM-11

4.1 PCI DSS v2.0

12.5 12.4
GRM06.1Do your information security and privacy policies align with industry standards (ISO-27001, ISO-22307, CoBIT, etc.)?
GRM06.2Do you have agreements to ensure your providers adhere to your information security and privacy policies?
GRM06.3Can you provide evidence of due diligence mapping of your controls, architecture and processes to regulations and/or standards? GRM06.4Do you disclose which controls, standards, certifications and/or regulations you comply with?
GRM07.1Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?
GRM07.2Are employees made aware of what actions could be taken in the event of a violation via their policies and procedures? Governance and Risk
Management
Business / Policy
Change Impacts
GRM08GRM08.1Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.

Do risk assessment results include updates to security policies, procedures, standards and controls to ensure they remain relevant and effective?
B.2
G.21
L.2
B.1.1, B.1.2,
B.1.6, B.1.7.2,
G.2, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-04 COBIT 4.1 PO 9.6 APO12
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x Domain 2,
4 6.03. (a) Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2
Clause

4.2.1 a,

4.2(b)

4.3 c,

4.3(a&b)

4.4 5.1(c)

5.1(d)

5.1(e)

5.1(f)

5.1(g)

5.1(h)

5.2 5.2 e,

5.2(f)

5.3 6.1.1(e)(2),

6.1.2(a)(1)

6.2 CIP-009-3 -
R2
CP-2
RA-2
RA-3
AR-2 Privacy Impact and
Risk Assessment

4.3 PCI DSS v2.0

12.1.3 12.2
GRM09.1Do you notify your tenants when you make material changes to your information security and/or privacy policies?
GRM09.2Do you perform, at minimum, annual reviews to your privacy and security policies?
GRM10.1Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?
GRM10.2Is the likelihood and impact associated with inherent and residual risk determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance)?
GRM11.1Do you have a documented, organization-wide program in place to manage risk?
GRM11.2Do you make available documentation of your organization-wide risk management program?
HRS-01.1 Are systems in place to monitor for privacy breaches and notify tenants expeditiously if a privacy event may have impacted their data?
HRS-01.2 Is your Privacy Policy aligned with industry standards? Human Resources
Background Screening
HRS02HRS-02.1 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

Pursuant to local laws, regulations, ethics and contractual constraints, are all employment candidates, contractors and involved third parties subject to background verification? S3.11.0 (S3.11.0) Procedures exist to help ensure that
personnel responsible for the design,
development, implementation, and operation of
systems affecting confidentiality and security have
the qualifications and resources to fulfill their
responsibilities.

CC1.3
CC1.4
E.2 E.2 63 (B)
HR-01
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
COBIT 4.1 PO 7.6 APO07.01
APO07.05
APO07.06
312.8 and 312.10 BOSS > Human
Resources
Security >
Background
Screening
shared x None 6.01. (a) Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3

1.2.9 A.8.1.2 A.7.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #2
Commandment #3
Commandment #6
Commandment #9
CIP-004-3 -
R2.2
PS-2
PS-3

9.29 PA27 BSGP PCI DSS v2.0

12.7 PCI DSS v2.0

12.8.3 12.7

12.8.3 HRS-03.1 Do you specifically train your employees regarding their specific role and the information security controls they must fulfill? HRS-03.2 Do you document employee acknowledgment of training they have completed?
HRS-03.3 Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?
HRS-03.4 Is successful and timed completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems?
HRS-03.5 Are personnel trained and provided with awareness programs at least once a year?
HRS-04.1 Are documented policies, procedures and guidelines in place to govern change in employment and/or termination?
HRS-04.2 Do the above procedures and guidelines account for timely revocation of access and return of assets?
Human Resources
Portable / Mobile
Devices
HRS05HRS-05.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (e.g. laptops, cell phones and personal digital assistants (PDAs)), which are generally higher-risk than nonportable devices (e.g., desktop computers at the provider organization’s facilities)?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 G.11, G12,
G.20.13,
G.20.14
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-32 COBIT 4.1 DS5.11
COBIT 4.1 DS5.5
APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06
312.8 and 312.10 Presentation
Services >
Presentation
Platform >
Endpoints -
Mobile Devices -
Mobile Device
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)

1.2.6 3.2.4

19.1 19.2

19.3 PA33
PA34
SGP
SGP
PCI DSS v2.0

9.7 PCI DSS v2.0

9.7.2 PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 PCI DSS v2.0

11.1 PCI DSS v2.0

12.3 11.1

12.3 Human Resources
Nondisclosure
Agreements
HRS06HRS-06.1 Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented and reviewed at planned intervals?
S4.1.0 (S4.1.0) The entity’s system availability,
confidentiality, processing integrity and security
performance is periodically reviewed and
compared with the defined system availability and
related security policies.

CC4.1 C.2.5 Schedule 1
(Section 5), 4.7 -
Safeguards
LG-01 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Compliance >
Intellectual
Property
Protection
shared x Domain 3 Article 16 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)

1.2.5 ISO/IEC
27001:2005
Annex A.6.1.5
A.13.2.4 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #8
Commandment #9
PL-4
PS-6
SA-9
DI-2 DATA INTEGRITY

AND DATA INTEGRITY
BOARD
a. Documents processes
to ensure the integrity of
personally identifiable
information (PII) through
existing security controls;
and
PA7 BSGP PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Human Resources
Roles / Responsibilities
HRS07HRS-07.1 Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.

Do you provide tenants with a role definition document clarifying your administrative responsibilities versus those of the tenant? S1.2.f (S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.

B.1 B.1.5,
D.1.1,D.1.3.3,
E.1, F.1.1,
H.1.1, K.1.2
5 (B) Schedule 1
(Section 5) 4.1
Accountability
IS-13 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 1.2.9

8.2.1 Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1
Clause 5.3
A.6.1.1
A.6.1.1
Commandment #6
Commandment #7
Commandment #8
AT-3
PL-4
PM-10
PS-1
PS-6
PS-7
AR-1 GOVERNANCE AND

PRIVACY PROGRAM
Control: The organization:

Supplemental Guidance:

The development and
implementation of a
comprehensive
governance and privacy
program demonstrates
organizational
accountability for and
commitment to the
protection of individual

2.2 PA9
PA24
BSGP 12.8.5
HRS-08.1 Do you provide documentation regarding how you may or access tenant data and metadata?
HRS-08.2 Do you collect or create metadata about tenant data usage through inspection technologies (search engines, etc.)?
HRS-08.3 Do you allow tenants to opt out of having their data/metadata accessed via inspection technologies?
HRS-09.1 Do you provide a formal, role-based, security awareness training program for cloud-related access and data management issues (e.g., multi-tenancy, nationality, cloud delivery model segregation of duties implications and conflicts of interest) for all persons with access to tenant data?
HRS-09.2 Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity? HRS-10.1 Are users made aware of their responsibilities for maintaining awareness and compliance with published security policies, procedures, standards and applicable regulatory requirements? HRS-10.2 Are users made aware of their responsibilities for maintaining a safe and secure working environment?
HRS-10.3 Are users made aware of their responsibilities for leaving unattended equipment in a secure manner?
HRS-11.1 Do your data management policies and procedures address tenant and service level conflicts of interests?
HRS-11.2 Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?
HRS-11.3 Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?
IAM-01.1 Do you restrict, log and monitor access to your information security management systems? (E.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)
IAM-01.2 Do you monitor and log privileged access (administrator level) to information security management systems?
IAM-02.1 Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes? IAM-02.2 Do you provide metrics to track the speed with which you are able to remove systems access that is no longer required for business purposes?
Identity & Access
Management
Diagnostic /
Configuration Ports
Access
IAM03IAM-03.1 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

Do you use dedicated secure networks to provide management access to your cloud service infrastructure?
S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

CC5.1 H1.1, H1.2,
G.9.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-30 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
DSS05.05
DSS06.06
312.8 and 312.10 SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
provider x Domain 2 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)

8.2.2 A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4
A.13.1.1
A.9.1.1
A.9.4.4
Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R2
CM-7
MA-3
MA-4
MA-5

15.4 PCI-DSS v2.0

9.1.2 1.2.2

7.1 7.1.2

7.1.3 7.2

7.2.3 9.1.2

9.1.3 IAM-04.1 Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access? IAM-04.2 Do you manage and store the user identity of all personnel who have network access, including their level of access?

9.3 12.3

12.6 12.4

8.1.8 10.5

7.1.2 7.1.4

7.2 8.1

8.1.5 8.5

3.5.1, 7.0

8.0 12.5.4

7.3 8.8

9.10 7.3, 8.8, 9.10, 12.1

12.2 12.1.1

12.2 12.2
PA27 BSGP
PA27 BSGP
BSGP
PA28 BSGP
PA30 BSGP
PA2
PA15
BSGP
SGP

1.1 3.3

5.1 5.2

5.3 5.4

7.1 12.2

17.7 18.1

18.3 3.2 (responsibility)

3.3 3.4

4.1 4.3

5.2 (residual Risk)

2.2 9.2

2.2 5.2

4.2 9.1

9.1 8.1

15.4 15.1

15.2 4.2

4.3 4.4

4.5 4.1

6.1 AR-2 Privacy Impact and
Risk Assessment
AR-5 PRIVACY

AWARENESS AND

TRAINING
Control: The organization:
a. Develops, implements,
and updates a
comprehensive training
and awareness strategy
aimed at ensuring that
personnel understand
privacy responsibilities
and procedures;
b. Administers basic
privacy training
[Assignment:
organization-defined
frequency, at least
annually] and targeted,
role-based privacy
training for personnel
having responsibility for
personally identifiable
information (PII) or for
activities that involve PII
[Assignment:
organization-defined
frequency, at least
annually]; and
c. Ensures that personnel
certify (manually or
electronically) acceptance
of responsibilities for
privacy requirements
[Assignment:

UL-1 INTERNAL USE
Control: The organization
uses personally
identifiable information
(PII) internally only for
the authorized purpose(s)
identified in the Privacy
Act and/or in public
notices.

99.31(a)(i)(ii)

99.31(a)(1)(ii)
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management
shared x
SRM > Policies
and Standards >
shared x
BOSS > Human
Resources
Security >
Employee
Awareness
shared x
BOSS > Data
Governance >
Clear Desk Policy
shared x
SRM > Policies
and Standards >
Information
Security Policies
SRM > InfoSec
Management >
Capabilitiy
Mapping
SRM > Policies
and Standards >
Information
Security Policies
shared x
SRM >
Governance Risk
& Compliance >
shared x
SRM >
Governance Risk
& Compliance >
Policy
Management
shared x
shared x
BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x
SRM > Policies
and Standards >
Information
Security Policies
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO07.04
APO12
APO13.01
APO13.03
MEA03.01
MEA03.02
APO12
EDM03.02
APO01.03
APO12
APO01.03
APO13.01
APO07.06
APO09.03
APO10.01
APO01.02
APO07.05
APO07.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.03
DSS05.05
CC3.2
CC1.2
CC2.3
CC6.2
CC2.5
CC3.2
CC3.1
CC3.3
CC3.1
CC5.6
CC2.2
CC2.3
CC5.4
CC3.2
CC6.2
CC2.2
CC2.3
CC5.1
CC5.5
CC5.6
45 CFR 164.308
(a)(3)(i)
45 CFR 164.312
(a)(1)
45 CFR 164.312
(a)(2)(ii)
45 CFR
164.308(a)(4)(ii)
(B) (New)
45 CFR
164.308(a)(4)(ii)
(c ) (New)
A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1
S3.2.g Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R5.1 -
R5.1.2
AC-1
IA-1
PCI DSS v2.0

3.5.1 PCI DSS v2.0

8.5.1 PCI DSS v2.0

12.5.4 Identity & Access
Management
Policies and Procedures
IAM04Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.

Identity & Access
Management
User Access Policy
IAM02User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customercontrolled access, suppliers' business relationships, or other thirdparty business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multifactor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions
• Adherence to applicable legal, statutory, or regulatory compliance requirements
S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

B.1 B.1.8, B.1.21,
B.1.28, E.6.2,
H.1.1, K.1.4.5,
8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.

4.7.4 IS-07 COBIT 4.1 DS 5.4 Domain 2 6.01. (b)

6.01. (d)

6.02. (e)

6.03. (b)

6.03.04. (b)

6.03.04. (c)

6.03.05. (b)

6.03.05. (d)

6.03.06. (b)

6.04.01. (c)

6.04.01. (f)

6.04.02. (a)

6.04.02. (b)

6.04.02. (c)

6.04.03. (b)

6.04.06. (a)

6.04.08. (a)

6.04.08. (b)

6.04.08. (c)

6.04.08.03. (a)

6.04.08.03. (b)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
Identity & Access
Management
Audit Tools Access
IAM01Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-29 COBIT 4.1 DS 5.7 Domain 2 6.03. (i)

6.03. (j)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1

8.1.0 NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)

8.2.1 A.15.3.2 Commandment #2
Commandment #5
Commandment
#11
CIP-003-3 -
R5.2
AU-9
AU-11
AU-14
PCI DSS v2.0

10.5.5 AT-2
AT-3
AT-4
PL-4
PCI DSS v2.0

8.5.7 PCI DSS v2.0

12.6.1 Human Resources
Workspace
HRS11Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions had been disabled after an established period of inactivity.

S3.3.0
S3.4.0
(S3.3.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.

E.1 E.4 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-17 Domain 2 NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2

8.2.3 Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #5
Commandment #6
Commandment #7
Commandment
#11
Human Resources
User Responsibility
HRS10All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality,
processing integrity and security policies and
changes and updates to those policies are
communicated to entity personnel responsible for
implementing them.

E.1 E.4 65 (B)
66 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.4
IS-16 COBIT 4.1 PO 4.6 Domain 2 Article 17 NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
CC3.2 APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06
312.8 and 312.10
312.8 and 312.10
45 CFR 164.308
(a)(5)(i)
45 CFR 164.308
(a)(5)(ii)(A)
Clause 5.2.2
A.8.2.2
Commandment #3
Commandment #6
SRM > GRC > shared x
AC-11
MP-2
MP-3
MP-4
Chapter VI, Section I, Article
39 and Chapyer VI, Section II,
Article 41
CIP-004-3 -
R1 - R2 -
R2.1
AT-1
AT-2
AT-3
AT-4
PCI DSS v2.0

12.6 PCI DSS v2.0

12.6.1 PCI DSS v2.0

12.6.2 1.2.10

8.2.1 45 CFR 164.308
(a)(5)(ii)(D)
Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2
Commandment #5
Commandment #6
Commandment #7
Chapter VI, Section I, Article
39 and Chapter VI, Section II,
Article 41
Human Resources
Training / Awareness
HRS09A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

S1.2.k
S2.2.0
(S1.2.k) The entity's security policies include, but
may not be limited to, the following matters:
k. Providing for training and other resources to
support its system security policies
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.

E.1 E.4 65 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.

4.7.4 IS-11 COBIT 4.1 PO 7.4 Domain 2 6.01. (c)

6.02. (e)
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4

1.2.10 8.2.1
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and 312.10
Human Resources
Acceptable Use
HRS08Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

S1.2
S3.9
(S1.2) The entity’s security policies include, but
may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.

B.3 B.1.7, D.1.3.3,
E.3.2, E.3.5.1,
E.3.5.2
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-26 COBIT 4.1 DS 5.3 Domain 2 Article 5, Article 6
Article 7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4

8.1.0 45 CFR 164.310
(b)
A.7.1.3 Commandment #1
Commandment #2
Commandment #3
Human Resources
Employment
Termination
HRS04Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

AC-8
AC-20
PL-4
PCI-DSS v2.0

12.3.5 312.8 and 312.10
312.4, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
S3.2.d
S3.8.e
(S3.2.d) Procedures exist to restrict logical access
to the system and information resources
maintained in the system including, but not limited
to, the following matters:
d. The process to make changes and updates to
user profiles
(S3.8.e) e. Procedures to prevent customers,
groups of individuals, or other entities from
accessing confidential information other than their
own
E.6 HR-03 COBIT 4.1 PO 7.8 None Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8

8.2.2 10.2.5
GRM11Organizations shall develop and maintain an enterprise risk management framework to mitigate risk to an acceptable level. 45 CFR 164.308
(a)(3)(ii)(C)
A.8.3.1 Commandment #6
Commandment #7
312.3, 312.8 and
312.10
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security >
Employee
Termination
provider x
BOSS > Human
Resources
Security >
Employee Code
of Conduct
shared x
shared x
45 CFR 164.308
(a)(3)(ii)(C)
A.7.1.1
A.7.1.2
A.8.3.2
Governance and Risk
Management
Program
PS-4
Human Resources
Employment
Agreements
HRS03Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

S2.2.0 (S2.2.0) The security obligations of users and the entity's security commitments to users are
communicated to authorized users
C.1 E.3.5 66 (B) Schedule 1
(Section 5) 4.7
Safeguards,
Subsec. 4.7.4
HR-02 COBIT DS 2.1 None Article 17 NIST SP 800-53 R3 PS1 NIST SP 800-53 R3 PS2
NIST SP 800-53 R3 PS6
NIST SP 800-53 R3 PS7
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

1.2.9 8.2.6
45 CFR
164.310(a)(1)
(New)
45 CFR
164.308(a)(4)(i)
(New)
A.6.1.5
A.8.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
PL-4
PS-6
PS-7
Human Resources
Asset Returns
HRS01Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

D.1 E.6.4 Schedule 1
(Section 5) 4.5
Limiting Use,
Disclosure and
Retention; 4.7
Safeguards, Subs.

4.7.5 IS-27 Domain 2 Article 17 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-4 5.2.3

7.2.2 8.2.1

8.2.6 APO01.08
APO07.06
APO13.01
BAI09.03
45 CFR 164.308
(a)(1)(ii)(A)
Clause 4.2.1 c)
through g)
Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2
CIP-002-3 -
R1.1 -
R1.2
CIP-005-
3a - R1 -
R1.2
CIP-009-3 -
R.1.1
PL-5
RA-2
RA-3
PCI DSS v2.0

12.1.2 BOSS >
Operational Risk
Management >
Risk
Management
Framework
S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.

L.2 A.1, L.1 Schedule 1
(Section 5), 4.7 -
Safeguards
RI-01 COBIT 4.1 PO 9.1 Domain 2,
4 Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1
312.8 and 312.10 1.2.4 45 CFR 164.308
(a)(8)
45 CFR
164.308(a)(1)(ii)
(B) (New)
Clause 4.2.1 c)
through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2
Chapter II
Article 19
CIP-009-3 -
R4
AC-4
CA-2
CA-6
PM-9
RA-1
PCI DSS v2.0

12.1.2 Governance and Risk
Management
Assessments
GRM10Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

S3.1
x3.1.0
S4.3.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality of
data, processing integrity, and system security is
assessed on a timely basis; policies are updated
for that assessment.

I.1
I.4
C.2.1, I.4.1,
I.5, G.15.1.3,
I.3
46 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-02 COBIT 4.1 PO 9.4 Domain 2,
4 6.03. (a)

6.08. (a)
Article 17 (1), (2) NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-30

1.2.4 1.2.5
312.8 and 312.10
PL-4
PS-1
PS-8
Governance and Risk
Management
Policy Reviews
GRM09The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

S1.1.0 (S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.

B.2 B.1.33. B.1.34, IS-05 COBIT 4.1 DS 5.2
DS 5.4
Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

1.2.1 8.2.7

10.2.3 45 CFR 164.316
(b)(2)(iii)
45 CFE
164.306(e)
(New)
Clause 4.2.3 f)
A.5.1.2
Commandment #1
Commandment #2
Commandment #3
PCI DSS v2.0

12.1.3 CIP-003-3 -
R3.2 -
R3.3 -
R1.3
R3 - R3.1 -
R3.2 -
R3.3
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

8.1.0 8.1.1
45 CFR 164.316
(a)
45 CFR 164.316
(b)(1)(i)
45 CFR 164.316
(b)(2)(ii)
45 CFR
164.308(a)(2)
(New)
Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2
Commandment #1
Commandment #2
Commandment #3
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 -R1.1 -
R1.2 - R2 -
R2.1 -
R2.2 -
R2.3
AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 Governance and Risk
Management
Policy Enforcement
GRM07A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures.

Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

S3.9
S2.4.0
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(S2.4.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.

B.1.5 Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-06 COBIT 4.1 PO 7.7 Domain 2 Article 17 NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8

10.2.4 45 CFR 164.308
(a)(1)(ii)(C)
A.8.2.3 Commandment #6
Commandment #7
Chapter X, Article 64
Governance and Risk
Management
Management Program
GRM04x1.2. (x1.2.) The entity’s system [availability,
processing integrity, confidentiality and related]
security policies include, but may not be limited to,
the following matters:

A.1, B.1 2 (B)
3 (B)
5 (B)
IS-01 COBIT 4.1 R2
DS5.2
COBIT 4.1 R2
DS5.5
Domain 2
Governance and Risk
Management
Policy
GRM06Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.

S1.1.0
S1.3.0
S2.3.0
(S1.1.0) The entity's security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.
(S2.3.0) Responsibility and accountability for the
entity's system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.

B.1 Schedule 1
(Section 5) 4.1
Accountability,
Subsec 4.1.4
IS-03 COBIT 4.1 DS5.2 APO01.03 Domain 2 6.02. (e)
APO01.04
APO13.01
APO13.02
Schedule 1
(Section 5), 4.1 -
Accountability; 4.7
Safeguards
Clause 8.1
A.5.1.2
Clause

4.2(b),

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 9.3(a),

9.3(b)

9.3(b)(f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)
A.8.1.1
A.8.1.2
A.8.1.4
A.13.2.4
A.7.1.2
A.7.3.1
A.8.1.3
PCI DSS v2.0

12.4 PCI DSS v2.0

12.8.2 PS-4
PS-5
Clause 7.2(a),

7.2(b)
A.7.2.2
Clause 7.2(a),

7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8
Clause 7.2(a),

7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9
A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1
Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6
Commandment #1
Commandment #2
Chapter II, Article 19 CIP-001-
1a - R1 -
R2
CIP-003-3 -
R1 - R1.1 -
R4
CIP-006-
3c R1
PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11
AR-1 Governance and
Privacy Program
Article 17 99.31.(a)(1)(ii) 8.2.1 45 CFR 4.1 PA8
164.308(a)(1)(i)
45 CFR
164.308(a)(1)(ii)
(B)
45 CFR
164.316(b)(1)(i)
45 CFR
164.308(a)(3)(i)
(New)
45 CFR
164.306(a)
(New)
Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8
All in sections 4,
5, 6, 7, 8, 9, 10.

A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 12.1

12.2 Domain 12
Clause 4.3
Clause 5

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)

7.2(b)

7.2(c)

7.2(d)

7.3(b)

7.3(c)
A5.1.1
A7.2.3
APO13.01
APO13.02
APO13.03
312.8 and 312.10 shared x
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 86
#15..
- 417 -
Identity & Access
Management
Segregation of Duties
IAM05IAM-05.1 User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

Do you provide tenants with documentation on how you maintain segregation of duties within your cloud service offering? S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CC5.1 Schedule 1
(Section 5) 4.7
Safeguards, Subs.

4.7.3(b)
IS-15 COBIT 4.1 DS 5.4 APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
312.8 and 312.10 ITOS > Resource
Management >
Segregation of
Duties
shared x Domain 2 6.04.01. (d)

6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)

99.31(a)(1)(ii) 8.2.2 45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR
164.308(a)(4)(ii)
(A) (New)
45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.3 A.6.1.2 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-007-3
R5.1.1
AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4

3.0 3.1

3.2 3.3

3.4 3.5
PA24 P PCI DSS v2.0

6.4.2 6.4.2, 7.3

8.8 9.10
IAM-06.1 Are controls in place to prevent unauthorized access to your application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-06.2 Are controls in place to prevent unauthorized access to tenant application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-07.1 Do you provide multi-failure disaster recovery capability? IAM-07.2 Do you monitor service continuity with upstream providers in the event of provider failure?
IAM-07.3 Do you have more than one provider for each service you depend on?
IAM-07.4 Do you provide access to operational redundancy and continuity summaries, including the services you depend on?
IAM-07.5 Do you provide the tenant the ability to declare a disaster? IAM-07.6 Do you provided a tenant-triggered failover option? IAM-07.7 Do you share your business continuity and redundancy plans with your tenants?
IAM-08.1 Do you document how you grant and approve access to tenant data?
IAM-08.2 Do you have a method of aligning provider and tenant data classification methodologies for access control purposes? IAM-09.1 Does your management provision the authorization and restrictions for user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components?
IAM-09.2 Do your provide upon request user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components? IAM-10.1 Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)?
IAM-10.2 If users are found to have inappropriate entitlements, are all remediation and certification actions recorded?
IAM-10.3 Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data?
IAM-11.1 Is timely deprovisioning, revocation or modification of user access to the organizations systems, information assets and data
implemented upon any change in status of employees, contractors, customers, business partners or involved third parties? IAM-11.2 Is any change in user access status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization?
IAM-12.1 Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service?
IAM-12.2 Do you use open standards to delegate authentication capabilities to your tenants?
IAM-12.3 Do you support identity federation standards (SAML, SPML, WSFederation, etc.) as a means of authenticating/authorizing users? IAM-12.4 Do you have a Policy Enforcement Point capability (e.g., XACML) to enforce regional legal and policy constraints on user access? IAM-12.5 Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data?
IAM-12.6 Do you provide tenants with strong (multifactor) authentication options (digital certs, tokens, biometrics, etc.) for user access? IAM-12.7 Do you allow tenants to use third-party identity assurance services? IAM-12.8 Do you support password (minimum length, age, history, complexity) and account lockout (lockout threshold, lockout duration) policy enforcement?
IAM-12.9 Do you allow tenants/customers to define password and account lockout policies for their accounts?
IAM12.10Do you support the ability to force password changes upon first logon?
IAM12.11Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)?
IAM-13.1 Are utilities that can significantly manage virtualized partitions (e.g., shutdown, clone, etc.) appropriately restricted and monitored? IAM-13.2 Do you have a capability to detect attacks that target the virtual infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?
IAM-13.3 Are attacks that target the virtual infrastructure prevented with technical controls?
IVS-01.1 Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis and response to incidents?
IVS-01.2 Is physical and logical user access to audit logs restricted to authorized personnel?
IVS-01.3 Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been done?
IVS-01.4 Are audit logs centrally stored and retained?
IVS-01.5 Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)?
IVS-02.1 Do you log and alert any changes made to virtual machine images regardless of their running state (e.g. dormant, off or running)? IVS-02.2 Are changes made to virtual machines, or moving of an image and subsequent validation of the image's integrity, made immediately available to customers through electronic methods (e.g. portals or alerts)?
Infrastructure &
Virtualization Security
Clock Synchronization
IVS-03 IVS-03.1 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?
S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.

CC6.2 G.7
G.8
G.13, G.14.8,
G.15.5, G.16.8,
G.17.6, G.18.3,
G.19.2.6,
G.19.3.1
20 (B)
28 (B)
30 (B)
35 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-12 COBIT 4.1 DS5.7 APO01.08
APO13.01
APO13.02
BAI03.05
DSS01.01
312.8 and 312.10 Infra Services >
Network Services
> Authoritative
Time Source
provider x Domain 10 6.03. (k) NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
A.10.10.1
A.10.10.6
A.12.4.1
A.12.4.4
AU-1
AU-8
PCI DSS v2.0

10.4 10.4
IVS-04.1 Do you provide documentation regarding what levels of system (network, storage, memory, I/O, etc.) oversubscription you maintain and under what circumstances/scenarios?
IVS-04.2 Do you restrict use of the memory oversubscription capabilities present in the hypervisor?
IVS-04.3 Do your system capacity requirements take into account current, projected and anticipated capacity needs for all systems used to provide services to the tenants?
IVS-04.4 Is system performance monitored and tuned in order to continuously meet regulatory, contractual and business requirements for all the systems used to provide services to the tenants?
Infrastructure &
Virtualization Security
Management -
Vulnerability
Management
IVS-05 IVS-05.1 Implementers shall ensure that the security v ulnerability assessment tools or serv ices accommodate the v irtualization technologies used (e.g. v irtualization aware).

Do security vulnerability assessment tools or services accommodate the virtualization technologies being used (e.g. virtualization aware)?
APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
provider x Domain 1,
13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
PA36 6.1
IVS-06.1 For your IaaS offering, do you provide customers with guidance on how to create a layered security architecture equivalence using your virtualized solution?
IVS-06.2 Do you regularly update network architecture diagrams that include data flows between security domains/zones?
IVS-06.3 Do you regularly review for appropriateness the allowed access/connectivity (e.g., firewall rules) between security domains/zones within the network?
IVS-06.4 Are all firewall access control lists documented with business justification?
Infrastructure &
Virtualization Security
OS Hardening and Base
Conrols
IVS-07 IVS-07.1 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

Are operating systems hardened to provide only the necessary ports, protocols and services to meet business needs using technical controls (i.e antivirus, file integrity monitoring and logging) as part of their baseline build standard or template?
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.01
DSS05.03
DSS06.06
SRM > Policies
and Standards >
Operational
Security Baselines
shared x Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1

2.1 2.2

2.5 5.1
IVS-08.1 For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes? IVS-08.2 For your IaaS offering, do you provide tenants with guidance on how to create suitable production and test environments?
IVS-08.3 Do you logically and physically segregate production and nonproduction environments? IVS-09.1 Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security IVS-09.2 requirements? Are system and network environments protected by a firewall or virtual firewall to ensure compliance with legislative, regulatory and contractual requirements?
IVS-09.3 Are system and network environments protected by a firewall or virtual firewall to ensure separation of production and nonproduction environments? IVS-09.4 Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data? IVS-10.1 Are secured and encrypted communication channels used when migrating physical servers, applications or data to virtual servers? IVS-10.2 Do you use a network segregated from production-level networks when migrating physical servers, applications or data to virtual servers?
Infrastructure &
Virtualization Security
VMM Security -
Hypervisor Hardening
IVS-11 IVS-11.1 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor
authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).

Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g. two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Privilege Use
Management -
Hypervisor
Governance and
Compliance
provider X Domain 1,
13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

3.5.1, 3.6.6
IVS-12.1 Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic? IVS-12.2 Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings? (e.g., encryption keys, passwords, SNMP community strings)
IVS-12.3 Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?
IVS-13.1 Do your network architecture diagrams clearly identify high-risk environments and data flows that may have legal compliance impacts?
IVS-13.2 Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and blackholing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denialof-service (DDoS) attacks? Interoperability &
Portability
APIs
IPY-01 IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.

Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?
- BAI02.04
BAI03.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
Application
Services >
Programming
Interfaces >
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Interoperability &
Portability
Data Request
IPY-02 IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industrystandard format (e.g., .doc, .xls, .pdf, logs, and flat files) Is unstructured customer data available on request in an industrystandard format (e.g., .doc, .xls, or .pdf)?- APO01.03 APO01.06
APO03.01
APO08.01
APO09.03
DSS04.07
Information
Services >
Reporting
Services >
provider Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c) IPY-03.1 Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications?

5.0 7.1

7.1.2 7.2

10.1 10.2

10.3 10.4

10.5 10.6

10.7, 10.8

11.4, 11.5, 11.6

12.5.2 10.5.5, 12.10.5

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 1.2.2

1.2.3 1.3

2.2.2 2.2.3

2.2.4 2.5

4.1 6.4.1

6.4.2 1.1

1.2 1.2.1

1.2.3 1.3

1.4 2.1.1

2.2.3 2.2.4

2.3 6.4.1

6.4.2, 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 7.2.2

7.3 12.8

12.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

12.5.4 8.1.4

4.1 1.2.3

2.1.1 4.1

4.1.1 11.1, 11.1.a,

11.1.b, 11.1.c,

11.1.d, 11.1.1,

11.1.2 9.1.3

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 1.2.2

1.2.3 1.3

2.2.2 2.2.3

2.2.4 2.5

4.1 8.1.3

8.1.4 8.1.5, 12.5.4

8.0 10.1,

12.3 BSGP
BSGP
P
GP
PA11
PA12
PA13
PA24
BSGP
SGP
SGP
P
PA16 SGP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3 BSGP
PA3
PA5
PA16
PA20
BSGP
BSGP
SGP
GP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3
PA6
PA16
PA20
PA25
PA32
PA33
BSGP
BSGP
SGP
GP
P
BSGP
SGP
PA24 GP

12.2 14.2

17.6 3.3

17.1 17.2

14.5 17.6

18.1 18.4

11.1 17.3

17.1 17.2

9.4 14.1

14.2 19.1

2.2 4.3

3.2 9.2

15.2 9.2

15.2 9.2
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

SHARING WITH THIRD

PARTIES
AP-1 The organization
determines and
documents the legal
authority that permits the
collection, use,
maintenance, and
sharing of personally
identifiable information
(PII), either generally or
in support of a specific
program or information
system need.
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m"
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

99.31(a)(1)(ii)

99.3 99.31(a)(1)(ii)
SRM >
Governance Risk
& Compliance >
Vendor
Management
shared x
Information
Services > User
Directory Services
> Active Directory
Services,
LDAP
Repositories,
X.500
Repositories,
DBMS
Repositories,
Meta Directory
Services,
Virtual Directory
Services
shared x
SRM > Policies
and Standards >
Technical Security
Standards
shared x
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
shared x
X
SRM >
Infrastructure
Protection
Services >
Network -
Wireless
Protection
provider X
ITOS > Service
Support > Release
Management -
Source Code
Management
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
APO01.03
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06
APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO13.01
APO13.02
DSS05.05
APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05
APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04
APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02
APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
CC3.1
CC3.3
CC5.3
CC5.1
CC6.2
A1.1
A1.2
CC4.1
CC5.6
CC5.6
CC5.6
CC5.6
CC5.6
CC7.4
IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).
45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.312
(b)
45 CFR
164.308(a)(5)(ii)
(c) (New)
A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3
Commandment #6
Commandment #7
Commandment
#11
CIP-007-3 -
R6.5
AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4
PCI DSS v2.0

10.1 PCI DSS
v2.0 10.2

PCI DSS
v2.010.3
PCI DSS v2.0

10.5 PCI DSS
v2.010.6
PCI DSS v2.0

10.7 PCI DSS v2.0

11.4 PCI DSS v2.0

12.5.2 PCI DSS
v2.0 12.9.5
Infrastructure &
Virtualization Security
Change Detection
Infrastructure &
Virtualization Security
Network Architecture
IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Infrastructure &
Virtualization Security
VM Security - vMotion
Data Protection
IVS-10 Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.

PCI DSS v2.0

1.2.3 PCI DSS v2.0

2.1.1 PCI DSS v2.0

4.1 PCI DSS v2.0

4.1.1 PCI DSS
v2.011.1
PCI DSS v2.0

9.1.3 Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.

CIP-004-3
R3
AC-4
SC-2
SC-3
SC-7
PCI DSS v2.0

1.1 PCI DSS v2.0

1.2 PCI DSS v2.0

1.2.1 PCI DSS v2.0

1.3 PCI DSS v2.0

1.4 Infrastructure &
Virtualization Security
Wireless Security
IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

D.1
B.3
F.1
G.4
G.15
G.17
G.18
E.3.1, F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
40 (B)
44 (C+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-10 COBIT 4.1 DS5.5
COBIT 4.1 DS5.7
COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
Domain 10 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

8.2.5 45 CFR 164.312
(e)(1)(2)(ii)
45 CFR
164.308(a)(5)(ii)
(D) (New)
45 CFR
164.312(e)(1)
(New)
45 CFR
164.312(e)(2)(ii)
(New)
A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R3
CIP-007-3 -
R6.1
AC-1
AC-18
CM-6
PE-4
SC-3
SC-7
A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2
Infrastructure &
Virtualization Security
Network Security
A.10.1.4
A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3
Commandment #1
Commandment
#10
Commandment
#11
SC-2 PCI DSS v2.0

6.4.1 PCI DSS v2.0

6.4.2 Infrastructure &
Virtualization Security
Segmentation
IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and
configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.17 G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-09 COBIT 4.1 DS5.10 Domain 10 6.03.03. (b)

6.03.05. (a)

6.03.05. (b)

6.04.01. (a)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)

6.04.08.02. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
45 CFR 164.308
(a)(4)(ii)(A)
A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
Infrastructure &
Virtualization Security
Production /
Nonproduction
Environments
IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets.

Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

B.1 I.2.7.1, I.2.20,
I.2.17,
I.2.22.2,
I.2.22.4,
I.2.22.10-14,
H.1.1
22 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-06 COBIT 4.1 DS5.7 Information Domain 10 6.03. (d) NIST SP 800-53 R3 SC-2 1.2.6 Services > Data
Governance >
Data Segregation
APO03.01 shared x
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
SA-4
IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections, these configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and compensating controls.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R2.2.4
SC-7 PCI DSS v2.0

1.1 PCI DSS v2.0

1.1.2 PCI DSS v2.0

1.1.3 PCI DSS v2.0

1.1.5 PCI DSS v2.0

1.1.6 PCI DSS v2.0

1.2 PCI DSS v2.0

1.2.1 PCI DSS v2.0

2.2.2, PCI DSS
v2.0 2.2.3
A.10.3.1 Commandment #1
Commandment #2
Commandment #3
Infrastructure &
Virtualization Security
Capacity / Resource
Planning
IVS-04 The av ailability , quality , and adequate capacity and resources shall be planned, prepared, and measured to deliv er the required sy stem perf ormance in accordance with legal, statutory , and regulatory compliance obligations. Projections of f uture capacity requirements shall be made to mitigate the risk of sy stem ov erload.

A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A4.1.0) The entity’s system availability and
security performance is periodically reviewed and
compared with the defined system availability and
related security policies.

G.5 OP-03 COBIT 4.1 DS 3 Domain 7,
8 6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 (1) NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
312.8 and 312.10 ITOS > Service 1.2.4
Delivery >
Information
Technology
Resiliency -
Capacity Planning
provider x
PCI DSS v2.0

7.1.2 Infrastructure &
Virtualization Security
Audit Logging /
Intrusion Detection
IVS-01 Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.

S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.

G.7
G.8
G.9
J.1
L.2
G.14.7, G.14.8,
G.14.9,
G.14.10,G.14.1
1, G.14.12,
G.15.5, G.15.7,
G.15.8, G.16.8,
G.16.9,
G.16.10,
G.15.9, G.17.5,
G.17.7, G.17.8,
G.17.6, G.17.9,
G.18.2, G.18.3,
G.18.5, G.18.6,
G.19.2.6,
G.19.3.1,
G.9.6.2,
G.9.6.3,
G.9.6.4,
G.9.19, H.2.16,
H.3.3, J.1, J.2,
L.5, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-14 COBIT 4.1 DS5.5
COBIT 4.1 DS5.6
COBIT 4.1 DS9.2
Domain 10 6.03. (i)

6.03. (j)

6.03.03. (a)

6.03.03. (d)

6.03.04. (e)

6.04.07. (a)

6.07.01. (a)

8.2.1 8.2.2
312.8 and 312.10
312.3, 312.8 and
312.10
BOSS > Security
Monitoring
Services > SIEM
shared x
Identity & Access
Management
Utility Programs Access
IAM13Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

H.2.16 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-34 COBIT 4.1 DS5.7 Domain 2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
CIP-004-3
R2.2.3
CIP-007-3 -
R5.1.3 -
R5.2.1 -
R5.2.3
AC-2
PS-4
PS-5
A.11.4.1
A 11.4.4
A.11.5.4
Commandment #1
Commandment #5
Commandment #6
Commandment #7
CIP-007-3 -
R2.1 -
R2.2 -
R2.3
AC-5
AC-6
CM-7
SC-3
SC-19
PCI DSS v2.0

8.5.4 PCI DSS v2.0

8.5.5 Identity & Access
Management
User ID Credentials
IAM12Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets) S3.2.b (S3.2.b) b. Identification and authentication of users.

B.1
H.5
E.6.2, E.6.3,
H.1.1, H.1.2,
H.2, H.3.2,
H.4, H.4.1,
H.4.5, H.4.8
6 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-02 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
Domain 10 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.04.05. (b)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10
45 CFR
164.308(a)(5)(ii)
(c) (New)
45 CFR 164.308
(a)(5)(ii)(D)
45 CFR 164.312
(a)(2)(i)
45 CFR 164.312
(a)(2)(iii)
45 CFR 164.312
(d)
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5
Commandment #6
Commandment #7
Commandment #8
Commandment #9
CIP-004-3
R2.2.3
CIP-007-3 -
R5.2 -
R5.3.1 -
R5.3.2 -
R5.3.3
AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10
PCI DSS v2.0

8.1 PCI DSS v2.0

8.2,
PCI DSS v2.0

8.3 PCI DSS v2.0

8.4 PCI DSS v2.0

8.5 PCI DSS v2.0

10.1,
PCI DSS v2.0

12.2,
PCI DSS v2.0

12.3.8 SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x 9.2

15.1 15.2
PA9
PA6
PA24
PA22

8.2.1 8.2.7
45 CFR 164.308
(a)(3)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
A.11.2.4 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-004-3
R2.2.2
CIP-007-3 -
R5 - R.1.3
AC-2
AU-6
PM-10
PS-6
PS-7
Identity & Access
Management
User Access Revocation
IAM11Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

H.2 E.6.2, E.6.3 Schedule 1
(Section 5), 4.7 -
Safeguards
IS-09 COBIT 4.1 DS 5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.04.02. (b)
Article 17 NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 SC-30

8.2.1 45 CFR
164.308(a)(3)(ii)
(C)

ISO/IEC
27001:2005
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
User Access
Authorization
IAM09Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part of the service and/or customer (tenant) has some shared responsibility over implementation of control.

Identity & Access
Management
User Access Reviews
IAM10User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

H.2.6, H.2.7,
H.2.9,
41 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
IS-10 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
Identity & Access
Management
User Access Restriction
/ Authorization
IAM08Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

IS-08
IS-12
COBIT 4.1 DS5.4 Domain 12
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
NIST SP800-53 R3 AC-3
NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 IA-2
NIST SP800-53 R3 IA-4
NIST SP800-53 R3 IA-5
NIST SP800-53 R3 IA-8
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-9
PCI DSS v2.0

7.1 PCI DSS v2.0

7.1.1 PCI DSS v2.0

7.1.2 PCI DSS v2.0

7.1.3 PCI DSS v2.0

7.2.1 PCI DSS v2.0

7.2.2 PCI DSS v2.0

8.5.1 PCI DSS v2.0

12.5.4 "FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m"
Domain 2 Article 17
S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

H.2.4, H.2.5, 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+)
Schedule 1
(Section 5)
Safeguards, Subs.

4.7.2 and 4.7.3
IS-08 DS5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.03.06. (b)

6.04.01. (a)

6.04.01. (b)

6.04.01. (d)

6.04.01. (e)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)
APO01.03 Article 17
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x
SRM > Privilege
Management
Infrastructure >
Authorization
Services -
Entitlement
Review
shared x NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
S3.2.0
S4.3.0
(S3.2.0) Procedures exist to restrict logical access
to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality,
processing integrity and security is assessed on a
timely basis; policies are updated for that
assessment.

Clause 4.3.3
A.12.4.3
A.15.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
CM-5
CM-6
PCI-DSS v2.0

6.4.1 PCI-DSS v2.0

6.4.2 Identity & Access
Management
Third Party Access
IAM07The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access.

Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.

B.1
H.2
B.1.1, B.1.2,
D.1.1, E.1,
F.1.1, H.1.1,
K.1.1, E.6.2,
E.6.3
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-05 COBIT 4.1 DS 2.3 Domain 2,
4 6.02. (a)

6.02. (b)

6.03. (a)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

7.1.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4
A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4
CA-3
MA-4
RA-3
PCI DSS v2.0

12.8.1 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Identity & Access
Management
Source Code Access
Restriction
IAM06Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

S3.13.0 (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are
made to the system.

I.2.7.2, I.2.9,
I.2.10, I.2.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-33 Domain 2 Article 17 NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. ©
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
SRM >
Infrastructure
Protection
Services >
Network
provider x
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7

7.1 7.1.1

7.1.2 7.1.3

7.2.1 7.2.2

8.5.1 12.5.4
AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9
CIP-003-3 -
R5.1.1 -
R5.3
CIP-004-3
R2.3
CIP-007-3
R5.1 -
R5.1.2
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
NIST SP 800-53 R3 AC-3 8.2.2
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
A.12.1.4
A.14.2.9
A.9.1.1

8.1,partial,
A.14.2.2

8.1,partial,
A.14.2.3

8.1,partial,
A.14.2.4
A.13.1.3
A.9.4.1
A.18.1.4
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
CIP-004-3
R2.2.4

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 2.2.2

2.2.3 Clause

5.2(c)

5.3(a),

5.3(b),

7.5.3(b)

7.5.3(d)

8.1,

8.3 9.2(g)
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5
Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5
A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1
A.9.2.5
Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2
A.9.1.2
Deleted
A.9.4.4
A.12.4.1
A.12.4.1
A.12.4.2,
A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3
Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2,
A.16.1.1,
A.16.1.2,
A.16.1.3,
A.16.1.4,
A.16.1.5,
A.16.1.6,
A.12.1.3
SRM > Privilege
Management
Infrastructure >
Privileged Usage
Management ->
Hypervisor
Governance and
Compliance
PA35 GP
Domain 1,
13 APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
312.8 and 312.10
SRM >
Infrastructure
Protection
Services >
Network
provider x
SRM >
Infrastructure
Protection
Services >
Network -
Firewall
provider x
SRM >
Cryptographic
Services > Data-intransit Encryption
provider
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
-
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 87
#15..
- 418 -
IPY-03.2 Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?
IPY-04.1 Can data import, data export and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols?
IPY-04.2 Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved?
IPY-05.1 Do you use an industry-recognized virtualization platform and standard virtualization formats (e,g., OVF) to help ensure interoperability?
IPY-05.2 Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review?
Mobile Security
Anti-Malware
MOS01MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

Do you provide anti-malware training specific to mobile devices as part of your information security awareness training?
- APO01.03
APO13.01
APO07.03
APO07.06
APO09.03
SRM >
Governance Risk
& Compliance >
Technical
Awareness and
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1) Mobile Security
Application Stores
MOS02MOS-02 A documented list of approved application stores has been communicated as acceptable for mobile devices accessing or storing provider managed data.

Do you document and make available lists of approved application stores for mobile devices accessing or storing company data and/or company systems?
- APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

4.1.1 Mobile Security
Approved Applications
MOS03MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores be loaded onto a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Approved Software for
BYOD
MOS04MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

Does your BYOD policy and training clearly state which applications and applications stores are approved for use on BYOD devices? - APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Awareness and
Training
MOS05MOS-05 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

Do you have a documented mobile device policy in your employee training that clearly defines mobile devices and the accepted usage and requirements for mobile devices?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

4.3 Mobile Security
Cloud Based Services
MOS06MOS-06 All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

Do you have a documented list of pre-approved cloud based services that are allowed to be used for use and storage of company business data via a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM >
Governance Risk
& Compliance >
Vendor
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Compatibility
MOS07MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

Do you have a documented application validation process for testing device, operating system and application compatibility issues? - APO01.03
APO01.08
APO13.01
APO13.02
BAI03.07
BAI03.08
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Device Eligibility
MOS08MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

Do you have a BYOD policy that defines the device(s) and eligibility requirements allowed for BYOD usage?
- APO01.03
APO01.08
APO13.01
APO13.02
BAI02.01
SRM > Policies
and Standards >
Information
Security Policies
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Device Inventory
MOS09MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices, (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD), will be included for each device in the inventory.

Do you maintain an inventory of all mobile devices storing and accessing company data which includes device status (os system and patch levels, lost or decommissioned, device assignee)? - BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03
SRM >
Infrastructure
Protection
Services > End
Point - Inventory
Control
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
Mobile Security 6.1.2(c)(2)
Device Management
MOS10MOS-10 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

Do you have a centralized mobile device management solution deployed to all mobile devices that are permitted to store, transmit, or process company data?
- APO03.01
APO03.02
APO04.02
APO13.01
APO13.02
BAI02.01
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Encryption
MOS11MOS-11 The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

Does your mobile device policy require the use of encryption for either the entire device or for data identified as sensitive enforceable through technology controls for all mobile devices?
- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS06.06
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
PA32 BSGP 4.1
MOS12.1Does your mobile device policy prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting)? MOS12.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
MOS13.1Does your BYOD policy clearly define the expectation of privacy, requirements for litigation, e-discovery and legal holds? MOS13.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
Mobile Security
Lockout Screen
MOS14MOS-14 BYOD and/or company owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

Do you require and enforce via technical controls an automatic lockout screen for BYOD and company owned devices?
- DSS05.03
DSS05.05
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Operating Systems
MOS15MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

Do you manage all changes to mobile device operating systems, patch levels and applications via your company's change management processes?
- APO01.03
APO13.01
APO13.02
BAI06
ITOS > Service
Support -Change
Management >
Planned Changes
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
MOS- 6.1.2(a)(2),

16.1 Do you have password policies for enterprise issued mobile devices and/or BYOD mobile devices?
MOS16.2Are your password policies enforced through technical controls (i.e.

MDM)?
MOS16.3Do your password policies prohibit the changing of authentication requirements (i.e. password/PIN length) via a mobile device? MOS17.1Do you have a policy that requires BYOD users to perform backups of specified corporate data?
MOS17.2Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?
MOS17.3Do you have a policy that requires BYOD users to use anti-malware software (where supported)?
MOS18.1Does your IT provide remote wipe or corporate data wipe for all company-accepted BYOD devices?
MOS18.2Does your IT provide remote wipe or corporate data wipe for all company-assigned mobile devices?
MOS19.1Do your mobile devices have the latest available security-related patches installed upon general release by the device manufacturer or carrier?
MOS19.2Do your mobile devices allow for remote validation to download the latest security patches by company IT personnel?
MOS20.1Does your BYOD policy clarify the systems and servers allowed for use or access on the BYOD-enabled device?
MOS20.2Does your BYOD policy specify the user roles that are allowed access via a BYOD-enabled device?
Security Incident
Management, EDiscovery & Cloud
Forensics
Contact / Authority
Maintenance
SEF-01 SEF-01.1 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impactedscope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations? CC3.3 APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03
312.4 BOSS >
Compliance >
Contact/Authority
Maintenance
sharedx A.6.1.6
A.6.1.7
A.6.1.3
A.6.1.4
Chapter VI,
Article 44.

Chapter II,
Article 16, part I

3.2 12.5.3

12.10.1 SEF-02.1 Do you have a documented security incident response plan? SEF-02.2 Do you integrate customized tenant requirements into your security incident response plans?
SEF-02.3 Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents? SEF-02.4 Have you tested your security incident response plans in the last year?
SEF-03.1 Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting? SEF-03.2 Does your logging and monitoring framework allow isolation of an incident to specific tenants?
SEF-04.1 Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?
SEF-04.2 Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques? SEF-04.3 Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data?
SEF-04.4 Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?
SEF-05.1 Do you monitor and quantify the types, volumes and impacts on all information security incidents?

4.1 12.1

12.10.1 PA8
PA11
BSGP
PA8 BSGP
SGP

4.1 4.2

4.6 7.1

7.2 7.3

7.2 7.3
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

99.31(a)(1)(i)
34 CFR 99.32(a)
BOSS >
Operational Risk
Management >
Key Risk
Indicators
sharedx
Infrastructure
Services > Virtual
Infrastructure >
Server
Virtualization
providerXX
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
sharedX
SRM >
Infrastructure
Protection
Services-
>Network > Link
Layer Network
Security
sharedX
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
ITOS > Service
Support >
Security Incident
Management
sharedx
shared
sharedX
SRM > Data
Protection >
Cryptographic
Services - Data-InTransit Encryption
providerx
312.8 and 312.10
312.3, 312.8 and
312.10
312.8 and 312.10
312.8 and 312.10
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.03
APO13.01
APO13.02
DSS05.03
APO01.03
APO13.01
APO13.02
CC5.5
CC6.2
CC2.3
CC2.5
C1.4
C1.5
CC2.5
CC6.2
CC6.2
CC4.1
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05 Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
IR-2
IR-6
IR-7
SI-4
SI-5
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 APO01.03
APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
DSS04.07
PA11 BSGP
PA11 BSGP
PCI-DSS v2.0

12.5.2 PCI-DSS v2.0

12.5.3 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Legal Preparation
SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

S2.4.0
C3.15.0
(S2.4.0) The process for informing the entity about
system availability issues, confidentiality issues,
processing integrity issues, security issues and
breaches of the system security and for submitting
complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of
noncompliance with defined confidentiality and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1
E.1
J.1.1, J.1.2,
E.4
IS-24 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (f)

6.07.01. (h)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)

1.2.7 45 CFR 164.308
(a)(6)(ii)
Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3
BOSS > Legal
Services >
Incident
Response Legal
Preparation
sharedx CIP-004-3
R3.3
AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8
BOSS > Human
Resources
Security >
Employee
Awareness
sharedx
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-007-3 -
R6.1
CIP-008-3 -
R1
IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8
PCI-DSS v2.0

12.9 PCI-DSS v2.0

12.9.1 PCI-DSS v2.0

12.9.2 PCI-DSS v2.0

12.9.3 PCI-DSS v2.0

12.9.4 PCI-DSS v2.0

12.9.5 PCI-DSS v2.0

12.9.6 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Reporting
SEF-03 Workforce personnel and external business relationships shall be informed of their responsibility and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and
accountability for the entity’s system availability,
confidentiality of data, processing integrity and
related security policies and changes and updates
to those policies are communicated to entity
personnel responsible for implementing them.
(S2.4) The process for informing the entity about
breaches of the system security and for submitting
J.1
E.1
J.1.1, E.4 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
IS-23 COBIT 4.1 DS5.6 Domain 2 6.07.01. (a) Article 17 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)

1.2.7 1.2.10

7.1.2 7.2.2

7.2.4 10.2.4
45 CFR 164.312
(a)(6)(ii)
16 CFR 318.3 (a)
(New)
16 CFR 318.5 (a)
(New)
45 CFR 160.410
(a)(1) (New)
Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-003-3 -
R4.1
CIP-004-3
R3.3
IS3.7.0
S3.9.0
(IS3.7.0) Procedures exist to identify, report, and
act upon system security breaches and other
incidents.
(S3.9.0) Procedures exist to provide that issues of
noncompliance with system availability,
confidentiality of data, processing integrity and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1 J.1.1, J.1.2 1.2.4

1.2.7 7.1.2

7.2.2 7.2.4

10.2.1 10.2.4
45 CFR 164.308
(a)(1)(i)
45 CFR 164.308
(a)(6)(i)
Clause 4.3.3
A.13.1.1
A.13.2.1
ITAR 22
CFR §
127.12
Mobile Security
Passwords
MOS16Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

Mobile Security
Policy
MOS17The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

Mobile Security
Remote Wipe
MOS18All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

Mobile Security
Security Patches
MOS19Mobile devices connecting to corporate networks or storing and accessing company information shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

Mobile Security
Users
MOS20The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Management
SEF-02 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
APO01.03
APO13.01
APO13.02
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.

Interoperability &
Portability
Standardized Network
Protocols
IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

Interoperability &
Portability
Virtualization
IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks, available for customer review.

Mobile Security
Jailbreaking and
Rooting
MOS12The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and isenforced through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management).

Mobile Security
Legal
MOS13The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds.

The BYOD policy shall clearly state the expectations over the loss of non-company data in the case a wipe of the device is required.

IS-25 - Domain 6
46 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.8
Openness, Subs.

4.8.2 IS-22 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (a)

6.07.01. (d)

6.07.01. (e)

6.07.01. (f)

6.07.01. (g)

6.07.01. (h)
Article 17 NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-3
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

S3.9.0
C4.1.0
(S3.9.0) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(C4.1.0) The entity’s system security, availability,
system integrity, and confidentiality is periodically
reviewed and compared with the defined system
security, availability, system integrity, and
confidentiality policies.

J.1.2 47 (B) COBIT 4.1 DS 4.9 - None
(Mobile
Guidance)
- Domain 6
None
(Mobile
Guidance)
BOSS > Data
Governance >
Secure Disposal
of Data
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
PA34
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
None
(Mobile
Guidance)
None
(Mobile
Guidance)
- None
(Mobile
Guidance)
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
providerX
SRM > Policies
and Standards >
Information
Security Services

6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
-
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)
Clause

5.3 (a),

5.3 (b),

7.5.3(b),

5.2 (c),

7.5.3(d),

8.1,

8.3,

9.2(g),
Annex
A.16.1.1
A.16.1.2
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7,
A.16.1.6
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 88
#15..
- 419 -
SEF-05.2 Will you share statistical information for security incident data with your tenants upon request?
STA-01.1 Do you inspect and account for data quality errors and associated risks, and work with your cloud supply-chain partners to correct them?
STA-01.2 Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?
Supply Chain
Management,
Transparency and
Accountability
Incident Reporting
STA02STA-02.1 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).

Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals)?
APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07
ITOS > Service
Support ->
Incident
Management >
Cross Cloud
Incident
Response
prov ider Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
STA-03.1 Do you collect capacity and use data for all relevant components of 6.1.2(b) your cloud service offering?
STA-03.2 Do you provide tenants with capacity planning and use reports? Supply Chain
Management,
Transparency and
Accountability
Provider Internal
Assessments
STA04STA-04.1 The provider shall perform annual internal assessments of conformance and effectiveness of its policies, procedures, and supporting measures and metrics.

Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?
MEA01
MEA02
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

12.1.1 STA-05.1 Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored and transmitted?
STA-05.2 Do you select and monitor outsourced providers in compliance with laws in the country where the data originates?
STA-05.3 Does legal counsel review all third-party agreements? STA-05.4 Do third-party agreements include provision for the security and protection of information and assets?
STA-05.5 Do you provide the client with a list and copies of all subprocessing agreements and keep this updated?
Supply Chain
Management,
Transparency and
Accountability
Supply Chain
Governance Reviews
STA06STA-06.1 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

Do you review the risk management and governanced processes of partners to account for risks inherited from other members of that partner's supply chain?
APO10.04
APO10.05
MEA01
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

12.8.4 STA-07.1 Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate and relevant agreements (e.g., SLAs) between providers and customers (tenants)?
STA-07.2 Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain
(upstream/downstream)?
STA-07.3 Can you manage service-level conflicts or inconsistencies resulting from disparate supplier relationships?
STA-07.4 Do you review all agreements, policies and processes at least annually?
Supply Chain
Management,
Transparency and
Accountability
Third Party Assessment
STA08STA-08.1 Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party providers upon which their information supply chain depends on.

Do you assure reasonable information security across your information supply chain by performing an annual review? STA-8.2 Does your annual review include all partners/third-party providers upon which your information supply chain depends?
STA-09.1 Do you permit tenants to perform independent vulnerability assessments?
STA-09.2 Do you have external third party services conduct vulnerability scans and periodic penetration tests on your applications and networks? TVM01.1Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems? TVM01.2Do you ensure that security threat detection systems using signatures, lists or behavioral patterns are updated across all infrastructure components within industry accepted time frames? TVM02.1Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.2Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.3Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.4Will you make the results of vulnerability scans available to tenants at their request?
TVM02.5Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications and systems?
TVM02.6Will you provide your risk-based systems patching time frames to your tenants upon request?
TVM03.1Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy? TVM03.2Is all unauthorized mobile code prevented from executing?

2.4 12.8.2

12.8.3 12.8.4
Appendix A

1.4, 5.0

2.2 6.1

6.2 6.3.2

6.4.5 6.5

6.6 11.2

11.2.1 11.2.2

11.2.3 PA2
PA8
BSGP
PA3
PA8
PA16
BSGP
BSGP
SGP
PA1 BSGP

7.2 7.3

17.1 5.2

2.2 5.4

14.1 17.6

12.4 14.1
3 3.1

3.2 3.3

3.4 3.5
BOSS >
Compliance >
Third-Party Audits
shared x
SRM >
Infrastructure
Protection
Services > AntiVirus
shared x
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
shared x
SRM >
Infrastructure
Protection
Services > End
Point - White
Listing
shared x
BOSS >
Operational Risk
Management >
Key Risk
Indicators
shared x
SRM >
Governance Risk
& Compliance >
Vendor
Management
prov ider X
provider x
BOSS > Legal
Services >
Contracts
shared x
ITOS > Service
Delivery > Service
Level
Management -
Vendor
Management
provider x
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x
312.8 and 312.10
312.8 and 312.10
312.2(a) and
312.3 (Prohibition
on Disclosure)
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04
APO09.03
MEA01
MEA02
APO01.08
APO10.05
MEA02.01
APO01.03
APO13.01
APO13.02
DSS05.01
APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07
APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04
APO09.03
APO09.05
CC5.6
CC7.1
CC6.2
CC4.1
CC2.2
CC2.3
CC2.2
CC2.3
CC5.5
C1.4
C1.5
CC7.1 CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5
PCI-DSS v2.0

2.2 PCI-DSS v2.0

6.1 PCI-DSS v2.0

6.2 PCI-DSS v2.0

6.3.2 PCI-DSS v2.0

6.4.5 PCI-DSS v2.0

6.5.X
PCI-DSS v2.0

6.6 PCI-DSS v2.0

11.2 PCI-DSS v2.0

11.2.1 PCI-DSS v2.0

11.2.2 PCI-DSS v2.0

11.2.3 Threat and Vulnerbility
Management
Mobile Code
TVM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.4.0
S3.10.0
(S3.4.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.

G.20.12, I.2.5 SA-15 Domain 10 6.03. (g) Article 17 A.10.4.2 A.12.2.2
A.12.5.1
A.12.5.2
A.12.6.1
Commandment #4
Commandment #5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
SC-18
CIP-007-3 -
R4 - R4.1 -
R4.2
SA-7
SC-5
SI-3
SI-5
SI-7
SI-8
PCI-DSS v2.0

5.1 PCI-DSS v2.0

5.1.1 PCI-DSS v2.0

5.2 Threat and Vulnerbility
Management
Vulnerability / Patch
Management
TVM02Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.10.0 (S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.

I.4 G.15.2, I.3 32 (B)
33 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-20 COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9
Domain 2 6.03.02. (a)

6.03.02. (b)

6.03.05. (c)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5
45 CFR 164.308
(a)(1)(i)(ii)(A)
45 CFR 164.308
(a)(1)(i)(ii)(B)
45 CFR 164.308
(a)(5)(i)(ii)(B)
CIP-004-3
R4 - 4.1 -

4.2 CIP-005-
3a - R1 -
R1.1
CIP-007-3 -
R3 - R3.1 -
R8.4

1.2.6 8.2.7

8.1*partial,
A.14.2.2,

8.1*partial,
A.14.2.3
A.12.6.1
A.12.2.1
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Appendix A

8.2.2 45 CFR 164.308
(a)(5)(ii)(B)
A.10.4.1 Commandment #4
Commandment #5
Threat and Vulnerbility
Management
Antivirus / Malicious
Software
TVM01Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.5.0 (S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious codes,
and unauthorized software.

G.7 17 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-21 COBIT 4.1 DS5.9 Domain 2 6.03. (f) Article 17 NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8
A.15.1.2

8.1* partial,

8.1* partial,
A.15.2.1
A.13.1.2
A.12.2.1
CC2.2
CC2.3
C1.4
C1.5
CC5.8
Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Chapter II
Article 14.

CA-3
MP-5
PS-7
SA-6
SA-7
SA-9
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 Supply Chain
Management,
Transparency and
Accountability
Supply Chain Metrics
STA07Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).

Supply Chain
Management,
Transparency and
Accountability
Third Party Audits
STA09Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

S3.1.0
x3.1.0
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operations that
would impair system [availability, processing
integrity, confidentiality] commitments and (2)
assess the risks associated with the identified
threats.

L.1, L.2, L.4,
L.7, L.9
76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B)
CO-05 COBIT 4.1 ME

2.6, DS 2.1, DS

2.4 Domain 2,
4 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)

6.10. (f)

6.10. (g)

6.10. (h)

6.10. (i)
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1

1.2.2 1.2.4

1.2.6 1.2.11

3.2.4 5.2.1
45 CFR
164.308(b)(1)
(New)
45 CFR 164.308
(b)(4)
A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2
Commandment #1
Commandment #2
Commandment #3
Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36
A.6.2.3
A.10.6.2
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05
Commandment #6
Commandment #7
Commandment #8
SC-20
SC-21
SC-22
SC-23
SC-24
ITOS > Service
Delivery > Service
Level
Management
Supply Chain
Management,
Transparency and
Accountability
Third Party Agreements
STA05Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutuallyagreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships
• Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts
• Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence
S2.2.0
A3.6.0
C3.6.0
(S2.2.0) The availability, confidentiality of data,
processing integrity, system security and related
security obligations of users and the entity’s
availability and related security commitments to
users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(C3.6.0) The entity has procedures to obtain
assurance or representation that the
confidentiality policies of third parties to whom
information is transferred and upon which the
entity relies are in conformity with the entity’s
defined system confidentiality and related security
policies and that the third party is in compliance
with its policies.

C.2 C.2.4, C.2.6,
G.4.1, G.16.3
74 (B)
75 (C+,
A+)
45 (B)
75 (C+,
A+)
79 (B)
4 (C+, A+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
LG-02 COBIT 4.1 DS5.11 Domain 3 6.02. (e)

6.10. (h)

6.10. (i)
Article 17 (3) NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
312.3, 312.8 and 1.2.5
312.10
A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Supply Chain
Management,
Transparency and
Accountability
Network /
Infrastructure Services
STA03Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems
components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

C2.2.0 (C2.2.0) The system security, availability, system integrity, and confidentiality and related security
obligations of users and the entity’s system
security, availability, system integrity, and
confidentiality and related security commitments
to users are communicated to authorized users.

C.2 C.2.6, G.9.9 45 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-31 COBIT 4.1 DS5.10 Domain 2 6.02. (c)

6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30

8.2.2 8.2.5
APO01.03
APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05
Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 Supply Chain
Management,
Transparency and
Accountability
Data Quality and
Integrity
STA01Providers shall inspect, account for, and work with their cloud supplychain partners to correct data quality errors and associated risks.

Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, rolebased access, and least-privilege access for all personnel within their supply chain.

DSS04.07
APO10
APO11
DSS05.04
DSS06.03
DSS06.06
IS-25 PA11 BSGP
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Consensus Assessments Initiative Questionnaire CAIQ Version

3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Consensus Assessments Initiative Questionnaire v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be modified or altered in any way; (c) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Consensus Assessments Initiative Questionnaire v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Consensus Assessments Initiative Questionnaire 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

J.1.2 47 (B) COBIT 4.1 DS 4.9
Domain 2
51 (B) Domain 3 6.02. (c)

6.02. (d)

6.07.01. (k)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.15.1.2
A.13.1.2
A.15.1.2,

8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1
Domain 2
A.16.1.6
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 89
#15..
- 420 -
CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE (CAIQ) V3.0.1 GUIDING DOCUMENT PRINCIPLES INTENT OF THIS TAB: To assist reviewers/users of document to understand both the intent and structure of CAIQ GUIDING PRINCIPLES:
 Questionnaire is organized using CSA 16 governing & operating domains divided into “control areas” within CSA’s Controls Matrix structure  Questions are to assist both cloud providers in general principles of cloud security and clients in vetting cloud providers on the security of their offering and company security profile
 CAIQ is not intended to duplicate or replace existing industry security assessments but to contain questions unique or critical to the cloud computing model in each control area
 Each question should be able to be answered yes or no  If a question can’t be answered yes or no then it was separated into two or more questions to allow yes or no answers.  Questions are intended to foster further detailed questions to provider by client specific to client’s cloud security needs. This was done to limit number of questions to make the assessment feasible and since each client may have unique follow-on questions or may not be concerned with all follow-on questions
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 90
#15..
- 421 -
CLOUD CONTROLS MATRIX VERSION 3.0.1
Scope
Applicability
Phys Network Compute Storage App Data SaaS PaaS IaaS Service Provider
Tenant /
Consumer
AICPA
2009 TSC Map
AICPA
Trust Service Criteria (SOC 2SM Report)
AICPA
2014 TSC
BITS Shared Assessments
AUP v5.0
BITS Shared Assessments
SIG v6.0 BSI Germany Canada PIPEDA CCM V1.X COBIT 4.1 COBIT 5.0 COPPA CSA Guidance V3.0 ENISA IAF 95/46/EC - European Union Data Protection Directive FedRAMP Security Controls
(Final Release, Jan 2012)
--LOW IMPACT LEVEL--
FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL--
FERPA GAPP (Aug 2009) HIPAA / HITECH Act ISO/IEC 27001-2005 ISO/IEC 27001-2013 ITAR Jericho Forum Domain > Container > Capability Public Priv ate
Application & Interface
Security
Application Security
AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web
applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

X X X X X X X X S3.10.0
S3.10.0
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies.

CC7.1 I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-04 AI2.4 APO09.03 APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02
312.8 and
312.10
Application Services > Development
Process > Software Quality
Assurance
shared x Domain 10 6.03.01. (c) Article: 27 (3) NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18

1.2.6 45 CFR 164.312(e)(2)(i) A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1
A9.4.2
A9.4.1,

8.1*Partial, A14.2.3,

8.1*partial, A.14.2.7
A12.6.1,
A18.2.2
Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Application & Interface
Security
Customer Access
Requirements
AIS-02 Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be
addressed.

X X X X X X X X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 C.2.1, C.2.3, C.2.4, C.2.6.1, H.1 10 (B)
11 (A+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 SA-01 APO09.01 APO09.02
APO09.03
APO13.01
BAI02
DSS05
312.3,
312.8 and
312.10
BOSS > Legal Services > Contracts shared x Domain 10 Article 17 (1), (2) NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6

1.2.2 1.2.6

6.2.1 6.2.2
A.6.2.1
A.6.2.2
A.11.1.1
A9.1.1. Commandment #6
Commandment #7
Commandment #8
Application & Interface
Security
Data Integrity
AIS-03 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

X X X X X X X X X X I3.2.0
I3.3.0
I3.4.0
I3.5.0
(I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies.
(I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies.
(I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa.

PI1.2
PI1.3
PI1.5
I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-05 DSS06.02 DSS06.04
312.8 and
312.10
Application Services >
Programming Interfaces > Input
Validation
shared x Domain 10 NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11

1.2.6 45 CFR 164.312 (c)(1)
45 CFR 164.312 (c)(2)
45 CFR 164.312(e)(2)(i)
A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
Commandment #1
Commandment #9
Commandment #11
Application & Interface
Security
Data Security / Integrity
AIS-04 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces,
jurisdictions and business functions to prevent improper disclosure, alteration, or destruction.

X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 B.1 G.8.2.0.2, G.8.2.0.3, G.12.1,
G.12.4, G.12.9, G.12.10, G.16.2,
G.19.2.1, G.19.3.2, G.9.4, G.17.2,
G.17.3, G.17.4, G.20.1
6 (B)
26 (A+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-03 DS5.11 APO09.01 APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02
312.8 and
312.10
BOSS > Data Governance > Rules
for Information Leakage Prevention
shared x Domain 10 6.02. (b)

6.04.03. (a)
Article 17 (1), (2),(3), (4) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-4
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-8

1.1.0 1.2.2

1.2.6 4.2.3

5.2.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4

8.2.1 8.2.2

8.2.3 8.2.5

9.2.1 A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
All
Audit Assurance &
Compliance
Audit Planning
AAC-01 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

X X X X X X X X X X X S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

CC4.1 L.1, L.2, L.7, L.9, L.11 58 (B) CO-01 ME 2.1
ME 2.2
PO 9.5
PO 9.6
APO12.04
APO12.05
APO12.06
MEA02.01
MEA02.02
Title 16
Part 312
BOSS > Compliance > Audit
Planning
shared x Domain 2, 4 6.01. (d) NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 PL-6

10.2.5 45 CFR 164.312(b) Clause 4.2.3 e)
Clause 4.2.3b
Clause 5.1 g
Clause 6
A.15.3.1
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

6.2(e),

9.1,

9.1(e),

9.2,
Commandment #1
Commandment #2
Commandment #3
Audit Assurance &
Compliance
Independent Audits
AAC-02 Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards,
procedures, and compliance obligations.

X X X X X X X X X X X X S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

CC4.1 L.2, L.4, L.7, L.9, L.11 58 (B)
59 (B)
61 (C+, A+)
76 (B)
77 (B)
CO-02 DS5.5
ME2.5
ME 3.1
PO 9.6
APO12.04
APO12.05
DSS05.07
MEA02.06
MEA02.07
MEA02.08
MEA03.01
Title 16
Part 312
BOSS > Compliance > Independent
Audits
shared x Domian 2, 4 6.03. (e)

6.07.01. (m)

6.07.01. (n)
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)

1.2.5 1.2.7

4.2.1 8.2.7

10.2.3 10.2.5
45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(D)
Clause 4.2.3e
Clause 5.1 g
Clause 5.2.1 d)
Clause 6
A.6.1.8
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

9.1,

9.2,

9.3(f),
A18.2.1
Commandment #1
Commandment #2
Commandment #3
Audit Assurance &
Compliance
Information System
Regulatory Mapping
AAC-03 Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are
reflected.

X X X X X X X X X X X X S3.1.0
x3.1.0
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operations that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats.

CC3.1 L.1, L.2, L.4, L.7, L.9 76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B)
Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3
CO-05 ME 3.1 APO12.01
APO12.02
APO12.03
MEA03.01
312.4 BOSS > Compliance > Information
System Regulatory Mapping
shared x Domain 2, 4 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)

6.10. (f)

6.10. (g)

6.10. (h)

1.2.2 1.2.4

1.2.6 1.2.11

3.2.4 5.2.1
ISO/IEC 27001:2005
Clause 4.2.1 b) 2)
Clause 4.2.1 c) 1)
Clause 4.2.1 g)
Clause 4.2.3 d) 6)
Clause 4.3.3
Clause 5.2.1 a - f
Clause 7.3 c) 4)
A.7.2.1
A.15.1.1
A.15.1.3
A.15.1.4
A.15.1.6
Clauses

4.2(b),

4.4,

5.2(c),

5.3(ab),

6.1.2,

6.1.3,

6.1.3(b),

7.5.3(b),

7.5.3(d),

8.1,

8.3 9.2(g),

9.3,

9.3(b),

9.3(f),

10.2,
A.8.2.1,
A.18.1.1,
A.18.1.3,
A.18.1.4,
A.18.1.5
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Business Continuity
Planning
BCR-01 A consistent unified framework for business continuity planning and plan
development shall be established, documented and adopted to ensure all
business continuity plans are consistent in addressing
priorities for
testing, maintenance, and information security requirements.

Requirements for business continuity plans include the
following:
• Defined purpose and scope, aligned with relevant
dependencies
• Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation
X X X X X X X X X X X X A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

CC3.1
A1.2
A1.3
K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6,
K.1.2.7, K.1.2.11, K.1.2.13,
K.1.2.15
RS-03 DSS04.01
DSS04.02
DSS04.03
DSS04.05 BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
NIST SP800-53 R3 CP-6
NIST SP800-53 R3 CP-6 (1)
NIST SP800-53 R3 CP-6 (3)
NIST SP800-53 R3 CP-7
NIST SP800-53 R3 CP-7 (1)
NIST SP800-53 R3 CP-7 (2)
NIST SP800-53 R3 CP-7 (3)
NIST SP800-53 R3 CP-7 (5)
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-9 (1)
NIST SP800-53 R3 CP-9 (3)
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-10 (2)
NIST SP800-53 R3 CP-10 (3)
NIST SP800-53 R3 PE-17
45 CFR 164.308 (a)(7)(i)
45 CFR 164.308 (a)(7)(ii)(B)
45 CFR 164.308 (a)(7)(ii)(C)
45 CFR 164.308 (a)(7)(ii)(E)
45 CFR 164.310 (a)(2)(i)
45 CFR 164.312 (a)(2)(ii)
Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4
Clause 5.1(h)
A.17.1.2
A.17.1.2
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Business Continuity
Testing
BCR-02 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

X X X X X X X X X X X X A3.3 (A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.

A1.2 K.1.3, K.1.4.3, K.1.4.6, K.1.4.7,
K.1.4.8, K.1.4.9, K.1.4.10,
K.1.4.11, K.1.4.12
52 (B)
55 (A+)
RS-04 DSS04.04 BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 6.07.01. (b)

6.07.01. (j)

6.07.01. (l)
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
45 CFR 164.308 (a)(7)(ii)(D) A.14.1.5 A17.3.1 Commandment #1 Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Datacenter Utilities /
Environmental
Conditions
BCR-03 Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications,and internet connectivity) shall be
secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with
automated fail-over or other redundancies in the event of planned or unplanned disruptions.

X X X X X X A3.2.0
A3.4.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against unauthorized access to system resource.

A1.1
A1.2
A1.3
F.1 F.1.6, F.1.6.1, F.1.6.2, F.1.9.2,
F.2.10, F.2.11, F.2.12
9 (B)
10 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-08 DSS01.03 DSS01.04
DSS01.05
DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (c)

6.09. (f)

6.09. (g)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
A.9.2.2
A.9.2.3
A11.2.2,
A11.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #9
Commandment #11
Business Continuity
Management &
Operational Resilience
Documentation
BCR-04 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made
available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system
• Effectively using the system’s security features
X X X X X X X X X X S3.11.0
A.2.1.0
(S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users.

CC1.3
CC1.4
CC2.1
G.1.1 56 (B)
57 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 OP-02 DS 9 DS 13.1
BAI08
BAI10
DSS01.01
312.8 and 312.10 SRM > Policies and Standards >
Job Aid Guidelines
shared x Domain 7, 8 Article 17 NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 CP-10 (2)
NIST SP 800-53 R3 CP-10 (3)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 Clause 4.3.3
A.10.7.4
Clause 9.2(g) Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Business Continuity
Management &
Operational Resilience
Environmental Risks
BCR-05 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have
countermeasures applied.

X X X X X X A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

CC3.1
A1.1
A1.2
F.1 F.2.9, F.1.2.21, F.5.1, F.1.5.2,
F.2.1, F.2.7, F.2.8
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-05 DSS01.03 DSS01.04
DSS01.05 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18

8.2.4 45 CFR 164.308 (a)(7)(i)
45 CFR 164.310(a)(2)(ii)
A.9.1.4
A.9.2.1
A11.1.4,
A11.2.1
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Equipment Location
BCR-06 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability
environmental risks and supplemented by redundant
equipment located at a reasonable distance.

CC3.1
A1.1
A1.2
F.1 F.2.9, F.1.2.21, F.5.1, F.1.5.2,
F.2.1, F.2.7, F.2.8
53 (A+)
75 (C+, A+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-06 DSS01.04 DSS01.05 312.8 and
312.10
Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-5
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18
45 CFR 164.310 (c) A.9.2.1 A11.2.1 Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Equipment
Maintenance
BCR-07 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

X X X X X X X X X X X A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies.

A1.1
A1.2
CC4.1
F.2.19 1 (B) OP-04 A13.3 BAI03.10
BAI04.03
BAI04.04
DSS03.05
Infra Services > Equipment
Maintenance >
provider x Domain 7, 8 6.09. (h) Article 17 (1) NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-6

5.2.3 8.2.2

8.2.3 8.2.4

8.2.5 8.2.6

8.2.7 45 CFR 164.310 (a)(2)(iv) A.9.2.4 A11.2.4 Commandment #2 Commandment #5
Commandment #11
Business Continuity
Management &
Operational Resilience
Equipment Power
Failures
BCR-08 Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment
X X X X X X X X A3.2.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

A1.1
A1.2
F.1 F.1.6, F.1.6.1, F.1.6.2, F.1.9.2,
F.2.10, F.2.11, F.2.12
54 (A+) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-07 DSS01.04 DSS01.05
DSS04.01
DSS04.02
DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (e)

6.09. (f)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-9
NIST SP800-53 R3 PE-10
NIST SP800-53 R3 PE-11
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
A.9.2.2
A.9.2.3
A 9.2.4
A.11.2.2,
A.11.2.3,
A.11.2.4
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Impact Analysis
BCR-09 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption • Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption
X X X X X X X X X X X X A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

CC3.1
A1.2
A1.3
K.2 RS-02 BAI06.01
BAI10.01
BAI10.02
BAI10.03
DSS04.01
DSS04.02 ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis provider x Domain 7, 8 6.02. (a)

6.03.03. (c)

6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
45 CFR 164.308 (a)(7)(ii)(E) ISO/IEC 27001:2005
A.14.1.2
A 14.1.4
A.17.1.1
A.17.1.2
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Policy
BCR-10 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, for
appropriate IT
governance and service management to ensure appropriate planning,
delivery and support of the organization's IT capabilities supporting
business functions, workforce, and/or customers based on industry
acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies
and procedures shall include defined roles and
responsibilities
supported by regular workforce training.

X X X X X X S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 G.1.1 45 (B) OP-01 DS13.1 APO01
APO07.01
APO07.03
APO09.03
DSS01.01
SRM > Policies and Standards >
Operational Security Baselines
shared x Domain 7, 8 6.03. (c) NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12

8.2.1 Clause 5.1
A 8.1.1
A.8.2.1
A 8.2.2
A.10.1.1
Clause 5.1(h)
A.6.1.1
A.7.2.1
A.7.2.2
A.12.1.1
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Business Continuity
Management &
Operational Resilience
Retention Policy
BCR-11 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance
obligations. Backup and recovery measures shall be
incorporated as part of business continuity planning and tested accordingly for effectiveness.

X X X X X X X X X X A3.3.0
A3.4.0
I3.20.0
I3.21.0
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.
(I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems.

A1.2
A1.3
I3.21
D.2.2.9 36 (B) Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.5.2
DG-04 DS 4.1
DS 4.2
DS 4.5
DS 4.9
DS 11.6
BAI09.01
BAI09.02
BAI09.03
DSS04.01
DSS04.02
DSS04.03
DSS04.04
DSS04.07
MEA03.01
312.3 BOSS > Data Governance > Data
Retention Rules
shared x Domain 5 6.03. (h)

6.07.01. (c)
Article 6(1) e NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-2 (1)
NIST SP 800-53 R3 CP-2 (2)
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)

5.1.0 5.1.1

5.2.2 8.2.6
45 CFR 164.308 (a)(7)(ii)(A)
45 CFR 164.310 (d)(2)(iv)
45 CFR 164.308(a)(7)(ii)(D)
45 CFR 164.316(b)(2)(i) (New)
Clause 4.3.3
A.10.5.1
A.10.7.3
Clauses

9.2(g)

7.5.3(b)

5.2 (c)

7.5.3(d)

5.3(a)

5.3(b)

8.1 8.3
A.12.3.1
A.8.2.3
EAR 15 §
762.6 Period
of Retention
EAR 15
CFR § 786.2
Recordkeepi
ng
Commandment #11
Change Control &
Configuration
Management
New Development /
Acquisition
CCC-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data,
physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the
organization's business leadership or other accountable business role or function.

X X X X X X X X X X S3.12.0
S3.10.0
S3.13.0
(S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.2
CC7.1
CC7.4
I.2 I.1.1, I.1.2, I.2. 7.2, I.2.8, I.2.9,
I.2.10, I.2.13, I.2.14, I.2.15, I.2.18,
I.2.22.6, L.5
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-01 A12 A16.1
APO01.02
APO01.06
BAI02.04
BAI06.01
ITOS > IT Operation > Architecture
Governance
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.6 A.6.1.4
A.6.2.1
A.12.1.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.5
A.15.1.3
A.15.1.4
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial) A.14.2.7
A.18.1.3
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Outsourced
Development
CCC-02 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

X X X X X X X X X X S3.10.0
S3.13
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies. (S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1
CC7.4
C.2
I.1
I.2
I.4
C.2.4, G.4, G6, I.1, I.4.4, I.4.5,
I.2.7.2, I.2.8, I.2.9, I.2.15, I.2.18,
I.2.22.6, I.2.7.1, I.2.13, I.2.14,
I.2.17, I.2.20, I.2.22.2, I.2.22.4,
I.2.22.7, I.2.22.8, I.2.22.9,
I.2.22.10, I.2.22.11, I.2.22.12,
I.2.22.13, I.2.22.14, I.3, J.1.2.10,
L.7, L.9, L.10
27 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-04 APO07.06 APO09.03
APO09.04
APO10.01
APO10.04
APO10.05
APO11.01
APO11.02
APO11.04
APO11.05 ITOS > IT Operation > Architecture Governance shared x None NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12
A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A18.2.1
A.15.1.2
A.12.1.4

8.1* (partial)

8.1* (partial) A.15.2.1

8.1* (partial) A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial) A.14.2.2

8.1* (partial) A.14.2.3

8.1* (partial) A.14.2.4

8.1* (partial) A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Quality Testing
CCC-03 Organization shall follow a defined quality change control and testing process (e.g. ITIL Service Management) with
established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.

X X X X X X X X X A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13
(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies.
(S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1
CC7.1
CC7.1
CC7.1
CC7.4
C.1.7, G.1, G.6, I.1, I.4.5, I.2.18,
I.22.1, I.22.3, I.22.6, I.2.23,
I.2.22.2, I.2.22.4, I.2.22.7. I.2.22.8,
I.2.22.9, I.2.22.10, I.2.22.11,
I.2.22.12, I.2.22.13,
I.2.22.14,I.2.20, I.2.17, I.2.7.1, I.3,
J.2.10, L.9
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-03 PO 8.1 APO11.01 APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05
ITOS > Service Support > Release
Management
shared x None 6.03.01. (b)

9.1.0 9.1.1

9.2.1 9.2.2
A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* partial A.14.2.2

8.1* partial A.14.2.3

8.1* partial A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Unauthorized Software
Installations
CCC-04 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on
organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X A3.6.0
S3.5.0
S3.13.0
(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC5.5
CC5.8
CC7.4
G.1
I.2
G.2.13, G.20.2,G.20.4, G.20.5,
G.7, G.7.1, G.12.11, H.2.16,
I.2.22.1, I.2.22.3, I.2.22.6, I.2.23
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-05 APO13.01 BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03 312.8 and 312.10 ITOS > Service Support > Configuration Management -> Software Mangement shared x None NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

3.2.4 8.2.2
A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3
A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1

8.1* (partial) A.14.2.4
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11
Change Control &
Configuration
Management
Production Changes
CCC-05 Policies and procedures shall be established for managing the risks associated with applying changes to:
• business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations
• infrastructure network and systems components
Technical measures shall be implemented to provide
assurance that all changes directly correspond to a
registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.

X X X X X X X X X X X A3.16.0
S3.13.0
(A3.16.0, S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4
CC7.4
I.2.17, I.2.20, I.2.22 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-02 A16.1 A17.6
BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06
ITOS > Service Support > Release
Management
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

1.2.6 45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b)
A.10.1.4
A.12.5.1
A.12.5.2
A.12.1.4

8.1* (partial) A.14.2.2

8.1* (partial) A.14.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment #11
Data Security &
Information Lifecycle
Management
Classification
DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

X X X X X X X X X X S3.8.0
C3.14.0
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.

CC3.1
CC3.1
D.1.3, D.2.2 DG-02 PO 2.3
DS 11.6
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
312.3 BOSS > Data Governance > Data
Classification
shared x Domain 5 6.04.03. (a) Article 4 (1),
Article 12, Article 17
NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4

1.2.3 1.2.6

4.1.2 8.2.1

8.2.5 8.2.6
A.7.2.1 A.8.2.1 Commandment #9
Data Security &
Information Lifecycle
Management
Data Inventory / Flows
DSI-02 Policies and procedures shall be established to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's applications and infrastructure network and systems. In particular,
providers shall ensure that data that is subject to geographic residency requirements not be migrated beyond its defined bounds.
-- APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05
BOSS > Data Governance >
Handling / Labeling / Security Policy
Domain 5 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)
NIST SP 800-53 R3 SC-30 Clause

4.2 5.2,

7.5,

8.1 Data Security &
Information Lifecycle
Management
eCommerce
Transactions
DSI-03 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

X X X X X X X S3.6
I13.3.a-e
I3.4.0
(S3.6) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (I13.3.a-e) The procedues related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policiies.

CC5.7
PI1.5
G.4
G.11
G.16
G.18
I.3
I.4
G.19.1.1, G.19.1.2, G.19.1.3,
G.10.8, G.9.11, G.14, G.15.1
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-28 DS 5.10 5.11 APO01.06 APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
312.8 and
312.10
SRM > Cryptographic Services >
Data in Transit Encryption
shared x Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)

3.2.4 4.2.3

7.1.2 7.2.1

7.2.2 8.2.1

8.2.5 45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(i)
A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4
A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Data Security &
Information Lifecycle
Management
Handling / Labeling /
Security Policy
DSI-04 Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data.

Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

X X X X X X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 G.13 D.2.2 DG-03 PO 2.3
DS 11.6
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
312.2 BOSS > Data Governance >
Handling / Labeling / Security Policy
shared x Domain 5 6.03.05. (b) Article 22
Article 23
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12

99.31.(a)(1)(ii) 1.1.2

5.1.0 7.1.2

8.1.0 8.2.5

8.2.6 A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1
A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1
Commandment #8
Commandment #9
Commandment #10
Data Security &
Information Lifecycle
Management
Non-Production Data
DSI-05 Production data shall not be replicated or used in nonproduction environments.X X X X X X X C3.5.0 S3.4.0
C3.21.0
(C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that confidential information is protected during the system development, testing, and change processes in accordance with defined system confidentiality and related security policies.

C1.3
CC5.6
C1.1
I.2.18 DG-06 APO01.06
BAI01.01
BAI03.07
BAI07.04 SRM > Policies and Standards > Technical Standard (Data Management Security Standard) shared x Domain 5 6.03. (d) NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1)

1.2.6 45 CFR 164.308(a)(4)(ii)(B) A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1
A.8.1.3
A.12.1.4
A.14.3.1

8.1* (partial) A.14.2.2.

Commandment #9
Commandment #10
Commandment #11
Data Security &
Information Lifecycle
Management
Ownership /
Stewardship
DSI-06 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

X X X X X X X X X S2.2.0
S2.3.0
S3.8.0
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary
CC2.3
CC3.1
C.2.5.1, C.2.5.2, D.1.3, L.7 Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3
DG-01 DS5.1
PO 2.3
APO01.06
APO03.02
APO13.01
APO13.03
312.4 BOSS > Data Governance > Data
Ownership / Stewadship
shared x Domain 5 Article 4 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2

6.2.1 45 CFR 164.308 (a)(2) A.6.1.3
A.7.1.2
A.15.1.4
A.6.1.1
A.8.1.2
A.18.1.4
Commandment #6
Commandment #10
Data Security &
Information Lifecycle
Management
Secure Disposal
DSI-07 Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

X X X X X X X X X C3.5.0
S3.4.0
(C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.

C1.3
CC5.6
D.2.2.10, D.2.2.11, D.2.2.14, 37 (B) Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.7.5 and 4.5.3
DG-05 DS 11.4 APO01.06
APO13.01
BAI09.03
DSS01.01
312.3 BOSS > Data Governance > Secure
Disposal of Data
shared x Domain 5 6.03. (h) Article 16
Article 17
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1

5.1.0 5.2.3
45 CFR 164.310 (d)(2)(i)
45 CFR 164.310 (d)(2)(ii)
A.9.2.6
A.10.7.2
A.11.2.7
A.8.3.2
Commandment #11
Datacenter Security
Asset Management
DCS-01 Assets must be classified in terms of business criticality, service-level expectations, and operational continuity
requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated
regularly, and assigned ownership by defined roles and
responsibilities.

X X X X X S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis.

CC3.1
CC3.1
Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-08 APO01.06 APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06 ITOS > Service Support > Configuration Management - Physical Inventory provider x Domain 8 Article 17 Annex A.8 Datacenter Security
Controlled Access
Points
DCS-02 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-03 DS 12.2 DS 12.3
APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06
312.8 and 312.10 Infra Services > Facility Security >
Controlled Physical Access
provider x Domain 8 6.08. (a)

99.31.a.1.ii 8.2.3 A.9.1.1
A.9.1.2
A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security
Equipment Identification
DCS-03 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 D.1 D.1.1, D.1.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-13 DS5.7 APO13.01 DSS05.02
DSS05.03
312.3,
312.8 and
312.10
> > Domain 10 6.05. (a) Article 17 NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
A.11.4.3 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8
Datacenter Security
Off-Site Authorization
DCS-04 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

X X X X X X X X S3.2.f
C3.9.0
(S3.2.f) f. Restriction of access to offline storage, backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access to the defined system including, but not limited to: facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.1
CC5.5
F.2.18, F.2.19, Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 FS-06 EDM05.02 APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01 312.8 and
312.10
SRM > Facility Security > Asset Handlingprovider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-17
45 CFR 164.310 (c )
45 CFR 164.310 (d)(1)
45 CFR 164.310 (d)(2)(i)
A.9.2.5
A.9.2.6
A.11.2.6
A.11.2.7
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #4
Commandment #5
Commandment #11
Datacenter Security
Off-Site Equipment
DCS-05 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the
organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory X X X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1 D.1.1, D.2.1. D.2.2, Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 FS-07 APO09.03 APO10.04
APO10.05
APO13.01
DSS01.02 312.8 and
312.10
BOSS > Data Governance > Secure Disposal of Data provider x Domain 8 6.05. (a)

6.05. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30
45 CFR 164.310 (d)(2)(iii) A.7.1.1
A.7.1.2
A.8.1.1
A.8.1.2
Commandment #6
Commandment #7
Commandment #8
Datacenter Security
Policy
DCS-06 Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 H.6 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.4.2, F1.4.6, F.1.4.7, F.1.7,
F.1.8, F.2.13, F.2.14, F.2.15,
F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-01 APO13.01 DSS01.04
DSS01.05
DSS04.01
DSS04.03 SRM > Policies and Standards > Information Security Policies (Facility Security Policy) provider x Domain 8 6.08. (a)

99.31.a.1.ii 8.2.1

8.2.2 8.2.3
45 CFR 164.310(a)(1)
45 CFR 164.310(a)(2)(ii)
45 CFR 164.310(b)
45 CFR 164.310 ( c) (New)
A.9.1.1
A.9.1.2
A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security -
Secure Area
Authorization
DCS-07 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

X X X X X X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-04 DS 12.3 APO13.01 APO13.02
DSS05.05
312.8 and 312.10 SRM > Policies and Standards >
Information Security Policy (Facility
Security Policy)
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.6 A.11.1.6 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security
Unauthorized Persons
Entry
DCS-08 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

X X X X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 G.21 F.2.18 Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-05 APO13.01 APO13.02
DSS05.05
DSS06.03 312.8 and
312.10
SRM > Policies and Standards > Information Security Policy (Facility Security Policy) provider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16

99.31.a.1.ii 8.2.5

8.2.6 45 CFR 164.310 (d)(1) A.9.2.7
A.10.1.2
A.11.2.5

8.1* (partial) A.12.1.2
Commandment #6
Commandment #7
Datacenter Security
User Access
DCS-09 Physical access to information assets and functions by users and support personnel shall be restricted.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B)
10 (B)
Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-02 DS 12.3 APO13.01 APO13.02
DSS05.04
DSS05.05
DSS06.03
312.8 and 312.10 Infra Services > Facility Security > Domain 8 6.08. (a)

99.31.a.1.ii 8.2.3 A.9.1.1 A.11.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Encryption & Key
Management
Entitlement
EKM-01 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies. APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
DSS06.06
SRM > Cryptographic Services >
Key Management
Annex
A.10.1
A.10.1.1
A.10.1.2
Encryption & Key
Management
Key Generation
EKM-02 Policies and procedures shall be established for the management of cryptographic keys in the service's
cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the
customer (tenant) of changes within the cryptosystem,
especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared
responsibility over implementation of the control.

X X X X X X X X X S3.6.0
S3.4
(S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7
CC5.6
L.6 38 (B)
39 (C+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-19 DS5.8 APO13.01 APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03
312.8 and
312.10
SRM > Cryptographic Services >
Key Management
shared x Domain 2 6.04.04. (a)

6.04.04. (b)

6.04.04. (c)

6.04.04. (d)

6.04.04. (e)

6.04.05. (d)

6.04.05. (e)

8.1.1 8.2.1

8.2.5 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312(e)(1)
Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6
Clauses

5.2(c)

5.3(a)

5.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.3

9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5
Commandment #9
Commandment #10
Commandment #11
Architectural Relevance
Corp Gov
Relevance
Cloud Service Delivery Model
Applicability Supplier Relationship
CSA Enterprise Architecture
(formerly Trusted Cloud Initiative)
Control Domain CCM V3.0
Control ID Updated Control Specification
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 91
#15..
- 422 -
Encryption & Key
Management
Sensitive Data
Protection
EKM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

XXXXXXXXXX C3.12.0
S3.6.0
S3.4
(C3.12.0, S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.
(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7
CC5.6
G.4
G.15
I.3
G.10.4, G.11.1, G.11.2, G.12.1,
G.12.2, G.12.4, G.12.10, G.14.18,
G.14.19, G.16.2, G.16.18,
G.16.19, G.17.16, G.17.17,
G.18.13, G.18.14, G.19.1.1,
G.20.14
23 (B)
24 (B)
25 (B)
Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3 IS-18 DS5.8 DS5.10
DS5.11
APO13.01
DSS05.02
DSS05.03
DSS06.06
312.8 and
312.10
SRM > Data Protection >
Cryptographic Services - Data-AtRest Encryption,
Cryptographic Services - Data-inTransit Encryption
sharedx Domain 2 6.04.05. (a)

8.1.1 8.2.1

8.2.5 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312 (e)(1)
45 CFR 164.312 (e)(2)(ii)
A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4
A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Encryption & Key
Management
Storage and Access
EKM-04 Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key
management and key usage shall be separated duties.

XXXXXXX -- APO01.06
BAI09.02
BAI09.03
SRM > Cryptographic Services >
Key Management
sharedx Domain 11 Annex
A.10.1
A.10.1.1
A.10.1.2
Governance and Risk
Management
Baseline Requirements
GRM-01 Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal,
statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and
authorized based on business need.

XXXXXXXXXXX S1.1.0
S1.2.0(a-i)
(S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include, but may not be limited to, the following matters:

CC3.2 L.2 L.2, L.5, L.7 L.8, L.9, L.10 12 (B)
14 (B)
13 (B)
15 (B)
16 (C+, A+)
21 (B)
Schedule 1 (Section 5), 4.7 - Safeguards IS-04 AI2.1
AI2.2
AI3.3
DS2.3
DS11.6
APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01
312.8 and 312.10 SRM > Governance Risk &
Compliance > Technical Standards
sharedx Domain 2 6.03.01. (a)

6.03.04. (a)

6.03.04. (b)

6.03.04. (c)

6.03.04. (e)

1.2.6 8.2.1

8.2.7 A.12.1.1
A.15.2.2
A.14.1.1
A.18.2.3
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Governance and Risk
Management
Data Focus Risk
Assessments
GRM-02 Risk assessments associated with data governance requirements shall be
conducted at planned intervals and shall consider the
following:
• Awareness of where sensitive data is stored and transmitted across
applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
XXXXXXXXXX S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis.

CC3.1
CC3.1
L.4, L.5, L.6, L.7 34 (B) Schedule 1 (Section 5), 4.7 - Safeguards DG-08 PO 9.1 PO 9.2
PO 9.4
DS 5.7
EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01
312.1 BOSS > Operational Risk
Management > Independent Risk
Management
sharedx Domain 5 6.01. (d)

6.04.03. (a)
Article 6, Article 8, Article 17 (1) NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12

1.2.4 8.2.1
45 CFR 164.308(a)(1)(ii)(A)
45 CFR 164.308(a)(8)
Clause 4.2.1 c) & g)
Clause 4.2.3 d)
Clause 4.3.1 & 4.3.3
Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4
Clauses

5.2(c)

5.3(a)

5.3(b)

6.1.2 6.1.2(a)(2)

6.1.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.2

8.3 9.2(g)
A.18.1.1
A.18.1.3
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment #10
Commandment #11
Governance and Risk
Management
Management Oversight
GRM-03 Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

XXXXXX S1.2.f
S2.3.0
(S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 E.1 E.4 5 (B)
65 (B)
Schedule 1 (Section 5) 4.1 Accountability; 4.7 Safeguards, Sub 4.7.4 IS-14 DS5.3 DS5.4
DS5.5
APO01.03
APO01.04
APO01.08
DSS01.01
312.8 and 312.10 BOSS > Human Resources Security
> Roles and Responsibilities
sharedx Domain 3, 9 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)

1.1.2 8.2.1
Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1
Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2
Commandment #6
Commandment #7
Commandment #8
Governance and Risk
Management
Management Program
GRM-04 An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and
XXXXXXXXXXXX x1.2. (x1.2.) The entity’s system [availability, processing integrity, confidentiality and related] security policies include, but may not be limited to, the following matters:

A.1, B.1 2 (B)
3 (B)
5 (B)
Schedule 1 (Section 5), 4.1 - Accountability; 4.7 Safeguards IS-01 R2 DS5.2 R2 DS5.5
APO13.01
APO13.02
APO13.03
312.8 and
312.10
SRM > InfoSec Management >
Capabilitiy Mapping
sharedx Domain 2 Article 17 99.31.(a)(1)(ii) 8.2.1 45 CFR 164.308(a)(1)(i) 45 CFR 164.308(a)(1)(ii)(B)
45 CFR 164.316(b)(1)(i)
45 CFR 164.308(a)(3)(i) (New)
45 CFR 164.306(a) (New)
Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8
All in sections 4, 5, 6, 7, 8, 9, 10.

A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1
Commandment #1
Commandment #2
Governance and Risk
Management
Management
Support/Involvement
GRM-05 Executive and line management shall take formal action to support
information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

XXXXX S1.3.0 (S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.

CC1.2 C.1 5 (B) Schedule 1 (Section 5), 4.1 Safeguards, Subsec. 4.1.1 IS-02 DS5.1 APO01.02 APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03
312.8 and
312.10
SRM > Governance Risk &
Compliance > Compliance
Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-1 8.2.1 45 CFR 164.316 (b)(2)(ii) 45 CFR 164.316 (b)(2)(iii)
Clause 5
A.6.1.1
All in section 5 plus clauses

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)
Commandment #3
Commandment #6
Governance and Risk
Management
Policy
GRM-06 Information security policies and procedures shall be established and
made readily available for review by all impacted personnel and external
business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic
business plan and an information security management
program inclusive of defined information security roles and responsibilities for business leadership.

XXXXXX S1.1.0
S1.3.0
S2.3.0
(S1.1.0) The entity's security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.
(S2.3.0) Responsibility and accountability for the entity's system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2
CC1.2
CC2.3
B.1 Schedule 1 (Section 5) 4.1 Accountability, Subsec 4.1.4 IS-03 DS5.2 APO01.03 APO01.04
APO13.01
APO13.02
312.8 and
312.10
SRM > Policies and Standards >
Information Security Policies
sharedx Domain 2 6.02. (e) Article 17 NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

8.1.0 8.1.1
45 CFR 164.316 (a)
45 CFR 164.316 (b)(1)(i)
45 CFR 164.316 (b)(2)(ii)
45 CFR 164.308(a)(2)
Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2
Clause 4.3
Clause 5

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)

7.2(b)

7.2(c)

7.2(d)

7.3(b)
Commandment #1
Commandment #2
Commandment #3
Governance and Risk
Management
Policy Enforcement
GRM-07 A formal disciplinary or sanction policy shall be established for employees who have violated security policies and
procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

XXXXXX S3.9
S2.4.0
(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(S2.4.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC6.2
CC2.5
B.1.5 Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 IS-06 PO 7.7 APO01.03 APO01.08
APO07.04
312.8 and
312.10
SRM > Governance Risk &
Compliance >
sharedx Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8

99.31(a)(i)(ii) 10.2.4 45 CFR 164.308 (a)(1)(ii)(C) A.8.2.3 A7.2.3 Commandment #6 Commandment #7
Governance and Risk
Management
Policy Impact on Risk
Assessments
GRM-08 Risk assessment results shall include updates to security policies,
procedures, standards, and controls to ensure that they remain relevant
and effective.

XXXXXXXXXXXX B.2
G.21
L.2
B.1.1, B.1.2, B.1.6, B.1.7.2, G.2,
L.9, L.10
Schedule 1 (Section 5), 4.7 - Safeguards RI-04 PO 9.6 APO12 APO13.01
APO13.03
312.8 and 312.10 BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domian 2, 4 6.03. (a) Article 17 (1), (2) NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2
Clause

4.2.1 a,

4.2(b)

4.3 c,

4.3(a&b)

4.4 5.1(c)

5.1(d)

5.1(e)

5.1(f)

5.1(g)

5.1(h)

5.2 5.2 e,

5.2(f)

5.3 6.1.1(e)(2),

6.1.2(a)(1) Governance and Risk
Management
Policy Reviews
GRM-09 The organization's business leadership (or other accountable business
role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to
ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

XXXXXX S1.1.0 (S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.

CC3.2 B.2 B.1.33. B.1.34, IS-05 DS 5.2
DS 5.4
APO12
APO13.01
APO13.03
MEA03.01
MEA03.02
312.8 and
312.10
SRM > Governance Risk &
Compliance > Policy Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

1.2.1 8.2.7

10.2.3 45 CFR 164.316 (b)(2)(iii)
45 CFE 164.306€
Clause 4.2.3 f)
A.5.1.2
Clause 8.1
A.5.1.2
Commandment #1
Commandment #2
Commandment #3
Governance and Risk
Management
Risk Assessments
GRM-10 Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at
planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods.

The likelihood and impact associated with inherent and
residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

XXXXXXXXXXXX S3.1
x3.1.0
S4.3.0
(S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats. (S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality of data, processing integrity, and system security is assessed on a timely basis; policies are updated for that assessment.

CC3.1
CC3.3
I.1
I.4
C.2.1, I.4.1, I.5, G.15.1.3, I.3 46 (B)
74 (B)
Schedule 1 (Section 5), 4.7 - Safeguards RI-02 PO 9.4 APO12 312.8 and 312.10
BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domain 2, 4 6.03. (a)

1.2.4 1.2.5
45 CFR 164.308 (a)(1)(ii)(A) Clause 4.2.1 c) through g) Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2
Clause

4.2(b),

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1) Governance and Risk
Management
Risk Management
Framework
GRM-11 Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and
documented in accordance with reasonable resolution time frames and stakeholder approval.

XXXXXXXXXXXX S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats.

CC3.1 L.2 A.1, L.1 Schedule 1 (Section 5), 4.7 - Safeguards RI-01 PO 9.1 EDM03.02 APO01.03
APO12
312.8 and
312.10
BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domain 2, 4 Article 17 (1), (2) NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1

1.2.4 45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(B)
Clause 4.2.1 c) through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a) Human Resources
Asset Returns
HRS-01 Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

XXXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1 E.6.4 Schedule 1 (Section 5) 4.5 Limiting Use, Disclosure and Retention; 4.7 Safeguards, Subs. 4.7.5
IS-27 APO01.08
APO07.06
APO13.01
BAI09.03 312.3,
312.8 and
312.10
BOSS > Human Resources Security > Employee Termination provider x Domain 2 Article 17 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-4 5.2.3

7.2.2 8.2.1

8.2.6 45 CFR 164.308 (a)(3)(ii)(C) A.7.1.1
A.7.1.2
A.8.3.2
A.8.1.1
A.8.1.2
A.8.1.4
Human Resources
Background Screening
HRS-02 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

XXXXXXX S3.11.0 (S3.11.0) Procedures exist to help ensure that personnel responsible for the design, development, implementation, and operation of systems affecting confidentiality and security have the qualifications and resources to fulfill their responsibilities.

CC1.3
CC1.4
E.2 E.2 63 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 HR-01 PO 7.6 APO07.01 APO07.05
APO07.06
312.8 and 312.10 BOSS > Human Resources Security
> Background Screening
sharedx None 6.01. (a) Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3

1.2.9 A.8.1.2 A.7.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #2
Commandment #3
Commandment #6
Commandment #9
Human Resources
Employment
Agreements
HRS-03 Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or onboarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

XXXXXXXXXXXX S2.2.0 (S2.2.0) The security obligations of users and the entity's security commitments to users are communicated to authorized users CC2.2
CC2.3
C.1 E.3.5 66 (B) Schedule 1 (Section 5) 4.7 Safeguards, Subsec. 4.7.4 HR-02 DS 2.1 APO01.03 APO13.01
APO07.06
APO09.03
APO10.01
312.3,
312.8 and
312.10
BOSS > Human Resources Security
> Employee Code of Conduct
sharedx None Article 17 NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

1.2.9 8.2.6
45 CFR 164.310(a)(1)
45 CFR 164.308(a)(4)(i)
A.6.1.5
A.8.1.3
A.13.2.4
A.7.1.2
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Human Resources
Employment
Termination
HRS-04 Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

XXXXXX S3.2.d
S3.8.e
(S3.2.d) Procedures exist to restrict logical access to the system and information resources maintained in the system including, but not limited to, the following matters:
d. The process to make changes and updates to user profiles (S3.8.e) e. Procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own
CC5.4 E.6 HR-03 PO 7.8 APO01.02
APO07.05
APO07.06
312.8 and
312.10
BOSS > Human Resources Security
> Roles and Responsibilities
sharedx None Article 17 NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8

8.2.2 10.2.5
45 CFR 164.308 (a)(3)(ii)(C) A.8.3.1 A.7.3.1 Commandment #6 Commandment #7
Human Resources
Mobile Device
Management
HRS-05 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the
implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

XXXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.11, G12, G.20.13, G.20.14 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-32 DS5.11 DS5.5
APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06
312.8 and
312.10
Presentation Servies > Presentation
Platform > Endpoints - Mobile
Devices - Mobile Device
Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)

1.2.6 3.2.4

8.2.6 45 CFR 164.310 (d)(1) A.7.2.1
A.10.7.1
A.10.7.2
A.10.8.3
A.11.7.1
A.11.7.2
A.15.1.4
A.8.2.1
A.8.3.1
A.8.3.2
A.8.3.3
A.6.2.1
A.6.2.2
A.18.1.4
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
All
Human Resources
Non-Disclosure
Agreements
HRS-06 Requirements for non-disclosure or confidentiality agreements reflecting
the organization's needs for the protection of data and operational
details shall be identified, documented, and reviewed at XXXXXXX S4.1.0 (S4.1.0) The entity’s system availability, confidentiality, processing integrity and security performance is periodically reviewed and compared with the defined system availability and related security policies.

CC4.1 C.2.5 Schedule 1 (Section 5), 4.7 - Safeguards LG-01 APO01.02 APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03 312.8 and 312.10 BOSS > Compliance > Intellectual Property Protection shared x Domain 3 Article 16 NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)

1.2.5 ISO/IEC 27001:2005
Annex A.6.1.5
A.13.2.4 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Human Resources
Roles / Responsibilities
HRS-07 Roles and responsibilities of contractors, employees, and third-party
users shall be documented as they relate to information assets and
security.

XXXXXXXXXXXX S1.2.f (S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security.

B.1 B.1.5, D.1.1,D.1.3.3, E.1, F.1.1,
H.1.1, K.1.2
5 (B) Schedule 1 (Section 5) 4.1 Accountability IS-13 DS5.1 APO01.02 APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
312.3, 312.8 and 312.10 BOSS > Human Resources Security > Roles and Responsibilities
sharedx Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 1.2.9

8.2.1 Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1
Clause 5.3
A.6.1.1
A.6.1.1
Commandment #6
Commandment #7
Commandment #8
Human Resources
Technology Acceptable
Use
HRS-08 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of
personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be
considered and incorporated as appropriate.

XXXXXXXX S1.2
S3.9
(S1.2) The entity’s security policies include, but may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC3.2
CC6.2
B.3 B.1.7, D.1.3.3, E.3.2, E.3.5.1,
E.3.5.2
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 IS-26 DS 5.3 APO01.03 APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06
312.4,
312.8 and
312.10
SRM > Policies and Standards >
Information Security Policies
sharedx Domain 2 Article 5, Article 6
Article 7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4

8.1.0 45 CFR 164.310 (b) A.7.1.3 A.8.1.3 Commandment #1 Commandment #2
Commandment #3
Human Resources
Training / Awareness
HRS-09 A security awareness training program shall be established for all
contractors, third-party users, and employees of the
organization and
mandated when appropriate. All individuals with access to organizational
data shall receive appropriate awareness training and
regular updates
in organizational procedures, processes, and policies
XXXXXXXXXXXX S1.2.k
S2.2.0
(S1.2.k) The entity's security policies include, but may not be limited to, the following matters:
k. Providing for training and other resources to support its system security policies
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC2.2
CC2.3
E.1 E.4 65 (B) Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4
IS-11 PO 7.4 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and
312.10
SRM > GRC > sharedx Domain 2 6.01. (c)

6.02. (e)
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4

99.31(a)(1)(ii) 1.2.10

8.2.1 45 CFR 164.308 (a)(5)(i)
45 CFR 164.308 (a)(5)(ii)(A)
Clause 5.2.2
A.8.2.2
Clause 7.2(a), 7.2(b)
A.7.2.2
Commandment #3
Commandment #6
Human Resources
User Responsibility
HRS-10 All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
XXXXXXXXXXXX S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality, processing integrity and security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 E.1 E.4 65 (B)
66 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.4 IS-16 PO 4.6 APO01.02 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and
312.10
BOSS > Human Resources Security
> Employee Awareness
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4

1.2.10 8.2.1
45 CFR 164.308 (a)(5)(ii)(D) Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2
Clause 7.2(a), 7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8
Commandment #5
Commandment #6
Commandment #7
Human Resources
Workspace
HRS-11 Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.

XXXXXXXX S3.3.0
S3.4.0
(S3.3.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.4.0) Procedures exist to protect against unauthorized access to system resources.

CC5.5
CC5.6
E.1 E.4 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-17 APO01.02 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06 312.8 and 312.10 BOSS > Data Governance > Clear Desk Policy sharedx Domain 2 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)

8.2.3 Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3
Clause 7.2(a), 7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #5
Commandment #6
Commandment #7
Commandment #11
Identity & Access
Management
Audit Tools Access
IAM-01 Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

XXXXXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-29 DS 5.7 APO01.03 APO01.08
APO13.01
APO13.02
DSS05.03
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management
sharedx Domain 2 6.03. (i)

6.03. (j)
NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)

8.2.1 A.15.3.2 Commandment #2
Commandment #5
Commandment #11
Identity & Access
Management
Credential Lifecycle /
Provision Management
IAM-02 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and
customer (tenant) users with access to data and
organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and
measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business
relationships, or other third-party business relationships) • Business case considerations for higher levels of
assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access,
segregation of duties, emergency access, large-scale
provisioning or geographically-distributed deployments, and personnel redundancy for critical systems)
• Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or reuse when feasible • Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and
strong/multi-factor, expireable, non-shared authentication XXXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

B.1 B.1.8, B.1.21, B.1.28, E.6.2,
H.1.1, K.1.4.5,
8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4
IS-07 DS 5.4 APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Policies and Standards > sharedx Domain 2 6.01. (b)

6.01. (d)

6.02. (e)

6.03. (b)

6.03.04. (b)

6.03.04. (c)

6.03.05. (b)

6.03.05. (d)

6.03.06. (b)

6.04.01. (c)

6.04.01. (f)

6.04.02. (a)

6.04.02. (b)

6.04.02. (c)

6.04.03. (b)

6.04.06. (a)

6.04.08. (a)

6.04.08. (b)

6.04.08. (c)

6.04.08.03. (a)

6.04.08.03. (b)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1

8.1.0 45 CFR 164.308 (a)(3)(i)
45 CFR 164.312 (a)(1)
45 CFR 164.312 (a)(2)(ii)
45 CFR 164.308(a)(4)(ii)(B)
45 CFR 164.308(a)(4)(ii)(c )
A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1
A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
Diagnostic /
Configuration Ports
Access
IAM-03 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

XXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 H1.1, H1.2, G.9.15 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-30 DS5.7 APO13.01 DSS05.02
DSS05.03
DSS05.05
DSS06.06
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management - Resource Protection
providerx Domain 2 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4
A.13.1.1
A.9.1.1
A.9.4.4
Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
Policies and
Procedures
IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access.

Policies shall also be developed to control access to network resources based on user identity.
-- APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
SRM > Policies and Standards >
Information Security Policies
Domain 12 Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4, Identity & Access
Management
Segregation of Duties
IAM-05 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

XXXXXXXXXXX S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 G.2.13. G.3, G.20.1, G.20.2,
G.20.5
Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3(b) IS-15 DS 5.4 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03
312.8 and
312.10
ITOS > Resource Management >
Seggregation of Duties
sharedx Domain 2 6.04.01. (d)

99.31(a)(1)(ii) 8.2.2 45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308(a)(4)(ii)(A)
45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b)
A.10.1.3 A.6.1.2 Commandment #6
Commandment #7
Commandment #8
Commandment #10
Identity & Access
Management
Source Code Access
Restriction
IAM-06 Access to the organization's own developed applications, program, or object source code, or any other form of
intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

XXXXXXXX S3.13.0 (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4 I.2.7.2, I.2.9, I.2.10, I.2.15 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-33 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03 ITOS > Service Support > Release Management - Source Code Management shared x Domain 2 Article 17 NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1
Clause 4.3.3
A.12.4.3
A.15.1.3
Clause

5.2(c)

5.3(a),

5.3(b),

7.5.3(b)

7.5.3(d)
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #9
Commandment #10
Identity & Access
Management
Third Party Access
IAM-07 The identification, assessment, and prioritization of risks posed by
business processes requiring third-party access to the
organization's
information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood
and impact of unauthorized or inappropriate access.

Compensating
controls derived from the risk analysis shall be implemented prior to
provisioning access.

CC3.1 B.1
H.2
B.1.1, B.1.2, D.1.1, E.1, F.1.1,
H.1.1, K.1.1, E.6.2, E.6.3
Schedule 1 (Section 5), 4.7 - Safeguards RI-05 DS 2.3 APO01.03 APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06
312.8 and 312.10 SRM > Governance Risk &
Compliance > Vendor Management
sharedx Domain 2, 4 6.02. (a)

6.02. (b)

6.03. (a)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

7.1.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4
A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5
Identity & Access
Management
Trusted Sources
IAM-08 Policies and procedures are established for permissible storage and
access of identities used for authentication to ensure identities are
only accessible based on rules of least privilege and
replication
limitation only to users explicitly defined as business necessary.

XXXXX S3.2.0
S4.3.0
(S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).
(S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality, processing integrity and security is assessed on a timely basis; policies are updated for that assessment.

CC3.3 IS-08
IS-12
APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
312.8 and
312.10
Information Services > User
Directory Services > Active
Directory Services,
LDAP Repositories,
X.500 Repositories,
DBMS Repositories,
Meta Directory Services,
Virtual Directory Services
sharedx Domain 12 Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5
Identity & Access
Management
User Access
Authorization
IAM-09 Provisioning user access (e.g., employees, contractors, customers
(tenants), business partners and/or supplier relationships) to data and
organizationally-owned or managed (physical and virtual) applications,
infrastructure systems, and network components shall be authorized by
the organization's management prior to access being granted and
appropriately restricted as per established policies and procedures.

Upon request, provider shall inform customer (tenant) of this user
access, especially if customer (tenant) data is used as part the service
and/or customer (tenant) has some shared responsibility over implementation of control.

XXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2.4, H.2.5, 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+)
Schedule 1 (Section 5) Safeguards, Subs. 4.7.2 and 4.7.3 IS-08 DS5.4 APO01.03 APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Identity Management
- Identity Provisioning
sharedx Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.03.06. (b)

6.04.01. (a)

6.04.01. (b)

6.04.01. (d)

6.04.01. (e)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-9

8.2.2 45 CFR 164.308 (a)(3)(i)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308 (a)(4)(i)
45 CFR 164.308 (a)(4)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
45 CFR 164.312 (a)(1)
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Commandment #10
Identity & Access
Management
User Access Reviews
IAM-10 User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to
demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access
violations, remediation must follow established user access policies and procedures.

XXXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2.6, H.2.7, H.2.9, 41 (B) Schedule 1 (Section 5), 4.7 - Safeguards IS-10 DS5.3 DS5.4
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Authorization
Services - Entitlement Review
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 8.2.1

8.2.7 45 CFR 164.308 (a)(3)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
A.11.2.4 A.9.2.5 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Commandment #10
Identity & Access
Management
User Access
Revocation
IAM-11 Timely de-provisioning (revocation or modification) of user access to
data and organizationally-owned or managed (physical and virtual)
applications, infrastructure systems, and network components, shall be
implemented as per established policies and procedures and based on
user's change in status (e.g., termination of employment or other
business relationship, job change or transfer). Upon request, XXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2 E.6.2, E.6.3 Schedule 1 (Section 5), 4.7 - Safeguards IS-09 DS 5.4 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Identity Management
- Identity Provisioning
sharedx Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

99.31(a)(1)(ii) 8.2.1 45 CFR 164.308(a)(3)(ii)(C) ISO/IEC 27001:2005 A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2
Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
User ID Credentials
IAM-12 Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or reuse when feasible • Adherence to industry acceptable and/or regulatory
compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets)
XXXXXXXXX S3.2.b (S3.2.b) b. Identification and authentication of users. CC5.3 B.1 H.5
E.6.2, E.6.3, H.1.1, H.1.2, H.2,
H.3.2, H.4, H.4.1, H.4.5, H.4.8
6 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-02 DS5.3 DS5.4
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Policies and Standards >
Technical Securitry Standards
sharedx Domain 10 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.04.05. (b)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10

99.3 99.31(a)(1)(ii)
45 CFR 164.308(a)(5)(ii)(c)
45 CFR 164.308 (a)(5)(ii)(D)
45 CFR 164.312 (a)(2)(i)
45 CFR 164.312 (a)(2)(iii)
45 CFR 164.312 (d)
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Identity & Access
Management
Utility Programs
Access
IAM-13 Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

XXXXXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 H.2.16 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-34 DS5.7 APO13.01 APO13.02
DSS05.05
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management - Resource Protection
sharedx Domain 2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
A.11.4.1
A 11.4.4
A.11.5.4
A.9.1.2 Deleted
A.9.4.4
Commandment #1
Commandment #5
Commandment #6
Commandment #7
Infrastructure &
Virtualization Security
Audit Logging /
Intrusion Detection
IVS-01 Higher levels of assurance are required for protection, retention, and
lifecyle management of audit logs, adhering to applicable legal,
statutory or regulatory compliance obligations and providing unique user
access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic
investigative capabilities in the event of a security breach.

XXXXXXXXXXX S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2 G.7
G.8
G.9
J.1
L.2
G.14.7, G.14.8, G.14.9,
G.14.10,G.14.11, G.14.12,
G.15.5, G.15.7, G.15.8, G.16.8,
G.16.9, G.16.10, G.15.9, G.17.5,
G.17.7, G.17.8, G.17.6, G.17.9,
G.18.2, G.18.3, G.18.5, G.18.6,
G.19.2.6, G.19.3.1, G.9.6.2,
G.9.6.3, G.9.6.4, G.9.19, H.2.16,
H.3.3, J.1, J.2, L.5, L.9, L.10
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-14 DS5.5 DS5.6
DS9.2
APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05
312.3,
312.8 and
312.10
BOSS > Security Monitoring
Services > SIEM
sharedx Domain 10 6.03. (i)

6.03. (j)

6.03.03. (a)

6.03.03. (d)

6.03.04. (e)

6.04.07. (a)

6.07.01. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-3 (1)
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SC-18

8.2.1 8.2.2
45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.312 (b)
45 CFR 164.308(a)(5)(ii)©
A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3
A.12.4.1
A.12.4.1
A.12.4.2, A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3
Commandment #6
Commandment #7
Commandment #11
Infrastructure &
Virtualization Security
Change Detection
IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent
validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).

APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04
SRM > Privilege Management
Infrastructure > Privileged Usage
Management -> Hypervisor
Governance and Compliance
Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2, Infrastructure &
Virtualization Security
Clock Synchronization
IVS-03 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

XXXXXXX S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2 G.7
G.8
G.13, G.14.8, G.15.5, G.16.8,
G.17.6, G.18.3, G.19.2.6,
G.19.3.1
20 (B)
28 (B)
30 (B)
35 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-12 DS5.7 APO01.08 APO13.01
APO13.02
BAI03.05
DSS01.01
312.8 and
312.10
Infra Services > Network Services >
Authoritative Time Source
providerx Domain 10 6.03. (k) NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
A.10.10.1
A.10.10.6
A.12.4.1
A.12.4.4
Infrastructure &
Virtualization Security
Information System
Documentation
IVS-04 The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal,
statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.

XXXXXXXXX A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies.

A1.1
A1.2
CC4.1
G.5 OP-03 DS 3 APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02
312.8 and 312.10 ITOS > Service Delivery >
Information Technology Resiliency -
Capacity Planning
providerx Domain 7, 8 6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 (1) NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.4 A.10.3.1 A.12.1.3 Commandment #1
Commandment #2
Commandment #3
Infrastructure &
Virtualization Security
Management -
Vulnerability
Management
IVS-05 Implementers shall ensure that the security vulnerability assessment
tools or services accommodate the virtualization technologies used (e.g.
virtualization aware).

XXXXX -- APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06
SRM > Threat and Vulnerability
Management > Vulnerability
Management
providerx Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
Network Security
IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and by compensating controls.

XXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7, G.10, G.9.11,
G.14.1, G.15.1, G.9.2, G.9.3,
G.9.13
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-08 APO03.01 APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network
providerx Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
OS Hardening and
Base Conrols
IVS-07 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

XXXXXXX -- APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
SRM > Policies and Standards >
Operational Security Baselines
sharedx Domain 1, 13 Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1
Infrastructure &
Virtualization Security
Production / NonProduction
Environments
IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to
information assets. Separation of the environments may
include: stateful inspection firewalls, domain/realm
authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

XXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 B.1 I.2.7.1, I.2.20, I.2.17, I.2.22.2,
I.2.22.4, I.2.22.10-14, H.1.1
22 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-06 DS5.7 APO03.01 APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and
312.10
Information Services > Data
Governance > Data Segregation
sharedx Domain 10 6.03. (d) NIST SP 800-53 R3 SC-2 1.2.6 A.10.1.4 A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3
A.12.1.4
A.14.2.9
A.9.1.1

8.1,partial, A.14.2.2

8.1,partial, A.14.2.3

8.1,partial, A.14.2.4
Commandment #1
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
Segmentation
IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations
XXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.17 G.9.2, G.9.3, G.9.13 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-09 DS5.10 APO03.01 APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network - Firewall
providerx Domain 10 6.03.03. (b)

6.03.05. (a)

6.03.05. (b)

6.04.01. (a)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)

6.04.08.02. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
45 CFR 164.308 (a)(4)(ii)(A) A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4
A.13.1.3
A.9.4.1
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 92
#15..
- 423 -
Infrastructure &
Virtualization Security
VM Security - vMotion
Data Protection
IVS-10 Secured and encrypted communication channels shall be used when
migrating physical servers, applications, or data to virtualized servers
and, where possible, shall use a network segregated from production-level networks for such migrations.

X X X X X -- APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
SRM > Cryptographic Services >
Data-in-transit Encryption
provider X Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
VMM Security -
Hypervisor Hardening
IVS-11 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated
communications to the administrative consoles).

X X X X X X X X X X -- APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege Mangement
Infrastructure > Privilege Use
Management - Hypervisor
Governance and Compliance
provider X Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
Wireless Security
IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the
following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for
authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP
community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network
X X X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1
B.3
F.1
G.4
G.15
G.17
G.18
E.3.1, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
G.9.17, G.9.7, G.10, G.9.11,
G.14.1, G.15.1, G.9.2, G.9.3,
G.9.13
40 (B)
44 (C+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-10 DS5.5 DS5.7
DS5.8
DS5.10
APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network - Wireless
Protection
provider X Domain 10 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

8.2.5 45 CFR 164.312 (e)(1)(2)(ii)
45 CFR 164.308(a)(5)(ii)(D)
45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(ii)
A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2
A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
Network Architecture
IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Interoperability &
Portability
APIs
IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to
facilitate migrating applications.

X X X X X X X X X -- BAI02.04
BAI03.01
BAI03.02
BAI03.03
Application Services >
Programming Interfaces >
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)
Interoperability & 6.1.2
Portability
Data Request
IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industrystandard format (e.g., .doc, .xls, .pdf, logs, and flat files) X X X X X X X X X -- APO01.03
APO01.06
APO03.01
APO08.01
Information Services > Reporting
Services >
provider Domain 6 Clause

6.1.1,

6.1.1(e)(2)
Interoperability & 6.1.2
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.

X X X X X X X X X X X X --
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
Information Technology Operation
Services > Service Delivery >
Service Level Management -
External SLA's provider
Domain 3 6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2) Interoperability &
Portability
Standardized Network
Protocols
IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

X X X X X X -- APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
SRM > Data Protection >
Cryptographic Services - Data-InTransit Encryption
provider x Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Interoperability &
Portability
Virtualization
IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solutionspecific virtualization hooks available for customer review.

X X X X X X X X X -- APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
Infrastructure Services > Virtual
Infrastructure > Server Virtualization
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Anti-Malware
MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

X X X X X X -- APO01.03
APO13.01
APO07.03
APO07.06
SRM > Governance Risk &
Compliance > Technical Awareness
and Training
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Application Stores
MOS-02 A documented list of approved application stores has been defined as acceptable for mobile devices accessing or storing provider managed data.

X X X X X X -- APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Approved Applications
MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved
applications not obtained
through a pre-identified application store.

X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
ITOS > Service Support >
Configuration Management -
Software Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Approved Software for
BYOD
MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Awareness and
Training
MOS-05 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices.

The provider shall post and communicate the policy and
requirements through the company's security awareness and training program.

X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Cloud Based Services
MOS-06 All cloud-based services used by the company's mobile devices or BYOD
shall be pre-approved for usage and the storage of company business
X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
SRM > Governance Risk &
Compliance > Vendor Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Compatibility
MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
ITOS > Service Support >
Configuration Management -
Software Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Device Eligibility
MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

X X X X X X -- APO01.03
APO01.08
APO13.01
SRM > Policies and Standards >
Information Security Policies
provider X None (Mobile
Guidance)
Clause

6.1.1,
Mobile Security 6.1.1(e)(2)
Device Inventory
MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)) will be included for each device in the inventory.

X X X X X X -- BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03
SRM > Infrastructure Protection
Services > End Point - Inventory
Control
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Device Management
MOS-10 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

X X X X X X X X X X X -- APO03.01
APO03.02
APO04.02
APO13.01
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Encryption
MOS-11 The mobile device policy shall require the use of encryption either for
the entire device or for data identified as sensitive on all mobile
X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
SRM > Data Protection >
Cryptographic Services - Data-AtRest Encryption
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Jailbreaking and
Rooting
MOS-12 The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and shall enforce the prohibition through detective and preventative controls on the device or through a
centralized device management system (e.g. mobile device management).

X X X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Legal
MOS-13 The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations regarding the loss of non-company data in the case a wipe of the device is required.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
SRM > Policies and Standards >
Information Security Services
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Lockout Screen
MOS-14 BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

X X X X X X X X -- DSS05.03
DSS05.05
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Operating Systems
MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
BAI06
ITOS > Service Support -Change
Management > Planned Changes
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Passwords
MOS-16 Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Policy
MOS-17 The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03
SRM > Policies and Standards >
Technical Securitry Standards
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Remote Wipe
MOS-18 All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall
allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's
corporate IT.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
BOSS > Data Governance > Secure
Disposal of Data
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Security Patches
MOS-19 Mobile devices connecting to corporate networks, or storing and accessing company information, shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these
updates remotely.

X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
SRM > Infrastructure Protection
Services->Network > Link Layer
Network Security
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Users
MOS-20 The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

X X X X X X X -- APO01.03
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Security Standards
shared X None (Mobile
Guidance)
Clause

6.1.1,
Security Incident 6.1.1(e)(2)
Management, EDiscovery & Cloud
Forensics
Contact / Authority
Maintenance
SEF-01 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

X X X X X X X X X X X X S4.3.0
x4.4.0
(S4.3.0) Environmental, regulatory, and technological changes are monitored and their effect on system security is assessed on a timely basis and policies are updated for that assessment.
(x4.4.0) Environmental, regulatory, and technological changes are monitored, and their impact on system [availability, processing integrity, confidentiality] and security is assessed on a timely basis.

System [availability, processing integrity, confidentiality] policies and procedures are updated for such changes as required.

CC3.3 L1 CO-04 ME 3.1 APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03
312.4 BOSS > Compliance >
Contact/Authority Maintenance
shared x Domain 2, 4 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 SI-5

1.2.7 10.1.1

10.2.4 A.6.1.6
A.6.1.7
A.6.1.3
A.6.1.4
Commandment #1
Commandment #2
Commandment #3
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Management
SEF-02 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, to triage security-related events and ensure timely and thorough
incident management, as per established IT service
management policies and procedures.

X X X X X X X X X X X X IS3.7.0
S3.9.0
(IS3.7.0) Procedures exist to identify, report, and act upon system security breaches and other incidents.
(S3.9.0) Procedures exist to provide that issues of noncompliance with system availability, confidentiality of data, processing integrity and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC5.5
CC6.2
J.1 J.1.1, J.1.2 46 (B) Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.8 Openness, Subs. 4.8.2
IS-22 DS5.6 APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
312.8 and
312.10
ITOS > Service Support > Security
Incident Management
shared x Domain 2 6.04.07. (b)

6.07.01. (a)

6.07.01. (d)

6.07.01. (e)

6.07.01. (f)

6.07.01. (g)

1.2.4 1.2.7

7.1.2 7.2.2

7.2.4 10.2.1

10.2.4 45 CFR 164.308 (a)(1)(i)
45 CFR 164.308 (a)(6)(i)
Clause 4.3.3
A.13.1.1
A.13.2.1
Clause

5.3 (a),

5.3 (b),

7.5.3(b),

5.2 (c),

7.5.3(d),

8.1,

8.3,

9.2(g),
Annex
A.16.1.1
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Reporting
SEF-03 Workforce personnel and external business relationships shall be informed of their responsibilities and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications
channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

X X X X X X X X X X X X A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
C3.6.0
(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S2.4) The process for informing the entity about breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.3
CC2.5
C1.4
C1.5
J.1
E.1
J.1.1, E.4 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 IS-23 DS5.6 APO01.03 APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01
312.3,
312.8 and
312.10
BOSS > Human Resources Security
> Employee Awareness
shared x Domain 2 6.07.01. (a) Article 17 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-5

99.31(a)(1)(i)
34 CFR 99.32(a)

1.2.7 1.2.10

7.1.2 7.2.2

7.2.4 10.2.4
45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a)
16 CFR 318.5 (a)
45 CFR 160.410 (a)(1)
Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.6.1.1
A.7.2.1,
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Legal Preparation
SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

X X X X X X X X X X X X S2.4.0
C3.15.0
(S2.4.0) The process for informing the entity about system availability issues, confidentiality issues, processing integrity issues, security issues and breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of noncompliance with defined confidentiality and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC2.5
CC6.2
J.1
E.1
J.1.1, J.1.2, E.4 IS-24 DS5.6 APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
312.8 and
312.10
BOSS > Legal Services > Incident
Response Legal Preparation
shared x Domain 2 6.04.07. (b)

6.07.01. (f)

1.2.7 45 CFR 164.308 (a)(6)(ii) Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7, Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05 Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

X X X X X X X X X X X X S3.9.0
C4.1.0
(S3.9.0) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(C4.1.0) The entity’s system security, availability, system integrity, and confidentiality is periodically reviewed and compared with the defined system security, availability, system integrity, and confidentiality policies.

CC6.2
CC4.1
J.1.2 47 (B) IS-25 DS 4.9 DSS04.07 312.8 and
312.10
BOSS > Operational Risk
Management > Key Risk Indicators
shared x Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
45 CFR 164.308 (a)(1)(ii)(D) A.13.2.2 A.16.1.6
Supply Chain
Management,
Transparency and
Accountability
Data Quality and
Integrity
STA-01 Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement
controls to mitigate and contain data security risks through proper separation of duties, role-based access, and leastprivilege access for all personnel within their supply chain. -- APO10
APO11
DSS05.04
DSS06.03
DSS06.06
SRM > Governance Risk &
Compliance > Vendor Management
provider X Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Incident Reporting
STA-02 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).
-- APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07
ITOS > Service Support -> Incident
Management > Cross Cloud
Incident Response
provider Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Supply Chain 6.1.2(a)(2),
Management,
Transparency and
Accountability
Network / Infrastructure
Services
STA-03 Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and
deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

X X X X X X X X X X X X C2.2.0 (C2.2.0) The system security, availability, system integrity, and confidentiality and related security obligations of users and the entity’s system security, availability, system integrity, and confidentiality and related security commitments to users are communicated to authorized users.

CC2.2
CC2.3
C.2 C.2.6, G.9.9 45 (B)
74 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-31 DS5.10 APO01.03 APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05
312.8 and 312.10 ITOS > Service Delivery > Service
Level Management
provider x Domain 2 6.02. (c)

6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

8.2.2 8.2.5
A.6.2.3
A.10.6.2
A.15.1.2
A.13.1.2
Commandment #6
Commandment #7
Commandment #8
Supply Chain
Management,
Transparency and
Accountability
Provider Internal
Assessments
STA-04 The provider shall perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.

X X X X X X X X X X X -- MEA01
MEA02
SRM > Governance Risk &
Compliance > Vendor Management
provider x Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Supply Chain
Agreements
STA-05 Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business
relationships, physical geographical location of hosted services, and any known regulatory compliance
considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures
implemented to enable effectively governance, risk
management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships • Notification and/or pre-authorization of any changes
controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business
relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit
report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and X X X X X X X X X X X X S2.2.0
A3.6.0
C3.6.0
(S2.2.0) The availability, confidentiality of data, processing integrity, system security and related security obligations of users and the entity’s availability and related security commitments to users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2
CC2.3
CC5.5
C1.4
C1.5
C.2 C.2.4, C.2.6, G.4.1, G.16.3 74 (B)
75 (C+, A+)
45 (B)
75 (C+, A+)
79 (B)
4 (C+, A+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3
LG-02 DS5.11
APO09.03
APO09.05
312.3,
312.8 and
312.10 BOSS > Legal Services > Contracts shared x
Domain 3 6.02. (e)

6.10. (h)

1.2.5 45 CFR 164.308 (a)(4)(ii)(A)
45 CFR 164.308 (b)(1)
45 CFR 164.308 (b)(2)(i)
45 CFR 164.308 (b)(2)(ii)
45 CFR 164.308 (b)(2)(iii)
45 CFR 164.308 (b)(3)
45 CFR 164.308 (b)(4)
45 CFR 164.312(e)(2)(i)
45 CFR 164.312 (c)(1)
45 CFR 164.312(e)(2)(ii)
45 CFR 164.314 (a)(1)(i)
45 CFR 164.314 (a)(1)(ii)(A)
45 CFR 164.314 (a)(2)(i)
45 CFR 164.314 (a)(2)(i)(A)
45 CFR 164.314 (a)(2)(i)(B)
45 CFR 164.314 (a)(2)(i)(C)
45 CFR 164.314 (a)(2)(i)(D)
45 CFR 164.314 (a)(2)(ii)(A)
45 CFR 164.314 (a)(2)(ii)(A)(1)
45 CFR 164.314 (a)(2)(ii)(A)(2)
45 CFR 164.314 (a)(2)(ii)(B)
45 CFR 164.314 (a)(2)(ii)(C)
45 CFR 164.314 (b)(1)
45 CFR 164.314 (b)(2)
45 CFR 164.314 (b)(2)(i)
45 CFR 164.314 (b)(2)(ii)
45 CFR 164.314 (b)(2)(iii)
45 CFR 164.314 (b)(2)(iv)
A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4
A.15.1.2,

8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Supply Chain
Management,
Transparency and
Accountability
Supply Chain
Governance Reviews
STA-06 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

X X X X X X X X X X X --
APO10.04
APO10.05
MEA01
SRM > Governance Risk &
Compliance > Vendor Management provider x
Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Supply Chain Metrics
STA-07 Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).

Reviews shall performed at least annually and identity nonconformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier
X X X X X X X X X X X 51 (B) -- APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04 ITOS > Service Delivery > Service Level Management - Vendor Management provider x Domain 3 6.02. (c)

6.02. (d)

6.07.01. (k)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)
Supply Chain 6.1.2(c)(1),
Management,
Transparency and
Accountability
Third Party Assessment
STA-08 Providers shall assure reasonable information security across their information supply chain by performing an annual review.

The review shall include all partners/third party-providers upon which their information supply chain depends on.

X X X X X X X X X X X --
APO09.03
MEA01
MEA02
SRM > Governance Risk &
Compliance > Vendor Management provider x
Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Third Party Audits
STA-09 Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

X X X X X X X X X X X S2.2.0
C2.2.0
C3.6
Note: third party service providers are addressed under either the carve-out method or the inclusive method as it relates to the assessment of controls.
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (C2.2.0) The system confidentiality and related security obligations of users and the entity’s confidentiality and related security commitments to users are communicated to authorized users before the confidential information is provided. This communication includes, but is not limited to, the following matters: (see sub-criteria on TSPC tab)
(C3.6) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2
CC2.3
C1.4
C1.5
C.2 C.2.4,C.2.6, G.4.1, G.4.2, L.2,
L.4, L.7, L.11
60 (B)
62 (C+, A+)
83 (B)
84 (B)
85 (B)
CO-03 ME 2.6
DS 2.1
DS 2.4
APO01.08
APO10.05
MEA02.01
312.2(a)
and 312.3
(Prohibiti
on on
Disclosur
e)
BOSS > Compliance > Third-Party
Audits shared x
Domain 2, 4 6.02. (b)

6.02. (d)
Article 17(2)
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-12
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

1.2.11 4.2.3

7.2.4 10.2.3

10.2.4 45 CFR 164.308(b)(1)
45 CFR 164.308 (b)(4)
A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2
A.15.1.2

8.1* partial,

8.1* partial, A.15.2.1
A.13.1.2
Commandment #1
Commandment #2
Commandment #3
Threat and Vulnerability
Management
Anti-Virus / Malicious
Software
TVM-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X X S3.5.0 (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious codes, and unauthorized software.

CC5.8 G.7 17 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-21 DS5.9
APO01.03
APO13.01
APO13.02
DSS05.01
312.8 and
312.10
SRM > Infrastructure Protection
Services > Anti-Virus shared x
Domain 2 6.03. (f)
Article 17
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8

8.2.2 45 CFR 164.308 (a)(5)(ii)(B) A.10.4.1 A.12.2.1 Commandment #4 Commandment #5
Threat and Vulnerability
Management
Vulnerability / Patch
Management
TVM-02 Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment,
penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing
remediation of identified vulnerabilities shall be used.

Changes shall be managed through a change management
process for all vendor-supplied patches, configuration
changes, or changes to the organization's internally
developed software. Upon request, the provider informs
customer (tenant) of policies and procedures and identfied weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

X X X X X X X X X S3.10.0 (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

CC7.1 I.4 G.15.2, I.3 32 (B)
33 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-20 AI6.1
AI3.3
DS5.9 APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07
312.8 and
312.10
SRM > Threat and Vulnerability
Management > Vulnerability
Management shared x
Domain 2 6.03.02. (a)

6.03.02. (b)

6.03.05. (c)

6.07.01. (o)
Article 17
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5

1.2.6 8.2.7
45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B)
A.12.5.1
A.12.5.2
A.12.6.1

8.1*partial, A.14.2.2,

8.1*partial, A.14.2.3
A.12.6.1
Commandment #4
Commandment #5
Threat and Vulnerbility
Management
Mobile Code
TVM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or
untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X X S3.4.0
S3.10.0
(S3.4.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

CC5.6
CC7.1
G.20.12, I.2.5 SA-15
APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04
312.8 and
312.10
SRM > Infrastructure Protection
Services > End Point - White Listing shared x
Domain 10 6.03. (g)
Article 17
A.10.4.2
A.12.2.2
A.12.2.1 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Cloud Controls Matrix (CCM) Version

3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Cloud Controls Matrix v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Cloud Controls Matrix v3.0.1 may not be modified or altered in any way; (c) the Cloud Controls Matrix v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Cloud Controls Matrix v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Controls Matrix Version

3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 93
#15..
- 424 -
Mexico - Federal Law on Protection of Personal Data Held by Private Parties NERC CIP NIST SP800-53 R3 NIST SP800-53 R4 App J NZISM PCI DSS v2.0 PCI DSS v3.0 PA ID PA level
CIP-007-3 - R5.1 SC-2
SC-3
SC-4
SC-5
SC-6
SC-7
SC-8
SC-9
SC-10
SC-11
SC-12
SC-13
SC-14
SC-17
SC-18
SC-20
SC-21
SC-22
SC-23
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

14.5 14.6
PA17
PA31
SGP
BSGP

6.5 6, 6.5
CA-1
CA-2
CA-5
CA-6
AP-1 The organization
determines and documents
the legal authority that
permits the collection, use,
maintenance, and sharing
of personally identifiable

9.2 4.1.1, 4.2, 4.3
CIP-003-3 - R4.2 SI-10
SI-11
SI-2
SI-3
SI-4
SI-6
SI-7
SI-9
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

14.5 14.6
PA25 GP 6.3.1

6.3.2 6.3.1

6.3.2 AC-1
AC-4
SC-1
SC-16
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

16.5 16.8

17.4 PA20
PA25
PA29
GPP
SGP

2.3 3.4.1

4.1 4.1.1

6.1 6.3.2a

6.5c

8.3 10.5.5

11.5 2.3

3.4.1 4.1

4.1.1 6.1

6.3.2a

6.5c, 7.1, 7.2, 7.3, 8.1, 8.2,

8.3, 8.4, 8.5, 8.6, 8.7, 8.8

10.5.5, 10.8

11.5, 11.6
CA-2
CA-7
PL-6
AR-4 Privacy Auditing and
Monitoring. To promote
accountability,
organizations identify and
address gaps in privacy
compliance, management,
operational, and technical
controls by conducting
regular assessments

5.1, 5.3, 5.4 PA15 SGP 2.1.2.b
Chapter VI, Section 1
Article 39, I. and VIII.

Chapter 8
Article 59
CIP-003-3 - R1.3 - R4.3
CIP-004-3 R4 - R4.2
CIP-005-3a - R1 - R1.1 - R1.2
CA-1
CA-2
CA-6
RA-5
AR-4. Privacy Auditing and
Monitoring. These
assessments can be selfassessments or thirdparty
audits that result in reports
on compliance gaps
identified in programs,
projects, and information
systems.

6.1 PA18 GP 11.2

11.3 6.6

12.1.2.b

11.2 11.3

6.3.2, 6.6

11.2.1, 11.2.2, 11.2.3,

11.3.1, 11.3.2, 12.1.2.b,

12.8.4 AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1

1.2 2.2

3.3 5.2

3.1.1 3.1

3.1 CP-1
CP-2
CP-3
CP-4
CP-6
CP-7
CP-8
CP-9
CP-10
PE-17
UL-2 INFORMATION

SHARING WITH THIRD
PARTIES - a. Shares
personally identifiable
information (PII) externally,
only for the authorized
purposes identified in the
Privacy Act and/or
described in its notice(s)
or for a purpose that is
compatible with those
purposes; b. Where
appropriate, enters into
Memoranda of
Understanding,
Memoranda of Agreement,
Letters of Intent, Computer
Matching Agreements, or
similar agreements, with
third parties that
specifically describe the
PII covered and specifically
enumerate the purposes
for which the PII may be
used; c. Monitors, audits,
and trains its staff on the

6.4 12.9.1

12.9.3 12.9.4

12.9.6 12.9.1

12.9.3 12.9.4

12.9.6 CP-2
CP-3
CP-4

4.4 5.2(time limit)

6.3(whenever change occurs)
PA15 SGP 12.9.2 12.9.2, 12.10.2
PE-1
PE-4
PE-13

10.1 10.2

10.3 10.4

10.5 10.6
PA15 SGP 4.1, 4.1.1, 9.1, 9.2
CIP-005-3a - R1.3
CIP-007-3 - R9
CP-9
CP-10
SA-5
SA-10
SA-11

10.5 13.5

17.1 12.1

12.2 12.3

12.4 1.1.2, 1.1.3, 2.2, 12.3

12.6 CIP-004-3 R3.2 PE-1
PE-13
PE-14
PE-15
PE-18

8.1 8.4
PA15 SGP 3.5.2, 3.6.3, 3.7,

5.1, 5.2, 5.3,

6.1, 6.2,

7.1, 7.2,

9.1, 9.2, 9.3, 9.4, 9.5, 9.6,

9.7, 9.8, 9.9,

12.2 PE-1
PE-5
PE-14
PE-15
PE-18

8.1 PA15 SGP 9.1.3

9.5 9.6

9.9 9.9.1

9.1.3 9.5

9.6 9.9

9.9.1, 12.2
CIP-007-3 - R6.1 - R6.2 - R6.3 -
R6.4
MA-2
MA-3
MA-4
MA-5
MA-6

3.3 12.1

12.5 14.5 (software)
PA8
PA15
BSGP
SGP

10.8, 11.6
CP-8
PE-1
PE-9
PE-10
PE-11
PE-12
PE-13
PE-14

8.1 8.2

8.3 8.4
PA15 SGP
CIP-007-3 - R8 - R8.1 - R8.2 -
R8.3
RA-3 6.4 PA8
PA15
BSGP
SGP
CM-2
CM-3
CM-4
CM-5
CM-6
CM-9
MA-4
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-12

12.1 12.2

12.3 12.4

4.3, 10.8,

11.1.2,

12.1 12.2

12.3 12.4

12.5, 12.5.3,

12.6, 12.6.2,

12.10 Chapter II
Article 11, 13
CIP-003-3 - R4.1 CP-2
CP-6
CP-7
CP-8
CP-9
SI-12
AU-11
FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do

6.4 13.1
PA10
PA29
BSGP
SGP

3.1 3.1.1

3.2 9.9.1

9.5 9.6

10.7 3.1

3.1.a

3.2 9.9.1

9.5. 9.5.1

9.6. 9.7, 9.8

10.7, 12.10.1
CA-1
CM-1
CM-9
PL-1
PL-2
SA-1
SA-3
SA-4

12.1 6.3.2 6.3.2, 12.3.4
SA-4
SA-5
SA-8
SA-9
SA-10
SA-11
SA-12
SA-13

2.2 4.1
PA17 SGP 3.6.7

6.4.5.2 7.1.3

8.5.1 9.1

9.1.2 9.2b

9.3.1 10.5.2

11.5 12.3.1

12.3.3 2.1, 2.2.4, 2.3, 2.5

3.3, 3.4, 3.6

4.1, 4.2

6.3.1, 6.3.2, 6.4.2, 6.4.3,

6.4.4, 6.4.5.2

6.7 7.1, 7.1.3, 7.1.4

8.3, 8.5.1, 8.7

9.1 9.1.2

9.2 10.5

11.5 12.3

12.8 CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13

12.1 14.1

14.2 1.1.1

6.1 6.4

6.1 6.2

6.3 6.4

6.5 6.6

6.7 CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7
FTC Fair Information
Principles
Involves both managerial
and technical measures to
protect against loss and
the unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

14.1 1.3.3

2.1, 2.2.2

3.6 4.1

5.1, 5.2, 5.3, 5.4

6.2 7.1

9.1 9.1.1

9.1.2 9.1.3

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

10.1, 10.2, 10.3, 10.4, 10.5,

10.6, 10.7

11.1, 11.4, 11.5

12.3 CIP-003-3 - R6 CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7
AR- 4. Privacy Monitoring
and Auditing.

Organizations also: (i)
implement technology to
audit for the security,
appropriate use, and loss
of PII; (ii) perform reviews
to ensure physical security
of documents containing
PII; (iii) assess contractor
compliance with privacy
requirements; and (iv)
ensure that corrective
actions identified as part of
the assessment process
are tracked and monitored
until audit findings are
corrected. The
organization Senior
Agency Official for Privacy
(SAOP)/Chief Privacy
Officer (CPO) coordinates
monitoring and auditing
efforts with information
security officials and

12.1 12.4
PA14 SGP 1.1.1

6.3.2 6.4

6.1 1.1.1

6.3.2 6.4.5
General Provisions, Article 3, V. and VI. CIP-003-3 - R4 - R5 RA-2 AC-4
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research.

PA10 SGP 9.7.1

9.10 12.3

3.1 9.6.1, 9.7.1

9.10 12.3
TR-2 SYSTEM OF

RECORDS NOTICES

AND PRIVACY ACT

STATEMENTS

1.1.3 12.3.3
AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9
TR-2 SYSTEM OF

RECORDS NOTICES

AND PRIVACY ACT

STATEMENTS
PA25
PA21
PA5
GP
GP
BSGP

2.1.1 4.1

4.1.1 4.2

2.1.1 3.1

4.1 4.1.1

4.2 Chapter II
Article 8, 9, 11, 12, 14, 18, 19, 20, 21 CIP-003-3 - R4 - R4.1 AC-16 MP-1
MP-3
PE-16
SI-12
SC-9
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

13.1 9.5

9.6 9.7.1

9.7.2 9.10

9.5, 9.5.1

9.6 9.7

9.8 9.9
CIP-003-3 - R6 SA-11
CM-04
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research.

17.8 6.4.3 6.4.3
Chapter IV
Article 30
CIP-007-3 - R1.1 - R1.2 CA-2
PM-5
PS-2
RA-2
SA-2
AP-1 AUTHORITY TO
COLLECT. AP-2

PURPOSE
SPECIFICATION.

3.4 3.7

12.5.5 12.10.4
CIP-007-3 - R7 - R7.1 - R7.2
R7.3
MP-6
PE-1
DM-2 DATA

RETENTION AND

DISPOSAL

13.4 13.5
PA10
PA39
PA34
PA40
BSGP
SGP
SGP
SGP

3.1.1 9.10

9.10.1 9.10.2

3.1 3.1.1

9.8, 9.8.1, 9.8.2, 3.1

12.3 PA4
PA8
PA37
PA38
BSGP
BSGP
SGP
SGP

9.7.1 9.9

9.9.1 CIP-006-3c R1.2 - R1.3 - R1.4 -
R1.6 - R1.6.1 - R2 - R2.2
PE-2
PE-3
PE-6
PE-7
PE-8
PE-18

8.1 8.2
PA4 BSGP 9.1

9.1.1 9.1.2

9.1.3 9.2

9.1 9.1.1

9.1.2, 9.1.3

9.2, 9.3, 9.4, 9.4.1, 9.4.2,

9.4.3, 9.4.4
IA-3
IA-4
PA22
PA33
GP
SGP
AC-17
MA-1
PE-1
PE-16
PE-17

12.5 19.1
PA4 BSGP 9.8

9.9 9.10

9.6.3 CM-8 12.6 PA4 BSGP 9.9.1

12.3.3 12.3.4

9.8, 9.8.1, 9.8.2

12.3 CIP-006-3c R1.2 - R1.3 - R1.4 -
R2 - R2.2
PE-2
PE-3
PE-4
PE-5
PE-6

4.2 8.1
PA4 BSGP 9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 CIP-006-3c R1.2 - R1.3 - R1.4 PE-7 9.4.3
PE-16
PE-18

8.2 8.1
PA4 BSGP 9.1

9.1.1 9.1.3
MA-1
MA-2
PE-16

8.1 8.2

8.3 8.4
PA4 BSGP 9.8

9.9 9.1

9.1.1 9.1.2

9.2 9.3

9.4 Chapter II,
Article 19 CIP-006-3c R1.2 - R1.3 - R1.4 -
R1.6 - R1.6.1 - R2 - R2.2
PE-2
PE-3
PE-6
PE-18

8.1 8.2
PA4
PA13
PA24
BSGP
SGP P

9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

9.4.4 PA36

3.5, 7.1.3

8.1 8.1.1

8.2.2 8.5

8.5.1 SC-12
SC-13
SC-17
SC-28

16.2 PA36 3.4.1

3.5 3.5.1

3.5.2 3.6

3.6.1 3.6.2

3.6.3 3.6.4

3.6.5 3.6.6

3.6.7 3.6.8

3.4.1 3.5

3.5.1 3.5.2

3.6 3.6.1

3.6.2 3.6.3

3.6.4 3.6.5

3.6.6 3.6.7

3.6.8,

4.1 ODCA UM: PA R2.0
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 94
#15..
- 425 -
CIP-003-3 - R4.2 AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8

16.1 PA25 GP 2.1.1

3.4 3.4.1

4.1 4.1.1

4.2 2.1.1

2.3 3.3

3.4 3.4.1

4.1 4.1.1

4.2 4.3

6.5.3 6.5.4

8.2.1 3.5.2, 3.5.3

3.6.1, 3.6.3
Chapter II, Article 19 and Chapter VI, Section I, Article 39 CM-2 SA-2
SA-4
AR-1 Governance and
Privacy Program. TR-1
PRIVACY NOTICE. TR-3

DISSEMINATION OF

PRIVACY PROGRAM

INFORMATION

4.4 5.1

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4
CA-3
RA-2
RA-3
MP-8
PM-9
SI-12
AR-2 Privacy Impact and
Risk Assessment

3.3 4.3

8.4 PA10
PA18
BSGP
GP

12.1 12.1.2

12.2 AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10
AR-1 Governance and
Privacy Program

3.2 12.6.1

12.6.2 12.6, 7.3, 8.8, 9.10
Chapter II, Article 19 CIP-001-1a - R1 - R2
CIP-003-3 - R1 - R1.1 - R4
CIP-006-3c R1
PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11
AR-1 Governance and
Privacy Program

4.1 PA8 BSGP 12.1

12.2 12.1

12.2 Chapter VI, Section I, Article 39 CIP-003-3 - R1 - R1.1 CM-1 PM-1
PM-11

4.1 12.5 12.4
Chapter VI, Section I, Article 39 CIP-003-3 - R1 -R1.1 - R1.2 - R2 - R2.1 - R2.2 - R2.3
AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1

4.2 4.3

4.4 4.5
PA30 BSGP 12.1

12.2 7.3, 8.8, 9.10, 12.1

12.2 Chapter X, Article 64 PL-4
PS-1
PS-8
CIP-009-3 - R2 CP-2
RA-2
RA-3
AR-2 Privacy Impact and
Risk Assessment

4.3 12.1.3 12.2
CIP-003-3 - R3.2 - R3.3 - R1.3
R3 - R3.1 - R3.2 - R3.3
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1

4.1 6.1

12.1.3 12.1.1
CIP-002-3 - R1.1 - R1.2
CIP-005-3a - R1 - R1.2
CIP-009-3 - R.1.1
PL-5
RA-2
RA-3

1.1 3.3

5.1 5.2

5.3 5.4

7.1 12.2

17.7 18.1

18.3 PA2
PA15
BSGP
SGP

12.1.2 12.2
Chapter II
Article 19
CIP-009-3 - R4 AC-4
CA-2
CA-6
PM-9
RA-1
AR-2 Privacy Impact and
Risk Assessment

3.2 (responsibility)

3.3 3.4

4.1 4.3

5.2 (residual Risk)

12.1.2 12.2
PS-4 2.2 9.3
CIP-004-3 - R2.2 PS-2
PS-3

9.29 PA27 BSGP 12.7

12.8.3 12.7

12.8.3 PL-4
PS-6
PS-7

9.2 PA27 BSGP 12.4

12.8.2 PS-4
PS-5
PA27 BSGP
CIP-007-3 - R7.1 AC-17
AC-18
AC-19
MP-2
MP-4
MP-6

19.1 19.2

19.3 PA33
PA34
SGP
SGP

9.7 9.7.2

9.8 9.9

11.1 12.3

11.1 12.3
PL-4
PS-6
SA-9
DI-2 DATA INTEGRITY

AND DATA INTEGRITY
BOARD
a. Documents processes
to ensure the integrity of
PA7 BSGP 12.8.2

12.8.3 12.8.4
AT-3
PL-4
PM-10
PS-1
PS-6
PS-7
AR-1 GOVERNANCE

AND PRIVACY

PROGRAM
Control: The organization:

Supplemental Guidance:

The development and
implementation of a

2.2 PA9
PA24
BSGP 12.8.5
AC-8
AC-20
PL-4

2.2 5.2

4.2 12.3.5 12.3
Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41 CIP-004-3 - R1 - R2 - R2.1 AT-1 AT-2
AT-3
AT-4
AR-5 PRIVACY

AWARENESS AND

TRAINING
Control: The organization:
a. Develops, implements,
and updates a
comprehensive training
and awareness strategy
aimed at ensuring that

9.1 PA28 BSGP 12.6

12.6.1 12.6.2

12.6 Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41 AT-2 AT-3
AT-4
PL-4
UL-1 INTERNAL USE
Control: The organization
uses personally identifiable
information (PII) internally
only for the authorized
purpose(s) identified in the
Privacy Act and/or in public

9.1 8.5.7

12.6.1 12.4
AC-11
MP-2
MP-3
MP-4

8.1 8.1.8
CIP-003-3 - R5.2 AU-9
AU-11
AU-14

15.4 10.5.5 10.5

7.1.2 7.1.4

7.2 CIP-007-3 - R5.1 - R5.1.2 AC-1 8.1
IA-1

15.1 15.2

3.5.1 8.5.1

12.5.4 3.5.1, 7.0

8.0 12.5.4
CIP-007-3 - R2 CM-7
MA-3
MA-4
MA-5

15.4 9.1.2 1.2.2

7.1 7.1.2

7.1.3 7.2

7.2.3 9.1.2

9.1.3 7.3

8.8 9.10
CIP-007-3 R5.1.1 AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4

3.0 3.1

3.2 3.3

3.4 3.5
PA24P 6.4.2 6.4.2, 7.3

8.8 9.10
CM-5
CM-6

9.4 14.1

14.2 19.1

6.4.1 6.4.2

6.4.1 6.4.2, 7.1

7.1.1 7.1.2

7.1.3 CA-3 7.1.4
MA-4
RA-3
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of passwords;
and the storage of data on

2.2 4.3

12.8.1 12.8.2

12.8.3 12.8.4

12.8 12.2
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those

3.2 9.2

15.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 CIP-003-3 - R5.1.1 - R5.3
CIP-004-3 R2.3
CIP-007-3 R5.1 - R5.1.2
AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9
AP-1 The organization
determines and documents
the legal authority that
permits the collection, use,
maintenance, and sharing
of personally identifiable
information (PII), either
generally or in support of a
specific program or
information system need.

9.2 15.2
PA24 GP 7.1

7.1.1 7.1.2

7.1.3 7.2.1

7.2.2 8.5.1

12.5.4 7.1

7.1.1 7.1.2

7.1.3 7.1.4

12.5.4 CIP-004-3 R2.2.2
CIP-007-3 - R5 - R.1.3
AC-2
AU-6
PM-10
PS-6
PS-7

9.2 8.1.4
CIP-004-3 R2.2.3
CIP-007-3 - R5.1.3 -R5.2.1 -
R5.2.3
AC-2
PS-4
PS-5
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures

9.2 8.5.4

8.5.5 8.1.3

8.1.4 8.1.5, 12.5.4
CIP-004-3 R2.2.3
CIP-007-3 - R5.2 - R5.3.1 -
R5.3.2 - R5.3.3
AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of passwords;

15.1 15.2
PA9
PA6
PA24
PA22
BSGP
BSGP P
GP

8.1 8.2,

8.3 8.4

8.5 10.1,

12.2,

12.3.8 8.0

10.1,

12.3 CIP-007-3 - R2.1 - R2.2 - R2.3 AC-5
AC-6
CM-7
SC-3
SC-19

12.2 14.2

7.1.2 5.0

7.1 7.1.2

7.2 CIP-007-3 - R6.5 AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4

17.6 PA11
PA12
PA13
PA24
BSGP
SGP
SGP P

10.1 10.2

10.3 10.5

10.6 10.7

11.4 12.5.2

12.9.5 10.1

10.2 10.3

10.4 10.5

10.6 10.7, 10.8

11.4, 11.5, 11.6

12.5.2 PA35 GP 10.5.5, 12.10.5
AU-1
AU-8

10.4 10.4
SA-4 3.3 PA16 SGP
PA36 6.1
CIP-004-3 R2.2.4 SC-7 17.1

17.2 PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 2.2.2

2.2.3 1.1

1.1.2 1.1.3

1.1.5 1.1.6

1.2 1.2.1

1.2.2 1.2.3

1.3 2.2.2

2.2.3 2.2.4

2.5 4.1

2.1 2.2

2.5 5.1
SC-2 14.5 PA3 BSGP 6.4.1

6.4.2 6.4.1

6.4.2 CIP-004-3 R3 AC-4
SC-2
SC-3
SC-7

17.6 18.1

18.4 PA3
PA5
PA16
PA20
BSGP
BSGP
SGP
GP

1.1 1.2

1.2.1 1.3

1.4 1.1

1.2 1.2.1

1.2.3 1.3

1.4 2.1.1

2.2.3 2.2.4

2.3 State of Utah Bid CH16012
3/22/2016 4:23 PM p. 95
#15..
- 426 -

4.1 3.5.1, 3.6.6
CIP-004-3 R3
CIP-007-3 - R6.1
AC-1
AC-18
CM-6
PE-4
SC-3
SC-7

11.1 17.3
PA3
PA6
PA16
PA20
PA25
PA32
PA33
BSGP
BSGP
SGP
GP
P
BSGP
SGP

1.2.3 2.1.1

4.1 4.1.1

11.1 9.1.3

1.2.3 2.1.1

4.1 4.1.1

11.1, 11.1.a, 11.1.b, 11.1.c, 11.1.d, 11.1.1, 11.1.2

9.1.3 4.1

4.1.1 4.3
PA32 BSGP 4.1
PA34 SGP
Chapter VI,
Article 44.

Chatper II,
Article 16, part I
CIP-001-1a R3 - R4 AT-5
IR-6
SI-5

3.2 11.1.e

12.5.3 12.9

12.5.3 12.10.1
Chapter II, Article 20 CIP-007-3 - R6.1
CIP-008-3 - R1
IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

4.1 4.2

4.6 7.1
PA8
PA11
BSGP 12.9

12.9.1 12.9.2

12.9.3 12.9.4

12.9.5 12.9.6

12.1 Chapter II, Article 20 CIP-003-3 - R4.1
CIP-004-3 R3.3
IR-2
IR-6
IR-7
SI-4
SI-5
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

7.2 PA8 BSGP 12.5.2

12.5.3 12.10.1
CIP-004-3 R3.3 AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8

7.3 PA11 BSGP
CIP-008-3 - R1.1 IR-4
IR-5
IR-8

7.2 7.3
PA11 BSGP 12.9.6
SC-20
SC-21
SC-22
SC-23
SC-24

17.1 PA3
PA8
PA16
BSGP
BSGP
SGP

12.1.1 Chapter II
Article 14.

CA-3
MP-5
PS-7
SA-6
SA-7
SA-9

5.2 2.2

2.4 12.8.2

12.8.4 Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36
CA-3
SA-9
SA-12
SC-7

5.4 2.4

12.8.2 12.8.3

12.8.4 Appendix A

2.4 12.8.2

12.8.3 12.8.4
Appendix A
CIP-007-3 - R4 - R4.1 - R4.2 SA-7
SC-5
SI-3
SI-5
SI-7
SI-8

14.1 17.6 PA1 BSGP

5.1 5.1.1

5.2 1.4, 5.0
CIP-004-3 R4 - 4.1 - 4.2
CIP-005-3a - R1 - R1.1
CIP-007-3 - R3 - R3.1 - R8.4
CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5

12.4 14.1
PA2
PA8 BSGP

2.2 6.1

6.2 6.3.2

6.4.5 6.5

6.6 11.2

11.2.1 11.2.2

11.2.3 2.2

6.1 6.2

6.3.2 6.4.5

6.5 6.6

11.2 11.2.1

11.2.2 11.2.3
SC-18
3 3.1

3.2 3.3

3.4 3.5
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 96
#15..
- 427 -
ATTACHMENT C: NIST Service Models
Offerors may optionally document the service model of cloud computing (e.g. IaaS, PaaS, SaaS, or a combination thereof, that most closely describes their offering, using the definitions in The NIST Definition of Cloud Computing SP 800-145. The following guidance is offered for the proper selection of service models.

NIST’s service models provide the RFP with a set of consistent sub-categories to assist ordering activities in locating and comparing services of interest. Service model is primarily concerned with the nature of the service offered and the staff and activities most likely to interact with the service. Offerors should select a single service model most closely corresponding to their proposed service based on the guidance below. It is understood that cloud services can technically incorporate multiple service models and the intent is to provide the single best categorization of the service.

Offerors should take care to select the NIST service model most closely corresponding to each service offered. Offerors should not invent, proliferate or select multiple cloud service model sub-categories to distinguish their offerings, because ad-hoc categorization prevents consumers from comparing similar offerings. Instead Offerors should make full use of the existing NIST categories to the fullest extent possible.

For example, in the RFP an offering branded by a contractor as “Storage as a Service” would be properly characterized as Infrastructure as a Service (IaaS), storage being a subset of infrastructure. Services branded as “LAMP as a Service” or “Database as a Service” would be properly characterized under the RFP as Platform as a Service (PaaS), as they deliver two kinds of platform services. Services branded as “Travel Facilitation as a Service” or “Email as a Service” would be properly characterized as species of Software as a Service (SaaS) for the RFP. However, Offerors must include branded descriptions of the service in the full descriptions of the service’s capabilities.

When choosing between equally plausible service model sub-categories, Offerors should consider several factors:
1) Visibility to the Purchasing Entities. The service model sub-categories in the RFP exist to help Purchasing Entities match their requirements with service characteristics. Offerors should select the most intuitive and appropriate service model from the point of view of a Purchasing Entity. 2) Primary Focus of the Service. Services may offer a mix of capabilities that span service models in the strict technical sense. For example, a service may offer both IaaS capabilities for processing and storage with some PaaS capabilities for application deployment, or SaaS capabilities for specific applications. In a service mix situation the Offerors should select the service model that is their primary focus.
3) Purchasing Entity Role. Offerors should consider the operational role of the Purchasing Entity’s primary actual consumer or operator of the service. For example services most often consumed by system managers are likely to fit best as IaaS; services most often consumed by State of Utah Bid CH16012
3/22/2016 4:23 PM p. 97
#15..
- 428 -
application deployers or developers as PaaS, and services most often consumed by business users as SaaS.
4) Lowest Level of Configurability. Offerors can consider IaaS, PaaS and SaaS as an ascending hierarchy of complexity, and select the model with the lowest level of available Purchasing Entity interaction. As an example, virtual machines are an IaaS service often bundled with a range of operating systems, which are PaaS services. The Purchasing Entity usually has access to configure the lower level IaaS service, and the overall service should be considered IaaS. In cases where the Purchasing Entity cannot configure the speed, memory, network configuration, or any other aspect of the IaaS component, consider categorizing as a PaaS service.

Cloud Service Types for SaaS, IaaS and PaaS
Cloud Service Providers should identify and describe their service offerings by Cloud Service Model (i.e.

Saas, IaaS or PaaS), along with additional sub-categories and descriptors. The following sub-categories and descriptors do not make up the complete list. Cloud Service Providers must either identify the category of service from the list below or provide the sub-category and descriptors of their service offering within one of the three Cloud Service Models.

SaaS
 Analytics
o Data Analytics
o Business Intelligence
 Business Continuity/Disaster Recovery
 Cloud and Infrastructure Management Tools
 Collaboration
 Customer Relationship Management
 Citizen Relationship Management
 Data Management
 E-Discovery
 Electronic Records Management

 ERP
o HR
o Finance
 Assume Accounts Payable / Receivable
 General Ledger
o Budget
o Procurement
 GIS
 Human Resource
o Payroll
o Time, Attendance and Scheduling
o Recruitment and Hiring
 Internet Filtering
 Licensing and Registration Systems
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 98
#15..
- 429 -
 Office Productivity
o Word Processing
o Document Tracking
o E-mail
o Spread sheets
o Presentation
 Message Filtering
 Meeting Planning, hosting, conferencing
 Mobile Data Management
 Point of Sale (POS)
 Procurement Systems
 Project and Portfolio Management (PPM) Tools.
 Security
 Travel Management
 Workflow and Electronic Signature
 Other (identify additional sub-categories and/or descriptors) PaaS
 Analytics
o Hadoop
o Business Intelligence
o Data Warehouse
 Database
o Relational
o NoSQL
 Development, Testing and Deployment
o Containers
o Services and APIs
o Mobile
o Internet of Things
o Tools
o Runtime environments
 Electronic Records Management
 E-Discovery
 GIS
 Integration (iPaaS)
 Open Source
 Other (identify additional sub-categories and/or descriptors) IaaS
 Computer/Infrastructure Services
o Operating systems
o Hypervisors
 Disaster Recovery
o Business Continuity
o High Availability / Failover
 GIS
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 99
#15..
- 430 -
 Storage
o File
o Block
o Object
o Archive
o Cache
o Content Delivery Networks (CDN)
o Litigation Hold
 Network
o Virtual network
o Load balancer
o DNS
o Gateway (e.g. VPN or Application)
o Firewall
o Traffic manager
o Direct link
 PC/Desktop “aaS”
 Security
o Identity & Access Management
o Encryption
o Data Loss Prevention (DLP)
o Web Security
o Email Security
o Network Security
o Security Information and Event Management (SIEM)
o Intrusion Management
o DDOS Monitoring / Management
 Other (identify additional sub-categories and/or descriptors) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 100
#15..
- 431 -
Attachment D: Scope of Services

1.0 General Business Environment & Solicitation Overview:

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a share pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

1.1 Definitions:

Cloud based services terminology varies greatly within the information technology industry. In an effort to clarify the target audience and the intent of this solicitation effort, the following definitions are offered:

1.1.1 Cloud Based Services Providers
Definition - A cloud based services provider is a person, an organization; it is the entity responsible for making a service available to interested parties. A cloud based service provider acquires and manages the computing infrastructure required for providing the services, runs the cloud software that provides the services, and makes arrangement to deliver the cloud services to the cloud consumers through network access.

A cloud based service provider may utilize subcontractors and/or third parties to fulfill parts of the cloud service delivery (“authorized partners”).

1.1.2 Categorization of Risk
Successful cloud based services providers will have the ability to store and secure one, all, or a combination of data1. Risk categories of the data are defined as:

Low Risk Data
Definition: FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“Low Impact Data”).

Low Impact levels are defined in FIPS 199 as follows:

The potential impact is low if the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. A limited adverse effect could mean that the loss of confidentiality, integrity, or availability might:

1 Data types and classifications may vary depending on the Participating State’s laws and regulations. Participating States may change the classification levels, types, names, and restrictions for certain data during the participating addendum stage.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 101
#15..
- 432 -
 Cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced;
 Result in minor damage to organizational assets, minor financial loss, or minor harm to individuals.

Moderate Risk Data
Definition: FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“Moderate Impact Data”).

The potential impact is moderate if the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. A serious adverse effect could mean that the loss of confidentiality, integrity, or availability might:
 Cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced;
 Result in significant damage to organizational assets, significant financial loss, or significant harm to individuals, but not loss of life or serious life threatening injuries.

High Risk Data
Definition: FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“High Impact Data”).

The potential impact is high if the loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. A severe or catastrophic adverse effect could mean that the loss of confidentiality, integrity, or availability might:
 Cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions;  Result in major damage to organizational assets, major financial loss, or severe or catastrophic harm to individuals involving loss of life or serious life threatening injuries.

Prior to signing a Participating Addendum, a Contractor and a Participating State must cooperate and determine what type of risk categories of the data are going to be utilized in the Participating Addendum.

1.1.3 Services & Models
All of the Cloud Service Based Models must follow the NIST definition of cloud computing found in NIST Special Publication 800-145. This cloud model is composed of five essential characteristics, three service models, and four deployment models.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 102
#15..
- 433 -
A successful Offeror’s cloud based service model(s) must meet the five essential characteristics which include:

On-demand self-service. A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).

Resource pooling. The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth.

Rapid elasticity. Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.

Measured service. Cloud systems automatically control and optimize resource use by leveraging a metering capability1 at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

A successful Offeror must provide at least one of the following cloud based service models in order to be considered for award. These three cloud based service models align with NIST requirements and standards. The cloud based services models are defined as:

Software as a Service (SaaS) - as used in this Master Agreement is defined as the capability provided to the consumer to use the provider’s applications running on a cloud infrastructure.

The applications are accessible from various client devices through a thin client interface such as a Web browser (e.g., Web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited userspecific application configuration settings.

Infrastructure as a Service (IaaS) - as used in this Master Agreement is defined the capability provided to the consumer is to provision processing, storage, networks, and other fundamental State of Utah Bid CH16012
3/22/2016 4:23 PM p. 103
#15..
- 434 -
computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

Platform as a Service (PaaS) - as used in this Master Agreement is defined as the capability provided to the consumer to deploy onto the cloud infrastructure consumer-created or - acquired applications created using programming languages and tools supported by the provider. This capability does not necessarily preclude the use of compatible programming languages, libraries, services, and tools from other sources. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

A successful Offeror will have the ability to provide cloud based services through the following deployment methods:
 Private cloud. The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
 Community cloud. The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.
 Public cloud. The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.  Hybrid cloud. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds) Note: In order to comply with NIST Standards and Requirements, but encourage the development and use of new technologies and as new definitions or modifications of NIST Standards and Requirements are established, the scope of services for the RFP may be modified to align with those definitions, pursuant to Utah Administrative Code R33-12-502. The scope of services may be modified for each awarded contract if both parties agree to the modification. No contract may be extended beyond the terms of the contract included in this solicitation as a result of a modification.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 104
#15..
- 435 -
Εξηιβιτ Ε: Ιντεντ το Παρτιχιπατε
Τηε Στατεσ λιστεδ βελοω ηαϖε οφ συβmιττεδ σιγνεδ ανδ συβmιττεδ τηε Ιντεντ το Παρτιχιπατε φορm το τηε Στατε οφ Υταη. Σοmε οφ τηε Στατεσ ηαϖε ατταχηεδ αδδιτιοναλ ινφορmατιον, ινχλυδινγ στατε σπεχιφιχ τερmσ ανδ χονδιτιονσ τηατ νεεδ το βε ποστεδ ασ παρτ οφ τηισ ΡΦΠ. Τηε βελοω λιστεδ Στατεσ ρεσερϖε τηε ριγητ το mοδιφψ τηε τερmσ ανδ χονδιτιονσ οφ ανψ αωαρδεδ Μαστερ Αγρεεmεντ ιν α Παρτιχιπατινγ Αδδενδυm.

Αλασκα
Χαλιφορνια
Χολοραδο
Χοννεχτιχυτ
Dελαωαρε
Γεοργια
Ηαωαιι
Ιδαηο
Ιλλινοισ
Ιοωα
Μαινε
Μασσαχηυσεττσ
Μιννεσοτα
Μισσισσιππι
Μισσουρι
Μοντανα
Νεϖαδα
Νεω Ηαmπσηιρε
Νεω ϑερσεψ
Νεω Μεξιχο
Νορτη Dακοτα
Οκλαηοmα
Ρηοδε Ισλανδ
Σουτη Dακοτα
Τεννεσσεε
Υταη
ςερmοντ
ςιργινια
Wασηινγτον
Wεστ ςιργινια
Wισχονσιν
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 105
#15..
- 436 -
California
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 106
#15..
- 437 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 107
#15..
- 438 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 108
#15..
- 439 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 109
#15..
- 440 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 110
#15..
- 441 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 111
#15..
- 442 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 112
#15..
- 443 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 113
#15..
- 444 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 114
#15..
- 445 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 115
#15..
- 446 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 116
#15..
- 447 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 117
#15..
- 448 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 118
#15..
- 449 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 119
#15..
- 450 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 120
#15..
- 451 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 121
#15..
- 452 -
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 122
#15..
- 453 -
Issued by the Office of the State Controller Date Issued: 7/1/74 Rule 3-1 Date Revised: 1/1/09

Page 1 ends

Modesto City CouncilJune 4, 2024

Modesto City Council
June 4, 2024