0%
Compliant: 0 | Non-Compliant: 0 | Unanswered: 9

NIST/ISO Compliance Self-Assessment Tool

Control Family Description Response Mitigation / Recommendation Notes
Access Control (AC) – Managing user permissions Are user accounts reviewed regularly for access appropriateness?
Incident Response (IR) – Preparing for and managing incidents Is there an established and tested incident response plan?
Risk Assessment (RA) – Identifying and managing risk Are formal risk assessments performed annually?
Configuration Management (CM) – Securing system settings Are baseline configurations documented and enforced?
Awareness & Training (AT) – Educating personnel Do all employees receive annual security awareness training?
Audit & Accountability (AU) – Monitoring and recording activity Are audit logs collected, protected, and reviewed regularly?
Media Protection (MP) – Safeguarding sensitive information Is sensitive data on media securely destroyed before disposal?
System & Communications Protection (SC) – Secure transmission Is sensitive data encrypted during transmission?
Physical & Environmental Security (PE) – Physical access controls Are physical locations secured with access restrictions and monitoring?

🛠️ Internal Notes

💼 Client Notes

Tip: “Not Applicable” should only be selected when a control does not logically apply to your environment. Justify N/A responses during audits.
Who Performs This Assessment?
Typically conducted by: Information Security Officers, IT Security Teams, Compliance Officers, System Administrators, and Department Managers. Used during audits, onboarding, or periodic risk evaluations.

Security Controls Guide

Why This Matters:

Access control is the cornerstone of security. Regular reviews ensure that only the right people have access to sensitive data and systems, reducing the risk of insider threats, data breaches, and privilege escalation.

Without access control reviews, users might retain unnecessary permissions long after they’ve changed roles or left the organization, leading to potential exposure or exploitation.

What to Check:

  • Access Review Frequency: Ensure reviews happen regularly (quarterly, bi-annually, or annually). Access should be reviewed when users change roles, or new roles are created.
  • Permissions Mapping: Check if permissions are assigned according to job roles. Use role-based access control (RBAC) or attribute-based access control (ABAC).
  • Automated Tools: Use automated IAM (Identity and Access Management) systems to streamline access reviews and detect unnecessary permissions.
  • Audit Trails: Ensure that audit logs are kept for changes made to user access. These should be regularly reviewed.
  • Segregation of Duties: Ensure that critical functions are segregated. A user should not have both the ability to make and approve changes that could impact security.
  • Exceptions and Justifications: Identify any users with elevated or non-standard access, and ensure there is a valid business justification.

Who to Talk To:

  • IT Admins: They can provide logs, reports, and the tools used to manage access permissions (e.g., Active Directory, Okta, etc.).
  • Human Resources: HR provides details on employee roles, employment status (e.g., if someone is still employed or has left), and any role changes.
  • Department Heads: They can help validate if users still require access to specific systems based on their job duties.

Evidence to Collect:

  • Access Review Reports: Look for documented evidence that reviews were conducted, including a list of users whose access was reviewed and whether changes were made.
  • Permission Change Logs: Obtain logs from IAM systems showing changes to user permissions, who approved them, and the date of the changes.
  • Access Control Policies: Review written policies that outline how often access reviews should occur, who is responsible, and the process to follow.
  • Sample Screenshots: Screenshots from your IAM tools or directory services that show user access and permissions.

Common Pitfalls to Avoid:

  • Inconsistent Review Cycles: Sometimes, reviews are skipped or postponed, leading to outdated access controls. Stick to a defined review schedule.
  • Unclear Role Definitions: Without clearly defined roles and responsibilities, access reviews can be inconsistent and incomplete. Ensure all roles are clearly documented.
  • Overlooking Temporary Access: Temporary or emergency access granted to users can often be forgotten. Make sure to track temporary access and remove it once it’s no longer needed.
  • Failing to Remove Access for Departing Employees: When employees leave the company or transfer departments, their access should be revoked immediately.

Best Practices:

  • Automate Access Reviews: Use automated tools that can highlight users with unnecessary access or role changes.
  • Least Privilege Principle: Ensure that users only have the minimum access necessary to do their jobs, and regularly audit their permissions.
  • Periodic Role-Based Access Control (RBAC) Review: Conduct annual reviews of all roles in your organization to ensure they are still relevant and appropriately assigned.
  • Continuous Monitoring: Implement continuous monitoring systems to track user activity and quickly detect unusual behavior that might indicate an access issue.

Recommendation If Not Compliant:

If your organization is not regularly reviewing user access or using role-based access controls, implement a structured program. Use IAM tools for automation, establish review policies, and assign clear responsibilities for monitoring and enforcing access reviews.

Additional Resources:

Why This Matters:

Maintaining an accurate inventory of assets is essential for effective security management. Without a comprehensive and current inventory, it’s impossible to track vulnerabilities, plan for updates, or monitor unauthorized devices.

Organizations that lack proper asset management often face difficulties when responding to incidents, ensuring compliance, and managing patches, increasing the risk of undetected threats.

What to Check:

  • Inventory Process: Ensure that there’s a well-documented process for tracking assets from procurement to disposal. This should include hardware, software, and virtual assets.
  • Real-Time Updates: Check if the asset inventory is updated in real-time or on a regular basis (e.g., after hardware is added or decommissioned, or software is installed or uninstalled).
  • Complete Coverage: Make sure the inventory includes all types of assets – from desktops, laptops, and mobile devices to servers, network devices, software, and cloud infrastructure.
  • Asset Classification: Confirm that assets are categorized appropriately, based on criticality and sensitivity (e.g., highly sensitive data systems versus general workstations).
  • Automated Discovery Tools: Determine if the organization uses tools (e.g., network scanners, asset management software) to automate asset discovery and updates.

Who to Talk To:

  • IT Department: They will provide insight into the tools and processes used for asset management, and can help confirm whether all assets are tracked properly.
  • Procurement: This team is involved in purchasing hardware and software and can help confirm what new assets have been added to the inventory.
  • Software License Management: They’ll ensure that all software assets are properly recorded, including licenses, versions, and renewal dates.

Evidence to Collect:

  • Asset Inventory Logs: Request access to the most recent asset inventory logs, showing all hardware and software assets currently owned by the organization.
  • System Configuration Files: Obtain configuration files or asset management system screenshots showing real-time asset tracking.
  • Automated Discovery Reports: If automated tools are in use, obtain reports from them to show how assets are being discovered and tracked.
  • Procurement Records: Review purchase orders, receipts, and licensing documents that show newly added assets.

Common Pitfalls to Avoid:

  • Incomplete Inventory: Often, smaller devices (e.g., USB drives, mobile phones) or software licenses may be overlooked. Ensure all assets, both physical and digital, are accounted for.
  • Lack of Regular Updates: Inventory that is not updated regularly can result in missed vulnerabilities and outdated configurations. Automate the process if possible.
  • Disjointed Systems: Avoid having separate asset tracking systems that don’t communicate with each other, as this leads to inconsistencies.
  • Failure to Include Disposed Assets: Proper disposal and decommissioning of assets should be tracked to avoid security risks from discarded hardware or software.

Best Practices:

  • Automate Discovery and Tracking: Use asset management software or discovery tools to automatically update the asset inventory when changes occur, reducing manual errors.
  • Regular Audits: Schedule regular audits to reconcile the actual assets with the inventory list and ensure completeness and accuracy.
  • Track Software Versions: Keep a record of software versions and license keys to ensure compliance with vendor terms and track security updates.
  • Implement Decommissioning Procedures: Establish a standard operating procedure for the secure disposal of assets to prevent data breaches when assets are retired or sold.

Recommendation If Not Compliant:

If your organization is not maintaining a comprehensive and updated inventory, consider adopting an automated asset management system. Implement regular audits and ensure that all hardware and software are categorized and tracked. Establish a formal process for updating the inventory whenever assets are added, modified, or decommissioned.

Additional Resources:

Why This Matters:

Risk assessment is essential to understanding potential threats and vulnerabilities that could impact the confidentiality, integrity, and availability of systems and data. It enables organizations to make informed decisions about mitigating or accepting risks.

Without a structured risk assessment process, organizations may overlook critical exposures, allocate resources ineffectively, or fail to comply with regulatory standards.

What to Check:

  • Risk Assessment Frequency: Ensure that risk assessments are conducted at regular intervals (e.g., annually) and whenever significant changes occur in systems or operations.
  • Documentation: Confirm that risk assessments are well-documented, including identified risks, their likelihood, impact, and mitigation strategies.
  • Methodology: Assess whether a consistent and structured methodology is used, such as NIST SP 800-30 or ISO 27005.
  • Involvement: Verify that key stakeholders (e.g., IT, security, legal, business units) are involved in the assessment process.
  • Risk Register: Check if a risk register or tracking system exists to monitor identified risks and their treatment plans.

Who to Talk To:

  • Risk Management Team: They oversee the risk assessment process and can provide reports and methodologies used.
  • IT and Security Leaders: These individuals can speak to technical risks and mitigation strategies.
  • Compliance Officers: They help ensure risk assessments align with regulatory requirements.
  • Department Heads: Can provide insight into business-specific risks and impacts.

Evidence to Collect:

  • Risk Assessment Reports: Formal documentation outlining risks, likelihood, impact, and planned mitigations.
  • Risk Register: A centralized list of risks with status updates, ownership, and priority levels.
  • Meeting Minutes: Records of risk assessment discussions and decisions made by key stakeholders.
  • Methodology Documents: The framework or guide used for conducting the risk assessments.

Common Pitfalls to Avoid:

  • Infrequent Assessments: Risks change as environments evolve. Performing assessments only once every few years may leave organizations exposed.
  • Incomplete Scope: Excluding key assets, systems, or departments can create blind spots in the risk profile.
  • No Follow-Up: Identified risks must be addressed. Assessments without action plans lead to unresolved issues.
  • Static Risk Register: A risk register that isn’t updated becomes outdated and unhelpful.

Best Practices:

  • Use a Formal Framework: Follow recognized standards like NIST SP 800-30 or ISO 27005 for consistency and completeness.
  • Risk Scoring: Quantify risks using scoring systems to prioritize treatment efforts based on likelihood and impact.
  • Integrate with Business Goals: Align risk assessments with strategic business objectives for better stakeholder engagement.
  • Review and Update Regularly: Keep the risk register and treatment plans current by reviewing them quarterly or after major changes.

Recommendation If Not Compliant:

If risk assessments are not conducted regularly or documented effectively, implement a formal risk management program. Adopt a standard methodology, assign ownership of risks, and establish a living risk register with regular reviews and updates.

Additional Resources:

Why This Matters:

Configuration management ensures that all systems are set up securely and consistently. Misconfigured systems are a common entry point for attackers and can lead to unauthorized access, data breaches, and compliance violations.

Without proper configuration management, default settings, unused services, or unpatched software can be overlooked, exposing systems to vulnerabilities.

What to Check:

  • Baseline Configurations: Ensure systems follow approved security baselines (e.g., CIS Benchmarks, NIST hardening guidelines).
  • Change Control Process: Verify that changes to configurations follow a formal change control process with proper documentation and approval.
  • Version Control: Use tools to track configuration versions and roll back if needed.
  • Automated Tools: Confirm the use of tools like Ansible, Puppet, or Chef to automate configuration enforcement and auditing.
  • Unnecessary Services: Ensure unnecessary ports, protocols, and services are disabled or removed.

Who to Talk To:

  • System Administrators: Responsible for implementing and maintaining system configurations and can provide baseline documents and tooling information.
  • Change Management Team: Can provide change request logs and verify whether system changes are tracked and approved.
  • Security Engineers: Oversee the configuration audit process and ensure compliance with security frameworks.

Evidence to Collect:

  • Configuration Baseline Documents: Include OS hardening guides, service configurations, and secure setup procedures.
  • Change Logs: Records showing system configuration changes and the associated approval or tickets.
  • Audit Reports: Outputs from configuration scanning tools that show compliance or deviation from baselines.
  • Screenshots: Of settings, configurations, and changes made via management consoles.

Common Pitfalls to Avoid:

  • Using Default Settings: Default passwords or services left active can easily be exploited.
  • Lack of Documentation: Not documenting configuration changes leads to poor traceability and inconsistent setups.
  • No Rollback Plan: Not having versioning or rollback capability can complicate recovery from bad configurations.
  • Inconsistent Environments: Development, testing, and production environments should align in configurations to avoid unexpected vulnerabilities.

Best Practices:

  • Enforce Configuration Baselines: Regularly verify systems against approved security baselines using automated tools.
  • Automate Configuration Management: Use tools to standardize and enforce secure configurations at scale.
  • Monitor for Drift: Continuously monitor systems for deviations from expected configurations and correct them promptly.
  • Implement Least Functionality: Disable features and services that are not needed to reduce the attack surface.

Recommendation If Not Compliant:

If secure configuration management is lacking, establish and enforce security baselines using industry standards. Implement configuration management tools to automate the process, and ensure all changes go through proper review and approval channels.

Additional Resources:

Why This Matters:

Security awareness and training programs empower employees to recognize and respond to threats like phishing, social engineering, and insider risks. Human error is a major cause of security incidents, so educating staff is essential to strengthening the organization’s security posture.

Trained personnel are less likely to fall victim to attacks and more likely to report suspicious activity, which improves incident detection and response.

What to Check:

  • Training Programs: Confirm that regular cybersecurity training is provided to all staff, tailored to roles and responsibilities.
  • Phishing Simulations: Verify if simulated phishing tests are conducted to assess awareness and readiness.
  • Tracking & Metrics: Check if training completion and test results are tracked and reported.
  • Onboarding Process: Ensure new hires receive security training as part of onboarding.
  • Policy Acknowledgement: Validate that employees acknowledge receipt and understanding of security policies.

Who to Talk To:

  • Training & Development Team: Oversees the content, scheduling, and delivery of training programs.
  • Human Resources: Ensures cybersecurity training is part of the onboarding process and compliance tracking.
  • IT Security Team: May conduct awareness campaigns, phishing tests, or maintain policy acknowledgment systems.

Evidence to Collect:

  • Training Schedules & Content: Documentation of past and upcoming training modules or sessions.
  • Completion Reports: Logs or dashboards showing who completed training and when.
  • Phishing Test Results: Reports showing success/failure rates in simulated phishing campaigns.
  • Signed Policies: Acknowledgment forms or digital records proving users accepted security policies.

Common Pitfalls to Avoid:

  • One-Time Training: Treating training as a one-off event instead of an ongoing program.
  • Generic Content: Not customizing training for different roles (e.g., developers, executives, admins).
  • No Follow-Up: Failing to reinforce learning with reminders, assessments, or updated materials.
  • Lack of Accountability: Not tracking completion or performance, leading to gaps in coverage.

Best Practices:

  • Make It Engaging: Use videos, quizzes, and simulations to keep users engaged and improve retention.
  • Role-Based Training: Tailor modules to specific job functions and risk levels.
  • Test & Report: Conduct regular phishing tests and publish results to promote accountability.
  • Continuous Education: Offer ongoing training opportunities and refreshers throughout the year.

Recommendation If Not Compliant:

If a formal training and awareness program is lacking, establish a recurring, role-specific training schedule. Integrate phishing simulations and track completion rates. Make training mandatory for all employees, and include it in onboarding and annual compliance reviews.

Additional Resources:

Why This Matters:

Audit logs provide crucial visibility into system and user activity. Regularly collecting and reviewing these logs helps detect unauthorized access, malicious activity, and performance issues before they become major incidents.

Without proper logging and monitoring, it’s nearly impossible to investigate incidents or meet compliance requirements such as those from NIST, ISO 27001, or regulatory frameworks like HIPAA and PCI-DSS.

What to Check:

  • Logging Coverage: Ensure all critical systems (e.g., firewalls, servers, authentication systems) generate logs.
  • Centralized Log Management: Verify the use of a Security Information and Event Management (SIEM) or log aggregation tool (e.g., Splunk, ELK, Graylog).
  • Retention Policy: Logs should be stored for a defined period (e.g., 90 days, 1 year) based on business and compliance needs.
  • Review Process: Check for documentation or evidence showing that audit logs are reviewed regularly (daily/weekly/monthly).
  • Alerting: Ensure alerts are configured for anomalous activity, such as failed logins, privilege escalation, or unusual access times.
  • Time Synchronization: All logging systems should use NTP to synchronize clocks, ensuring accurate timestamps.

Who to Talk To:

  • Security Analysts: They typically monitor logs and respond to alerts or anomalies.
  • System Administrators: They can confirm which systems generate logs and how those logs are forwarded and stored.
  • Compliance Officers: They can provide insight into audit requirements and evidence of periodic reviews.

Evidence to Collect:

  • Log Samples: Exported log entries showing typical entries and coverage across systems.
  • SIEM Dashboards or Reports: Screenshots or reports from log aggregation tools showing alerts, dashboards, and review summaries.
  • Log Retention Policy: Documentation stating how long logs are kept and where.
  • Incident Reports: Historical records where logs were used to identify or respond to incidents.

Common Pitfalls to Avoid:

  • Not Centralizing Logs: Logs stored locally on systems may be lost or missed during reviews.
  • Ignoring Low-Level Alerts: Small anomalies can be early signs of major issues.
  • Missing Time Synchronization: Logs without accurate timestamps make correlation during investigations difficult.
  • Insufficient Review Frequency: Logs reviewed only during incidents are not proactive and may miss ongoing threats.

Best Practices:

  • Automate Log Collection: Use tools to automatically collect, tag, and store logs in real-time.
  • Role-Based Alerting: Assign alerts to the appropriate team members based on the nature of the activity.
  • Baseline Normal Behavior: Establish a baseline of typical user/system activity and flag deviations.
  • Regular Log Review Meetings: Schedule periodic reviews with security and IT teams to discuss key findings.

Recommendation If Not Compliant:

If your organization is not collecting or reviewing audit logs, implement a centralized logging solution immediately. Establish review routines, alert thresholds, and retention schedules. Integrate logs into incident response and compliance procedures to ensure traceability and accountability.

Additional Resources:

Why This Matters:

Media containing sensitive or confidential information (e.g., USB drives, backup tapes, printed documents) must be properly protected to prevent unauthorized access, data breaches, and loss of integrity. Mishandling of physical or digital media is a common cause of data leaks.

Proper media protection ensures compliance with regulatory requirements and helps maintain data confidentiality and integrity throughout its lifecycle.

What to Check:

  • Access Controls: Determine how access to sensitive media is restricted and logged.
  • Labeling: Confirm that media is labeled appropriately according to sensitivity or classification levels.
  • Storage: Verify that sensitive media is securely stored (e.g., locked cabinets, encrypted storage).
  • Transport Procedures: Ensure that secure methods (encryption, tracking, tamper-proof containers) are used for moving sensitive media.
  • Media Sanitization & Disposal: Check if outdated or unused media is properly wiped, degaussed, or physically destroyed.

Who to Talk To:

  • IT Security Team: Implements and monitors secure handling and disposal procedures.
  • Records Management or Compliance Officer: Oversees document and media retention and destruction policies.
  • Facilities/Operations: May be responsible for physical storage and transport logistics of sensitive media.

Evidence to Collect:

  • Media Handling Policies: Written procedures for labeling, storing, and transporting media.
  • Access Logs: Records showing who accessed specific media and when.
  • Sanitization Records: Documentation showing that media was securely erased or destroyed.
  • Audit Reports: Results of checks on media handling compliance or incidents involving lost media.

Common Pitfalls to Avoid:

  • Unencrypted Portable Media: Using USBs, external drives, or laptops without encryption.
  • Poor Disposal Practices: Throwing away media without proper wiping or destruction.
  • Unlabeled Media: Failing to identify sensitive media, leading to mishandling.
  • No Chain of Custody: Transporting media without logs or accountability.

Best Practices:

  • Encrypt All Sensitive Media: Whether at rest or in transit, encryption is critical for protection.
  • Restrict Access: Limit access to only authorized personnel with a business need.
  • Secure Storage: Use locked cabinets, safes, or controlled areas for physical media.
  • Track Movement: Maintain logs and chain-of-custody forms for media transport.
  • Certified Destruction: Use secure destruction services and retain certificates as evidence.

Recommendation If Not Compliant:

If media protection practices are inadequate, establish or update policies for handling, labeling, encrypting, and securely disposing of media. Provide training for personnel and implement logging for access and movement. Use encryption by default and ensure disposal is certified and documented.

Additional Resources:

Why This Matters:

Ensuring the secure transmission of data protects sensitive information from being intercepted or tampered with during transit. This is critical for maintaining confidentiality, integrity, and trust in systems handling personal, financial, or operational data.

Unprotected communication channels can be exploited through man-in-the-middle attacks, eavesdropping, or data manipulation, resulting in data breaches and compliance violations.

What to Check:

  • Encryption Protocols: Verify that encryption protocols like TLS 1.2+ are used for web communications and VPNs.
  • Email Transmission: Ensure emails containing sensitive data are encrypted using technologies such as S/MIME or PGP.
  • Secure APIs: Confirm that APIs transmitting sensitive data are using HTTPS and implementing proper authentication mechanisms.
  • Network Segmentation: Check whether sensitive systems are isolated from public networks or other less secure environments.
  • Firewall and IDS/IPS: Ensure traffic is monitored and controlled using up-to-date firewall rules and intrusion detection/prevention systems.

Who to Talk To:

  • Network Engineers: They can confirm encryption standards, network architecture, and segmentation.
  • Security Architects: They design secure communication channels and select technologies for data protection in transit.
  • System Administrators: They implement and maintain firewall configurations and encrypted services.

Evidence to Collect:

  • Network Diagrams: Visuals showing data flow, segmentation, and secure communication zones.
  • Configuration Files: Screenshots or exports of firewall, VPN, and TLS/SSL configurations.
  • Encryption Certificates: Details of certificates used for TLS/SSL encryption, including expiration and issuer.
  • Policy Documents: Policies or procedures outlining requirements for secure transmission of data.

Common Pitfalls to Avoid:

  • Outdated Protocols: Use of deprecated protocols like SSL or TLS 1.0/1.1 can expose data to compromise.
  • Unsecured Internal Traffic: Assuming internal traffic is safe and leaving it unencrypted can be risky, especially in hybrid cloud environments.
  • Lack of Certificate Management: Expired or misconfigured SSL certificates can break encryption or expose vulnerabilities.
  • Improper VPN Configuration: Weak VPN setups can fail to adequately protect data in transit.

Best Practices:

  • Use Strong Encryption: Enforce TLS 1.2 or higher for all web-based communications and encrypt all sensitive data in transit.
  • Regular Testing: Conduct vulnerability scans and penetration tests to identify insecure transmission points.
  • Certificate Monitoring: Track certificate expiration and renewals to avoid service disruptions and security gaps.
  • Secure DNS: Implement DNSSEC and other secure DNS practices to prevent spoofing and hijacking.

Recommendation If Not Compliant:

Implement a comprehensive secure transmission strategy, including mandatory encryption, routine certificate management, secure VPN configurations, and regular audits of all communication channels. Update and enforce policies requiring encrypted communications for all sensitive data exchanges.

Additional Resources:

Why This Matters:

Physical access controls prevent unauthorized individuals from entering sensitive areas, protecting hardware, data, and systems from tampering, theft, or destruction. Without physical security, even the best cybersecurity measures can be bypassed.

Environmental controls also protect against hazards such as fire, water damage, or power failure, ensuring systems remain safe and operational.

What to Check:

  • Access Control Mechanisms: Are badge readers, biometric scanners, or keypads in place to control entry to data centers or server rooms?
  • Visitor Logs: Are visitors required to sign in, and are logs maintained and reviewed regularly?
  • Surveillance: Are CCTV cameras present, and are video feeds monitored and retained securely?
  • Environmental Protections: Are fire suppression systems, climate control, and uninterruptible power supplies (UPS) in place?
  • Access Reviews: Is access to secure areas periodically reviewed and updated as personnel roles change?

Who to Talk To:

  • Facilities Manager: They manage physical security systems and building access.
  • Security Personnel: They oversee surveillance, entry monitoring, and emergency response.
  • IT/Data Center Manager: They know which areas house critical systems and how they’re physically protected.

Evidence to Collect:

  • Access Control Policies: Documents outlining who is allowed access to which areas and under what conditions.
  • Surveillance Logs: Footage retention schedules or proof of functioning video monitoring.
  • Visitor Sign-In Sheets: Recent logs showing visitor activity and escort procedures.
  • Environmental Monitoring Reports: Maintenance records for HVAC, fire suppression, and UPS systems.

Common Pitfalls to Avoid:

  • Propped Open Doors: Doors left open for convenience compromise security.
  • Shared or Unsecured Access Cards: Using generic badges or failing to disable access promptly after employee termination.
  • Outdated Equipment: Relying on old locks or malfunctioning surveillance cameras.
  • No Backup Power: Systems shut down during power outages if no UPS or generator is available.

Best Practices:

  • Layered Access Control: Use multi-factor authentication and zoning for critical areas.
  • Regular Testing: Conduct periodic drills and tests of alarms, locks, and environmental controls.
  • Audit Logs: Review access logs routinely to detect anomalies or unauthorized access attempts.
  • Visitor Escort Policy: Require visitors to be escorted at all times within sensitive zones.

Recommendation If Not Compliant:

Implement physical security measures including access badges, surveillance, and visitor management procedures. Ensure environmental safeguards such as fire suppression and power backup are maintained. Conduct regular training and reviews to enforce adherence to policies.

Additional Resources:

Why This Matters:

System integrity ensures that systems operate as intended and are free from unauthorized changes or malicious code. It helps maintain trust in the systems’ outputs, prevents corruption of data, and supports continuity of operations.

Monitoring and protecting against unauthorized modifications is crucial for detecting and responding to potential compromises in a timely manner.

What to Check:

  • Integrity Checks: Are tools or processes in place to detect unauthorized changes to critical files, software, or configurations?
  • Malware Detection: Is anti-malware software deployed and kept up-to-date on all systems?
  • Baseline Configuration: Are baseline images or configuration records maintained for comparison?
  • Patch Validation: Are patches tested and validated before deployment to ensure they don’t affect system integrity?
  • Alerting Mechanisms: Are alerts configured for when integrity checks or malware scans detect issues?

Who to Talk To:

  • System Administrators: They manage patching, baseline configurations, and integrity verification tools.
  • Security Operations Center (SOC): They monitor alerts and incidents related to system tampering or malware.
  • IT Security Team: They are responsible for deploying and updating endpoint protection solutions.

Evidence to Collect:

  • System Baseline Documentation: Records of original configurations or file hashes.
  • Integrity Monitoring Reports: Output from tools like Tripwire or Windows System File Checker.
  • Anti-Malware Logs: Recent scan logs and reports showing active protection.
  • Patch Test Records: Documentation showing how updates are tested before roll-out.

Common Pitfalls to Avoid:

  • No Integrity Baseline: Without a known-good baseline, it’s hard to detect unauthorized changes.
  • Disabled Security Software: Antivirus or endpoint protection that is outdated or turned off.
  • Unmonitored Alerts: Alerts are generated but never reviewed or acted upon.
  • Incomplete Coverage: Some systems lack protection or monitoring altogether.

Best Practices:

  • File Integrity Monitoring: Use automated tools to compare current states with baselines and alert on deviations.
  • Regular Anti-Malware Scans: Schedule frequent, automated scans with real-time protection enabled.
  • Centralized Logging: Forward alerts to a centralized SIEM for correlation and response.
  • Review Results: Include integrity checks in regular security audits and reviews.

Recommendation If Not Compliant:

Implement file integrity monitoring solutions and ensure anti-malware tools are active and updated. Establish system baselines and perform regular reviews to detect unauthorized changes. Enable alerting and response workflows for detected anomalies.

Additional Resources:

Why This Matters:

System and information integrity ensures that flaws, errors, or malicious activity in systems or data are detected and addressed quickly. This control helps minimize the potential damage from vulnerabilities or compromises.

Without timely detection and correction of issues, systems become vulnerable to exploitation, leading to data breaches or system failures.

What to Check:

  • Vulnerability Scanning: Are automated tools used regularly to identify system vulnerabilities?
  • Security Patch Management: Are flaws and bugs patched quickly after detection?
  • Malicious Code Detection: Are systems monitored for signs of malware or unauthorized software?
  • Error Reporting: Are system errors and faults logged and analyzed?
  • Email Protection: Are inbound messages scanned for malicious content?

Who to Talk To:

  • IT Security Team: They are responsible for running vulnerability scans and patching systems.
  • SOC Analysts: They monitor for anomalies, threats, and suspicious code.
  • System Engineers: They deploy updates and maintain system integrity mechanisms.

Evidence to Collect:

  • Vulnerability Scan Reports: Documentation of scanning frequency and detected issues.
  • Patch Records: Logs showing when patches were applied and to which systems.
  • Anti-Malware Logs: Reports of detection, quarantine, or removal actions.
  • System Logs: Logs showing how faults and anomalies are handled.

Common Pitfalls to Avoid:

  • Infrequent Scanning: Long gaps between scans allow vulnerabilities to go undetected.
  • Delayed Patching: Known flaws remain unaddressed, increasing attack risk.
  • Unmonitored Alerts: Security systems generate alerts that are ignored or misconfigured.
  • No Email Filtering: Malware enters via email due to lack of scanning or filters.

Best Practices:

  • Continuous Monitoring: Enable real-time monitoring of systems for suspicious activity.
  • Automated Patch Deployment: Automate patching for high-risk systems to reduce response time.
  • Threat Intelligence Feeds: Integrate with feeds to stay ahead of emerging threats.
  • Comprehensive Email Security: Use spam filters, attachment scanning, and link protection.

Recommendation If Not Compliant:

Establish a routine vulnerability management process and automate patch deployment where feasible. Enhance anti-malware protection, enable real-time alerts, and implement robust email security filtering to catch threats before they affect users or systems.

Additional Resources:

Why This Matters:

Planning and monitoring for security ensures that the organization has a defined strategy and framework for protecting its assets and information. This process helps ensure that the necessary safeguards are in place before risks escalate.

Without a solid security plan, organizations may find themselves unprepared to address threats, making it difficult to protect sensitive information or respond to incidents effectively.

What to Check:

  • Security Strategy: Does your organization have a comprehensive security strategy in place, including objectives and risk tolerance?
  • Risk Management Framework: Does the organization utilize a recognized risk management framework (e.g., NIST RMF, ISO 27001)?
  • Security Training Plans: Are security awareness training programs in place for staff?
  • Security Assessments: Are regular security assessments (e.g., penetration tests, vulnerability scans) conducted?
  • Incident Response Plan: Is there a formal incident response plan with clear procedures and roles?

Who to Talk To:

  • Chief Information Security Officer (CISO): The CISO is responsible for overseeing the organization’s security planning efforts.
  • IT Managers: They help implement security strategies and ensure the availability of resources.
  • Risk Management Team: They assist in evaluating and prioritizing risks.
  • Security Analysts: They conduct risk assessments and monitor for security threats.

Evidence to Collect:

  • Security Plans: Copies of the organization’s security plan, risk management framework, and policies.
  • Risk Assessments: Documentation of completed risk assessments, including identified threats and vulnerabilities.
  • Training Records: Evidence that security awareness training has been completed by staff.
  • Incident Response Procedures: Documentation of incident response procedures, including test results from tabletop exercises.

Common Pitfalls to Avoid:

  • Lack of Formal Security Strategy: A security strategy not documented or communicated can lead to fragmented and inconsistent practices.
  • Failure to Update Security Plans: Security plans must be updated to reflect changing threats and business operations.
  • Infrequent Risk Assessments: Risk assessments should be conducted regularly, not just once or during audits.
  • Unprepared Incident Response: Organizations without a formal incident response plan or tested procedures may struggle to respond to security incidents.

Best Practices:

  • Continuous Risk Monitoring: Use continuous monitoring tools to detect threats and vulnerabilities in real-time.
  • Regular Updates to Security Plans: Regularly update your security strategy and policies to reflect emerging risks and changes in technology.
  • Frequent Security Testing: Conduct regular security testing, such as penetration tests and vulnerability assessments, to identify gaps in your defenses.
  • Staff Awareness: Implement regular security awareness programs to ensure all employees understand their role in protecting the organization.

Recommendation If Not Compliant:

If your organization does not have a formal security plan or ongoing risk assessments, prioritize developing a comprehensive security strategy. Ensure that security training is mandatory for all employees and conduct regular security assessments and incident response exercises.

Additional Resources: