Technical Guidelines for the implementation of minimum security measures for Digital Service Providers

Technical Guidelines for the implementation of minimum security measures for Digital Service Providers DECEMBER, 2016 www.enisa.europa.eu European Union Agency For Network And Information Security

About ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contact

For contacting the authors please use resilience@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

Acknowledgements

Special thank the experts of the ENISA Cloud Security and Resilience expert group, BSI, ANSSI, Microsoft, Google, VMWare, Palo Alto Networks and cyber security experts from the EU Member States, who provided useful comments and feedback on earlier drafts of this document: https://resilience.enisa.europa.eu/cloud-security-and-resilience

Legal notice

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

Copyright Notice

© European Union Agency for Network and Information Security (ENISA), 2016 Reproduction is authorised provided the source is acknowledged.

ISBN 978-92-9204-203-5, doi 10.2824/456345

Table of Contents

Executive Summary 6

1. Introduction 7

Background 7

1.1.1 General introduction 7 1.1.2 Objectives 7 1.1.3 Scope & Target Audience 7 1.1.4 Document overview 8 1.1.5 Methodology 9

2. List of security objectives and measures for DSPs 11

Description 11

The role of risk assessment 12

SO 01 - Information security policy 12

Description 12 Security measures within sophistication levels 13 Mapping 14

SO 02 – Risk Management 14

Description 14 Security measures in sophistication levels 14 Mapping 15

SO 03 – Security Roles 15

Description 15 Security measures within sophistication levels 16 Mapping 17

SO 04 – Third party management 17

Description 17 Security measures within sophistication levels 17 Mapping 19

SO 05 – Background checks 19

Description 19 Security measures within sophistication levels 19 Mapping 20

SO 06 – Security knowledge and training 20

Description 20 Security measures within sophistication levels 20 Mapping 22

SO 07 – Personnel changes 22

Description 22 Security measures within sophistication levels 22

Mapping 23

SO 08 – Physical and environmental security 23

Description 23 Security measures within sophistication levels 23 Mapping 25

SO 09 – Security of supporting utilities 26

Description 26 Security measures within sophistication levels 26 Mapping 26

SO 10 – Access control to network and information systems 27

Description 27 Security measures within sophistication levels 27 Mapping 28

SO 11 – Integrity of network components and information systems 29

Description 29 Security measures within sophistication levels 29 Mapping 30

SO 12 – Operating procedures 30

Description 30 Security measures within sophistication levels 30 Mapping 31

SO 13 – Change management 31

Description 31 Security measures within sophistication levels 31 Mapping 32

SO 14 – Asset management 32

Description 32 Security measures within sophistication levels 32 Mapping 34

SO 15 – Security incident detection & Response 34

Description 34 Security measures within sophistication levels 34 Mapping 36

SO 16 – Security incident reporting 36

Description 36 Security measures within sophistication levels 36 Mapping 37

SO 17 – Business continuity 37

Description 37 Security measures within sophistication levels 37 Mapping 39

SO 18 – Disaster recovery capabilities 39

Description 39 Security measures within sophistication levels 39 Mapping 40

SO 19 – Monitoring and logging 40

Description 40 Security measures within sophistication levels 40 Mapping 41

SO 20 – System tests 41

Description 41 Security measures within sophistication levels 42 Mapping 43

SO 21 – Security assessments 43

Description 43 Security measures within sophistication levels 43 Mapping 44

SO 22 – Compliance 44

Description 44 Security measures within sophistication levels 44 Mapping 45

SO 23 – Security of data at rest 46

Description 46 Security measures within sophistication levels 46 Mapping 48

SO 24 –Interface security 48

Description 48 Security measures within sophistication levels 49 Mapping 50

SO 25 –Software security 50

Description 50 Security measures within sophistication levels 50 Mapping 51

SO 26 – Interoperability and portability 51

Description 51 Security measures within sophistication levels 52 Mapping 52

SO 27 – Customer Monitoring and log access 52

Description 52 Security measures within sophistication levels 52 Mapping 53

3. Summary 54

Executive Summary

Online marketplaces, online search engines and cloud computing services are considered as Digital Service Providers (DSPs) in the context of the recently adopted Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, hereafter referred to as the Network and Information Security (NIS) Directive.

The NIS Directive aims to bring cybersecurity capabilities on the same level of development in all the EU Member States. Its purpose is to ensure that exchange of information and cooperation related to security amongst Member States are efficient, including at the cross-border level . With NIS becoming a requirement, the introduction of specific laws in this area across the European Union will have a significant impact to all industry sectors including those relating to DSP categories.

Many businesses in the Union rely on these DSPs for the provision of their services. Some digital services could be an important resource for their users, including Operators of Essential Services (OES), and as such users might not always have alternatives available. The security, continuity and reliability of the type of digital services referred to in this Directive are of the essence for the smooth functioning of many businesses. A disruption of such a digital service could prevent the provision of other services which depend on it and could consequently have an impact on key economic and societal activities in the Union. Such digital services might therefore be critical for the smooth functioning of businesses that depend on them, for the internal market and cross- border trade across the Union .

It is essential for all Member States to make sure that they have minimum capabilities to ensure a high level of NIS in their territory and to improve the functioning of the internal market. Commonly defined security measures can support harmonised security practices across EU Member States and potentially enhance the overall level of NIS in the EU.

Therefore, ENISA has issued this report to assist Member States and DSPs in providing a common approach regarding the security measures for DSPs. Although ENISA has already drafted a set of security objectives in the context of cloud security in 2014 , this study goes further than that by broadening the scope of its work and by including security objectives for all three categories of digital service providers. This study lists 27 Security Objectives (SOs) for DSPs. In those 27 SOs, security measures that map to the NIS Directive requirements are also included.

This particular initiative has been achieved by examining current information and network security practices for the DSPs across the EU. It has brought light to some important findings that can add to existing security objectives and measures in information technology infrastructures in Europe. It is recommended that stakeholders and responsible parties analyse their information security needs in detail in order to evaluate and adapt each of the security objectives and measures according to their specific business requirements.

1. Introduction

Background 1.1.1 General introduction

The world is becoming increasingly interconnected as industries continue to revolutionize and knowledge continues to be shared. With the advent of digital services, network and information systems and services are becoming highly crucial to the society. Thus, it is imperative that their security and reliability is significantly ensured.

In fact, if security and resilience of networks and information systems are not ensured, this can impede the pursuit of economic activities, lead to financial losses, undermine the confidence or cause major damage to the economy of a country. For example, network and information systems, and primarily the Internet, play an essential role in facilitating the cross–border movement of goods, services and people. Substantial disruptions of those systems, whether intentional or unintentional and regardless of where they occur, can affect individual Member States and the Union as a whole. Knowing how to properly address network and information security is key to avoid any damaging effects.

DSPs operate in a fast changing environment and should ensure a level of security proportionate to the degree of risk posed to the digital services they provide. Responsibilities in ensuring the security of network and information systems lie to a great extent with DSPs themselves. A culture of risk management, involving risk assessment and the implementation of security measures appropriate to the risks faced, should be promoted and developed through appropriate regulatory requirements, standards and commonly acceptable industry practices.

1.1.2 Objectives

The objectives of this report are to:

 Define common baseline security objectives for Digital Service Providers (DSPs).  Describe different levels of sophistication in the implementation of security objectives.  Map the security objectives against well-known industry standards, national frameworks and certification schemes.

1.1.3 Scope & Target Audience

This study analyses the security objectives by providing security measures and examples of implementation concerning the digital service providers and in particular:

 Cloud computing service providers  Online marketplaces  Online search engines

The three DSP categories are described in the NIS Directive as follows:

 Online marketplaces:

An online marketplace allows consumers and/or traders to conclude online sales and service contracts with traders, and is the final destination for the conclusion of those contracts. It does not

cover online services that serve only as an intermediary to third-party services where a contract can ultimately be concluded. It therefore does not cover online services that compare the price of particular products or services from different traders, and then redirect the user to the preferred trader to purchase the product. Computing services provided by the online marketplace may include processing of transactions, aggregations of data or profiling of users. Application stores, which operate as online stores enabling the digital distribution of applications or software programmes from third parties, are to be understood as being a type of online marketplace  Online search engines:

An online search engine should allow the user to perform searches of in principle all websites on the basis of a query on any subject. It may alternatively be focused on websites in a particular language. The definition of an online search engine provided in this Directive should not cover search functions that are limited to the content of a specific website, irrespective of whether the search function is provided by an external search engine. It should also not cover online services that compare the price of particular products or services from different traders, and then redirect the user to the preferred trader to purchase the product.  Cloud computing service providers:

Cloud computing services span a wide range of activities that can be delivered according to different models. For the purposes of this report, "cloud computing services" means services that enable access to a scalable and elastic pool of shareable computing resources. The term "computing resources" covers resources such as networks, servers or other infrastructure, storage, applications and services. "Scalable" means that, in order to handle fluctuations in demand, computing resources are flexibly allocated by the cloud service provider irrespective of the geographical location of the resources.

Privacy is of outmost importance for the personal data being processed by DSPs but it is considered out of scope for this particular report. This is because, there is a good deal of data protection requirements (i.e. consent of the data subject, the purpose definition, proportionality of collected data etc.) and tools (i.e. privacy by design, privacy impact assessment, privacy seals, notifications of the processing to and audits by the national Data Protection Authorities (DPAs) and data breach notifications) which are examined under a very specific piece of EU Regulation, the General Data Protection Regulation (GDPR). The identification of the entire set of organisational and technical measures which are deemed adequate to GDPR is a subject for thorough analysis which exceeds the boundaries of the current undertaking. For this reason, this report focuses only on the objectives which are solely considered most relevant to the security element of the information systems and data maintained by the DSPs. However, some security measures described herein i.e. encryption, secure disposal of data, media access policy etc. are extensively used to address data protection requirements as well.

1.1.4 Document overview

The report lists and describes the high-level security objectives for the DSP categories together with the different sophistication levels in the implementation of security measures. For each sophistication level (basic, industry-standard and state of the art), the corresponding measures and examples are provided.

The report also provides a mapping between security objectives, industry standards, certification schemes and national frameworks. The goal of the mapping is to allow DSP communities to understand more easily if their NIS requirements and security objectives meet the requirements of those frameworks.

1.1.5 Methodology

This study is based on the Cloud Certification Schemes Meta framework (CCSM) released in November 2014 by ENISA, regarding cloud service providers. This tool is a meta-framework that provides a neutral high-level mapping from the customer's Network and Information Security requirements to security objectives in existing cloud certification schemes.

Additional security objectives concerning cloud services that may have come into play since 2014 have also been examined. The list of objectives has been validated with the ENISA Cloud Expert Group through extra consultation and a validation workshop.

A questionnaire was developed and a publicly available online survey was launched in order to identify several security controls and measures implemented, along with good practices and standards deployed by DSP and in particular online market places and online search engines.

The diagram below illustrates the relationship between security requirements, security objectives and security measures which are key terminologies that have been used throughout the document. Further to this,

examples of these terminologies are also described below.

 Security requirement: Customers have security requirements. In the procurement phase customers usually check which security requirements are met by the security objectives of the provider. This process is often referred to as due-diligence.  Security objectives: Providers have security objectives. Objectives are high-level goals and usually do not include many technical details. For example, “we offer an uptime of 99.9%”, or “customer data cannot be accessed by unauthorized personnel”. Security objectives are sometimes grouped in “security domains” (e.g. “software security”). Security objectives are sometimes called “control objectives”).  Security measures: Providers have security measures in place, to reach the security objectives. Security measures are sometimes called “controls” or “security controls”-.

The report also provides a mapping between security objectives and the following industry standards, certification schemes and national frameworks:

 ISO/IEC 27001:2013  CSA CCM: Cloud Controls Matrix v3.0.1  BSI C5: Cloud Computing Compliance Controls Catalogue (C5), criteria to assess the information security of cloud services, version 1.0 – as of February 2016  COBIT5: Framework for the governance and management of enterprise IT  CCS CSC: The CIS Critical Security Controls for Effective Cyber Defence, Version 6.1, August 31, 2016  OCF: CSA STAR PROGRAM & OPEN CERTIFICATION FRAMEWORK IN 2016 AND BEYOND  NIST: Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0, National Institute

of Standards and Technology, February 12, 2014

 PCI DSS: Payment Card Industry (PCI) Security Standards Council, Data Security Standard Requirements and Security Assessment Procedures, Version 3.2, April 2016  CES: Cyber Essentials Scheme, Requirements for basic technical protection from cyber attacks, June 2014

2. List of security objectives and measures for DSPs

Description

For each security objective we provide:

 Brief description of the security objective.  Levels of sophistication on the implementation of security measures with examples.  A mapping with industry standards, certification schemes and national frameworks

The list below, categorizes security measures into three sophistication levels. Each level contains the practices to assess the adequacy of the design and evidence that should be provided in order to check the effective implementation of the security practice. For each security objective, we have provided security measures that are either basic, industry-standard or state of the art. Readers can refer to the table below for the definition of each of these sophistication levels and can also refer to the list below for an overview of the security levels of each objective.

Sophistication levels are applied independently to each objective. As a result, a DSP may receive different sophistication ratings for different objectives. It is important to realise that the sophistication levels that are applicable to a given organisation depend on its specific characteristics such as its size or the services provided. For example, for a provider with only 5 employees it may be unnecessary to have a security policy that is fully aligned with best practice industry standards, or to have a documented formal procedure for hiring personnel.

The practices that complete each sophistication level are selected from relevant standards, guidelines and frameworks which have been identified during the stock taking exercise and described in the section 1.1.5.

The role of risk assessment

DSPs wishing to establish, implement, operate, monitor and continuously maintain and improve an appropriate level of security, must also carefully and continuously consider and assess the actual level of preparedness and the related security risks they face.

A risk assessment should be performed throughout the system life cycle: during requirements definition, procurement, control definition and configuration, system operations, and system close-out.

A “Risk Assessment” (RA) would be, in this context, an important step to be performed before deciding the required sophistication levels needed by the DSP. The extent and granularity of the Risk Assessment should take into account several factors such as the size of the organisation, the implementation cost of the measures etc.

The risk assessment allows the DSP to define a threshold for the minimum acceptance level before the establishment of a risk value and to perform the risk assessment for the assets in scope. Therefore, a risk assessment is a key preliminary step that should be conducted in order to understand what risk level is appropriate/acceptable for each organisation before deciding upon the required sophistication levels needed by DSPs.

The organisation should select specific controls, measures and sophistication levels by considering and effectively using the results of the risk assessment. This way, the proposed security measures could be considered as an appropriate benchmark enabling the security managers to determine which specific aspects of security require attention and priority within their respective organisations.

Establishing a security benchmark within a context that has been defined by DSP security experts is considered to be a successful formula, because such a benchmark can be properly focused on DSP specific security issues. Such benchmark can complement the outcome of the risk assessment and provide an additional input for defining and selecting the specific controls, measures and sophistication levels for the security of the services offered by the DSPs.

The above-described proposed approach is aligned with general risk management good practices – and therefore will help create synergies between the risk management and the security efforts of the DSP. In contrast with a compliance based approach, this approach is considered to be more pragmatic and efficient. Moreover, the proposed approach is considered to be more powerful because it takes into consideration the specific characteristics of DSPs. Therefore, it can be applied to a wide range of DSPs independently of their size or maturity.

The use of sophistication levels allows the definition of different quality requirements for each measure. This approach is different from a maturity level approach because, in practice, an organisation will probably not have all its measures developed to the same level of maturity.

The identification of a suitable risk assessment methodology for DSPs is beyond the scope of this report; therefore, it has not been described in detail. Only the relevance and usefulness of performing a suitable risk assessment, before deciding the required sophistication levels, was highlighted (SO 02: Risk Management).

SO 01 - Information security policy Description

The DSP establishes and maintains an information security policy. The document details information on main assets and processes, strategic security objectives.

Security measures within sophistication levels

1

2

3

Mapping

ISO27001: A.5 Information Security policies CSA CCM: (GRM-01, GRM-03, GRM-04, GRM-05, GRM-06, GRM-

07, GRM-08, GRM-09)

CSA CCM: (GRM-01, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09) Governance and Risk

Management

BSI C5: OIS-01, OIS-01H, OIS-02, SA-01, SPN-02, SPN-03

CCS: 5.15 Configuration Management, 5.16 Data Management, 6.1 Location of Data and Data Centers, 6.2

Compliance Management, 6.3 Policy Management, 6.4 Audit Management, 6.12 Security Management

OCF: (GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11)

Governance and Risk Management

NIST: ID.GV-1: Organizational information security policy is established

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.1 &

12.1.1

SO 02 – Risk Management Description

The DSP establishes and maintains an appropriate governance and risk management framework, to identify and address risks for the security of the offered services. Risks management procedures can include (but are not limited to), maintaining a list of risks and assets, using Governance Risk management and Compliance (GRC) tools and Risk Assessment (RA) tools etc.

Security measures in sophistication levels Mapping

ISO27001: ISO27001:2013 (all)

CSA CCM: CSA CCM (GRM-02, GRM-04, GRM-08, GRM-10, GRM-11, STA-01, STA-04, STA-04, STA-05, STA-06) Governance and Risk Management, Supply Chain Management, Transparency and Accountability

BSI C5: OIS-06, OIS-07, OIS-07H, OIS-03H, SA-01, SA-03, BEI-04, SPN-02, SPN-03

CCS: CCS, 6.2 Compliance Management, 6.3 Policy Management, 6.11 Risk Management, 6.12 Security Man-

agement

OCF: OFC, (GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10,

GRM-11) Governance and Risk Management, (STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA- 08, STA-09) Supply Chain Management, Transparency and Accountability

NIST: ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and commu-

nicated

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.2

SO 03 – Security Roles Description

The DSP assigns appropriate security roles and security responsibilities to designated personnel. (i.e. CSO, CISO, CTO etc.) .

Security measures within sophistication levels

1

Mapping

ISO27001: A.6.1 Internal organization

CSA CCM: (BCR-10, CCC-01, DSI-06, GRM-06, HRS-03, HRS-07, IAM-02, IAM-05, IAM-09, IAM-10, SEF-01, SEF-

02, SEF-03) Business Continuity Management & Operational Resilience, Change Control & Configuration Management, Data Security & Information Lifecycle Management, Governance and Risk Management, Identity & Access Management, Security Incident Management, E-Discovery & Cloud Forensics

BSI C5: OIS-02, OIS-03, OIS-04, SA-01, BCM-01

CCS: 5.13 User Management and Authentication, 6.5 Data Protection, 6.10 Employee Management

OCF: OCF, (BCR-01, BCR-02, BCR-03,BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11) Busi-

ness Continuity Management & Operational Resilience, CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS- 06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11 Human Resources, IAM-01, IAM-02, IAM-03, IAM-04, IAM-05, IAM-06, IAM-07, IAM-08, IAM-09, IAM-10, IAM-11,IAM-12,IAM-13 Identity & Access Management, SEF-01, SEF-02, SEF-03, SEF-04, SEF-05 Security Incident Management, E-Discovery & Cloud Forensics

NIST: ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders

(e.g., suppliers, customers, partners) are established

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.4

SO 04 – Third party management Description

The DSP establishes and maintains a policy with security requirements for contracts with suppliers and customers. SLAs, security requirements in contracts, outsourcing agreements etc., are established to ensure that the dependencies on suppliers and residual risks do not negatively affect security of the offered services.

Security measures within sophistication levels Mapping

ISO27001: A.15.1 Information security in supplier relationships

CSA CCM: (CCC-02, STA-01, STA-02, STA-03, STA-04, STA-05, STA-05, STA-06, STA-07, STA-08, STA-09) Change

Control & Configuration Management and Supply Chain Management, Transparency & Accountability

BSI C5: HR-03H, DLL-01, DLL-02, UP-01, BEI-02

CCS: 6.6 Terms and Conditions of Use, 6.8 Contract Management, 6.13 Embedding External Services, 7.7 Ser-

vice Level Management

OCF: OFC, CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, STA-01,

STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and Accountability

NIST: PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibili-

ties

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.8.3

SO 05 – Background checks Description

The DSP performs appropriate background checks on personnel (employees, contractors and third party users) before hiring, if required, for their duties and responsibilities provided that this is allowed by the local regulatory framework. Background checks may include checking past jobs, checking professional references, etc.

Security measures within sophistication levels

1

Mapping

ISO27001: A.7.1 Human resource security - Prior to employment

CSA CCM: CSA CCM, (HRS-02) Human Resources

BSI C5: HR-01

CCS: 5.11 System Administration and Management, 5.13 User Management and Authentication, 6.10 Em-

ployee Management

OCF: OFC, HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11 Human

Resources

NIST: PR. IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screen-

ing)

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.7

SO 06 – Security knowledge and training Description

The DSP verifies and ensures that personnel have sufficient security knowledge and that they are provided with regular security training. This is achieved through for example, security awareness raising, security education, security training etc.

Security measures within sophistication levels

2

3

Mapping

ISO27001: A.7.2.2, A.6.1.1, A.7.2.2

CSA CCM: CCS CCM (HRS-08, HRS-09) Human Resources

BSI C5: HR-02, HR-03, SA-01

COBIT5: COBIT 5 APO07.03, BAI05.07, COBIT 5 APO07.02, DSS06.03, COBIT 5 APO07.03, APO10.04, APO10.05,

COBIT 5 APO07.03

CCS: CCS, 5.11 System Administration and Management, 5.13 User Management and Authentication, 6.10 Em-

ployee Management

OCF: OCF, BCR-01, BCR-02, BCR-03, BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11 Business

Continuity Management & Operational Resilience, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11 Human Resources, SEF-01, SEF-02, SEF-03, SEF-04, SEF-05

NIST: PR.AT-1: All users are informed and trained

PCI-DSS: Requirement 6 - Develop and maintain secure systems and applications: 6.5, Requirement 9: Restrict

physical access to cardholder data: 9.9, 9.9.3, Requirement 12: Maintain a policy that addresses information security for all personnel:12.6.1, 12.10.4, A3.1 - Implement a PCI DSS compliance program: A3.1.4

SO 07 – Personnel changes Description

The DSP establishes and maintains an appropriate process for managing changes in personnel or changes in their roles and responsibilities.

Security measures within sophistication levels Mapping

ISO27001: A.7.3.1

CSA CCM: CSA CCM, (HRS-04) Human Resources

BSI C5: HR-02, HR-05

CCS: 5.11 System Administration and Management, 5.13 User Management and Authentication, 6.10 Em-

ployee Management

OCF: HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11 Human Re-

sources

NIST: PR. IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screen-

ing

PCI-DSS: A3.2- Document and validate PCI DSS scope: A3.2.3

SO 08 – Physical and environmental security Description

The DSP establishes and maintains policies and measures for physical and environmental security of datacenters such as physical access controls, alarm systems, environmental controls and automated fire extinguishers etc.

Security measures within sophistication levels

2

Mapping

ISO27001: A.11

CSA CCM: CSA CCM (DCS-01, DCS-02, DCS-03, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09, DCS-

10, DCS-11) - Datacenter security

BSI C5: PS-01, PS-02, PS-03, PS-04, PS-05, BCM-05

CCS: 5.17 Physical Security

OCF: OCF, DCS-01, DCS-02, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09 Datacenter Security,

HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11 Human Resources

NIST: ID.AM-1: Physical devices and systems within the organization are inventoried, PR.AC-2: Physical access

to assets is managed and, PR.AT-5: Physical and information security personnel understand roles & responsibilities, PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met, PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met

PCI-DSS: Requirement 8 - Identify and authenticate access to system components: 8.6, Requirement 9 - Re-

strict physical access to cardholder data: all

SO 09 – Security of supporting utilities Description

The DSP establishes and maintains appropriate security measures to ensure the security of supporting utilities such as electricity, fuel, HVAC etc. For example, this may be through the protection of power grid connections, diesel generators, fuel supplies, etc.

Security measures within sophistication levels

1

Mapping

ISO27001: ISO/IEC/27001 A.11.2.2

BSI C5: PS-04, BCM-05

CCS: 5.17 Physical Security

OCF: BCR-01, BCR-02, BCR-03,BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11 Business Con-

tinuity Management & Operational Resilience, DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, DCS-01, DCS-02, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09 Datacenter Security, HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS- 10, HRS-11 Human Resources, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS- 11,IVS-12,IVS-13 Infrastructure & Virtualization Security

SO 10 – Access control to network and information systems Description

The DSP established and maintains appropriate policies and measures for access to business resources. For example, zero trust model, ID management, authentication of users, access control systems, firewall and network security etc.

Security measures within sophistication levels

1

2

3

Mapping

ISO27001: ISO/IEC 27001:2013 A.9.2.1, A.9.2.2, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, ISO/IEC 27001:2013 A.11.1.1,

A.11.1.2, A.11.1.4, A.11.1.6, A.11.2.3, ISO/IEC 27001:2013 A.6.2.2, A.13.1.1, A.13.2.1, ISO/IEC 27001:2013 A.6.1.2, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, ISO/IEC 27001:2013 A.13.1.1, A.13.1.3, A.13.2.1

CSA CCM: CCA CCM (EKM-01, EKM-02, EKM-03, EKM-04) Encryption & key management

BSI C5: IDM-01, IDM-02, IDM-03, IDM-04, IDM-05, IDM-06, IDM-07, IDM-08, IDM-09, IDM-10, IDM-11, IDM-12,

KOS-01, KOS-02, KOS-03, KOS-04, KOS-05, KOS-06, KOS-07, KOS-08 COBIT 5: COBIT 5 DSS05.04, DSS06.03, COBIT 5 DSS01.04, DSS05.05, COBIT 5 APO13.01, DSS01.04, DSS05.03

CCS: CCS, 5.3 Client Separation, 5.4 Security Architecture, 5.6 Network Segmentation, 5.7 Network Architec-

ture, 5.11 System Administration and Management, 5.13 User Management and Authentication, 6.5 Data Protection

OCF: OCF, CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, DSI-01, DSI-

02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, EKM-01, EKM- 02, EKM-03, EKM-04 Encryption & Key Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11 Human Resources, IAM-01, IAM-02, IAM-03, IAM-04, IAM-05, IAM-06, IAM-07, IAM-08, IAM-09, IAM-10, IAM-11,IAM-12,IAM-13 Identity & Access Management, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and Accountability

NIST: PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate

PCI-DSS: Requirement 1: Install and maintain a firewall configuration to protect cardholder data: all Require-

ment 2: Do not use vendor-supplied defaults for system passwords and other security parameters: all

SO 11 – Integrity of network components and information systems Description

The DSP establishes, protects, and maintains the integrity of its own network, platforms and services by taking steps to prevent successful security incidents. The goal is the protection from viruses, code injections and other malware that can alter the functionality of the systems or integrity or accessibility of information.

Security measures within sophistication levels Mapping

ISO27001: A.13.1

BSI C5: RB-05, RB-17, RB-18, RB-23, IDM-08, IDM-11, KOS-02, KOS-03, KOS-05, BEI-01

CCS: 5.4 Security Architecture, 5.5 Encryption, 5.6 Network Segmentation, 5.7 Network Architecture, 6.5 Data

Protection

OCF: CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, DSI-01, DSI-02,

DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, EKM-01, EKM-02, EKM-03, EKM-04 Encryption & Key Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, IAM-01, IAM-02, IAM-03, IAM-04, IAM-05, IAM-06, IAM-07, IAM-08, IAM-09, IAM-10, IAM-11,IAM-12,IAM-13 Identity & Access Management, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, IPY-01, IPY-02, IPY-03, IPY-04, IPY-05 Interoperability & Portability, MOS- 01,MOS-02,MOS-03,MOS-04,MOS-05,MOS-06,MOS-07,MOS-08,MOS-09,MOS-10,MOS-11,MOS-12,MOS-13 to MOS-20 Mobile Security, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and Accountability, TVM-01, TVM-02, TVM-03 Threat and Vulnerability Management

NIST: PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate, PR.IP-5:

Policy and regulations regarding the physical operating environment for organizational assets are met

PCI-DSS: Requirement 4: Encrypt transmission of cardholder data across open, public networks

SO 12 – Operating procedures Description

The DSP establishes and maintains procedures for the operation of key network and information systems by personnel. (i.e. operating procedures, user manual, administration procedures for critical systems etc.)

Security measures within sophistication levels Mapping

ISO27001: ISO/IEC 27001:2013 A12.1.1, A.12.5.1, A.13.2.1, A.14.2.2

CCS: 4.1 Service Desk, 4.2 Application Management, 4.3 Technical Management, 4.4 Operations Management

BSI C5: SA-01, AM-03, AM-07, PS-05, RB-06, RB-10, RB-11, RB-17, RB-19, IDM-01, KRY-01, KOS-07, PI-03, BEI-

01, BEI-03, SIM-01, BCM-02, MDM-01

OCF: BCR-01, BCR-02, BCR-03,BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11 Business Con-

tinuity Management & Operational Resilience, CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, DCS-01, DCS-02, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09 Datacenter Security, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM- 11 Governance and Risk Management, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS- 10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security

SO 13 – Change management Description

The DSP establishes and maintains change management procedures for key network and information systems. These may include for example, change and configuration procedures and processes, change procedures and tools, procedures for applying patches etc.

Security measures within sophistication levels Mapping

ISO27001: ISO/IEC 27001:2013 A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4

CSA CCM: CSA CCM (CCC-01, CCC-02, CC03, CC04, CC05, CC06) Change control & configuration management

BSI C5: BEI-03, BEI-04, BEI-05, BEI-06, BEI-07, BEI-08, BEI-09, BEI-10, BEI-11, BEI-12, DLL-02, BCM-02, BCM-04

COBIT 5: COBIT 5 BAI06.01, BAI01.06

CCS: 4.2 Application Management, 4.4 Operations Management, 7.5 Change Management

OCF: DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management,

DCS-01, DCS-02, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09 Datacenter Security, GRM-01, GRM- 02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security

NIST: PR. IP-3: Configuration change control processes are in place

PCI-DSS: Requirement 6: Develop and maintain secure systems and applications: 6.4.6, Requirement 12 - Main-

tain a policy that addresses information security for all personnel: 12.1.1.1, A3.2- Document and validate PCI DSS scope: A3.2.2.1, A3.4.1

SO 14 – Asset management Description

The DSP establishes and maintains asset management procedures and configuration controls for key network and information systems.

Security measures within sophistication levels

1

2

Mapping

ISO27001: ISO/IEC 27001:2013 A.8.1.1, A.8.1.2, ISO/IEC 27001:2013 A.13.2.1, ISO/IEC 27001:2013 A.8.2.1,

ISO/IEC 27001:2013 A.6.1.1

CSA CCM: (DSI-01) Datacenter security - Asset management, (HRS-01) Human resources- Asset returns

BSI C5: AM-01, AM-02, AM-03, AM-04, AM-05, AM-06, AM-07, AM-08

COBIT 5: BAI09.01, BAI09.02, COBIT 5 BAI09.01, BAI09.02, BAI09.05, DSS05.02, APO02.02, APO01.02, DSS06.03

CCS: 4.2 Application Management, 5.1 Principles of Cloud Architecture, 5.16 Data Management, 6.1 Location of

Data and Data Centers, 7.6 Service Asset and Configuration Management

OCF: DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management,

DCS-01, DCS-02, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09 Datacenter Security, HRS-01, HRS- 02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11 Human Resources, IVS-01, IVS- 02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security

NIST: PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.1, 12.2

SO 15 – Security incident detection & Response Description

The DSP establishes and maintains procedures for detecting and responding to security incidents appropriately. These should consider detection, response, mitigation, recovery and remediation from a security incident. Lessons learned should also be adopted by the service provider.

Security measures within sophistication levels Mapping

ISO27001: ISO/IEC 27001:2013 A.16.1.5

CSA CCM: (SEF-03, SEF-04, SEF-05) Security incident management (reporting & response metrics)

BSI C5: SIM-01, SIM-02, SIM-03, SIM-04, SIM-05, SIM-06, SIM-07, RB-10, RB-11, RB-14, RB19, RB-20, DLL-01,

DLL-02

COBIT 5: BAI01.10

CCS: 4.1 Service Desk, 5.18 Response to Security Incidents, 6.12 Security Management, 7.1 Resolution Pro-

cesses

OCF: CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, IVS-01, IVS-02,

IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, SEF-01, SEF-02, SEF-03, SEF-04, SEF-05 Security Incident Management, E-Discovery & Cloud Forensics

NIST: DE.AE-5: Incident alert thresholds are established, RS.AN-2: The impact of the incident is understood

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.10,

12.10.1. 12.10.2

SO 16 – Security incident reporting Description

The DSP establishes and maintains appropriate procedures for reporting and communicating about security incidents.

Security measures within sophistication levels Mapping

ISO27001: ISO/IEC 27001:2013 A.16.1.5

CSA CCM: CSA CMM (SEF-01, SEF-02, SEF-04,) Security incident management (contact/authority maintenance,

management & legal preparations)

BSI C5: SIM-04, SIM-06, OIS-03, DLL-01, DLL-02

COBIT 5: EDM03.02, MEA03.02

CCS: 4.1 Service Desk, 5.18 Response to Security Incidents, 6.12 Security Management, 7.1 Resolution Pro-

cesses

OCF: CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, IVS-01, IVS-02,

IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11, IVS-12,IVS-13 Infrastructure & Virtualization Security, SEF-01, SEF-02, SEF-03, SEF-04, SEF-05 Security Incident Management, E-Discovery & Cloud Forensics

NIST: PR. IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Re-

covery and Disaster Recovery) are in place and managed

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.10.2,

12.10.4, 12.10.5, 12.10.6

SO 17 – Business continuity Description

The DSP establishes and maintains contingency plans and a continuity strategy for ensuring continuity of the services offered.

Security measures within sophistication levels

1

2

Mapping

ISO27001: ISO/IEC/27001:2013 A.17.1

CSA CCM: (BCR-01, BCR-02, BCR-03, BCR-04-BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11) Busi-

ness continuity management & operational resilience retention policy

BSI C5: BCM-01, BCM-02, BCM-03, BCM-04, BCM-05

CCS: 5.12 Backup, 7.2 IT Service Continuity Management

OCF: BCR-01, BCR-02, BCR-03, BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11 Business Con-

tinuity Management & Operational Resilience, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM- 07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management

NIST: PR. IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Re-

covery and Disaster Recovery) are in place and managed

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.10.1

SO 18 – Disaster recovery capabilities Description

The DSP establishes and maintains an appropriate disaster recovery capability for restoring the offered services in case of natural and/or major disasters.

Security measures within sophistication levels Mapping

ISO27001: ISO/IEC 27001:2013 A.16.1.1, A.17.1.1, A.17.1.2

CSA CCM: (BCR-09, BCR-11) Business continuity management & operational resilience retention policy

BSI C5: BCM-04, BCM-05

COBIT 5: DSS04.03

CCS: 5.1 Principles of Cloud Architecture, 5.12 Backup, 7.2 IT Service Continuity Management

OCF: BCR-01, BCR-02, BCR-03,BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11 Business Con-

tinuity Management & Operational Resilience, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM- 07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management

NIST: PR. IP-10: Response and recovery plans are tested

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.10.1

SO 19 – Monitoring and logging Description

The DSP establishes and maintains procedures and systems for monitoring and logging of the offered services (logs of user actions, system transactions/performance monitors, automated monitoring tools etc.).

Security measures within sophistication levels

1

2

Mapping

ISO27001: ISO/IEC 27001:2013 A.12.4

CSA CCM: CSA CCM (IVS-01)- Infrastructure & Virtualization Security (Audit Logging / Intrusion Detection)

BSI C5: RB-02, RB-07, RB-10, RB-11, RB-12, RB-13, RB-14, RB-15, RB-16, KOS-02, DLL-02

CCS: 5.11 System Administration and Management

OCF: OCF, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11, IVS-12, IVS-13

Infrastructure & Virtualization Security

NIST: DE.CM: Security continuous monitoring

PCI-DSS: A1: Additional PCI DSS Requirements for Shared Hosting Providers: A1.3

SO 20 – System tests Description

The DSP establishes and maintains appropriate procedures for testing key network and information systems underpinning the offered services.

Security measures within sophistication levels

1

Mapping

ISO27001: ISO/IEC 27001:2013 A.14.2

BSI C5: RB-18, RB-21, BEI-01, BSI-02, BEI-03, BEI-07, BEI-09

CCS: 4.3 Technical Management, 6.2 Compliance Management, 6.4 Audit Management, 6.12 Security Manage-

ment

OCF: OCF, AIS-01, AIS-02, AIS-03, AIS-04 Application & Interface Security, CCC-01, CCC-02, CCC-03, CCC-04,

CCC-05 Change Control & Configuration Management, DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, IVS-01, IVS-02, IVS-03, IVS- 04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, IPY-01, IPY-02, IPY-03, IPY-04, IPY-05 Interoperability & Portability, MOS-01,MOS-02,MOS-03,MOS-04,MOS- 05,MOS-06,MOS-07,MOS-08,MOS-09,MOS-10,MOS-11,MOS-12,MOS-13 to MOS-20 Mobile Security, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and Accountability, TVM-01, TVM-02, TVM-03 Threat and Vulnerability Management

NIST: PR. IP-10: Response and recovery plans are tested

PCI-DSS: A3.2- Document and validate PCI DSS scope: A3.2.4, A3.2.5.1

SO 21 – Security assessments Description

The DSP establishes and maintains appropriate procedures for performing security assessments of critical assets.

Security measures within sophistication levels

1

Mapping

ISO27001: ISO/IEC 27001:2013 A.12.6.1, A.18.2.2

CSA CCM: (AAC-02) Audit assurance & compliance independent audits

BSI C5: COM-02, COM-03, RB-17, RB-18, RB-19, RB-21

CCS: 6.2 Compliance Management, 6.4 Audit Management, 6.12 Security Management, 6.13 Embedding Exter-

nal Services

OCF: OCF, CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, GRM-01,

GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS- 12,IVS-13 Infrastructure & Virtualization Security, IPY-01, IPY-02, IPY-03, IPY-04, IPY-05 Interoperability & Portability, MOS-01,MOS-02,MOS-03,MOS-04,MOS-05,MOS-06,MOS-07,MOS-08,MOS-09,MOS-10,MOS-11,MOS- 12,MOS-13 to MOS-20 Mobile Security, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-

09 Supply Chain Management, Transparency and Accountability

PCI-DSS: Requirement 6: Develop and maintain secure systems and applications: 6.6

SO 22 – Compliance Description

The DSP establishes and maintains a policy for checking and enforcing the compliance of internal policies against the national and EU legal requirements and industry best practices and standards. These policies are reviewed on a regular basis.

Security measures within sophistication levels

1

Mapping

ISO27001: ISO/IEC/27001:2013 A.18

CSA CCM: CSA CCM (AAC-01, AAC-02, AAC-03) Audit assurance & compliance

BSI C5: COM-01, COM-02, COM-03

COBIT 5: 5.15 Configuration Management, 6.2 Compliance Management, 6.4 Audit Management, 6.12 Security Management, 6.13 Embedding External Services

OCF: OCF, AAC-01, AAC-02, AAC-03 Audit Assurance & Compliance, CCC-01, CCC-02, CCC-03, CCC-04, CCC-05

Change Control & Configuration Management, DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, EKM-01, EKM-02, EKM-03, EKM-04 Encryption & Key Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS- 10, HRS-11 Human Resources, IAM-01, IAM-02, IAM-03, IAM-04, IAM-05, IAM-06, IAM-07, IAM-08, IAM-09, IAM-10, IAM-11,IAM-12,IAM-13 Identity & Access Management, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, IPY-01, IPY-02, IPY- 03, IPY-04, IPY-05 Interoperability & Portability, MOS-01,MOS-02,MOS-03,MOS-04,MOS-05,MOS-06,MOS- 07,MOS-08,MOS-09,MOS-10,MOS-11,MOS-12,MOS-13 to MOS-20 Mobile Security, SEF-01, SEF-02, SEF-03, SEF-04, SEF-05 Security Incident Management, E-Discovery & Cloud Forensics, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and accountability

SO 23 – Security of data at rest Description

The DSP establishes and maintains appropriate mechanisms for the protection of the data at rest .

Security measures within sophistication levels Mapping

ISO27001: ISO/IEC 27001:2013 A.8.2.3, ISO/IEC 27001:2013 A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2,

A.14.1.3, ISO/IEC 27001:2013 A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, ISO/IEC 27001:2013 A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3, ISO/IEC 27001:2013 A.12.1.4

CSA CCM: (DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07) Data security

BSI C5: AM-05, SIM-02, RB-10, COM-01, KRY-01, KRY-02, KRY-03, KRY-04, PI-05, RB-11, RB-13, AM-04, AM-07,

RB-23, KOS-05, BEI-03, HR-02, HR-03

COBIT 5: APO01.06, BAI02.01, BAI06.01, DSS06.06

CCS: 5.1 Principles of Cloud Architecture, 5.2 Development Processes, 5.3 Client Separation, 5.5 Encryption, 5.7

Network Architecture, 5.9 Virtualization, 5.13 User Management and Authentication, 5.16 Data Management, 6.5 Data Protection

OCF: OCF, AIS-01, AIS-02, AIS-03, AIS-04 Application & Interface Security, AAC-01, AAC-02, AAC-03 Audit Assur-

ance & Compliance, BCR-01, BCR-02, BCR-03,BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11 Business Continuity Management & Operational Resilience, CCC-01, CCC-02, CCC-03, CCC-04, CCC-05 Change Control & Configuration Management, DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, DCS-01, DCS-02, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09 Datacenter Security, EKM-01, EKM-02, EKM-03, EKM-04 Encryption & Key Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, IAM-01, IAM-02, IAM-03, IAM-04, IAM-05, IAM-06, IAM-07, IAM-08, IAM-09, IAM-10, IAM-11,IAM- 12,IAM-13 Identity & Access Management, IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, IPY-01, IPY-02, IPY-03, IPY-04, IPY-05 Interoperability & Portability, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and Accountability

NIST: Data Security (PR.DS): Information and records (data) are managed consistent with the organization’s

risk strategy to protect the confidentiality, integrity, and availability of information. ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed

PCI-DSS: Requirement 12 - Maintain a policy that addresses information security for all personnel: 12.6

SO 24 –Interface security Description

The DSP should establish and maintain an appropriate policy for keeping secure the interfaces of services which use personal data.

Security measures within sophistication levels

1

Mapping

CSA CCM: (AIS-01, AIS-02, AIS-03, AIS -04) Application & Interface Security

BSI C5: OIS-02, SA-01, PI-01, HR-02, HR-03, KRY-01, KRY-02, SIM-07, SIM-01, SIM-03, SIM-04, SIM-05, SIM-06

IDM-08

CCS: 5.1 Principles of Cloud Architecture, 5.2 Development Processes, 5.4 Security Architecture

OCF: OCF, AIS-01, AIS-02, AIS-03, AIS-04 Application & Interface Security, EKM-01, EKM-02, EKM-03, EKM-04

Encryption & Key Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, IAM-01, IAM-02, IAM-03, IAM-04, IAM-05, IAM-06, IAM-07, IAM-08, IAM-09, IAM-10, IAM-11,IAM-12,IAM-13 Identity & Access Management, IVS-01, IVS- 02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, IPY-01, IPY-02, IPY-03, IPY-04, IPY-05 Interoperability & Portability, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and Accountability,

PCI-DSS: Requirement 2: Do not use vendor-supplied defaults for system passwords and other security param-

eters: 2.3

SO 25 –Software security Description

The DSP establishes and maintains a policy which ensures that the software is developed in a manner which respects security .

Security measures within sophistication levels Mapping

CSA CCM: (AIS -04) -Application & Interface Security/Data Security Integrity

BSI C5: BEI-01, BEI-02

CCS: 5.1 Principles of Cloud Architecture, 5.2 Development Processes, 5.9 Virtualization, 5.14 Patch Manage-

ment

OCF: OCF, AIS-01, AIS-02, AIS-03, AIS-04 Application & Interface Security, CCC-01, CCC-02, CCC-03, CCC-04,

CCC-05 Change Control & Configuration Management, DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07 Data Security & Information Lifecycle Management, GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11 Governance and Risk Management, IVS-01, IVS-02, IVS-03, IVS- 04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13 Infrastructure & Virtualization Security, IPY-01, IPY-02, IPY-03, IPY-04, IPY-05 Interoperability & Portability, MOS-01,MOS-02,MOS-03,MOS-04,MOS- 05,MOS-06,MOS-07,MOS-08,MOS-09,MOS-10,MOS-11,MOS-12,MOS-13 to MOS-20 Mobile Security, STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09 Supply Chain Management, Transparency and Accountability, TVM-01, TVM-02, TVM-03 Threat and Vulnerability Management

NIST: ID.AM-2: Software platforms and applications within the organization are inventoried, ID.AM-5: Re-

sources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value, PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity, DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed

PCI-DSS: Requirement 2: Do not use vendor-supplied defaults for system passwords and other security param-

eters: 2.4

SO 26 – Interoperability and portability Description

Online market place and cloud providers use standards which allow customers to interface with other digital services and/or if needed to migrate to other providers offering similar services.

Security measures within sophistication levels Mapping

CSA CCM: (IPY-01, IPY-02, IPY-03, IPY-04, IPY-05) - Interoperability & Portability

BSI C5: PI-01, PI-02, PI-03, PI-04, PI-05

CCS: 5.8 Network Monitoring, 5.10 System Monitoring

OCF: IPY-01, IPY-02, IPY-03, IPY-04, IPY-05 Interoperability & Portability

SO 27 – Customer Monitoring and log access Description

The cloud provider grants customers access to relevant transaction and performance logs so customers can investigate issues or security incidents when needed.

Security measures within sophistication levels

1

Mapping

ISO27001: ISO/IEC 27001:2013 A.12.4.1, A.12.4.2, A.12.4.3 & A.12.4.4

CSA CCM: (IVS-01)- Infrastructure & Virtualization Security, (Audit Logging / Intrusion Detection)

BSI C5: RB-13H, RB-14, RB14H, RB-10, RB-11, RB-12, RB-13, RB-15, RB-16H, RB-23

COBIT 5: APO11.04

CCS: 5.8 Network Monitoring, 5.10 System Monitoring

OCF: IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11, IVS-12, IVS-13 Infra-

structure & Virtualization Security

NIST: PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with

policy, PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools

3. Summary

To summarise, the level of sophistication to which security measures are implemented from one organization to another can vary for a multitude of reasons. For instance, this may depend on the industry sector, the size of the company or the time and effort that the management can afford to invest in implementing security measures. From the received feedback for this study, stakeholders should consider the different roles that the DSP’s play in the online environment, and in particular how their level of criticality differs (i.e. lack of availability for a search engine may not pose a significant risk, whereas for a different DSP, this may be more critical). As a result, some security objectives may be prioritized over others and thus the sophistication levels may also differ.

There are high level security objectives, which are interchangeable among all three DSP categories, while a few belong to specific DSP categories. In the following table, the common security objectives for all DSPs are marked with a check mark. If a SO doesn’t belong to a specific DSP category, it is indicated with an xmark.

Finally, we present a summary table below with a mapping of the SOs to the different schemes. If a security objective is covered in one of the schemes below it is marked with a dot. If not, it stays blank.

SECURITY OBJECTIVES ISO27001 CSA CCM BSI C5 COBIT 5 CCS OCF NIST PCI-DSS CES

SECURITY OBJECTIVES ISO27001 CSA CCM BSI C5 COBIT 5 CCS OCF NIST PCI-DSS CES

ENISA

European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

Athens Office

1 Vasilissis Sofias Marousi 151 24, Athens, Greece

TP-05-16-077-EN-N

PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-203-5 DOI: 10.2824/456345 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu